openwrt/package/boot/uboot-envtools/files/ipq40xx

85 lines
1.9 KiB
Plaintext
Raw Normal View History

#
# Copyright (C) 2016 LEDE
#
[ -e /etc/config/ubootenv ] && exit 0
touch /etc/config/ubootenv
. /lib/uboot-envtools.sh
. /lib/functions.sh
board=$(board_name)
ubootenv_mtdinfo () {
UBOOTENV_PART=$(cat /proc/mtd | grep APPSBLENV)
mtd_dev=$(echo $UBOOTENV_PART | awk '{print $1}' | sed 's/:$//')
mtd_size=$(echo $UBOOTENV_PART | awk '{print "0x"$2}')
mtd_erase=$(echo $UBOOTENV_PART | awk '{print "0x"$3}')
nor_flash=$(find /sys/bus/spi/devices/*/mtd -name ${mtd_dev})
if [ -n "$nor_flash" ]; then
ubootenv_size=$mtd_size
else
# size is fixed to 0x40000 in u-boot
ubootenv_size=0x40000
fi
sectors=$(( $ubootenv_size / $mtd_erase ))
sectors=$(printf "0x%x" $sectors )
echo /dev/$mtd_dev 0x0 $ubootenv_size $mtd_erase $sectors
}
case "$board" in
alfa-network,ap120c-ac|\
devolo,magic-2-wifi-next|\
edgecore,ecw5211|\
glinet,gl-a1300 |\
glinet,gl-ap1300|\
glinet,gl-b1300|\
ipq40xx: add support for GL.iNet GL-B2200 This patch adds supports for the GL-B2200 router. Specifications: - SOC: Qualcomm IPQ4019 ARM Quad-Core - RAM: 512 MiB - Flash: 16 MiB NOR - SPI0 - EMMC: 8GB EMMC - ETH: Qualcomm QCA8075 - WLAN1: Qualcomm Atheros QCA4019 2.4GHz 802.11b/g/n 2x2 - WLAN2: Qualcomm Atheros QCA4019 5GHz 802.11n/ac W2 2x2 - WLAN3: Qualcomm Atheros QCA9886 5GHz 802.11n/ac W2 2x2 - INPUT: Reset, WPS - LED: Power, Internet - UART1: On board pin header near to LED (3.3V, TX, RX, GND), 3.3V without pin - 115200 8N1 - UART2: On board with BLE module - SPI1: On board socket for Zigbee module Update firmware instructions: Please update the firmware via U-Boot web UI (by default at 192.168.1.1, following instructions found at https://docs.gl-inet.com/en/3/troubleshooting/debrick/). Normal sysupgrade, either via CLI or LuCI, is not possible from stock firmware. Please do use the *gl-b2200-squashfs-emmc.img file, gunzipping the produced *gl-b2200-squashfs-emmc.img.gz one first. What's working: - WiFi 2G, 5G - WPA2/WPA3 Not tested: - Bluetooth LE/Zigbee Credits goes to the original authors of this patch. V1->V2: - updates *arm-boot-add-dts-files.patch correctly (sorry, my mistake) - add uboot-envtools support V2->V3: - Li Zhang updated official patch to fix wrong MAC address on wlan0 (PCI) interface V3->V4: - wire up sysupgrade Signed-off-by: Li Zhang <li.zhang@gl-inet.com> [fix tab and trailing space, document what's working and what's not] Signed-off-by: TruongSinh Tran-Nguyen <i@truongsinh.pro> [rebase on top of master, address remaining comments] Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com> [remove redundant check in platform.sh] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-12-01 15:18:17 +00:00
glinet,gl-b2200|\
luma,wrtq-329acn|\
ipq40xx: add netgear wac510 support This adds support for the Netgear WAC510 Insight Managed Smart Cloud Wireless Access Point, an indoor dual-band, dual-radio 802.11ac business-class wireless AP with integrated omnidirectional antennae and two 10/100/1000 Mbps Ethernet ports. For more information see: <https://www.netgear.com/business/wifi/access-points/wac510> Specifications: SoC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core RAM: 256 MiB Flash1: 2 MiB Winbond W25Q16JV SPI-NOR Flash2: 128 MiB Winbond W25N01GVZEIG SPI-NAND Ethernet: Built-in IPQ4018 (SoC, QCA8072 PHY), 2x 1000/100/10 port, WAN port active IEEE 802.3af/at PoE in Wireless1: Built-in IPQ4018 (SoC) 802.11b/g/n 2x2:2, 3 dBi antennae Wireless2: Built-in IPQ4018 (SoC) 802.11a/n/ac 2x2:2, 4 dBi antennae Input: (Optional) Barrel 12 V 2.5 A Power, Reset button SW1 LEDs: Power, Insight, WAN PoE, LAN, 2.4G WLAN, 5G WLAN Serial: Header J2 1 - 3.3 Volt (Do NOT connect!) 2 - TX 3 - RX 4 - Ground WARNING: The serial port needs a TTL/RS-232 3.3 volt level converter! The Serial settings are 115200-8-N-1. Installation via Stock Web Interface: BTW: The default factory console/web interface login user/password are admin/password. In the web interface navigating to Management - Maintenance - Upgrade - 'Firmware Upgrade' will show you what is currently installed e.g.: Manage Firmware Current Firmware Version: V5.0.10.2 Backup Firmware Version: V1.2.5.11 Under 'Upgrade Options' choose Local (alternatively SFTP would be available) then click/select 'Browse File' on the right side, choose openwrt-ipq40xx-generic-netgear_wac510-squashfs-nand-factory.tar and hit the Upgrade button below. After a minute or two your browser should indicate completion printing 'Firmware update complete.' and 'Rebooting AP...'. Note that OpenWrt will use the WAN PoE port as actual WAN port defaulting to DHCP client but NOT allowing LuCI access, use LAN port defaulting to 192.168.1.1/24 to access LuCI. Installation via TFTP Requiring Serial U-Boot Access: Connect to the device's serial port and hit any key to stop autoboot. Upload and boot the initramfs based OpenWrt image as follows: (IPQ40xx) # setenv serverip 192.168.1.1 (IPQ40xx) # setenv ipaddr 192.168.1.2 (IPQ40xx) # tftpboot openwrt-ipq40xx-generic-netgear_wac510-initramfs-fit-uImage.itb (IPQ40xx) # bootm Note: This only runs OpenWrt from RAM and has not installed anything to flash as of yet. One may permanently install OpenWrt as follows: Check the MTD device number of the active partition: root@OpenWrt:/# dmesg | grep 'set to be root filesystem' [ 1.010084] mtd: device 9 (rootfs) set to be root filesystem Upload the factory image ending with .ubi to /tmp (e.g. using scp or tftp). Then flash the image as follows (substituting the 9 in mtd9 below with whatever number reported above): root@OpenWrt:/# ubiformat /dev/mtd9 -f /tmp/openwrt-ipq40xx-generic-netgear_wac510-squashfs-nand-factory.ubi And reboot. Dual Image Configuration: The default U-Boot boot command bootipq uses the U-Boot environment variables primary/secondary to decide which image to boot. E.g. primary=0, secondary=3800000 uses rootfs while primary=3800000, secondary=0 uses rootfs_1. Switching their values changes the active partition. E.g. from within U-Boot: (IPQ40xx) # setenv primary 0 (IPQ40xx) # setenv secondary 3800000 (IPQ40xx) # saveenv Or from a OpenWrt userspace serial/SSH console: fw_setenv primary 0 fw_setenv secondary 3800000 Note that if you install two copies of OpenWrt then each will have its independent configuration not like when switching partitions on the stock firmware. BTW: The kernel log shows which boot partition is active: [ 2.439050] ubi0: attached mtd9 (name "rootfs", size 56 MiB) vs. [ 2.978785] ubi0: attached mtd10 (name "rootfs_1", size 56 MiB) Note: After 3 failed boot attempts it automatically switches partition. Signed-off-by: Robert Marko <robimarko@gmail.com> Signed-off-by: Marcel Ziswiler <marcel@ziswiler.com> [squashed netgear-tar commit into main and rename netgear-tar for now, until it is made generic.] Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2020-11-25 13:23:58 +00:00
netgear,wac510|\
openmesh,a42|\
openmesh,a62|\
ipq40xx: add support for Pakedge WR-1 Pakedge WR-1 is a dual-band wireless router. Specification SoC: Qualcomm Atheros IPQ4018 RAM: 256 MB DDR3 Flash: 32 MB SPI NOR WIFI: 2.4 GHz 2T2R integrated 5 GHz 2T2R integrated Ethernet: 5x 10/100/1000 Mbps QCA8075 USB: 1x 2.0 LEDS: 8x (3 GPIO controlled, 5 connected to switch) Buttons: 1x GPIO controlled UART: pin header J5 1. 3.3V, 2. GND, 3. TX, 4. RX baud: 115200, parity: none, flow control: none Installation 1. Rename initramfs image to: openwrt-ipq806x-qcom-ipq40xx-ap.dk01.1-c1-fit-uImage-initramfs.itb and copy it to USB flash drive with FAT32 file system. 2. Connect USB flash drive to the router and apply power while pressing reset button. Hold the button, on the lates bootloader version, when Power and WiFi-5 LEDs will start blinking release it. For the older bootloader holding it for 15 seconds should suffice. 3. Now the router boots the initramfs image, at some point (close to one minute) the Power LED will start blinking, when stops, router is fully booted. 4. Connect to one of LAN ports and use SSH to open the shell at 192.168.1.1. 5. ATTENTION! now backup the mtd8 and mtd9 partitions, it's necessary if, at some point, You want to go back to original firmware. The firmware provided by manufacturer on its site is encrypted and U-Boot accepts only decrypted factory images, so there's no way to restore original firmware. 6. If the backup is prepared, transfer the sysupgrade image to the router and use 'sysupgrade' command to flash it. 7. After successful flashing router will reboot. At some point the Power LED will start blinking, wait till it stops, then router is ready for configuration. Additional information U-Boot command line is password protected. Password is unknown. Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
2022-09-06 13:32:33 +00:00
pakedge,wr-1|\
plasmacloud,pa1200|\
ipq40xx: add support for Plasma Cloud PA2200 Device specifications: * QCA IPQ4019 * 256 MB of RAM * 32 MB of SPI NOR flash (w25q256) - 2x 15 MB available; but one of the 15 MB regions is the recovery image * 2T2R 2.4 GHz - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=PlasmaCloud-PA2200 * 2T2R 5 GHz (channel 36-64) - QCA9888 hw2.0 (PCI) - requires special BDF in QCA9888/hw2.0/board-2.bin bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=PlasmaCloud-PA2200 * 2T2R 5 GHz (channel 100-165) - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=PlasmaCloud-PA2200 * GPIO-LEDs for 2.4GHz, 5GHz-SoC and 5GHz-PCIE * GPIO-LEDs for power (orange) and status (blue) * 1x GPIO-button (reset) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x gigabit ethernet - phy@mdio3: + Label: Ethernet 1 + gmac0 (ethaddr) in original firmware + used as LAN interface - phy@mdio4: + Label: Ethernet 2 + gmac1 (eth1addr) in original firmware + 802.3at POE+ + used as WAN interface * 12V 2A DC Flashing instructions: The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the factory image to the u-boot when the device boots up. Signed-off-by: Marek Lindner <marek.lindner@kaiwoo.ai> [sven@narfation.org: prepare commit message, rebase, use all LEDs, switch to dualboot_datachk upgrade script, use eth1 as designated WAN interface] Signed-off-by: Sven Eckelmann <sven@narfation.org>
2018-12-14 15:46:53 +00:00
plasmacloud,pa2200)
ubootenv_add_uci_config "/dev/mtd5" "0x0" "0x10000" "0x10000"
;;
aruba,ap-303)
ubootenv_add_uci_config "/dev/mtd13" "0x0" "0x10000" "0x10000"
;;
aruba,ap-365)
ubootenv_add_uci_config "/dev/mtd8" "0x0" "0x10000" "0x10000"
;;
ipq40xx: Add support Netgear LBR20 **Netgear LBR20** is a router with two gigabit ethernets , three wifi radios and integrated LTE cat.18 modem. SoC Type: Qualcomm IPQ4019 RAM: 512 MiB Flash: 256 MiB , SLC NAND, 2 Gbit (Macronix MX30LF2G18AC) Bootloader: U-Boot Modem: LTE CAT.18 Quectel EG-18EA , Max. 1.2Gbps downlink / 150Mbps uplink WiFi class AC2200: - radio0 : 5G on QCA9888 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps , 80MHz - limited for low channels - radio1: 2,4G on IPQ4019 ,WiFi4- 802.11b/g/n MIMO2x2 300Mbps 40Mhz - radio2: 5G on IPQ4019 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps ,80Mhz - limited for high channels (from 100 up to 165) . Becouse of DFS remember to set country before turning on. Ethernet: 2x1GbE (WAN/LAN1, LAN2) LEDs: section power : green and red , section on top (orbi) drived by TLC59208F: red, green ,blue and white USB ports: No Buttons: 2 Reset and SYNC(WPS) Power: 12 VDC, 2,5 A Connector type: Barrel OpenWRT Installation 1. Simplest way is just do upgrade from webpage with *factory.img 2. You can also do it with standard tool for Netgear's debricking - NMPRFlash 3. Most advanced way is to open device , connect to UART console and : - Prepare OpenWrt initramfs image in TFTP server root (server IP 192.168.1.10) - Connect serial console (115200,8n1) to UART connector - Connect TFTP server to RJ-45 port - Stop in u-Boot and run u-Boot command: > setenv serverip 192.168.1.10 > set fdt_high 0x85000000 > tftpboot 0x83000000 openwrt-ipq40xx-generic-netgear_lbr20-initramfs-zImage.itb > bootm 0x83000000 - Login via ssh - upload or download *sysupgrade.bin ( like wget ... or scp transfer) - Install image via "sysupgrade -n" (like “sysupgrade -n /tmp/openwrt-ipq40xx-generic-netgear_lbr20-squashfs-sysupgrade.bin”) Back to Stock - Download firmware from official Netgear's webpage , it will be *.img file after decompressing. - Use NMRPFlash tool ( detailed insructions on project page https://github.com/jclehner/nmrpflash ) Open the case - Unscrew nuts and remove washers from antenna's conectors. - There are two Torx T10 screws under the label next to antenna conectors. You have to unglue this label from left and right corner to get it - Two parts of shell covers will slide out from eachother , you have to unglue two small rubber pads and namplate sticker on bottom to do that. - PCB is screwed with 4Pcs of Torx T10 screws - Before lifting up PCB remove pigtiles for LTE antennas and release them from PCB and radiator (black and white wires) - On other side of PCB ,in left bottom corner there is already soldered with 4 pins UART connector for console. Counting from left it is +3,3V , TX , RX ,GND (reffer to this picture: https://i.ibb.co/Pmrf9KB/20240116-103524.jpg ) BDF's files are in firmware_qca-wireless https://github.com/openwrt/firmware_qca-wireless/ and in parallel sent to ath10k@lists.infradead.org. Signed-off-by: Marcin Gajda <mgajda@o2.pl>
2024-02-11 15:20:21 +00:00
buffalo,wtr-m2133hp|\
netgear,lbr20)
ubootenv_add_uci_config "/dev/mtd8" "0x0" "0x40000" "0x20000"
;;
linksys,ea6350v3)
ubootenv_add_uci_config "/dev/mtd7" "0x0" "0x20000" "0x20000"
;;
linksys,ea8300|\
linksys,mr8300)
ipq40xx: Add support for Linksys EA8300 (Dallas) The Linksys EA8300 is based on QCA4019 and QCA9888 and provides three, independent radios. NAND provides two, alternate kernel/firmware images with fail-over provided by the OEM U-Boot. Installation: "Factory" images may be installed directly through the OEM GUI. Hardware Highlights: * IPQ4019 at 717 MHz (4 CPUs) * 256 MB NAND (Winbond W29N02GV, 8-bit parallel) * 256 MB RAM * Three, fully-functional radios; `iw phy` reports (FCC/US, -CT): * 2.4 GHz radio at 30 dBm * 5 GHz radio on ch. 36-64 at 23 dBm * 5 GHz radio on ch. 100-144 at 23 dBm (DFS), 149-165 at 30 dBm #{ managed } <= 16, #{ AP, mesh point } <= 16, #{ IBSS } <= 1 * All two-stream, MCS 0-9 * 4x GigE LAN, 1x GigE Internet Ethernet jacks with port lights * USB3, single port on rear with LED * WPS and reset buttons * Four status lights on top * Serial pads internal (unpopulated) "Linksys Dallas WiFi AP router based on Qualcomm AP DK07.1-c1" Implementation Notes: The OEM flash layout is preserved at this time with 3 MB kernel and ~69 MB UBIFS for each firmware version. The sysdiag (1 MB) and syscfg (56 MB) partitions are untouched, available as read-only. Serial Connectivity: Serial connectivity is *not* required to flash. Serial may be accessed by opening the device and connecting a 3.3-V adapter using 115200, 8n1. U-Boot access is good, including the ability to load images over TFTP and either run or flash them. Looking at the top of the board, from the front of the unit, J3 can be found on the right edge of the board, near the rear | J3 | |-| | |O| | (3.3V seen, open-circuit) |O| | TXD |O| | RXD |O| | |O| | GND |-| | | Unimplemented: * serial1 "ttyQHS0" (serial0 works as console) * Bluetooth; Qualcomm CSR8811 (potentially conected to serial1) Other Notes: https://wikidevi.com/wiki/Linksys_EA8300 states FCC docs also cover the Linksys EA8250. According to the RF Test Report BT BR+EDR, "All models are identical except for the EA8300 supports 256QAM and the EA8250 disable 256QAM." Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
2019-04-10 15:34:28 +00:00
ubootenv_add_uci_config "/dev/mtd7" "0x0" "0x40000" "0x20000"
;;
linksys,whw01)
ipq40xx: add support for Linksys WHW01 v1 This patch adds support for Linksys WHW01 v1 ("Velop") [FCC ID Q87-03331]. Specification ------------- SOC: Qualcomm IPQ4018 WiFi 1: Qualcomm QCA4019 IEEE 802.11b/g/n WiFi 2: Qualcomm QCA4019 IEEE 802.11a/n/ac Bluetooth: Qualcomm CSR8811 (A12U) Ethernet: Qualcomm QCA8072 (2-port) SPI Flash 1: Mactronix MX25L1605D (2MB) SPI Flash 2: Winbond W25M02GV (256MB) DRAM: Nanya NT5CC128M16IP-DI (256MB) LED Controller: NXP PCA963x (I2C) Buttons: Single reset button (GPIO). Notes ----- There does not appear to be a way to trigger TFTP recovery without entering U-Boot. The device must be opened to access the serial console in order to first flash OpenWrt onto a device from factory. The device has automatic recovery backed by a second set of partitions on the larger of the two SPI flash ICs. Both the primary and secondary must be flashed to prevent accidental rollback to "factory" after 3 failed boot attempts. Serial console -------------- A serial console is available on the following pins of the populated J2 connector on the device mainboard (115200 8n1). (<-- Top of PCB / Device) J2 [o o o o o o] | | | | | `-- GND | `---- TX `--------- RX Installation instructions ------------------------- 1. Setup TFTP server with server IP set to 192.168.1.236. 2. Copy compiled `...squashfs-factory.bin` to `nodes-jr.img` in tftp root. 3. Connect to console using pinout detailed in the serial console section. 4. Power on device and press enter when prompted to drop into U-Boot. 5. Flash first partition device via `run flashimg`. 6. Once complete, reset device and allow to power up completely. 7. Once comfortable with device upgrade reboot and drop back into U-Boot. 8. Flash the second partition (recovery) via `run flashimg2`. Revert to "factory" ------------------- 1. Download latest firmware update from vendor support site. 2. Copy extracted `.img` file to `nodes-jr.img` in tftp root. 3. Connect to console using pinout detailed in the serial console section. 4. Power on device and press enter when prompted to drop into U-Boot. 5. Flash first partition device via `run flashimg`. 6. Once complete, reset device and allow to power up completely. 7. Once comfortable with device upgrade reboot and drop back into U-Boot. 8. Flash the second partition (recovery) via `run flashimg2`. Link: https://github.com/openwrt/openwrt/pull/3682 Signed-off-by: Peter Adkins <peter@sunkenlab.com> (calibration from nvmem, updated to 5.10+5.15) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-06-09 20:35:46 +00:00
ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x40000" "0x10000"
;;
ipq40xx: add support for Linksys WHW03 V1 Hardware: ========= SOC: Qualcomm IPQ4019 WiFi 1: QCA4019 IEEE 802.11b/g/n WiFi 2: QCA4019 IEEE 802.11a/n/ac WiFi 3: QCA9886 IEEE 802.11a/n/ac Bluetooth: Qualcomm CSR8510 (A10) Zigbee: Silicon Labs EM3581 NCP + Skyworks SE2432L Ethernet: Qualcomm Atheros QCA8072 (2-port) Flash: Samsung KLM4G1FEPD (4GB eMMC) RAM (NAND): 512MB LED Controller: NXP PCA9633 (I2C) Buttons: Single reset button (GPIO). Ethernet: ========= The device has 2 ethernet ports, configured as follows by default: - left port: WAN - right port: LAN Wifi: ===== The Wifi radios are turned off by default. To configure the router, you will need to connect your computer to the LAN port of the device. Bluetooth and Zigbee: ===================== Configuration included but not tested. Storage: ======== For compatibility with stock firmware, all of OpenWrt runs in a 136 MiB eMMC partition (of which there are two copies, see below). You can also use partition /dev/mmcblk0p19 "syscfg" (3.4 GiB) any way you see fit. During very limited tests, stock firmware did not mount this partition. However, backing up its stock content before use is recommended anyway. Firmware: ========= The device uses a dual firmware mechanism: it automatically reverts to the previous firmware after 3 failed boot attempts. You can switch to the inactive firmware copy by changing the "boot_part" U-Boot environment variable. You can also do it by turning on the device for a couple of seconds and then back off, 3 times in a row. Installation: ============= OpenWrt's "factory" image can be installed via the stock web UI: 1. Login to the UI. (The default password is printed on the label.) 2. Enter support mode by clicking on the "CA" link at the bottom. 3. Click "Connectivity", "Choose file", "Start", and ignore warnings. This port is based on work done by flipy (https://github.com/flipy). Signed-off-by: Rodrigo Balerdi <lanchon@gmail.com> Link: https://github.com/openwrt/openwrt/pull/15345 Signed-off-by: Robert Marko <robimarko@gmail.com>
2024-04-11 15:14:19 +00:00
linksys,whw03)
ubootenv_add_uci_config "/dev/mmcblk0p11" "0x0" "0x100000"
;;
linksys,whw03v2)
ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x80000" "0x20000"
;;
ipq40xx: add support for the ZyXEL NBG6617 This patch adds support for ZyXEL NBG6617 Hardware highlights: SOC: IPQ4018 / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7 DRAM: 256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz NOR: 32 MiB Macronix MX25L25635F ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN) USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC) WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: RESET Button, WIFI/Rfkill Togglebutton, WPS Button LEDS: Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS Serial: WARNING: The serial port needs a TTL/RS-232 3.3v level converter! The Serial setting is 115200-8-N-1. The 1x4 .1" header comes pre-soldered. Pinout: 1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX first install / debricking / restore stock: 0. Have a PC running a tftp-server @ 192.168.1.99/24 1. connect the PC to any LAN-Ports 2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file into the tftp-server root directory and rename it to just "ras.bin". 3. power-cycle the router and hold down the the WPS button (for 30sek) 4. Wait (for a long time - the serial console provides some progress reports. The u-boot says it best: "Please be patient". 5. Once the power LED starts to flashes slowly and the USB + WPS LEDs flashes fast at the same time. You have to reboot the device and it should then come right up. Installation via Web-UI: 0. Connect a PC to the powered-on router. It will assign your PC a IP-address via DHCP 1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234) 2. Go to the "Expert Mode" 3. Under "Maintenance", select "Firmware-Upgrade" 4. Upload the OpenWRT factory image 5. Wait for the Device to finish. It will reboot into OpenWRT without any additional actions needed. To open the ZyXEL NBG6617: 0. remove the four rubber feet glued on the backside 1. remove the four philips screws and pry open the top cover (by applying force between the plastic top housing from the backside/lan-port side) Access the real u-boot shell: ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02" When the device is starting up, the user can enter the the loader shell by simply pressing a key within the 3 seconds once the following string appears on the serial console: | Hit any key to stop autoboot: 3 The user is then dropped to a locked shell. |NBG6617> HELP |ATEN x[,y] set BootExtension Debug Flag (y=password) |ATSE x show the seed of password generator |ATSH dump manufacturer related data in ROM |ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations) |ATGO boot up whole system |ATUR x upgrade RAS image (filename) |NBG6617> In order to escape/unlock a password challenge has to be passed. Note: the value is dynamic! you have to calculate your own! First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env) to get the challange value/seed. |NBG6617> ATSE NBG6617 |012345678901 This seed/value can be converted to the password with the help of this bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors): - tool.sh - ror32() { echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) )) } v="0x$1" a="0x${v:2:6}" b=$(( $a + 0x10F0A563)) c=$(( 0x${v:12:14} & 7 )) p=$(( $(ror32 $b $c) ^ $a )) printf "ATEN 1,%X\n" $p - end of tool.sh - |# bash ./tool.sh 012345678901 | |ATEN 1,879C711 copy and paste the result into the shell to unlock zloader. |NBG6617> ATEN 1,0046B0017430 If the entered code was correct the shell will change to use the ATGU command to enter the real u-boot shell. |NBG6617> ATGU |NBG6617# Co-authored-by: David Bauer <mail@david-bauer.net> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: David Bauer <mail@david-bauer.net>
2018-06-21 12:24:59 +00:00
zyxel,nbg6617)
ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x10000" "0x10000"
;;
esac
config_load ubootenv
config_foreach ubootenv_add_app_config ubootenv
exit 0