This commit adds the basic elements to support Poray brand routers.
It contains a tool to do the encryption/obfuscation that is used in
Poray routers.
Support for Poray devices was worked on by:
Felix Kaechele <heffer@fedoraproject.org>
Luis Soltero <lsoltero@globalmarinenet.com>
Michel Stempin <michel.stempin@wanadoo.fr>
Signed-off-by: Felix Kaechele <heffer@fedoraproject.org>
SVN-Revision: 37635
Add Netgear WNCE2001.
This is a small RT3052 device with 4MB spi flash and 32MB ram.
2 built-in antennas, 1x fastE, no USB, reset & wps switch.
On my model the AP/RT switch is unpopulated, but I verified the gpio
mapping for it.
The stock firmware is running an unprotected tftpd which allows you
to read any file from the filesystem.
Serial port is present on testpads (See image on the wiki page).
There are more testpads below the shield near the SoC, which
may have JTAG.
Slight annoyance: The bootloader is checksumming kernel&rootfs, but
can be tricked by zeroing checksum and length fields in the checksum
partition, see
target/linux/ramips/base-files/lib/preinit/04_disable_wnce2001_flash_checksumming
The manufacturer image is very similar to the DAP one, so I slightly
modified mkdapimg to support generating it.
The resulting
openwrt-ramips-rt305x-wnce2001-squashfs-factory-(worldwide|northamerica).bin
can be used to flash from stock to OpenWRT using the stock firmware
upgrade function, without using the serial port.
http://www.netgear.com/landing/wnce2001.aspxhttp://wiki.openwrt.org/toh/netgear/wnce2001
Signed-off-by: Tobias Diedrich <ranma+openwrt@tdiedrich.de>
SVN-Revision: 36289
Based on the following patch:
http://patchwork.openwrt.org/patch/3043/
Signed-off-by: Cezary Jackiewicz <cezary.jackiewicz@gmail.com>
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
SVN-Revision: 34781
While the disadvantage is less available flash space, it's easy and
safe to flash without opening the device.
Going back to the original firmware is also possible.
This patch add two firmware utilities, mkbrncmdline and mkbrnboot.
mkbrncmdline patches the uncompressed kernel so the registeres a0 to
a3 are initialized and the memory size is passed in.
mkbrnboot takes the lzma compressed kernel and squashfs images and
creates a firmware image that can be flashed using the BRN-BOOT
recovery kernel, which is booted by holding both buttons when
powering up the device and will listen on http://192.168.2.1.
The firmware file from bin/lantiq/ to use is
openwrt-lantiq-danube-ARV4525PW-BRNDTW502-brnImage
The BRN-BOOT recovery kernel does size-check the image, so if it's
too big to fit into flash it will complain accordingly.
A second patch is needed to make the wired network interface work
since there is no u-boot to pre-initialise it.
Signed-off-by: Tobias Diedrich <ranma+openwrt@tdiedrich.de>
SVN-Revision: 30532
Gabor Juhos