could anyone brilliant get openwrt to run on Gigastone TR1?
it is atheros 9331 and only $8 USD on Amazon
https://www.amazon.com/Gigastone-GS-TR1-R-Wireless-Travel-Router/dp/B01DR04V90#Ask
From Amazon review:
THIS SHOULD NOT BE ALLOWED TO BE SOLD - DNS HIJACK TO CHINA
May 6, 2019
Verified Purchase
The interface allows you to select the mode (AP/Router...) but it does not take any input either from static IP entry or from DHCP to provide the DNS. here is why, it sends all DNS traffic to an IP in China owned by Shanghai Telecom and they then have the ability to redirect your Session to wherever they want since they resolve the IP address to whomever they want. I saw a few connections to non US sites that triggered alerts in my security system. I had to setup NetFlow to see this and ultimately a WireShark PCAP on the device to find this. Amazon should never allow this device to be sold! DO NOT BUY THIS!
As far as adding support to it, it's probably some rebranded 4MB unit. With modern kernels, that's probably going to run poorly.
2 Likes
@bobsimms215
Its a clone of TL-MR3020. So, follow the device page, get UART , replace the bootloader with the pepe2k version of U-boot and flash your Openwrt firmware of choice. You can upgrade flash and ram yourself to 16MB/64MB google is your friend. About the amazon review, that is is true for a lot of IOT devices. However, with a new open source bootloader and firmware that should't have much importance.
Maybe the J2 connector will get me UART?
I did try uploading the squashfs.bin from snapshot-ar7-generic
This seemed to cause illness in the device, it no longer works.
On the plus side, the 'Upgrade' function in web gui seems to accept the bin ok.
@bobsimms215
Yes, in the pic those 4 holes are the way to connect. So, solder some headers and connect to the device.
When I mentioned install your Firmware of choice, I meant any Openwrt version specific for your device which is ar9331 ( Atitude Adjustment, Barrier Breaker, Chaos Calmer and Lede) Therefore, it would be inside targets/ar71xx/generic/. Also, squashfs is just the file system no the whole firmware. Squashfs should be used together with kernel, both being installed from inside Uboot, which you don't have access yet, also involve more arguments and addresses to place the kernel and squashfs after being transfer to the device most likely using FTP.
Now that your device is a brick, you have no options more than get UART access, follow what I mentioned in the first post.
Please read the documentation:
https://openwrt.org/docs/guide-quick-start/start
Some Progress has been made.
I know this is a wussy board (4MB), but still would like to get Openwrt running on it. An old version is ok, don't need GUI, just ssh for some basic network functionality.
Is this enough info? Can someone advise on next steps?
Connected a USB TTL cable to header soldered on to the 4 holes.
Pin closest to edge of board is GND, Next one is RX and then TX. Did not connect the 4th pin (presumably Vcc).
Used Putty, 115200,8,N,1 flowcontrol=none
On boot, I get this:
U-Boot 1.1.4-ga519b4f0-dirtyOct 9 201317:21:10
AP121 (ar9331) U-boot
DRAM: 16 MB
Flash Manuf Id 0x0, DeviceId0 0x0, DeviceId1 0x0
flash size 4194304, sector count = 64
Flash: 4 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:aa:aa
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:aa:aa
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot: 0
## Booting image at 9f300000 ...
Image Name: Linux Kernel Image
Created: 2014-02-26 4:14:51 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 905965 Bytes = 884.7 kB
Load Address: 80002000
Entry Point: 801ea0e0
Verifying Checksum at 0x9f300040 ...OK
Uncompressing Kernel Image ... OK
Starting kernel ...
Booting AR9330(Hornet)...
If I interrupt it, I get this:
Hit any key to stop autoboot: 0
TR1> ?
reset - Perform RESET of the CPU
? - alias for 'help'
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
cp - memory copy
dhcp - invoke DHCP client to obtain IP/boot params
erase - erase FLASH memory
help - print online help
httpd - start webserver
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset - Perform RESET of the CPU
run - run commands in an environment variable
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
TR1>
also this...
TR1> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),2752k(rootfs),896k(uImage),64k(NVRAM),64k(ART)
bootcmd=bootm 0x9f300000
bootdelay=1
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.16.254
serverip=192.168.16.10
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
nc=setenv stdin nc;setenv stdout nc;setenv stderr serial
serial=setenv stdin serial;setenv stdout serial;setenv stderr serial
ncip=192.168.16.10
Environment size: 508/65532 bytes
Alright! There was some useful info from your printenv. Set the network card of your pc to a static IP 192.168.16.254 and set the gateway to 192.168.16.10
Run the device and stop it again.You will get the U-boot terminal.
Run the command > httpd
Connect an Ethernet cable from the device to the pc.
Open your browser, go to this address 192.168.16.10
take pics of the menus and post them.
If there is an option to back up your U- boot then back it up. If there is an option to upload a firmware then contact support of Gigastone and ask for the firmware of this device, so in case of other upgrades/failures/second thoughts you could always recover to a working state.
I have some pics.
httpd server boots up on 192.168.16.254
TR1> httpd
dup 1 speed 100
HTTP server is starting at IP: 192.168.16.254
HTTP server is ready!
Request for: /
I believe the serverip=192.168.16.10 is for your separate device as tftp server.
Root page:
I found some more looking at source html.
U-Boot
ART
Note that the normal web GUI allows firmware upload.
Main page:
Firmware upload:
Great! You have now an unbrickable device easy to flash and recover. Stay away from the U-boot page if you don't know what you are doing, the same goes for the ART page or you will miss the wifi drivers. Inside the flash firmware page from U-boot web try images from here first:
https://archive.openwrt.org/chaos_calmer/15.05.1/ar71xx/generic/
I might recommend this one: openwrt-15.05.1-ar71xx-generic-tl-mr3020-v1-squashfs-sysupgrade.bin
Try only just the images that have the format:
Openwrt-xyz-ar711xx-generic-blahblahblah-squashfs-sysupgrade.bin. Most of them will work with your device, some better than others. Avoid, the others kernel.bin or squashfs.bin.
Because your device is a 4/32 , you can experiment with AA, BB, CC,CC-15.05.1 and lede.The more up to date versions don't support 4/32 devices. Well, there is a tiny version too but without luci.
Once, the device is already running Openwrt make a back up of the whole device:
run these commands:
#cat /proc/mtd
Make copies of all the files listed after that command. Copy to /tmp and then use scp to transfer to your pc. (use winscp if you are in windows)
#cat /dev/mtd0 > /tmp/uboot_backup.bin
when it is done,will be time of clean up and furthest test.
I'll give it a try.
Based on U-Boot output it is a 4/16 not 4/32. Still try the mr3020?
I thought first time flash was supposed to use the *factory.bin images?
I thought we needed some memory location specifics to make a device specific image? Or, does that come next?
Upload via the standard Web GUI or the one started from U-Boot? Or, doesn't matter?
Uploaded the 3020sysupgrade file via U-Boot web server.
It didn't seem to like it.
U-Boot 1.1.4-ga519b4f0-dirtyOct 9 201317:21:10
AP121 (ar9331) U-boot
DRAM: 16 MB
Flash Manuf Id 0x0, DeviceId0 0x0, DeviceId1 0x0
flash size 4194304, sector count = 64
Flash: 4 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot: 0
## Booting image at 9f300000 ...
Bad Magic Number
Failed to execute bootcmd, starting dhcp and httpd to update firmware ...
dup 1 speed 100
BOOTP broadcast 1
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
BOOTP broadcast 2
checksum bad
checksum bad
checksum bad
checksum bad
BOOTP broadcast 3
checksum bad
checksum bad
checksum bad
BOOTP broadcast 4
can not get ip
HTTP server is starting at IP: 192.168.16.254
HTTP server is ready!
I thought you said your device don't boot anymore. How can you use the gigastone web page?
I have been referring to the U-boot webserver, which you get access through UART. You are lucky, most devices don't have the type of webserver built-in inside U-boot, it will allow you to recover always.
It seems a modified pepe2k U-boot version (google it and read about it). The factory images are used for devices already hacked by the Openwrt devs, after flashing factory you need to flash the sysupgrade image. In your case not, it is still a kind of unknown device even the cpu/cards and else are similar to devices already running Openwrt.
The memory specifics are needed when trying to recover/test/upgrade a device, using arguments from printenv and running scripts/commands from U-boot terminal to place kernel and squashfs to an address in memory, then delete some space allocation and copy from memory to the device flash. In your case, because of your U-boot webserver, all this process is not needed, it is easy. Just upload a whole firmware from your pc and that's it. If fails, just rinse and repeat with a different firmware.
Sometimes u-boot show not the real size. (just try). However, I think the Kamikase version of openwrt had supported 16MB of ram.
Your device AR9331 can work with 16MB of flash and 64Mb of ram, search a bit the forum and you can find ways to upgrade your device for a couple of dollars.
Sorry for any confusion, I have two of the routers, one still works.
I tried a bunch of the CC images, no luck so far.
Can someone help get past this error?
To install pepe2k bootloader, from what I read it requires support for specific hardware. I have messaged pepe2k.
Is this something we can get past by building an image for this device?
Getting Closer...
Found an image that doesn't get the bad magic number.
openwrt-15.05.1-ar71xx-generic-dir-601-a1-squashfs-sysupgrade.bin (available for AA, BB and CC)
It fails to boot at the default mem location, but if I issue a bootm with the loaded location.
bootm 0x9f050000
It gets pretty far along in booting, but hangs at:
[ 2.030000] bootconsole [early0] disabled
Any ideas?
TR1> bootm 0x9f050000
## Booting image at 9f050000 ...
Image Name: MIPS OpenWrt Linux-3.18.23
Created: 2020-01-25 9:23:24 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1176702 Bytes = 1.1 MB
▒▒▒▒ 80060000
Entry Point: 80060000
Verifying Checksum at 0x9f050040 ...OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 3.18.23 (buildbot@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r47269) ) #1 Sun Jan 31 18:39:35 CET 2016
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[ 0.000000] SoC: Atheros AR9330 rev 1
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 01000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x00ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x00ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x00000000-0x00ffffff]
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping off. Total pages: 4064
[ 0.000000] Kernel command line: board=DIR-600-A1 console=ttyS0,115200 mtdparts=spi0.0:192k(u-boot)ro,64k(nvram)ro,3712k(firmware),64k(mac)ro,64k(art)ro rootfstype=squashfs,jffs2 noinitrd
[ 0.000000] PID hash table entries: 64 (order: -4, 256 bytes)
[ 0.000000] Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 12080K/16384K available (2586K kernel code, 128K rwdata, 540K rodata, 256K init, 193K bss, 4304K reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:51
[ 0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:25.000MHz
[ 0.000000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[ 0.080000] pid_max: default: 32768 minimum: 301
[ 0.080000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.090000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.100000] NET: Registered protocol family 16
[ 0.100000] MIPS: machine is D-Link DIR-600 rev. A1
[ 0.580000] Switched to clocksource MIPS
[ 0.580000] NET: Registered protocol family 2
[ 0.590000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.590000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.600000] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.600000] TCP: reno registered
[ 0.610000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.610000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.620000] NET: Registered protocol family 1
[ 0.620000] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.650000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.650000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.660000] msgmni has been set to 23
[ 0.670000] io scheduler noop registered
[ 0.670000] io scheduler deadline registered (default)
[ 0.670000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.680000] ar933x-uart: ttyATH0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a AR933X UART
[ 0.700000] m25p80 spi0.0: found mx25l3205d, expected m25p80
[ 0.710000] m25p80 spi0.0: mx25l3205d (4096 Kbytes)
[ 0.710000] 5 cmdlinepart partitions found on MTD device spi0.0
[ 0.720000] Creating 5 MTD partitions on "spi0.0":
[ 0.720000] 0x000000000000-0x000000030000 : "u-boot"
[ 0.730000] 0x000000030000-0x000000040000 : "nvram"
[ 0.730000] 0x000000040000-0x0000003e0000 : "firmware"
[ 0.750000] 0x0000003e0000-0x0000003f0000 : "mac"
[ 0.750000] 0x0000003f0000-0x000000400000 : "art"
[ 0.770000] libphy: ag71xx_mdio: probed
[ 1.370000] ag71xx-mdio.1: Found an AR7240/AR9330 built-in switch
[ 1.400000] eth0: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[ 1.990000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd041, driver=Generic PHY]
[ 2.000000] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[ 2.000000] TCP: cubic registered
[ 2.000000] NET: Registered protocol family 17
[ 2.010000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[ 2.020000] Bridge firewalling registered
[ 2.030000] 8021q: 802.1Q VLAN Support v1.8
[ 2.030000] bootconsole [early0] disabled
After connecting an Ethernet cable, did you try?
telnet 192.168.1.1 from another terminal. (not serial)
Otherwise, check this:
https://forums.xilinx.com/t5/Embedded-Linux/bootconsole-earlycon0-disabled/m-p/749298#M18595
Anyhow, the best advice would be to replace flash and ram, to release the potential of the device. Check here software mods, hardware mods and DIY from a similar device:
https://oldwiki.archive.openwrt.org/toh/tp-link/tl-wr703n