Specifications:
SoC: Qualcomm Atheros QCA9557
RAM: 128 MB (Nanya NT5TU32M16EG-AC)
Flash: 16 MB (Macronix MX25L12845EMI-10G)
Ethernet: 5x 10/100/1000 (1x WAN, 4x LAN)
Wireless: QCA9557 2.4GHz (nbg), QCA9882 5GHz (ac)
USB: 2x USB 2.0 port
Buttons: 1x Reset
Switches: 1x Wifi
LEDs: 11 (Pwr, WAN, 4x LAN, 2x Wifi, 2x USB, WPS)
MAC addresses:
WAN *:3f uboot-env ethaddr + 3
LAN *:3e uboot-env ethaddr + 2
2.4GHz *:3c uboot-env ethaddr
5GHz *:3d uboot-env ethaddr + 1
The label contains all four MAC addresses, however the one without
increment is first, so this one is taken for label MAC address.
Notes:
The Wifi is controlled by an on/off button, i.e. has to be implemented
by a switch (EV_SW). Despite, it appears that GPIO_ACTIVE_HIGH needs
to be used, just like recently fixed for the NBG6716.
Both parameters have been wrong at ar71xx.
Flash Instructions:
At first the U-Boot variables need to be changed in order to boot the
new combined image format. ZyXEL uses a split kernel + root setup and
the current kernel is too large to fit into the partition. As resizing
didnt do the trick, I've decided to use the prefered combined image
approach to be future-kernel-enlargement-proof (thanks to blocktrron for
the assistance).
First add a new variable called boot_openwrt:
setenv boot_openwrt bootm 0x9F120000
After that overwrite the bootcmd and save the environment:
setenv bootcmd run boot_openwrt
saveenv
After that you can flash the openwrt factory image via TFTP. The servers
IP has to be 192.168.1.33. Connect to one of the LAN ports and hold the
WPS Button while booting. After a few seconds the NBG6616 will look for
a image file called 'ras.bin' and flash it.
Return to vendor firmware is possible by resetting the bootcmd:
setenv bootcmd run boot_flash
saveenv
and flashing the vendor image via the TFTP method as described above.
Accessing the U-Boot Shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
| NBG6616> ?
| ATEN x,(y) set BootExtension Debug Flag (y=password)
| ATSE x show the seed of password generator
| ATSH dump manufacturer related data in ROM
| ATRT (x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations
| ATGO boot up whole system
| ATUR x upgrade RAS image (filename)
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
| NBG6616> ATSE NBG6616
| 00C91D7EAC3C
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
| # bash ./tool.sh 00C91D7EAC3C
| ATEN 1,10FDFF5
Copy and paste the result into the shell to unlock zloader.
| NBG6616> ATEN 1,10FDFF5
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
| NBG6616> ATGU
| NBG6616#
Signed-off-by: Christoph Krapp <achterin@googlemail.com>
[move keys to DTSI, adjust usb_power DT label, remove kernel config
change, extend commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
AR8327 datasheet[1] calls the register at address 0x0010
"Power-on Strapping Register". As it has nothing to do with "strip",
let's rename it to "POWER_ON_STRAP" to make it easier to grasp.
[1] https://lafibre.info/images/doc/201106_spec_AR8327.pdf
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
All definitions of gpio in SoC DTSI files do not set status, i.e.
have it enabled. This drops all remaining redundant "status = okay"
definitions in descendent files (mostly older ones).
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
In ath79, for several SoCs the console bootargs are defined to the
very same value in every device's DTS. Consolidate these definitions
in the SoC dtsi files and drop further redundant definitions elsewhere.
The only device without any bootargs set has been OpenMesh OM5P-AC V2.
This will now inherit the setting from qca955x.dtsi
Note that while this tidies up master a lot, it might develop into a
frequent pitfall for backports.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
There are at least 3 different chips in the Scorpion series of SoCs.
Rename the common DTSI to better reflect it's purpose for the whole
series.
Also rename the compatible bindings from qca,ar9557 and qca,qca9557
to qca,qca9550.
Signed-off-by: David Bauer <mail@david-bauer.net>
This applies further fixes to the DTS of ZyXEL NBG6716 based on
what is found in ar71xx (mach-nbg6716.c):
- use WiFi label names as in ar71xx
- fix WPS gpio number
- fix GPIO_ACTIVE_HIGH and mode for WiFi switch
- add codes for USB eject buttons
- fix node name for "internet" LED
This device has separate LEDs for WAN and "Internet". As the WAN-LED
(and the four LAN-LEDs) are driven independent of the setup in
DT/01_leds, the "internet" LED is left unassigned (in contrast to
ar71xx, where it was set up effectively as a second WAN LED)
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The USB LED assignment to internal ports was swapped.
Fix it.
We also explicitly checked that the LED label numbers match those
on the device.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2.4 GHz Wifi on ath79 is set up in 10-ath9k-eeprom, but in ar71xx
it was done with ath79_register_wmac.
Thus, the following errors are observed on the device:
ath: phy1: Unable to initialize hardware; initialization status: -5
ath9k 18100000.wmac: failed to initialize device
ath9k: probe of 18100000.wmac failed with error -5
This patch changes the ath79 support to properly use wmac as well.
This will also require fixing the MAC address in a different way.
Signed-off-by: Guillaume Lefebvre <guillaume@zelig.ch>
[several adjustments to 10-fix-wifi-mac, use correct MAC address,
rewrite commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
A minority of ethernet-phy definitions seems to use numbers in label,
name and reg property relatively random. This patch aligns their
use to have the same numeric value for all of them.
While at it, improve order of properties/add newlines for the ethX
nodes where necessary.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
In several DTS files, button nodes are just named buttonX or
xxx_button. This replaces the names with more specific names matching
the majority of key definitions.
While at it, fix name of keys node in one case.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This applies several style adjustments that have been requested in
recent reviews to older DTS files. Despite making the code base more
consistent, this will also help to reduce review time when DTSes
are copy/pasted.
Applied changes:
- Rename gpio-keys/gpio-leds to keys/leds
- Remove node labels that are not used
- Use label property for partitions
- Prefix led node labels with "led_"
- Remove redundant includes
- Harmonize new lines after status property
- Several smaller style fixes
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This fixes several issues introduced with ZyXEL NBG6716 support:
- Inhomogeneous indent
- Wrong ath10k MAC patching function
- Wrong brackets for pad-to in nand.mk
- Add missing DEVICE_MODEL
- Remove k2t.sh include (copy/paste leftover)
Fixes: 99835e0999 ("ath79: add support for ZyXEL NBG6716")
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Attention: Kernel partition size has been enlarged to 4MB.
To switch, you must update to latest ar71xx-nand snapshort and flash the
sysupgrade-4M-Kernel.bin:
zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin | mtd -r -e ubi write - firmware; reboot -f
You will end up with a fresh config if you do not inject config into the image.
The NBG6716 may come with 128MB or 256MB NAND. ar71xx was able to use all, but
ath79 can only use the first 128MB. Therefore the complete NAND needs to be
overwritten. If not, the old UBI may make problems and lead to reboot loop.
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6716> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6716>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6716> ATSE NBG6716
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6716> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6716> ATGU
|NBG6716#
Signed-off-by: André Valentin <avalentin@marcant.net>
