openwrtv3/include
Christian Lamparter 82618062cf ipq40xx: add support for the ZyXEL NBG6617
This patch adds support for ZyXEL NBG6617

Hardware highlights:

SOC:    IPQ4018 / QCA Dakota
CPU:    Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM:   256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz
NOR:    32 MiB Macronix MX25L25635F
ETH:    Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB:    1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1:  Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2:  Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT:  RESET Button, WIFI/Rfkill Togglebutton, WPS Button
LEDS:   Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS

Serial:
	WARNING: The serial port needs a TTL/RS-232 3.3v level converter!
	The Serial setting is 115200-8-N-1. The 1x4 .1" header comes
	pre-soldered. Pinout:
	  1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX

first install / debricking / restore stock:
 0. Have a PC running a tftp-server @ 192.168.1.99/24
 1. connect the PC to any LAN-Ports
 2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file
    into the tftp-server root directory and rename it to just "ras.bin".
 3. power-cycle the router and hold down the the WPS button (for 30sek)
 4. Wait (for a long time - the serial console provides some progress
    reports. The u-boot says it best: "Please be patient".
 5. Once the power LED starts to flashes slowly and the USB + WPS LEDs
    flashes fast at the same time. You have to reboot the device and
    it should then come right up.

Installation via Web-UI:
 0. Connect a PC to the powered-on router. It will assign your PC a
    IP-address via DHCP
 1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234)
 2. Go to the "Expert Mode"
 3. Under "Maintenance", select "Firmware-Upgrade"
 4. Upload the OpenWRT factory image
 5. Wait for the Device to finish.
    It will reboot into OpenWRT without any additional actions needed.

To open the ZyXEL NBG6617:
 0. remove the four rubber feet glued on the backside
 1. remove the four philips screws and pry open the top cover
    (by applying force between the plastic top housing from the
    backside/lan-port side)

Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:

|   Hit any key to stop autoboot:  3

The user is then dropped to a locked shell.

|NBG6617> HELP
|ATEN    x[,y]     set BootExtension Debug Flag (y=password)
|ATSE    x         show the seed of password generator
|ATSH              dump manufacturer related data in ROM
|ATRT    [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO              boot up whole system
|ATUR    x         upgrade RAS image (filename)
|NBG6617>

In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!

First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.

|NBG6617> ATSE NBG6617
|012345678901

This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):

- tool.sh -
ror32() {
  echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -

|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711

copy and paste the result into the shell to unlock zloader.

|NBG6617> ATEN 1,0046B0017430

If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.

|NBG6617> ATGU
|NBG6617#

Co-authored-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: David Bauer <mail@david-bauer.net>
2018-06-26 08:57:26 +02:00
..
site include/site: add powerpc64 config 2017-10-24 13:24:04 +02:00
autotools.mk treewide: fix build depends to refer to source package names 2018-01-13 19:54:44 +01:00
cmake.mk cmake: skip build system check on compile 2017-02-21 13:03:20 +01:00
debug.mk include: remove trailing whitespaces 2015-03-29 07:29:18 +00:00
depends.mk build: add missing wildcard for ignoring .pkgdir in dependency checks 2017-02-05 22:17:30 +01:00
device_table.txt image: ensure that /dev/console exist in rootfs images 2013-08-27 12:02:58 +00:00
download.mk downloads.mk: introduce name-agnostic PROJECT_GIT variable 2018-01-10 21:27:31 +01:00
feeds.mk imagebuilder: reuse rootfs preparation from rootfs.mk 2018-03-07 09:59:08 +01:00
hardened-ld-pie.specs build: add hardened builds with PIE (ASLR) support 2018-01-27 16:46:45 +01:00
hardening.mk build: add hardened builds with PIE (ASLR) support 2018-01-27 16:46:45 +01:00
host-build.mk build: pass HOSTCXX to host builds as CXX 2018-04-20 13:20:25 +02:00
image-commands.mk ipq40xx: add support for the ZyXEL NBG6617 2018-06-26 08:57:26 +02:00
image-legacy.mk image: fix ar71xx legacy images 2017-07-15 07:02:59 +02:00
image.mk build: Allow to change the FIT config section name 2018-03-17 08:09:04 +01:00
kernel-build.mk Config-devel.in: rename symbol KERNEL_GIT_BRANCH -> KERNEL_GIT_REF 2018-01-27 16:46:45 +01:00
kernel-defaults.mk config: don't define the same symbol twice 2018-01-17 11:07:17 +01:00
kernel-version.mk kernel: bump 4.14 to 4.14.51 2018-06-26 08:57:21 +02:00
kernel.mk include/kernel.mk: build kmod packages with empty FILES 2018-04-12 05:47:10 +02:00
netfilter.mk netfilter: add bpf match support 2018-06-26 08:57:25 +02:00
nls.mk treewide: fix build depends to refer to source package names 2018-01-13 19:54:44 +01:00
package-bin.mk build: use if-then to avoid non-zero return codes in bin/ packaging code 2017-01-23 13:49:45 +01:00
package-defaults.mk include/package-defaults.mk: fix default Build/Prepare with empty ./src 2018-03-07 09:59:08 +01:00
package-dumpinfo.mk include/package-dumpinfo.mk: don't duplicate source package information for every binary package 2018-01-13 19:54:45 +01:00
package-ipkg.mk build: allow defining license information per binary package 2017-11-25 20:02:04 +01:00
package-seccomp.mk include: add a seccomp filter install wrapper 2015-03-26 10:57:56 +00:00
package.mk build: prevent spurious package rebuilds under CONFIG_AUTOREMOVE 2018-05-22 09:27:38 +02:00
prereq-build.mk build: add busybox support to time prereq-check 2018-06-18 21:27:01 +02:00
prereq.mk include: extend SetupHostCommand macro to accept more arguments 2018-04-05 13:58:15 +02:00
quilt.mk kernel: split patches folder up into backport, pending and hack folders 2017-08-05 08:46:36 +02:00
rootfs.mk imagebuilder: reuse rootfs preparation from rootfs.mk 2018-03-07 09:59:08 +01:00
scan.awk build: propagate override information to .packageinfo 2015-02-09 12:09:31 +00:00
scan.mk build: get rid of host.mk 2017-02-26 13:31:44 +01:00
scons.mk build: use CXXFLAGS if defined 2016-10-13 17:04:43 +02:00
shell.sh build: use mkhash to replace various quirky md5sum/openssl calls 2017-01-05 11:09:12 +01:00
subdir.mk build: add busybox support to time prereq-check 2018-06-18 21:27:01 +02:00
target.mk octeon: Add and set CPU type Octeon+ as default 2018-06-20 15:36:02 +02:00
toolchain-build.mk build: stop overriding STAGING_DIR_HOST for toolchain build 2017-05-25 19:01:07 +02:00
toplevel.mk include/toplevel.mk: Add xconfig target 2017-11-02 15:58:45 +01:00
u-boot.mk u-boot.mk: add HOST_LDFLAGS to UBOOT_MAKE_FLAGS 2018-02-10 20:52:31 +01:00
uclibc++.mk toolchain: eliminate the INSTALL_LIBSTDCPP config symbol and make c++ support mandatory - fixes recursive config symbol dependency issues 2013-05-09 20:50:49 +00:00
unpack.mk build: unzip: perform operations quietly 2017-01-05 11:09:13 +01:00
verbose.mk build: tell users to do non-paralle builds on errors 2015-04-16 12:18:26 +00:00
version.mk build: change version.mk defaults to OpenWrt 2018-06-22 13:45:03 +02:00