ath79: add support for Netgear WNDR4300
This patch adds ath79 support for Netgear WNDR4300.
Router was previously supported by ar71xx target only.
Note: device requires 'ar934x-nand' driver in kernel.
Specification
=============
* Description: Netgear WNDR4300
* Loader: U-boot
* SOC: Atheros AR9344 (560 MHz)
* RAM: 128 MiB
* Flash: 128 MiB (NAND)
- U-boot binary: 256 KiB
- U-boot environment: 256 KiB
- ART: 256 KiB
- POT: 512 KiB
- Language: 2 MiB
- Config: 512 KiB
- Traffic Meter: 3 MiB
- Firmware: 25 MiB
- ART Backup: 256 KiB
- Reserved: 96 MiB
* Ethernet: 5 x 10/100/1000 (4 x LAN, 1 x WAN) (AR8327)
* Wireless:
- 2.4 GHz b/g/n (internal)
- 5 GHz a/n (AR9580)
* USB: yes, 1 x USB 2.0
* Buttons:
- Reset
- WiFi (rfkill)
- WPS
* LEDs:
- Power (amber/green)
- WAN (amber/green)
- WLAN 2G (green)
- WLAN 5G (blue)
- 4 x LAN (amber/green)
- USB (green)
- WPS (amber/green)
* UART: 4-pin connector JP1, 3.3V (Vcc, TX, RX, GND), 115200 8N1
* Power supply: DC 12V 2.5A
* MAC addresses: LAN=WLAN2G on case label, WAN +1, WLAN5G +2
Installation
============
* TFTP recovery
* TFTP via U-boot prompt
* sysupgrade
* Web interface
Note about partitioning: firmware partition offset (0x6c0000) is
hardcoded into vendor's u-boot, so this partition cannot be moved
and resized to include Netgear-specific flash areas (pot, language,
config, traffic_meter) not used by OpenWrt.
Test build configuration
========================
CONFIG_TARGET_ath79=y
CONFIG_TARGET_ath79_nand=y
CONFIG_TARGET_ath79_nand_DEVICE_netgear_wndr4300=y
CONFIG_ALL_KMODS=y
CONFIG_DEVEL=y
CONFIG_CCACHE=y
CONFIG_COLLECT_KERNEL_DEBUG=y
CONFIG_IMAGEOPT=y
Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
2019-10-31 20:18:10 +00:00
|
|
|
include ./common-netgear.mk # for netgear-uImage
|
|
|
|
|
|
ath79: add support for ZyXEL NBG6716
Attention: Kernel partition size has been enlarged to 4MB.
To switch, you must update to latest ar71xx-nand snapshort and flash the
sysupgrade-4M-Kernel.bin:
zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin | mtd -r -e ubi write - firmware; reboot -f
You will end up with a fresh config if you do not inject config into the image.
The NBG6716 may come with 128MB or 256MB NAND. ar71xx was able to use all, but
ath79 can only use the first 128MB. Therefore the complete NAND needs to be
overwritten. If not, the old UBI may make problems and lead to reboot loop.
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6716> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6716>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6716> ATSE NBG6716
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6716> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6716> ATGU
|NBG6716#
Signed-off-by: André Valentin <avalentin@marcant.net>
2019-10-23 09:30:30 +00:00
|
|
|
# attention: only zlib compression is allowed for the boot fs
|
2019-10-27 23:30:51 +00:00
|
|
|
define Build/zyxel-buildkerneljffs
|
|
|
|
|
rm -rf $(KDIR_TMP)/zyxelnbg6716
|
|
|
|
|
mkdir -p $(KDIR_TMP)/zyxelnbg6716/image/boot
|
|
|
|
|
cp $@ $(KDIR_TMP)/zyxelnbg6716/image/boot/vmlinux.lzma.uImage
|
|
|
|
|
$(STAGING_DIR_HOST)/bin/mkfs.jffs2 \
|
|
|
|
|
--big-endian --squash-uids -v -e 128KiB -q -f -n -x lzma -x rtime \
|
|
|
|
|
-o $@ \
|
|
|
|
|
-d $(KDIR_TMP)/zyxelnbg6716/image
|
|
|
|
|
rm -rf $(KDIR_TMP)/zyxelnbg6716
|
ath79: add support for ZyXEL NBG6716
Attention: Kernel partition size has been enlarged to 4MB.
To switch, you must update to latest ar71xx-nand snapshort and flash the
sysupgrade-4M-Kernel.bin:
zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin | mtd -r -e ubi write - firmware; reboot -f
You will end up with a fresh config if you do not inject config into the image.
The NBG6716 may come with 128MB or 256MB NAND. ar71xx was able to use all, but
ath79 can only use the first 128MB. Therefore the complete NAND needs to be
overwritten. If not, the old UBI may make problems and lead to reboot loop.
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6716> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6716>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6716> ATSE NBG6716
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6716> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6716> ATGU
|NBG6716#
Signed-off-by: André Valentin <avalentin@marcant.net>
2019-10-23 09:30:30 +00:00
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Build/zyxel-factory
|
|
|
|
|
let \
|
|
|
|
|
maxsize="$(subst k,* 1024,$(RAS_ROOTFS_SIZE))"; \
|
|
|
|
|
let size="$$(stat -c%s $@)"; \
|
|
|
|
|
if [ $$size -lt $$maxsize ]; then \
|
|
|
|
|
$(STAGING_DIR_HOST)/bin/mkrasimage \
|
|
|
|
|
-b $(RAS_BOARD) \
|
|
|
|
|
-v $(RAS_VERSION) \
|
|
|
|
|
-r $@ \
|
|
|
|
|
-s $$maxsize \
|
|
|
|
|
-o $@.new \
|
|
|
|
|
-l 131072 \
|
|
|
|
|
&& mv $@.new $@ ; \
|
|
|
|
|
fi
|
|
|
|
|
endef
|
|
|
|
|
|
2019-10-27 14:49:18 +00:00
|
|
|
define Device/aerohive_hiveap-121
|
|
|
|
|
ATH_SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Aerohive
|
|
|
|
|
DEVICE_MODEL := HiveAP 121
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
|
|
|
|
BLOCKSIZE := 128k
|
|
|
|
|
PAGESIZE := 2048
|
|
|
|
|
IMAGE_SIZE := 116m
|
|
|
|
|
KERNEL_SIZE := 5120k
|
|
|
|
|
UBINIZE_OPTS := -E 5
|
|
|
|
|
SUPPORTED_DEVICES += hiveap-121
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | check-size $$$$(IMAGE_SIZE)
|
|
|
|
|
IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += aerohive_hiveap-121
|
|
|
|
|
|
2018-12-31 12:45:29 +00:00
|
|
|
define Device/glinet_gl-ar300m-nand
|
2018-10-29 03:56:46 +00:00
|
|
|
ATH_SOC := qca9531
|
2019-07-07 08:02:49 +00:00
|
|
|
DEVICE_VENDOR := GL.iNet
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_MODEL := GL-AR300M
|
|
|
|
|
DEVICE_VARIANT := NAND
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-storage kmod-usb-ledtrig-usbport
|
2018-05-29 08:02:59 +00:00
|
|
|
KERNEL_SIZE := 2048k
|
|
|
|
|
BLOCKSIZE := 128k
|
|
|
|
|
PAGESIZE := 2048
|
|
|
|
|
VID_HDR_OFFSET := 512
|
2018-12-06 11:07:56 +00:00
|
|
|
IMAGES += factory.ubi
|
|
|
|
|
IMAGE/sysupgrade.bin := sysupgrade-tar
|
2018-05-29 08:02:59 +00:00
|
|
|
IMAGE/factory.ubi := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi
|
|
|
|
|
endef
|
2018-12-31 12:45:29 +00:00
|
|
|
TARGET_DEVICES += glinet_gl-ar300m-nand
|
ath79: add support for ZyXEL NBG6716
Attention: Kernel partition size has been enlarged to 4MB.
To switch, you must update to latest ar71xx-nand snapshort and flash the
sysupgrade-4M-Kernel.bin:
zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin | mtd -r -e ubi write - firmware; reboot -f
You will end up with a fresh config if you do not inject config into the image.
The NBG6716 may come with 128MB or 256MB NAND. ar71xx was able to use all, but
ath79 can only use the first 128MB. Therefore the complete NAND needs to be
overwritten. If not, the old UBI may make problems and lead to reboot loop.
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6716> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6716>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6716> ATSE NBG6716
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6716> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6716> ATGU
|NBG6716#
Signed-off-by: André Valentin <avalentin@marcant.net>
2019-10-23 09:30:30 +00:00
|
|
|
|
ath79: add support for Netgear WNDR4300
This patch adds ath79 support for Netgear WNDR4300.
Router was previously supported by ar71xx target only.
Note: device requires 'ar934x-nand' driver in kernel.
Specification
=============
* Description: Netgear WNDR4300
* Loader: U-boot
* SOC: Atheros AR9344 (560 MHz)
* RAM: 128 MiB
* Flash: 128 MiB (NAND)
- U-boot binary: 256 KiB
- U-boot environment: 256 KiB
- ART: 256 KiB
- POT: 512 KiB
- Language: 2 MiB
- Config: 512 KiB
- Traffic Meter: 3 MiB
- Firmware: 25 MiB
- ART Backup: 256 KiB
- Reserved: 96 MiB
* Ethernet: 5 x 10/100/1000 (4 x LAN, 1 x WAN) (AR8327)
* Wireless:
- 2.4 GHz b/g/n (internal)
- 5 GHz a/n (AR9580)
* USB: yes, 1 x USB 2.0
* Buttons:
- Reset
- WiFi (rfkill)
- WPS
* LEDs:
- Power (amber/green)
- WAN (amber/green)
- WLAN 2G (green)
- WLAN 5G (blue)
- 4 x LAN (amber/green)
- USB (green)
- WPS (amber/green)
* UART: 4-pin connector JP1, 3.3V (Vcc, TX, RX, GND), 115200 8N1
* Power supply: DC 12V 2.5A
* MAC addresses: LAN=WLAN2G on case label, WAN +1, WLAN5G +2
Installation
============
* TFTP recovery
* TFTP via U-boot prompt
* sysupgrade
* Web interface
Note about partitioning: firmware partition offset (0x6c0000) is
hardcoded into vendor's u-boot, so this partition cannot be moved
and resized to include Netgear-specific flash areas (pot, language,
config, traffic_meter) not used by OpenWrt.
Test build configuration
========================
CONFIG_TARGET_ath79=y
CONFIG_TARGET_ath79_nand=y
CONFIG_TARGET_ath79_nand_DEVICE_netgear_wndr4300=y
CONFIG_ALL_KMODS=y
CONFIG_DEVEL=y
CONFIG_CCACHE=y
CONFIG_COLLECT_KERNEL_DEBUG=y
CONFIG_IMAGEOPT=y
Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
2019-10-31 20:18:10 +00:00
|
|
|
# fake rootfs is mandatory, pad-offset 129 equals (2 * uimage_header + 0xff)
|
|
|
|
|
define Device/netgear_ath79_nand
|
|
|
|
|
DEVICE_VENDOR := NETGEAR
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
|
|
|
|
|
KERNEL_SIZE := 2048k
|
|
|
|
|
BLOCKSIZE := 128k
|
|
|
|
|
PAGESIZE := 2048
|
|
|
|
|
IMAGE_SIZE := 25600k
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma -d20 | \
|
|
|
|
|
pad-offset $$(KERNEL_SIZE) 129 | \
|
|
|
|
|
netgear-uImage lzma | append-string -e '\xff' | \
|
|
|
|
|
append-uImage-fakehdr filesystem $$(NETGEAR_KERNEL_MAGIC)
|
|
|
|
|
KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma -d20 | netgear-uImage lzma
|
|
|
|
|
IMAGES := sysupgrade.bin factory.img
|
|
|
|
|
IMAGE/factory.img := append-kernel | append-ubi | netgear-dni | check-size $$$$(IMAGE_SIZE)
|
|
|
|
|
IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata | check-size $$$$(IMAGE_SIZE)
|
|
|
|
|
UBINIZE_OPTS := -E 5
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/netgear_wndr4300
|
|
|
|
|
ATH_SOC := ar9344
|
|
|
|
|
DEVICE_MODEL := WNDR4300
|
|
|
|
|
NETGEAR_KERNEL_MAGIC := 0x33373033
|
|
|
|
|
NETGEAR_BOARD_ID := WNDR4300
|
|
|
|
|
NETGEAR_HW_ID := 29763948+0+128+128+2x2+3x3
|
|
|
|
|
SUPPORTED_DEVICES += wndr4300
|
|
|
|
|
$(Device/netgear_ath79_nand)
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += netgear_wndr4300
|
|
|
|
|
|
ath79: add support for ZyXEL NBG6716
Attention: Kernel partition size has been enlarged to 4MB.
To switch, you must update to latest ar71xx-nand snapshort and flash the
sysupgrade-4M-Kernel.bin:
zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin | mtd -r -e ubi write - firmware; reboot -f
You will end up with a fresh config if you do not inject config into the image.
The NBG6716 may come with 128MB or 256MB NAND. ar71xx was able to use all, but
ath79 can only use the first 128MB. Therefore the complete NAND needs to be
overwritten. If not, the old UBI may make problems and lead to reboot loop.
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6716> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6716>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6716> ATSE NBG6716
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6716> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6716> ATGU
|NBG6716#
Signed-off-by: André Valentin <avalentin@marcant.net>
2019-10-23 09:30:30 +00:00
|
|
|
define Device/zyxel_nbg6716
|
|
|
|
|
ATH_SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := ZyXEL
|
2019-10-27 23:30:51 +00:00
|
|
|
DEVICE_MODEL := NBG6716
|
ath79: add support for ZyXEL NBG6716
Attention: Kernel partition size has been enlarged to 4MB.
To switch, you must update to latest ar71xx-nand snapshort and flash the
sysupgrade-4M-Kernel.bin:
zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin | mtd -r -e ubi write - firmware; reboot -f
You will end up with a fresh config if you do not inject config into the image.
The NBG6716 may come with 128MB or 256MB NAND. ar71xx was able to use all, but
ath79 can only use the first 128MB. Therefore the complete NAND needs to be
overwritten. If not, the old UBI may make problems and lead to reboot loop.
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6716> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6716>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6716> ATSE NBG6716
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6716> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6716> ATGU
|NBG6716#
Signed-off-by: André Valentin <avalentin@marcant.net>
2019-10-23 09:30:30 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
RAS_BOARD := NBG6716
|
|
|
|
|
RAS_ROOTFS_SIZE := 29696k
|
|
|
|
|
RAS_VERSION := "OpenWrt Linux-$(LINUX_VERSION)"
|
|
|
|
|
KERNEL_SIZE := 4096k
|
|
|
|
|
BLOCKSIZE := 128k
|
|
|
|
|
PAGESIZE := 2048
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | uImage none | \
|
|
|
|
|
zyxel-buildkerneljffs | check-size 4096k
|
|
|
|
|
IMAGES := sysupgrade.tar sysupgrade-4M-Kernel.bin factory.bin
|
2019-10-27 23:30:51 +00:00
|
|
|
IMAGE/sysupgrade.tar/squashfs := append-rootfs | pad-to $$$$(BLOCKSIZE) | sysupgrade-tar rootfs=$$$$@ | append-metadata
|
ath79: add support for ZyXEL NBG6716
Attention: Kernel partition size has been enlarged to 4MB.
To switch, you must update to latest ar71xx-nand snapshort and flash the
sysupgrade-4M-Kernel.bin:
zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin | mtd -r -e ubi write - firmware; reboot -f
You will end up with a fresh config if you do not inject config into the image.
The NBG6716 may come with 128MB or 256MB NAND. ar71xx was able to use all, but
ath79 can only use the first 128MB. Therefore the complete NAND needs to be
overwritten. If not, the old UBI may make problems and lead to reboot loop.
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6716> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6716>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6716> ATSE NBG6716
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6716> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6716> ATGU
|NBG6716#
Signed-off-by: André Valentin <avalentin@marcant.net>
2019-10-23 09:30:30 +00:00
|
|
|
IMAGE/sysupgrade-4M-Kernel.bin/squashfs := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | pad-to 263192576 | gzip
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | zyxel-factory
|
|
|
|
|
UBINIZE_OPTS := -E 5
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += zyxel_nbg6716
|
|
|
|
|
DEVICE_VARS += RAS_ROOTFS_SIZE RAS_BOARD RAS_VERSION
|
