OpenWrt Forum Archive

Topic: P-2812HNU-F1 (vs P-2812HNU-F3, P-2812HNU-51c, P-2812HNUL-F1)

The content of this topic has been archived on 13 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi all, I am DGDodo from the Netherlands.
New to this forum, but have some knowledge about firmware running devices.
I found an older DSL/modem/router from Zyxel P-2812HNU-F1, but running 4 x 1GBps LAN.
Looks familiair with P-2812HNU-F3, with are build on other Hardware then the 51c version (thx to Mijzelf).

As far as outside, the box seems almost dead.

When only providing power to the device, the following LED sequence is show:
  1 sec INET, DSL, POWER, WLAN
10 sec continues LED P2, with 10 times POWER flashing.
  1 sec INET, DSL, POWER, WLAN
And next all LEDs are off.

LEDS:
-----
USB1 USB2 P1 P2 Inet WAN DSL E1 E2 E3 E4 POWER WLAN/WPS

According user manual (P-2812HNU-F1_1.00.pdf), if all leds are off, there is no power, lol
Somebody knows what could cause this?
Could be, that the device was flashed with special ISP FW that if no DSL cable attached the device goed off?

Only when connect a device eth1 (E1), the corresponding LED lits nicely up.
This works only for E1 and E2, NOT E3 and E4? E3 and E4 also show 'no connection' when connected to an laptop. E1 and E2 try to get ip, E3 and E4 show 'Network Cable Unplugged'.
There's is also no DHCP server active on E1 or E2...

Searching around, I found an internal serial connector, as you can read here:
http://wiki.openwrt.org/toh/zyxel/p2812hnu-f3 (and i fixed the link on the hardware table:)
Although the picture there shows an F3 version, my F1 has the same serial connector.

Searching further, i found:

Type                    NAND                 ECC
P-2812HNU-F3    K9F1G08U0B    1bit/512Bytes    LINK
P-2812HNU-F1    K9F1G08U0D    1bit/528bytes    LINK
P-2812HNUL-F1  ??                      ??                        ??
P-2812HNU-51c  (Build on Broadcom CPU, F1 & F3 on Lantiq CPU)

NAND's are different in ECC checking! So NOT compatible if the kernel (or other boot part) uses this, i guess. I do not know which NAND is used in P-2912HNUL versions, although all FW of all 4 devices is availbale at http://ftp2.zyxel.com/ (with Java enabled, anonymous)

Trying to make page at openwrt, which my pictures and findings about the F1 version.
(http://wiki.openwrt.org/toh/zyxel/p2812hnu-f1)

And not having the serial TTL converter (yet), i can measure there's activity on that serial port...

Being continued ...

(Last edited by DGDodo on 17 May 2014, 22:24)

My P-2812HNU-F1
p2812_outside

As also be seen at: http://wiki.openwrt.org/toh/zyxel/p2812hnu-f1

consist of the following components:

memory        K9F1G08U0D        1bit/528bytes    LINK
WiFi              RT3062f                300Mbps            LINK
telephone     PEF42068             2xFXS                LINK
LAN/WAN      PSB80190             VRX208              LINK

pics:
p2812_chipS
p2812_Ralink
p2812_lantiq2
p2812_lantiq1


The LAN/WAN chipset has 4 x 100Mbps OR 2 x 1Gbps, hopefully these are the 2 still working, E1 and E2 smile

Regards, DG.

(Last edited by DGDodo on 13 May 2014, 20:57)

all i can say about your device based information that you give that looks like it is dead.
i dont be surprised if you have nothing in console while power on if you connect console cable.

(Last edited by zerg on 12 Dec 2013, 19:24)

Zerg,

I assume you read about the flashing led's and 'not having the serial TTL converter (yet), i can measure there's activity on that serial port...' Still think nothing will be shown on serial port?
I can see rubish (with 5V serial), wont try 12V serial tongue
Just hope there's some life in it to flash it, 1 way or another.
Regards, DG.

Ok, got my TTL serial cable!
Nicely running 115200,8,n,1(,n).
And ... a second, working P-2812HNU-F1 (only also this one does not give ipadres or is accessible without DSL connected).
After installing the appropriate serial drivers, the following is seen on my (zerg said:) 'dead', P-2812HNU-F1:

ROM VER: 1.0.5
CFG 06
NAND
NAND Read OK

ROM VER: 1.0.5
CFG 06
NAND
NAND Read OK
DDR Access auto data-eye tuning Rev 0.3a
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...



ZyU-F02-300-20AA003-V3.06|03/31|2011(TUE)

CLOCK CPU 500M RAM 250M
DRAM:  128 MB

 relocate_code start
 relocate_code finish.
128 MiB
*** Warning - bad CRC or NAND, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   fw_addr=0xa0200000
Internal phy(GE) firmware version: 0x020c
setup MDIO for new GPHY
vr9 Switch
Hit any key to stop autoboot:  0

NAND read: device 0 offset 114688, size 65536 ...  65536 bytes read: OK
## Starting application at 0x86A80000 ...


Z-LOADER 3.0(Mar 31 2011)

NAND flash block size: 0x20000
Dual image: Both OK! upgcnt1=0 upgcnt2=1
Select 2nd zboot image...
go 0x86a90000
## Starting application at 0x86A90000 ...


Z-Boot 3.0.0(Dec 29 2011)

we get zloader version: 3.0
Hit any key to stop autoboot:  

So ... it's not dead at all!

Strange thing, I see twice the message: "Hit any key to stop autoboot:".
Only on the second message you can break the autoboot proces ('Z-BOOT').
This means, normally the 'Z-LOADER' is always loaded, i guess.
Why is the device using the 2nd zboot image, and not the 1st? I dont know.

Correct me if I am wrong:
- CPU 500MHz,  256 MB Ram and 128 MB DRAM?


If i dont stop the autoboot proces, the device tries to boot and following is shown:

no ROMD partition
MRD_CERT_1 check=0
MRD_CERT_2 check=0


 Read Kernel to RAM from 2f80800
bootargs=root=/dev/mtdblock1 console=ttyS0,115200 phym=128M mem=126M panic=1 vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=1
## Booting image at 80800000 ...
   Image Name:   MIPS Linux-2.6.20
   Created:      2011-12-29   8:40:42 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1298116 Bytes =  1.2 MB
   Load Address: 80002000
   Entry Point:  803b3000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 803b3000) ...
## Giving linux memsize in MB, 128

Starting kernel ...

Infineon xDSL CPE VR9
mips_hpt_frequency = 250000000, counter_resolution = 2
Linux version 2.6.20.19
 (jiuan@holyBuild) (gcc version 4.3.3 (GCC) ) #21 Thu Dec 29 16:40:32 CST 2011
phym = 08000000, mem = 07e00000, max_pfn = 00007e00
Reserving memory for CP1 @0xa7e00000, size 0x00200000
CPU revision is: 00019555
Determined physical RAM map:
User-defined physical RAM map:
 memory: 07e00000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists.  Total pages: 32004
Kernel command line: root=/dev/mtdblock1 console=ttyS0,115200 phym=128M mem=126M panic=1 vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=1 
1 MIPSR2 register sets available
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
Lantiq ICU driver, version 3.0.1, (c) 2001-2010 Lantiq Deutschland GmbH
PID hash table entries: 512 (order: 9, 2048 bytes)


cycles_per_jiffy = 2500000
Using 250.000 MHz high precision timer.
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 123520k/129024k available (2986k kernel code, 5472k reserved, 788k data, 180k init, 0k highmem)
Security Framework v1.0.0 initialized
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Lantiq PCI host controller driver, version 1.1.9, (c) 2001-2010 Lantiq Deutschland GmbH
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 4096 bind 2048)
TCP reno registered
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 118
gptu: succeeded to request irq 119
gptu: succeeded to request irq 120
gptu: succeeded to request irq 121
gptu: succeeded to request irq 122
gptu: succeeded to request irq 123
IFX DMA driver, version ifxmips_dma_core.c:v1.0.10 
,(c)2009 Infineon Technologies AG
Lantiq CGU driver, version 1.0.11, (c) 2001-2010 Lantiq Deutschland GmbH
Wired TLB entries for Linux read_c0_wired() = 0
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (SUMMARY)  (C) 2001-2006 Red Hat, Inc.
yaffs Dec 29 2011 16:36:05 Installing. 
Infineon Technologies DEU driver version 1.0.1 
IFX DEU DES initialized (multiblock).
IFX DEU AES initialized (multiblock).
IFX DEU ARC4 initialized (multiblock).
IFX DEU SHA1 initialized.
io scheduler noop registered (default)
ifx_pmu_init: Major 252
Lantiq PMU driver, version 1.1.4, (c) 2001-2010 Lantiq Deutschland GmbH
Lantiq GPIO driver, version 1.2.12, (c) 2001-2010 Lantiq Deutschland GmbH
Infineon Technologies RCU driver version 1.0.6 
Lantiq LED Controller driver, version 1.0.4, (c) 2001-2010 Lantiq Deutschland GmbH
MEI CPE Driver, Version 1.1.0

<6>(c) Copyright 2009, Infineon Technologies AG

<6>### MEI CPE - MEI CPE - MEI CPE - MEI CPE ###

<6>ttyS0 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC
Lantiq ASC (UART) driver, version 1.0.5, (c) 2001-2010 Lantiq Deutschland GmbH
RAMDISK driver initialized: 1 RAM disks of 6144K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
IFX SWITCH API, Version 1.1.6
SWAPI: Registered character device [switch_api] with major no [81]
Switch API: PCE MicroCode loaded !!
Switch Auto Polling value = 0
GPHY FW load for A1x !!
GPHY FIRMWARE LOAD SUCCESSFULLY AT ADDR : 400000
IFX GPHY driver GE Mode, version ifxmips_vr9_gphy: V0.7 - Firmware: 8304
Checking PHY LED States!!

ifx_nand_init
Probe for NAND flash...
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 24 at 0x00300000
Creating 7 MTD partitions on "ifx_nand":
0x000e0000-0x01ee0000 : "rootfs,kernel1"
0x01ee0000-0x03ce0000 : "rootfs,kernel2"
0x03ce0000-0x047a0000 : "telenor"
0x047a0000-0x07460000 : "firmware"
0x07460000-0x07f00000 : "config"
0x07f00000-0x07f40000 : "mrd_cert1"
0x07f40000-0x07f80000 : "mrd_cert2"
Lantiq SSC driver, version 2.2.2, (c) 2001-2010 Lantiq Deutschland GmbH
pegasus: v0.6.14 (2006/09/27), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new interface driver pegasus
Registered led device: ledc_0
Registered led device: ledc_1
Registered led device: ledc_2
Registered led device: ledc_3
Registered led device: ledc_4
Registered led device: ledc_5
Registered led device: ledc_6
Registered led device: ledc_7
Registered led device: ledc_8
Registered led device: ledc_9
Registered led device: ledc_10
Registered led device: ledc_11
Registered led device: ledc_12
Registered led device: ledc_13
Registered led device: ledc_14
Registered led device: ledc_15
Registered led device: ledc_16
Registered led device: ledc_17
Registered led device: ledc_18
Registered led device: ledc_19
Registered led device: ledc_20
Registered led device: ledc_21
Registered led device: ledc_22
Registered led device: ledc_23
Lantiq LED driver, version 1.0.15, (c) 2001-2010 Lantiq Deutschland GmbH
Mirror/redirect action on
u32 classifier
    Performance counters on
    input device check on 
    Actions configured 
nf_conntrack version 0.5.0 (1008 buckets, 8064 max)
nf_ct_ftp: registering helper for pf: 2 port: 21
nf_ct_ftp: registering helper for pf: 10 port: 21
ip_conntrack_rtsp v0.6.21 loading
ZLD: zy_sm_init() register hooks successful.
GRE over IPv4 tunneling driver
ip_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_time loading
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
ebt_ulog: not logging via ulog since somebody else already registered for PF_BRIDGE
NET: Registered protocol family 8
atmpvc_init() failed with -17
lec.c: Dec 29 2011 16:37:55 initialized
mpc.c: Dec 29 2011 16:37:52 initialized
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>
yaffs: dev is 32505857 name is "mtdblock1"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.1, "mtdblock1"
Time: MIPS clocksource has been installed.
yaffs: auto selecting yaffs2
yaffs_read_super: isCheckpointed 0
VFS: Mounted root (yaffs filesystem) readonly.
Freeing unused kernel memor
init started: BusyBox v1.10.4 (2011-12-29 16:57:15 CST)

starting pid 162, tty '': '/etc/init.d/rcS'
Algorithmics/MIPS FPU Emulator v1.5
Run init.d/rcS!
Trying to mount NAND flash as YAFFS2 for configuration files
yaffs: dev is 32505860 name is "mtdblock4"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.4, "mtdblock4"
Checkpoint read object 1 type 0 chunk 2689 does not match existing object type 3
yaffs tragedy: Bad object type, 2097152 != 3, for object 1 at chunk 2886 during scan
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs_read_super: isCheckpointed 0
CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 80101c08, ra == 8010117c

This device looks to have corrupted code to run. Device ends with no LED's on, and no prompt on serial port sad .
So beter try to fix this device first.

I can however also break the autoboot, by pressing any key.
"Next, I will follow the unbrick process descibed by asmartin, to get this device running original ZyXEL's firmware.
1st I'll leave boatloader the same, and try to flash device with next -original- firmware:

ZyXEL P-2812HNUL-F1 OBM
3.10(TUJ.0)C0
Release Note
Date: May 4, 2011
Supported Platforms:
ZyXEL P-2812HNUL-F1/P-2812HNU-F1
Versions:
Bootbase version: ZyU-F02-300-20AA003-V3.04|04/01|2011(TUJ)
Firmware version: 3.10(TUJ.0)C0
DSL code version: AnnexA_53.26.16.53.3B.11
WLAN code version: RT3062_LinuxAP_V2.3.0.0
Voice code version: 3.11.0 IFX TAPI

Before I (we) try to build openWRT version for these devices, for example, I don't need the 'Voice code' at all in my configuration smile .


Just more info:

When stopping the autoboot proces, we end up having the following command choices (just press ENTER):
(LED P2 stays on, POWER flashes)

ZHAL>
ATBT    x         block0 write enable (1=enable, 0=disable)
ATWM    x         set MAC address in working buffer
ATEN    x,(y)     set BootExtension Debug Flag (y=password)
ATSE    x          show the seed of password generator
ATWZ    a(,b,c)   write ZyXEL MAC addr, Country code, EngDbgFlag
ATCB              copy from FLASH ROM to working buffer
ATCL              clear working buffer
ATSB              save working buffer to FLASH ROM
ATBU              dump manufacturer related data in working buffer
ATSH              dump manufacturer related data in ROM
ATCO    x         set country code in working buffer
ATFL    x         set EngDebugFlag in working buffer
ATVD    x         set vendor name in working buffer
ATPN    x         set product name in working buffer
ATFE    x,y,...   set feature bits in working buffer
ATSN    x         set serial number in FLASH ROM
ATTL              MRD_CERT & ROM-D partition utility
ATGO              boot up whole system
ATGU              go back to U-Boot command line mode
ATRT    (x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations
ATMI    x         Enable/Disable model ID checking (1=enable, 0=disable)
ATMT    x         reduce manufacture bootup time for wireless calibration (1=enable, 0=disable)
ATUR    x         upgrade RAS image (filename)
ATUB    x         upgrade ZyU-Boot image (filename)

The ATSH command returns:

ZHAL> ATSH
ZLD   Version          : V3.10(TUE.3)
Bootbase Version       : V3.06|03/31|2011(TUE)
Vender Name            : ZyXEL Communications Corp.
Product Model          : P-2812HNU-F1
Serial Number          : S110Y280xxxxx
First MAC Address      : CC5xxxxx77F8
Last MAC Address       : CC5xxxxx77FF
MAC Address Quantity   : 08
Default Country Code   : FD
Boot Module Debug Flag : 00
RootFS      Checksum   : 000014c9
Kernel      Checksum   : 000077cb
RomFile     Checksum   : 00002080
Main Feature Bits      : 00
Other Feature Bits     :
          06 00 00 02 19 01 00 ff-f8 00 00 00 01 00 00 00
          00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00

(MAC and serial are changed!)


I'll keep everybody posted here smile

DG.

PS. Also have a virtual machine testing openWRT with LUCI, attitude Adjustment, r36088, on only 32MB!
Maybe with the right kernel and driver sets we could make openWRT running on these devices?

(Last edited by DGDodo on 30 Dec 2013, 19:18)

So far we reached step 9 of the unbrand manual.

step 10

Next ATSE command, for me:

ATSE P2812HNU-F1
AFCxxxxx77F8 (changed!)

--
step 11

Using 'http://www.tonycool.es/zyxel/zynpass_en.htm' the seed returns:
Seed:     AFCxxxxx77F8
Password: 11xxxxx3 (changed!)

--
step 12 + 13

Enable Debug Flag: ATEN 1,11xxxxx3
Unlock block0: ATBT 1

step 14

We leave bootblock unchanged, so only ATUR command!
ATUR 310TUJ0C0.bin

job ends:

done
Bytes transferred = 19992192 (1310e80 hex)
verify zboot ok
FW package is not correct

I also have the original 310TUJ0C0.rom file.
Maybe try both .rom and .bin file:

step 10: DB1xxxxx77F8 (changed!)
11xxxxx3  (changed!)

ATEN 1,11xxxxx3
ATBT 1

Again step 14, both bootrom and bin file:

ATUB 310TUJ0C0.rom returns:

ZHAL> ATUB 310TUJ0C0.rom
Using vr9 Switch device
TFTP from server 192.168.1.33; our IP address is 192.168.1.1
Filename '310TUJ0C0.rom '.
Load address: 0x80000000
Loading: #############################################################
done
Bytes transferred = 309737 (4b9e9 hex)
wrong image

and ATUR 310TUJ0C0.bin returns:

done
Bytes transferred = 19992192 (1310e80 hex)
verify zboot ok
FW package is not correct

So, no luck 1st time, DG.

DGDodo wrote:

So far we reached step 9 of the unbrand manual.

step 10

Next ATSE command, for me:

ATSE P2812HNU-F1
AFCxxxxx77F8 (changed!)

--
step 11

Using 'http://www.tonycool.es/zyxel/zynpass_en.htm' the seed returns:
Seed:     AFCxxxxx77F8
Password: 11xxxxx3 (changed!)

--
step 12 + 13

Enable Debug Flag: ATEN 1,11xxxxx3
Unlock block0: ATBT 1

step 14

We leave bootblock unchanged, so only ATUR command!
ATUR 310TUJ0C0.bin

job ends:

done
Bytes transferred = 19992192 (1310e80 hex)
verify zboot ok
FW package is not correct

I also have the original 310TUJ0C0.rom file.
Maybe try both .rom and .bin file:

step 10: DB1xxxxx77F8 (changed!)
11xxxxx3  (changed!)

ATEN 1,11xxxxx3
ATBT 1

Again step 14, both bootrom and bin file:

ATUB 310TUJ0C0.rom returns:

ZHAL> ATUB 310TUJ0C0.rom
Using vr9 Switch device
TFTP from server 192.168.1.33; our IP address is 192.168.1.1
Filename '310TUJ0C0.rom '.
Load address: 0x80000000
Loading: #############################################################
done
Bytes transferred = 309737 (4b9e9 hex)
wrong image

and ATUR 310TUJ0C0.bin returns:

done
Bytes transferred = 19992192 (1310e80 hex)
verify zboot ok
FW package is not correct

So, no luck 1st time, DG.

Hi DGDodo.

Try to reboot before uploading the bin file (rom file is not necessary, just to restore default settings from web or TFTP).

After uploading bin file, perform a factory reset (push and keep pushing reset button for 15-20 seconds,at least)

Regards

(Last edited by asmartin on 30 Dec 2013, 22:16)

asmartin,

Do not exactly understand what you mean by: 'Try to reboot before uploading ...', the router itself ?
Anyway, I got it working!

--
Ok, I tried the original firmware 311TUJ0C0.bin upgrading better than down? smile
Same results as before, no luck, also with the rom file.
It looks alot, the current firmware cannot use 'ATMI 0', the device reboots. The 'Boot Module Debug Flag' cannot be set to '01', it stays on '00'.
--
Lost some of the logs, dont know why (probably i opened the log 4 any reason, and then there was nothing written : )

Some times it did not work (You see the typo ... atur instead of atub, hehehe):

ZHAL> atur 304TUJ.bm
atur from 0x80000000 load 304TUJ.bm
Using vr9 Switch device
TFTP from server 192.168.1.33; our IP address is 192.168.1.1
Filename '304TUJ.bm'.
Load address: 0x80000000
Loading: *###########################
done
Bytes transferred = 135168 (21000 hex)
verify zboot fail

But 1 time:

ZHAL> ATSE P2812HNU-F1
4E0F040A77F8
ZHAL> aten 1,1170BB63
ZHAL> ATBT 1
ZHAL> ATUB 304TUJ.bm
Using vr9 Switch device
TFTP from server 192.168.1.33; our IP address is 192.168.1.1
Filename '304TUJ.bm'.
Load address: 0x80000000
Loading: *###########################
done
Bytes transferred = 135168 (21000 hex)
nand erase offset 0 length 20000
Erasing at 0x0 -- 100% complete.
OK

After this one, all reboots return:
ZyU-F02-300-20AA003-V3.04|04/01|2011(TUJ)
Bootbase Version       : V3.04|04/01|2011(TUJ)

instead of:
ZyU-F02-300-20AA003-V3.06|03/31|2011(TUE)
Bootbase Version       : V3.06|03/31|2011(TUE)

--

Downgraded bootloader to 3.04TUJ, great!

ZHAL> atsh
ZLD   Version          : V3.10(TUE.3)
Bootbase Version       : V3.04|04/01|2011(TUJ)
Vender Name            : ZyXEL Communications Corp.
Product Model          : P-2812HNUL-F1

Binary file still high level, bootcode from 3.06 to 3.04

Next the 'Boot Module Debug Flag' is standard '01', on, after each reboot? Dont forget to turn it off, sometime ...
Nevermind, now we can flash original 310TUJ0C0.bin from ZyXEL itself smile

ZHAL> atur 310TUJ0C) 0.bin
atur from 0x80000000 load 310TUJ0C0.bin
Using vr9 Switch device
TFTP from server 192.168.1.33; our IP address is 192.168.1.1
Filename '310TUJ0C0.bin'.
Load address: 0x80000000
..
done
Bytes transferred = 19992192 (1310e80 hex)
verify zboot ok
verify image ok
IMG_TYPE_ZBOOT
try erase partition: offset:20000, size: 20000, write size: 21000
nand erase offset 20000 length 20000

Erasing at 0x20000 -- 100% complete.
OK
Rebuild sysconfig... nand erase offset 7420000 length aa0000

Erasing at 0x7420000 --   1% complete.
Erasing at 0x7440000 --   2% complete.
Erasing at 0x7460000 --   3% 
..
complete.
Erasing at 0x7ea0000 -- 100% complete.
OK
Rebuild firmware partition... nand erase offset 4760000 length 2cc0000

Erasing at 0x4760000 --   0% complete.
Erasing at 0x47c0000 --   1% complete.
Erasing at 0x4840000 --   2% 
..
<router reboots>

Although model changed to P-2812HNUL-F1? Also for the ATSE commmand?
But not in the web interface! (weird stuff from the builders, lol)

We only lost the follow command in AT list:
ATMT    x         reduce manufacture bootup time for wireless calibration (1=enable, 0=disable)
Don't know the funtionality of this option (yet).

Changed the SN back to original, but (again weird) only the last 3 words of the MAC addreses changes back after command.

Now check functionality running ATGO command (continue boot).
Runs further then before wink
Got to router login,  euh, name & password?
Then I remember the 'Factory Default' reboot.
The password NEEDS to be reset, easiest way: by web GUI 192.168.1.1
Password already filled in (prob 1234), use admin as login.
Next page ask to change password for admin.

Everything working, Web interface, DSL, 3G, USB file or media shares.
Original 3.10 ZyXEL firmware active on formerly ISP locked and not working model ! 
Better than nothing!

Regards, DG

PS. I see this device has already nice interface and functionality, maybe I dont need openWRT on this one?

(Last edited by DGDodo on 31 Dec 2013, 15:44)

DGDodo wrote:

PS. I see this device has already nice interface and functionality, maybe dont need openWRT on this one?

Define 'need'. Of course it can work without Openwrt (btw, a big part of the firmware *is* Openwrt), else it wasn't sold as router. But the box can do *much more* than it currently does.
Further the stock firmware has some nasty edges. A TR069 daemon is running on the WAN port, without the possibility to switch it off. For USB storage only fat is supported. For file transfer only samba and ftp, both hardly configurable. The box doesn't support IPv6 tunnel providers.

Mijzelf, I needed one 1Gbps switch to make my home LAN fully 1Gbps, that was the need to get this device working at all smile
Perhaps OpenWRT because I don't need the DSL functionality, and the device was flashed with ISP firmware with no USB support, and only 2 Wifi channels.
Now I have the original firmware running, with 4 Wifi channels, USB support etc. Switched off the DSL and now use the WAN connectivity. So the need to build an openWRT version for this device gets less and less (for me).

Anyhow, I have another (same model) ZyXEL with can be used to test other firmware(s) ... And I have some more devices with 'locked ISP firmware' with need their original (maybe better: OpenWRT) firmware.

So I'll keep post my findings here.
Regards, DG.

(Last edited by DGDodo on 31 Dec 2013, 15:53)

Later then expected, but w(h)ell, better late then never smile

2nd device had also

ZyU-F02-300-20AA003-V3.06|03/31|2011(TUE)

But i messed up and have now 2 devices running:

ZyU-F02-300-20AA003-V3.04|04/01|2011(TUJ)

If somebody had the original 306TUE.bm file?  I'm looking for it tongue 
Or another (higher or lower) version would do for testing purposes.

Now testing with root access to update V3.10 to 1.00(AAC3)C0 using web interface.
...
This works fine, if you're fast enough upgrade your device.
It keeps the root password active (if you activated this before).


DG

(Last edited by DGDodo on 14 May 2014, 20:53)

A bit off-topic. I saw you mention the P-2812HNU-51c as a relative to the others. Well, you can scratch it. I have one, and it's a totally different beast:

$ cat cpuinfo
system type        : 96368MVWG
processor        : 0
cpu model        : BCM6368 V3.1
BogoMIPS        : 398.33
wait instruction    : no
microsecond timers    : yes
tlb_entries        : 32
extra interrupt vector    : no
hardware watchpoint    : no
ASEs implemented    :
VCED exceptions        : not available
VCEI exceptions        : not available

unaligned exceptions        : 2613452
$ cat meminfo
MemTotal:        59420 kB
MemFree:         23056 kB
Buffers:          2488 kB
Cached:          14916 kB
SwapCached:          0 kB
Active:          10232 kB
Inactive:        13440 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               0 kB
Writeback:           0 kB
AnonPages:        6292 kB
Mapped:           7124 kB
Slab:             6352 kB
SReclaimable:      552 kB
SUnreclaim:       5800 kB
PageTables:        496 kB
NFS_Unstable:        0 kB
Bounce:              0 kB
CommitLimit:     47536 kB
Committed_AS:    13112 kB
VmallocTotal:  1032148 kB
VmallocUsed:      3744 kB
VmallocChunk:  1027316 kB

Thanks for that info!
I'll change the 51c to a broadcom device (probably easier to run OpenWRT on that one).

DG.

Hi,
has anyone succesfully installed Openwrt on 51c?
If I wanted to install on my 51c, where do I have to look for an instruction?

calvxrr wrote:

Hi,
has anyone succesfully installed Openwrt on 51c?
If I wanted to install on my 51c, where do I have to look for an instruction?

As scapi wrote: https://forum.openwrt.org/viewtopic.php … 26#p264926
i also doubt there is anyone who did the OpenWrt trick on the 51c box.
It is build around a different CPU-base as the P-2812HNU(L)-F1 or F3.

You should check all hardware components (CPU, type of memory, switch-type, etc.) and see if these could make an OpenWrt version, as some system type: 96368MVWG, cpu model: BCM6368 do run OpenWrt, but i am NOT aware about other components, like memory or switch type.
But it will be a lot of: testing / 'tryl & error', before you have a good working OpenWrt version for a unknown box.

Ok, today if I have some time, I'll try to open my box and post some screenshots. If I wanted to install bin file, I do this via serial cable or via http of the router?

That is to be defined. There is no OpenWRT firmware for that box yet, so it's impossible to say how it should be installed.

But the odds that a first version can be installed over http is almost zero.

According to the Wiki there is no support for DSL, VOIP and NAND for the platform, so at best it will be an ordinary wireless router.

The discussion might have continued from here.