Engenius ECB9500

#1

Have an ECB9500, see page at https://wiki.openwrt.org/inbox/engenius/engenius_ecb9500 for some information.

Also seems to be known as ECB9750.

Similar hw to F5D8235-4 v1.

Working on porting LEDE/openwrt to it. Any help welcome :-).

0 Likes

How to have kernel use rootfs at another MTD partition or address
#2

uboot environment (printenv):

bootcmd=tftp
bootdelay=3
baudrate=57600
ethaddr="xx:xx:xx:xx:xx:xx"
preboot=echo;echo
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
kernel_addr=BFC40000
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
ethact=Eth0 (10/100-M)
sn=nnnnnnnnn
hw_ver=1.3.0
wanaddr=xx:xx:xx:xx:xx:xx
wlanaddr=xx:xx:xx:xx:xx:xx
op_mode=0
eth_en=0
domain=0
pro_id=000
country=000
hw_id=01010004
filesize=fdb10
fileaddr=8A800000
ipaddr=192.168.99.9
serverip=192.168.99.8
autostart=no
bootfile=uImageECB9500
storage_addr=0x1D0000
storage_size=0x80000
snextra=00000000000000000000
stdin=serial
stdout=serial
stderr=serial
0 Likes

#3

typing sn2450 by the console prompt gives shell access (via https://wiki.openwrt.org/toh/sitecom/wl-4001). here are some outputs.

BusyBox v1.7.5 (2010-07-19 09:47:32 CST) built-in shell (ash)


# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "Bootloader"
mtd1: 00010000 00010000 "Config "
mtd2: 00010000 00010000 "Factory"
mtd3: 00180000 00010000 "Kernel"
mtd4: 00080000 00010000 "storage"
mtd5: 00010000 00010000 "backup"
mtd6: 000b0000 00010000 "manufacture"
mtd7: 000e0000 00010000 "storage2"
mtd8: 00010000 00010000 "backup1"
mtd9: 00400000 00010000 "app"

# uname -a
Linux localhost.localdomain 2.4.30 #4 Mon Jul 19 09:48:35 CST 2010 mips unknown

# cat /proc/cpuinfo
system type             : Palmchip Surfboard
processor               : 0
cpu model               : unknown V6.12
BogoMIPS                : 266.24
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 16
extra interrupt vector  : yes
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available

# <tab><tab>
[                      ifdown                 rm
[[                     ifup                   rmgmt
apcfg_init             init                   rmmod
apps_init              insmod                 route
apps_init_ver.txt      ip                     rt2860apd
appscore_init_ver.txt  ipcs                   setconfig
arp                    iptables               sh
ash                    iwconfig               sleep
basename               iwpriv                 snmpd
brctl                  kill                   snmptrap
burn                   killall                sort
burna                  ln                     stty
burnb                  logger                 sync
burnf                  logserver              sysconf_cli
burnk                  ls                     sysconfd
busybox                lsmod                  sysctl
cat                    md5sum                 syslogd
chat                   mii_mgr                tail
chmod                  mkdir                  tar
cli                    mknod                  tc
cmp                    modprobe               test
config_term            mv                     tftp
cp                     netstat                time
date                   nice                   touch
df                     ntpclient              true
dl.sh                  opmode.sh              tty
dmapp.sh               pidof                  udhcpc
dmesg                  ping                   udhcpd
dnsmasq                poff                   umount
dropbear               pon                    uname
du                     poweroff               upnpd
dumpleases             pppd                   uptime
echo                   pppoe                  utelnetd
expr                   pppstats               uuidgen
ez-ipupdate            pptp                   vconfig
flashw                 printf                 wanmanager
fwmanager              processmanager         wc
grep                   ps                     wget
halt                   pwd                    wpa_cli
header                 raether                wpa_passphrase
httpd                  rateup                 wpa_supplicant
httpsd                 reboot                 wscd
id                     reset                  zebra
ifconfig               ripd
0 Likes

#4

Updated OEM firmware to latest I could find (2.3.3), here's the current output:

BusyBox v1.7.5 (2012-03-13 17:11:12 CST) built-in shell (ash)


# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "Bootloader"
mtd1: 00010000 00010000 "Config "
mtd2: 00010000 00010000 "Factory"
mtd3: 00180000 00010000 "Kernel"
mtd4: 00080000 00010000 "storage"
mtd5: 00010000 00010000 "backup"
mtd6: 000b0000 00010000 "manufacture"
mtd7: 000e0000 00010000 "storage2"
mtd8: 00010000 00010000 "backup1"
mtd9: 00400000 00010000 "app"

# uname -a
Linux localhost.localdomain 2.4.30 #4 Tue Mar 13 17:12:17 CST 2012 mips unknown

# cat /proc/cpuinfo
system type		: Palmchip Surfboard
processor		: 0
cpu model		: unknown V6.12
BogoMIPS		: 266.24
wait instruction	: no
microsecond timers	: yes
tlb_entries		: 16
extra interrupt vector	: yes
hardware watchpoint	: no
VCED exceptions		: not available
VCEI exceptions		: not available

# <tab><tab>
[                      ifconfig               ripd
[[                     ifdown                 rm
apcfg_init             ifup                   rmgmt
apps_init              init                   rmmod
apps_init_ver.txt      insmod                 route
appscore_init_ver.txt  ip                     rt2860apd
arp                    ipcs                   setconfig
ash                    iptables               sh
basename
0 Likes

#5

...and latest bootlog:

U-Boot 1.1.3 (Nov 20 2008 - 18:00:37)


Board: RT2880 DRAM:  32 MB

relocate_code Pointer at: 8bfa8000


 twe0 set to <NULL>


 toe0 set to <NULL>


 Default FLASH_CS1_CFG = 0511FFA1 


 Ready Set Value = 0x0511FFA1


 Setup FLASH_CS1_CFG = 0511FFA1 

 CAS 3 (D1835272) 


 EN_ID_29LV640H, Size = 00800000 bytes


 Set info->start[0]=BC000000


AMD Read Mode, flash reset,triger at BC000000

flash_protect ON: from 0xBC400000 to 0xBC42522F

protect on 64

protect on 65

protect on 66


  monitor protection ON by default,monitor_flash_len = 152112 


 ENV protection ON by default !! 

flash_protect ON: from 0xBC430000 to 0xBC43FFFF

protect on 67

 D-CACHE set to 4 way 

 I-CACHE set to 4 way 


 ##### The CPU freq = 266 MHZ #### 


 SDRAM bus set to 32 bit 

 SDRAM size =32 Mbytes


Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   5: Load ucos code to SDRAM via TFTP. 

 2  1  0 

   

3: System Boot system code via Flash.

## Booting image at bc450000 ...

   Image Name:   Linux Kernel Image

   Created:      2012-03-13   9:12:20 UTC


 System Control Status = 0x02910084 

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    1030357 Bytes = 1006.2 kB

   Load Address: 8a000000

   Entry Point:  8a196040

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 8a196040) ...

## Giving linux memsize in MB, 32


Starting kernel ...



THIS IS ASIC - VERSION B
ramsize = 32 MBytes
rambase not set, set to default (0x08000000)
MEMORY DESCRIPTOR dump:
[0,8a275cc0]: base<0a000000> size<02000000> type<Free RAM memory>
PROC INIT OK!


init started: BusyBox v1.7.5 (2012-03-13 17:11:12 CST)

starting pid 10, tty '/dev/console': '/sbin/config_init'
Config Init version: 2.3.3.471 date: 2012/03/13

starting pid 55, tty '/dev/ttyS1': '/sbin/config_term'
************************************************************************
*                                  ECB9500                             *
************************************************************************

KernelApp/Ramdisk Ver:2.3.3.471			 Date:2012/03/13
console> sh: cannot create /lib/modules/2.4.30/modules.dep: Read-only file system
ln: /sbin/./apps_init: File exists
ln: /sbin/./header: File exists
ln: /sbin/./httpsd: File exists
ln: /sbin/./mii_mgr: File exists
ln: /sbin/./opmode.sh: File exists
ln: /sbin/./raether: File exists
ln: /sbin/./reset: File exists
ln: /sbin/./udhcpd: File exists
sh: cannot create /proc/switch/power_status: nonexistent directory
sh: cannot create /proc/switch/power_status: nonexistent directory
sh: cannot create /proc/netpktconfig/config_interface: nonexistent directory
sh: cannot create /proc/netpktconfig/config_interface: nonexistent directory
2009-01-01 00:00:07, Rateup WARNING: rateup could not read the primary log file for eth2
2009-01-01 00:00:11, Rateup WARNING: rateup could not read the primary log file for ra0

old bootlog:

U-Boot 1.1.3 (Nov 20 2008 - 18:00:37)


Board: RT2880 DRAM:  32 MB

relocate_code Pointer at: 8bfa8000


 twe0 set to <NULL>


 toe0 set to <NULL>


 Default FLASH_CS1_CFG = 0511FFA1 


 Ready Set Value = 0x0511FFA1


 Setup FLASH_CS1_CFG = 0511FFA1 

 CAS 3 (D1835272) 


 EN_ID_29LV640H, Size = 00800000 bytes


 Set info->start[0]=BC000000


AMD Read Mode, flash reset,triger at BC000000

flash_protect ON: from 0xBC400000 to 0xBC42522F

protect on 64

protect on 65

protect on 66


  monitor protection ON by default,monitor_flash_len = 152112 


 ENV protection ON by default !! 

flash_protect ON: from 0xBC430000 to 0xBC43FFFF

protect on 67

 D-CACHE set to 4 way 

 I-CACHE set to 4 way 


 ##### The CPU freq = 266 MHZ #### 


 SDRAM bus set to 32 bit 

 SDRAM size =32 Mbytes


Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   5: Load ucos code to SDRAM via TFTP. 

 2  1  0 

   

3: System Boot system code via Flash.

## Booting image at bc450000 ...

   Image Name:   Linux Kernel Image

   Created:      2010-07-19   1:48:39 UTC


 System Control Status = 0x02910084 

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    1030015 Bytes = 1005.9 kB

   Load Address: 8a000000

   Entry Point:  8a196040

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 8a196040) ...

## Giving linux memsize in MB, 32


Starting kernel ...



THIS IS ASIC - VERSION B
ramsize = 32 MBytes
rambase not set, set to default (0x08000000)
MEMORY DESCRIPTOR dump:
[0,8a275ca0]: base<0a000000> size<02000000> type<Free RAM memory>
PROC INIT OK!


init started: BusyBox v1.7.5 (2010-07-19 09:47:32 CST)

starting pid 10, tty '/dev/console': '/sbin/config_init'
Config Init version: 2.2.7.445 date: 2010/07/19

starting pid 55, tty '/dev/ttyS1': '/sbin/config_term'
************************************************************************
*                                  ECB9500                             *
************************************************************************

KernelApp/Ramdisk Ver:2.2.7.445			 Date:2010/07/19
console> sh: cannot create /lib/modules/2.4.30/modules.dep: Read-only file system
ln: /sbin/./apps_init: File exists
ln: /sbin/./httpsd: File exists
sh: cannot create /proc/switch/power_status: nonexistent directory
sh: cannot create /proc/switch/power_status: nonexistent directory
sh: cannot create /proc/netpktconfig/config_interface: nonexistent directory
sh: cannot create /proc/netpktconfig/config_interface: nonexistent directory
0 Likes

#6

Have LEDE working on this device, thank G-d.

Wired not working -- computer port does not light up when its connected, changing VLAN switch settings to have port0 on vlan1 does not fix this).

Using modified F5D8235-4 v1 imgs (its GPIO modules (and USB modules?) must be removed, otherwise it will reboot when GPIOs are set up).

Flashed with serial and tftp...

Some GPIO values:

  • 0 = WPS button (0=pressed)
  • 10 = ? (when 1, ethernet port is on, when 0, off)
  • 12 = power LED (0=on)
  • 14 = reset button (0=pressed?) (setting this to be 0 resets the router!)
  • GPIOs 0-2,8,10,11,14,17-20 have starting value=1, remaining have value=0
  • WLAN LED can be controlled via /sys/class/leds/rt2800soc-phy0::radio/brightness 0=off, >=1=on
  • ngpio=24
0 Likes

#7

Current patch:

diff --git a/target/linux/ramips/base-files/etc/board.d/01_leds b/target/linux/ramips/base-files/etc/board.d/01_leds
index e01ba5f..295a03d 100755
--- a/target/linux/ramips/base-files/etc/board.d/01_leds
+++ b/target/linux/ramips/base-files/etc/board.d/01_leds
@@ -142,6 +142,10 @@ w306r-v20|\
 wt1520)
 	set_wifi_led "rt2800pci-phy0::radio"
 	;;
+ecb9500)
+	set_wifi_led "rt2800pci-phy0::radio"
+	ucidef_set_led_default "power" "power" "$board:green:power" "1"
+	;;
 dir-615-d|\
 dir-615-h1)
 	ucidef_set_led_default "status" "Status LED (amber)" "$board:amber:status" "0"
diff --git a/target/linux/ramips/base-files/etc/board.d/02_network b/target/linux/ramips/base-files/etc/board.d/02_network
index 9d3a9de..cb64674 100755
--- a/target/linux/ramips/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/base-files/etc/board.d/02_network
@@ -196,6 +196,7 @@ ramips_setup_interfaces()
 	pbr-d1|\
 	wli-tx4-ag300n|\
 	wmr-300|\
+	ecb9500|\
 	wn3000rpv3|\
 	wrh-300cr)
 		ucidef_set_interface_lan "eth0"
@@ -302,6 +303,7 @@ ramips_setup_macs()
 
 	case $board in
 	a5-v11|\
+	ecb9500|\
 	ht-tm02)
 		lan_mac=$(cat /sys/class/net/eth0/address)
 		;;
diff --git a/target/linux/ramips/base-files/etc/diag.sh b/target/linux/ramips/base-files/etc/diag.sh
index 5496137..f801cb4 100644
--- a/target/linux/ramips/base-files/etc/diag.sh
+++ b/target/linux/ramips/base-files/etc/diag.sh
@@ -136,6 +136,9 @@ get_status_led() {
 	f5d8235-v2)
 		status_led="$board:blue:router"
 		;;
+	ecb9500)
+		status_led="$board:green:power"
+		;;
 	f7c027|\
 	timecloud)
 		status_led="$board:orange:status"
diff --git a/target/linux/ramips/base-files/lib/ramips.sh b/target/linux/ramips/base-files/lib/ramips.sh
index 91ce5fb..17ae0e0 100755
--- a/target/linux/ramips/base-files/lib/ramips.sh
+++ b/target/linux/ramips/base-files/lib/ramips.sh
@@ -181,6 +181,9 @@ ramips_board_detect() {
 	*"E1700")
 		name="e1700"
 		;;
+	*"ECB9500")
+		name="ecb9500"
+		;;
 	*"ESR-9753")
 		name="esr-9753"
 		;;
diff --git a/target/linux/ramips/base-files/lib/upgrade/platform.sh b/target/linux/ramips/base-files/lib/upgrade/platform.sh
index 3245e2c..2739429 100755
--- a/target/linux/ramips/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ramips/base-files/lib/upgrade/platform.sh
@@ -52,6 +52,7 @@ platform_check_image() {
 	duzun-dm06|\
 	dwr-512-b|\
 	e1700|\
+	ecb9500|\
 	esr-9753|\
 	ew1200|\
 	ex2700|\
diff --git a/target/linux/ramips/dts/ECB9500.dts b/target/linux/ramips/dts/ECB9500.dts
new file mode 100644
index 0000000..f5dc8b8
--- /dev/null
+++ b/target/linux/ramips/dts/ECB9500.dts
@@ -0,0 +1,124 @@
+/dts-v1/;
+
+#include "rt2880.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	compatible = "ECB9500", "ralink,rt2880-soc";
+	model = "EnGenius ECB9500";
+
+/*
+	pci@440000 {
+		status = "ok";
+	};
+*/
+
+	cfi@1f000000 {
+		compatible = "cfi-flash";
+		reg = <0xbc400000 0x800000>;
+		bank-width = <2>;
+		device-width = <2>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "uboot";
+			reg = <0x0 0x30000>;
+			read-only;
+		};
+
+		partition@30000 {
+			label = "uboot-env";
+			reg = <0x30000 0x10000>;
+			read-only;
+		};
+
+		factory: partition@40000 {
+			label = "factory";
+			reg = <0x40000 0x10000>;
+			read-only;
+		};
+
+		partition@50000 {
+			label = "firmware";
+			reg = <0x50000 0x7b0000>;
+		};
+	};
+
+	gpio-keys-polled {
+		compatible = "gpio-keys-polled";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		poll-interval = <100>;
+
+		wps {
+			label = "wps";
+			gpios = <&gpio0 0 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio0 14 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		power {
+			label = "ecb9500:green:power";
+			gpios = <&gpio0 12 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&gpio0 {
+	status = "okay";
+
+	eth_enable {
+		gpio-hog;
+		gpios = <10 0>;
+		output-high;
+	};
+};
+
+&pinctrl {
+	state_default: pinctrl0 {
+		gpio {
+			ralink,group = "spi", "i2c", "jtag", "mdio", "uartlite";
+			ralink,function = "gpio";
+		};
+	};
+};
+
+
+&ethernet {
+	status = "okay";
+	mtd-mac-address = <&factory 0x4>;
+
+	port@0 {
+		mediatek,fixed-link = <1000 1 1 1>;
+		reg = <0>;
+	};
+
+	mdio-bus {
+		status = "okay";
+
+		phy0: ethernet-phy@1 {
+			compatible = "marvell,88e1116r";
+			phy-mode = "rgmii-id";
+			reg = <1>;
+		};
+	};
+};
+
+&wmac {
+	status = "okay";
+	ralink,mtd-eeprom = <&factory 0x0>;
+};
diff --git a/target/linux/ramips/image/rt288x.mk b/target/linux/ramips/image/rt288x.mk
index 86a5063..a1b6b85 100644
--- a/target/linux/ramips/image/rt288x.mk
+++ b/target/linux/ramips/image/rt288x.mk
@@ -30,6 +30,13 @@ define Device/ar725w
 endef
 TARGET_DEVICES += ar725w
 
+define Device/ecb9500
+  DTS := ECB9500
+  DEVICE_TITLE := EnGenius ECB9500
+  IMAGE_SIZE := $(ralink_default_fw_size_8M)
+endef
+TARGET_DEVICES += ecb9500
+
 define Device/f5d8235-v1
   IMAGE_SIZE := 7744k
   DEVICE_TITLE := Belkin F5D8235 V1
0 Likes

#8

Hi Hmm,

I'm interested to know how much you've got working on the ECB9500, and what is yet not quite working. I was going to put dd-wrt on there, but I can't find any success stories, nor any info how to re-flash the original firmware via serial to recover to the original. I did get serial link working after discovering the 57600 speed.

I have found as you mentioned, sn2450 gives a busybox prompt

I mis-remembered it, and discovered:
sn4200 gives a prompt of cmd>
(I couldn't think of any commands that worked)

Also I'm curious where you found the 2.3.3 firmware. The source I saw it looked legit but the downloads are all zero bytes. Source at engeniusnetworks.net The source at engeniusnetworks.COM is only 2.3.2.

I'm not sure how I can help you, but I'd be willing to test as long as I can recover to factory.

--Nate

0 Likes

#9

Apologies for the lengthy delay.

In short, everything but wired ethernet is working. The only time the ethernet works is when the device is powered on into bootloader, and a new firmware is flashed. This brings up/initializes the ethernet hardware, and the ethernet then works in LEDE until next reboot.

0 Likes