User Tools

Site Tools

ALFA Network AP121

For a detailed description see Hornet-UB. The Hornet UB is the baseboard of the AP121U, which is the AP121 with an USB jack.

The AP121 design is very similar to the Atheros AP121 reference design which is the base design of many routers. See AP121 tag below.

Supported Versions

Hardware Highlights


Firmware flashing

Firwmare file fixup

At least with OpenWrt Barrier Breaker, there is an issue that the tarball is build in the wrong way. The following script can be used to rebuild the firmware image. It requires the firmware file as the first parameter, and a different output filename as the second parameter. The script simply modifies the filenames in the contained tarball to end in .image instead of _image.

#! /bin/sh
SIZE=$(stat -c%s "$1") || exit 1
tmpdir=$( mktemp -d )
tar -xzf "$1" -C "$tmpdir"
cd "$tmpdir"
for f in *_image; do
	mv "$f" "$( basename "$f" _image ).image"
tar -czf newfw *
mv "$tmpdir/newfw" "$2"
rm -rf "$tmpdir"
dd if="$1" bs=1 skip=$(( $SIZE - 0x21 )) >>"$2"

Automated flashing with a script

You can use this shell script to flash devices that have the original firmware:

# Pass the firmware image file to be flashed as the first and only
# command line argument.
# Some of the curl calls are probably not quite neccessary. The last
# one uploads the firmware, if the image was OK, then a website is
# returned, otherwise "Firmware file error" is thrown.
if [ "x$fw" = "x" -o ! -f "$fw" ]; then
	echo "Please specify firmware file as parameter"
	exit 1
curl \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
curl  \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
  --referer '' \
  --data 'admuser=admin' --data 'admpass=admin' \
curl \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
  --referer '' \
curl \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
  --referer '' \
  -F filename=@"$fw"\;filename=firmware.img -F uploadFWButton=Upload \



Architecture MIPS
Vendor Qualcomm Atheros
bootloader U-Boot
System-On-Chip Atheros AR9331 (MIPS 24Kc V7.4)
CPU/Speed 400 MHz
BogoMIPS 265.42
Flash-Chip mx25l6405d
Flash size 8 MiB
RAM 32 MiB
Wireless Atheros AR9330
Ethernet Atheros AG71xx
Serial Yes
  • 2x Ethernet ports 1 with PoE (Power over Ethernet)
  • Powered via 12V or 5V type M barrel connector (though power to the USB port can be marginal with only 5V system input)
  • Tiny form factor
    • 8.5cm x 6cm PCB
    • 9.3cm x 7cm x 2.6cm casing
    • weight 74g


port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
Insert photo of PCB with markings for serial port

FIXME Replace EXAMPLE by real values.

Serial connection parameters
for ALFA Network AP121
EXAMPLE 115200, 8N1

OEM Bootlog

For comparing with other routers based on AP121 design (i.e. TP-Link) the complete bootlog:

AP121-8MB (ar9331) U-boot DRAM: 32 MB Top of RAM usable for U-Boot at: 82000000 Reserving 248k for U-Boot at: 81fc0000 Reserving 192k for malloc() at: 81f90000 Reserving 44 Bytes for Board Info at: 81f8ffd4 Reserving 36 Bytes for Global Data at: 81f8ffb0 Reserving 128k for boot params() at: 81f6ffb0 Stack Pointer at: 81f6ff98 Now running in RAM - U-Boot at: 81fc0000 id read 0x100000ff flash size 8388608, sector count = 128 Flash: 8 MB In: serial Out: serial Err: serial Net: ag7240_enet_initialize... Fetching MAC Address from 0x81feb688 Fetching MAC Address from 0x81feb688 : cfg1 0x5 cfg2 0x7114 eth0: 00:c0:ca:67:2c:c9 eth0 up : cfg1 0xf cfg2 0x7214 eth1: 00:c0:ca:67:2c:c8 athrs26_reg_init_lan ATHRS26: resetting s26 ATHRS26: s26 reset done eth1 up eth0, eth1 Please choose the operation: 1: Entr boot command line interface. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). You choosed 0 System Boot system code via Flash. ## Booting image at 9f650000 ... Image Name: Linux Kernel Image Created: 2012-07-31 6:25:27 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1390190 Bytes = 1.3 MB Load Address: 80002000 Entry Point: 8030c560 Verifying Checksum at 0x9f650040 ...OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 8030c560) ... ## Giving linux memsize in bytes, 33554432 Starting kernel ... Booting AR9330(Hornet)... Linux version 2.6.31--LSDK-9.2.0_U10.1020 (elvis@elvis-CentOS) (gcc version 4.3.3 (GCC) ) #1 Tue Jul 31 14:25:09 CST 2012 flash_size passed from bootloader = 8 arg 1: console=ttyS0,115200 arg 2: root=31:02 arg 3: init=/sbin/init arg 4: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),6144k(rootfs),1600k(uImage),64k(NVRAM),64k(ART) arg 5: python arg 6: mem=32M CPU revision is: 00019374 (MIPS 24Kc) Determined physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map: memory: 02000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00002000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00002000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: console=ttyS0,115200 root=31:02 init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),6144k(rootfs),1600k(uImage),64k(NVRAM),64k(ART) python mem=32M PID hash table entries: 128 (order: 7, 512 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 28312k/32768k available (3130k kernel code, 4456k reserved, 747k data, 164k init, 0k highmem) NR_IRQS:128 plat_time_init: plat time init done Calibrating delay loop... 266.24 BogoMIPS (lpj=532480) Mount-cache hash table entries: 512 NET: Registered protocol family 16 ===== ar7240_platform_init: 0 bio: create slab <bio-0> at 0 SCSI subsystem initialized NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered NET: Registered protocol family 1 AR7240 GPIOC major 0 squashfs: version 4.0 (2009/01/31) Phillip Lougher JFFS2 version 2.2 (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc. fuse init (API version 7.12) msgmni has been set to 55 alg: No test for lzma (lzma-generic) alg: No test for stdrng (krng) Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) io scheduler noop registered io scheduler deadline registered (default) HDLC line discipline maxframe=4096 N_HDLC line discipline registered. Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled ttyS0: detected caps 00000000 should be 00000100 serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A console [ttyS0] enabled brd: module loaded PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 PPPoL2TP kernel driver, V1.0 IMQ driver loaded successfully. Hooking IMQ before NAT on PREROUTING. Hooking IMQ after NAT on POSTROUTING. ATHR_GMAC: Length per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 ATHR_GMAC: Mac address for unit 0 ATHR_GMAC: 00:c0:ca:67:2c:c9 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 252 ATHR_GMAC: Mac capability flags : 4201 ATHR_GMAC: Mac address for unit 1 ATHR_GMAC: 00:c0:ca:67:2c:c8 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 252 ATHR_GMAC: Mac capability flags : 4C81 6 cmdlinepart partitions found on MTD device ar7240-nor0 Creating 6 MTD partitions on "ar7240-nor0": 0x000000000000-0x000000040000 : "u-boot" 0x000000040000-0x000000050000 : "u-boot-env" 0x000000050000-0x000000650000 : "rootfs" 0x000000650000-0x0000007e0000 : "uImage" 0x0000007e0000-0x0000007f0000 : "NVRAM" 0x0000007f0000-0x000000800000 : "ART" NET: Registered protocol family 26 GACT probability on Mirror/redirect action on netem: version 1.2 u32 classifier Performance counters on input device check on Actions configured Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (512 buckets, 2048 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. ctnetlink v0.93: registering with nfnetlink. xt_time: kernel timezone is -0000 IPv4 over IPv4 tunneling driver ip_tables: (C) 2000-2006 Netfilter Core Team arp_tables: (C) 2002 David S. Miller TCP bic registered TCP cubic registered TCP westwood registered TCP htcp registered NET: Registered protocol family 10 IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 Bridge firewalling registered RPC: Registered udp transport module. RPC: Registered tcp transport module. 802.1Q VLAN Support v1.8 Ben Greear <> All bugs added by David S. Miller <> arch/mips/ar7240/gpio_ap121.c (ar7240_simple_config_init) AP_RESET_GPIO: 12 arch/mips/ar7240/gpio_ap121.c (ar7240_simple_config_init) JUMPSTART_GPIO: 11 ar7240wdt_init: Registering WDT success VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 164k freed athr_gmac_ring_alloc Allocated 640 at 0x81de7000 athr_gmac_ring_alloc Allocated 4032 at 0x81def000 Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY... ADDRCONF(NETDEV_UP): eth0: link is not ready athr_gmac_ring_alloc Allocated 640 at 0x81de7400 athr_gmac_ring_alloc Allocated 4032 at 0x81e88000 Setting Drop CRC Errors, Pause Frames and Length Error frames ATHRS26: resetting s26 ATHRS26: s26 reset done Setting PHY... ADDRCONF(NETDEV_UP): eth1: link is not ready ar7240wdt_ioctl: called **** drop_caches_sysctl_handler: all done timer added ...**** device eth1 entered promiscuous mode br0: starting userspace STP failed, starting kernel STP Args: 1 asf: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint ath_hal: (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_ahb: 9.2.0_U10.1020 (Atheros/multi-bss) __ath_attach: Set global_scn[0] ACBKMinfree = 48 ACBEMinfree = 32 ACVIMinfree = 16 ACVOMinfree = 0 CABMinfree = 48 UAPSDMinfree = 0 Bootstrap clock 25MHz ar9300RadioAttach: Need analog access recipe!! Restoring Cal data from Flash ath_get_caps[5105] rx chainmask mismatch actual 1 sc_chainmak 0 ath_get_caps[5080] tx chainmask mismatch actual 1 sc_chainmak 0 SC Callback Registration for wifi0 wifi0: Atheros 9380: mem=0xb8100000, irq=2 Creating ap for Blackbird on wlan_vap_create : enter. devhandle=0x815782c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x815782c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. VAP device ath0 created Added ath0 mode master Configuring RF . . . DES SSID SET=Blackbird ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 Created ath0 mode ap for Blackbird device ath0 entered promiscuous mode br0: topology change detected, propagating br0: port 2(ath0) entering forwarding state ARPING to from via br0 Sent 1 probe(s) (1 broadcast(s)) Received 0 reply (0 request(s), 0 broadcast(s)) >>>>> WPS MODE, 0 CHH: System Configuration ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1 br0: port 2(ath0) entering disabled state DEVICE IS DOWN ifname=ath0 DEVICE IS DOWN ifname=ath0 br0: topology change detected, propagating br0: port 2(ath0) entering forwarding state Setting Max Stations:127 ALFA mips #1 Tue Jul 31 14:25:09 CST 2012 (none) ALFA login:


toh/ · Last modified: 2018/06/03 07:06 by tmomas