OpenWrt for Zyxel WSM20 (Multy M1) development discussion

For Developers
2

opening of the case
side above
unclip at the back with an object like a mediator

843805f492a38013f2ac68eacd329b43f076dc69_2_666x500

serial port 115200 -> 3.3volts nothing, white RX -> TX , green TX -> RX , black GND

20230313_171741
20230313_1717411920×1440 231 KB

Startuo log

You can interrupt startup with f key ( not found login / password )

Loading from nand0, offset 0x2c00000
Fit image detected...
FIT description: MIPS OpenWrt FIT (Flattened Image Tree)
Image 0 (kernel@1)
Description: MIPS OpenWrt Linux-4.4.198

U-Boot 1.0.3 (Jul 29 2021 - 06:23:57)
CPU: MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 1200MHz, Bus: 220MHz, XTAL: 40MHz
Model: MediaTek MT7621 reference board (NAND)
DRAM: 256 MiB
NAND: 128 MiB

3

This is definitelly great

U-Boot 1.0.3 (Jul 29 2021 - 06:23:57)

CPU:   MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 1200MHz, Bus: 220MHz, XTAL: 40MHz
Model: MediaTek MT7621 reference board (NAND)
DRAM:  256 MiB
NAND:  128 MiB

Maybe just with such user and password we could be sysupgrading straight from the U-Boot.

What happens if you interrupt with f

Can you send help command?

4

Is there anything in the NWA50AX Wiki that can help?

6

Post the output.

1 Like
9

interrupt uboot, post the output from help, and printenv.

FYI I've requested the M1 specific posts to be split from this thread, they're off topic.

10

It's true, but it would be great to know more about all the specs as in the ToH

I would say:

Bootloader: U-Boot 99,99%
Flash: 128Mb???
RAM: 256Mb???
Ethernet ports (100mb/1Gb): 1 WAN Gb and 3 LAN Gb

For me it looks the best future proof budget solution so far.

With the hype I'm seriously tempted on purchasing the pack of 3. They are absurdly cheap. Almost the same price as the shitty TP-Link TL-WR741 4/32 but we are talking about a killer AX1800 that may probably blast 90% of the current's ToH inventory (at least for a Dumb AP).

Given that 99,99% of the components have been already developed, only would like to see if the U-Boot can be halted and if it has some convenient way of flashing other than straight from UART (for dev is fine but for daily driver is a pain in the ass for me). But it seems that OEM factory images could be uploaded straight from Zyxel interface, which makes this amazing.

Also note that ZyXEL NR7101, NWA55AXE, NWA50AX has the exact same software and all three support 22.03.3

Also ZyXEL NR7101 is an amazing piece of hardware, which gives me some extra confidence on this budget APs.

1 Like
11

the boot log should reveal most of this, unless the output's supressed.

you could also see if you can find the info based on the markings, on the chips, on the PCB.

1 Like
12

Dude, I've bought the pack out of pure hype. I've been reviewing hardware specs and for $20-$25 per unit, it's crazy!

As soon as they arrive i'm going all in :slight_smile:

Anyway, to avoid keep on going on dev topics for this device, I've opened a more appropiate thread.
https://forum.openwrt.org/t/openwrt-for-zyxel-multy-m1/

13

@Annick interrupt earlier, try hard reboot of the Zyxel and keep pressing ESC or space way way earlier in the uboot process.

14

or keep pressing the reset or WDS button while power it on, and watch the serial while doing so.

1 Like
16

@Annick if you unplug GND just after boot can you interrupt uboot?

I had an issue on the belkin rt1800 where I had to boot with GND unplugged and attach GND afterwards to break into uboot

17

You are not in bootloader, you are straight with that ZyXEL custom OpenWRT fully loaded.

I believe that you need to interrupt bootloader within the first second of loading. You can just reboot from OpenWRT and then start pressing keys like mad (possibly ENTER)

Can you check if sysupgrade command works within that custom OpenWRT?

18

In failsafe ode ( key f ) i can run sysupgrade & mtd

cat/proc/mtd
dev:    size   erasesize  name
mtd0: 07f80000 00020000 "All"
mtd1: 00100000 00020000 "Bootloader"
mtd2: 00100000 00020000 "Ubootenv"
mtd3: 001c0000 00020000 "Factory"
mtd4: 02800000 00020000 "firmware_now"
mtd5: 00380000 00020000 "kernel"
mtd6: 02440000 00020000 "rootfs"
mtd7: 02800000 00020000 "firmware"
mtd8: 00100000 00020000 "persist"
mtd9: 00400000 00020000 "rootfs_data"
mtd10: 025c0000 00020000 "app"
mtd11: 00100000 00020000 "crt"
mtd12: 02800000 00020000 "RAS1"
mtd13: 02800000 00020000 "RAS2"
root@(none):/#

Too bad there is no USB

Problem is login & password in not failsafe mode

19

This is more than enough.

Now its time to develop a firmware.

It would be great to find a TFTP in case we screw and brick the device

Will need to try the classic TFTP setups

20

still think you should check if the external buttons trigger some kind of recovery, then you wouldn't need to open the device for flashing.

22

try another usb adapter or check the cable, or play with tx and rx

23

I assume there's output, but u-boot ignores the buttons ...

24

If he has the right output in the COM why do you think that playing with TX and RX would be a thing?

Why would you interrupt the output if he already can access failsafe mode? There must be a TFTP already running from there.

Can you do a ps to see which processes are running in failsafe?

25

Not what I'm saying/want.
I want to try to trigger a recovery w/o opening the device, but it seems to be a dead end.

If you're already in openwrt, there's no TFTP, TFTP is used by uboot, if you can figure out the access.

26

I have to review it by myself when they come to the office. But from what I've read since this is already using openwrt, I think they use in their main UI the basic openwrt upgrading commands, so I think that you can basically flash straight from there.

What I'm not confident if it would be possible to trigger a TFTP without soldering.