It is possible to add the Zyxel NWA1100-N support?
- https://www.dslreports.com/forum/r30273458-ZyXEL-NWA1100-N-Firmware-Recovery
- https://deviwiki.com/wiki/ZyXEL_NWA1100-N
From https://www.dslreports.com/forum/r30273458-ZyXEL-NWA1100-N-Firmware-Recovery
----------------------------------------------------------
U-Boot 1.1.4 (Jan 11 2011 - 18:46:16)
PB93 (ar7241 - Virian) U-boot
DRAM:
sri
#### TAP VALUE 1 = 0x2, 2 = 0x2 [0x75555155: 0x55777577]
64 MB
id read 0x100000ff
flash size 8MB, sector count = 128
In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize...
No valid address in Flash. Using fixed address
eth0: 00:03:7f:09:0b:ad
ATHRF1E: Port 0, Negotiation timeout
eth0
----------------------------------------------------------
Does anybody know parameters for three below U-Boot commands?
# Get an image from tftpserver
ar7240> tftp
# Erase flash memory
ar7240> erase
# Write the image to flash memory
cp.b
More details about memory mapping in NWA1100-N
ar7240> bdinfo
boot_params = 0x83F6BFB0
memstart = 0x80000000
memsize = 0x04000000
flashstart = 0x9F000000
flashsize = 0x00800000
flashoffset = 0x00038984
ethaddr = 00:AA:BB:CC:DD:EE
ip_addr = 192.168.0.35
baudrate = 115200 bps
Booting AR7240(Python)...
Linux version 2.6.31--LSDK-9.2.0.16 (leon@leon-Inspiron-620) (gcc version 4.3.3 (GCC) ) #1 Thu Nov 20 10:25:09 CST 2014
flash_size passed from bootloader = 8
arg 1: console=ttyS0,115200
arg 2: root=31:02
arg 3: rootfstype=jffs2
arg 4: init=/sbin/init
arg 5: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uImage),64k(configure),64k(mfg),64k(eeprom)
arg 6: mem=64M
# Get an image from tftpserver
ar7240> tftpboot 0x81000000 firmware.img
works OK
I am still wondering about flash erase first address (do not want to erase U-Boot or Linux image)
Erase flash memory
I guess that it can be
erase 0x9f020000 +0x58C8F9
Firmware 1.00(UJG.4)C0.img
size 5818617 bytes
0x58C8F9
Write the image to flash memory
cp.b 0x81000000 0x9f020000 0x58C8F9
arg 5 ( Flash Partition table ) passed to Linux kernel in more readable form
ar7240> mtdparts
device nor0 , # parts = 7
#: name size offset mask_flags
0: u-boot 0x00040000 0x00000000 0
1: u-boot-env 0x00010000 0x00040000 0
2: rootfs 0x00610000 0x00050000 0
3: uImage 0x00170000 0x00660000 0
4: configure 0x00010000 0x007d0000 0
5: mfg 0x00010000 0x007e0000 0
6: eeprom 0x00010000 0x007f0000 0
active partition: nor0,0 - (u-boot) 0x00040000 @ 0x00000000
defaults:
mtdids : nor0=ar7240-nor0
mtdparts: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uImage),64k(configure),64k(mfg),64k(eeprom)
For my understanding firmware should be located in rootfs partition.
Does someone more familiar with U-Boot can confirm that firmware in this particular case is located in rootfs partition?
Unfortunately I am not familiar with firmware update process and whether any translation is done on the fly or not.
ZyXEL Access Point NWA1100-N connected to PC serial port via external TTL to RS-232 Adapter Arduino.
PC Serial Port Settings:
Speed: 115200
Data bits: 8
Stop bits: 1
Parity: none
Row Control: none
ar7240> help
? - alias for 'help'
autoscr - run script from memory
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
bootvx - Boot vxWorks from an ELF image
chpart - change active partition
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
echo - echo args to console
erase - erase FLASH memory
ethreg - S26 PHY Reg rd/wr utility
exit - exit script
flinfo - print FLASH memory information
fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
go - start application at address 'addr'
help - print online help
iminfo - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
ls - list files in a directory (default /)
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing)
mtdparts- define flash/nand partitions
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
pci - list and access PCI Configuration Space
ping - send ICMP ECHO_REQUEST to network host
pll [] - Set to change CPU/AHB/DDR speeds
printenv- print environment variables
progmac - Set ethernet MAC addresses
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
req - FLASH,DRAM,GPIOtest
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
sntp - synchronize RTC via network
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
version - print monitor version
ar7240>
ar7240> printenv
bootcmd=bootm 0x9f660000
bootdelay=4
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
mfg_enable=1
bootversion=U-Boot 1.1.4
customer=ZyXEL
ethact=eth0
filesize=5c729e
fileaddr=82100000
netmask=255.255.255.0
fw_ver=V1.00(UJG.4)C0
serverip=192.168.0.36
ipaddr=192.168.0.35
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts =ar7240-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uImage),64k(configur e),64k(mfg),64k(eeprom)
mtdparts=mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uIm age),64k(configure),64k(mfg),64k(eeprom)
stdin=serial
stdout=serial
stderr=serial
Environment size: 628/65532 bytes
ar7240> imls
Image at 9F660000:
Image Name: Linux Kernel Image
Created: 2014-11-20 2:25:29 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 830637 Bytes = 811.2 kB
Load Address: 80002000
Entry Point: 801bcd50
Verifying Checksum ... OK