Port OpenWrt to ZyXEL NWA3560-N

I'd like to port OpenWRT to this access point. I have not gained serial console access yet, but it seems that the hardware is well supported (same CPU as EdgeRouter lite and ath9k radios). The other similarity with the EdgeRouter is that it has a 256 USB DOM, but I couldn't find a kernel in it, so it might be on the builtin flash memory. I have a DOM dump, but i cannot share it now because it contains credentials that I cannot share, but here's fdisk output:

Disk /dev/sdb: 245 MiB, 256901120 bytes, 501760 sectors
Disk model: ZyWALL_USG      
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Dispositivo Avvio  Start   Fine Settori   Size Id Tipo
/dev/sdb1             62   9919    9858   4,8M 83 Linux
/dev/sdb2           9920 150783  140864  68,8M 83 Linux
/dev/sdb3         150784 486079  335296 163,7M 83 Linux

and here is a tree of the last two file systems:

├── 49A0000.ext
├── 4D8000.ext
├── ext-root
│   ├── compress.img
│   ├── etc_writable
│   │   ├── ksyms
│   │   ├── ksyms_last
│   │   └── zyxel
│   │       └── conf
│   │           ├── __eps_checking_default.xml
│   │           ├── startup-config.conf.xml
│   │           ├── startup-config-device-ha.xml
│   │           ├── __system_default_device_ha.xml
│   │           └── __system_default.xml
│   ├── filechecksum
│   ├── filechecksum.tmp
│   ├── filelist
│   ├── fwversion
│   ├── fwversion.old
│   └── fwversion.tmp
└── ext-root-0
    └── etc
        ├── custmiz_image
        │   ├── custmiz_page.css
        │   └── logo
        └── zyxel
            └── ftp
                ├── cert
                │   ├── default
                │   ├── default.prv
                │   └── version
                ├── conf
                │   ├── lastgood.conf
                │   ├── startup-config.conf
                │   └── system-default.conf
                ├── Firmware
                ├── tmp
                │   ├── bbhangs_cnt1
                │   └── bbhangs_cnt2
                └── wtp_image
                    ├── cwinfo
                    ├── cw_ver
                    ├── self.img
                    └── _self.img.extracted
                        └── 0.zip

14 directories, 31 files

What can I do next?

Here are some board photos:
The disk on module:

The board:

My layman's suggestion would be to build a ramdisk image with the existing DTS (the kernel has a Cavium DTS that is used by the EdgeRouter Lite also), and see where that gets you for initial testing and research.

In your opinion, how can I boot the ramdisk? What do you think of the procedures in this PDF? https://mega.nz/file/TsxwSZwK#dq2f48TrtmNO9bqrIFE7lsLt7cY1L2zzxpwkA6gltCg (It is the upgrade guide)

Connect serial, see what the bootloader says, interrupt it if possible, load the initramfs image.

Thanks! I'll do it as soon as I can

Is there a way to proceed through JTAG? I don’t know the serial console pinout and I don’t know wether it’s ttl or rs232

Sorry I have no idea about that...

Hehe now everything is downhill (at least I hope so) because there’s an RS232 transceiver near the serial (mini DIN 6) port whose data sheet is this: https://mega.nz/file/CtoURKaC#ge_Y1MlemGqOnFn4FYEpo3pkbuIKbNOiKme9y_hlc8I

and that’s what I’ve found out

1 Like

So this is what I get from the console:

NWA3560-N> athe                                                                 
======= Debug Command Listing =======                                           
AT            just answer OK                                                    
ATHE          print help                                                        
ATSR          system reboot                                                     
ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)              
ATUK          upload kernel image to disk                                       
ATUR          Use ATUK to upload kernel                                         
ATBAx         change baudrate 1:38.4k 2:19.2k 3:9.6k 4:57.6k 5:115.2k           
ATGO          boot router                                                       
ATKZ(x)       show init switch or set to x                                      
ATSH          dump manufacturer related data in ROM                             
ATAC(x)       Apply startup configuration                                       
ATGT(x)       Go hardware test module                                           
NWA3560-N> atsh                                                                 
BootModule Version      :V1.16 | 08/31/2011 14:20:00                            
Vendor  Name            :ZyXEL Communications Corp.                             
Product Model           :NWA3560-N                                              
System  Type            :10                                                     
MAC Address             :mymac                                           
Default Country Code    :e1                                                     
Boot Module Debug Flag  :0                                                      
Hardware Version        :ZyXEL NWA3560-N CN50xx                                 
Serial  Number          :mysn                                          
SNMP MIB level  & OID   :060102030405060708091011121314151617181920             
Main Feature Bit        :0                                                      
Other Feature Bits      :                                                       
03 93 00 00 00 00 00 00-00 00 00 00 00 00 00 00                                 
03 00 00 00 00 00 00 00-00 00 00 00 00 00                                       

@Borromini as you can see above, the ATUK command should load the ramdisk, but the ATUR command (that should boot it) doesn't work.

There's a JTAG header onboard, can I use it to replace the bootloader with a more standard one?

@eutampieri: It will be interesting if it will be possible!

Have you progressed?

Note: The NWA3160-N is same but with only one WiFi card:

Good point for Console part!
Have you looked the JP4?
Where is on it?

Well, I haven’t made any progress, but I’m still interested!

Speaking of JP4, I’m not JTAG expert and I’m not even sure it’s JTAG, however I think we’d need a bootloader and I don’t know where to get one