EnGenius ESR900
Supported Versions
OEM source code available at: OEM Link (broken link) Mirror (Google Drive)
sha1sums:
- OEM file:
7b659370a03ea827ec0eccfcddefd51e9409d3af _20130712111828_33700.zip - Google Drive file:
2a48bd5e2982f94ca0641008806d67668dc74985 ESR900_GPL_RELEASE.tar.gz - Decompressed archive (same for both sources):
e9cd3f2329f83321078ed11762e63ee7086e59be ESR900_GPL_RELEASE.tar
Hardware Highlights
Installation
Flash Layout
| ESR900 Flash Layout | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| Layer0 | spi0.0: m25p80 16384KiB | ||||||||
| Layer1 | mtd0 u-boot 192KiB | mtd1 u-boot-env 64KiB | mtd9 firmware 14656KiB | mtd5 manufacture 1024KiB | mtd6 backup 64KiB | mtd7 storage 320KiB | mtd8 caldata 64KiB | ||
| Layer2 | mtd2 kernel 1408KiB | mtd3 rootfs 13248KiB | |||||||
| mountpoint | / | ||||||||
| filesystem | mini_fo/overlayfs | ||||||||
| Layer3 | mtd4 rootfs_data 10688KiB | ||||||||
| Size in KiB | 192KiB | 64KiB | 1408KiB | 2560KiB | 10688KiB | 1024KiB | 64KiB | 320KiB | 64KiB |
| Name | u-boot | u-boot-env | kernel | rootfs | rootfs_data | manufacture | backup | storage | caldata |
| mountpoint | none | none | none | /rom | /overlay | none | none | none | none |
| filesystem | none | none | none | SquashFS | JFFS2 | none | none | none | none |
OEM easy installation
This is the preferred method. Download the DLF file linked in the table above.
In the web administration interface of the device (by default at http://192.168.0.1, click “Tools”, then “Firmware”. On the firmware upgrade page, choose the DLF file you downloaded earlier, then click “Apply”. Your ESR900 will reboot into OpenWrt, and you will then be able to access the device via telnet at 192.168.1.1.
OEM installation using the TFTP method
Upgrading OpenWrt
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
LuCI Web Upgrade Process
- Browse to
http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/LuCI Upgrade URL - Upload image file for sysupgrade to LuCI
- Wait for reboot
Terminal Upgrade Process
After adding the device to the repository, correct the missing values in the commands.
- Login as root via SSH on 192.168.1.1
- Use the following commands to upgrade.
cd /tmp/ wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc sysupgrade /tmp/xxx.abc
- If sysupgrade does not support this router, use the following commands.
cd /tmp/ wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc mtd write /tmp/xxx.abc linux && reboot
Basic configuration
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
Specific Configuration
Interfaces
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| br-lan | LAN & WiFi | 192.168.1.1/24 |
| vlan1 (eth0.1) | LAN ports (1 to 4) | None |
| vlan2 (eth0.2) | WAN port | DHCP |
| wl0 | WiFi | Disabled |
| wl1 | WiFi | Disabled |
Switch Ports (for VLANs)
| Port | Switch port |
|---|---|
| CPU | 0 |
| LAN 4 | 1 |
| LAN 3 | 2 |
| LAN 2 | 3 |
| LAN 1 | 4 |
| WAN | 5 |
| WLAN (5 GHz) | 6 |
Failsafe mode
Buttons
→ hardware.button on howto use and configure the hardware button(s).
The EnGenius ESR900 has two buttons. They are Reset and WPS. Here, we merely name the buttons, so we can use them in the above Howto:
| BUTTON | Event |
|---|---|
| Reset | reset |
| WPS | wps |
I just guessed the names, I haven't actually gotten the real ones yet.
Hardware
Info
| Instruction set | MIPS |
|---|---|
| Vendor | Qualcomm Atheros |
| bootloader | U-Boot |
| System-On-Chip | QCA9558-AT4A Rev 2 |
| CPU @Frq | MIPS 74Kc Vers. ?.? @720MHz |
| Flash size | 16 MiB |
| Flash Chip | Macronix MX25L12845EMI-10G |
| RAM size | 128 MiB |
| RAM Chip | Nanya NT5TU32M16DG-AC |
| Wireless No1 | SoC-integrated: QCA9558-AT4A w/ 3×3 MIMO for 2.4GHz 802.11b/g/n |
| Wireless No2 | Discrete Chip: AR9580-AR1A w/ 3×3 MIMO for 5GHz 802.11a/n |
| switch | Atheros AR8327-BL1A (Gigabit, VLAN) |
| Modem | none |
| USB | Yes 1 x 2.0 |
| Serial | Yes |
| JTAG | No |
Photos
Front:
Back:
Opening the case
Note: This will void your warranty!
- To remove the case, first flip the router upside-down, so that you can see the four screws holding it together.
- Then, use a screwdriver to remove the screws.
- Pull the bottom casing away from the router (it might get stuck on the ethernet ports). Be sure not to lose the WPS button that will almost certainly fall out after removing the back case.
- You should now have access to all the important bits of the router. If you need to access the rest of it, just flip over the circuit board.
Serial
→ port.serial general information about the serial port, serial port cable, etc.
Photo of the serial header:
The pins, from left to right:
| 4 | 3 | 2 | 1 |
|---|---|---|---|
| Rx | Tx | GND | VCC (3.3V) |
The serial port on the ESR900 has a 4-pin 0.1“ header pre-soldered to the board, making connecting to it trivial. It uses 3.3V logic levels, so make sure your serial cable either only outputs 3.3V or has a 3.3V mode.
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
I don't think this router has any JTAG test points.
Debricking
Bootlogs
OEM bootlog
U-Boot 1.0.0 (Apr 9 2013 - 17:53:16) Product Name: ESR900 ap136 - Scorpion 1.0 DRAM:128 MB Now running in RAM - U-Boot at: 87fc8000 Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18 Flash size 16MB, sector count = 256 In: serial Out: serial Err: serial reset_switch: reset_usb: Multi Net: ath_gmac_enet_initialize... athrs_sgmii_res_cal: cal value = 0xe No valid address in Flash. Using fixed address ath_gmac_enet_initialize: reset mask:c02200 Scorpion ----> S17 PHY * : cfg1 0x80000000 cfg2 0x7114 eth0: <MAC ADDRESS REDACTED> athrs17_reg_init: complete eth0 up eth0 athrs17_disable_all_port Setting 0x18116290 to 0x60c0214f Please choose the operation: 1: Load system code to SDRAM via TFTP. 3: Boot system code via Flash (default). 1 0 3: System Boot system code via Flash. athrs17_set_portvlan_isolated complete ## Booting image at 9f040000 ... Image Name: Linux Kernel Image Created: 2013-06-20 11:33:36 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1839776 Bytes = 1.8 MB Load Address: 80002000 Entry Point: 802ad470 Verifying Checksum at 0x9f040040 ...OK Uncompressing Kernel Image ... OK Starting kernel ... Booting QCA955x init started: BusyBox v1.7.5 (2013-06-20 19:26:41 CST) starting pid 809, tty '/dev/console': '/sbin/config_init' mknod: /dev/ttyS0: File exists mknod: /dev/ttyS1: File exists Config Init version: 1.0.1.26 date: 2013/06/20 Tue Jan 1 00:00:00 UTC 2013 ln: /lib/./modules: File exists starting pid 869, tty '/dev/ttyS0': '/sbin/config_term' ************************************************************************ * ESR900 * ************************************************************************ KernelApp/Ramdisk Ver:1.0.1.26 Date:2013/06/20 password:
OpenWrt bootlog
U-Boot 1.0.0 (Apr 9 2013 - 17:53:16) Product Name: ESR900 ap136 - Scorpion 1.0 DRAM:128 MB Now running in RAM - U-Boot at: 87fc8000 Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18 Flash size 16MB, sector count = 256 In: serial Out: serial Err: serial reset_switch: reset_usb: Multi Net: ath_gmac_enet_initialize... athrs_sgmii_res_cal: cal value = 0xe No valid address in Flash. Using fixed address ath_gmac_enet_initialize: reset mask:c02200 Scorpion ----> S17 PHY * : cfg1 0x80000000 cfg2 0x7114 eth0: <MAC ADDRESS REDACTED> athrs17_reg_init: complete eth0 up eth0 athrs17_disable_all_port Setting 0x18116290 to 0x60c0214f Please choose the operation: 1: Load system code to SDRAM via TFTP. 3: Boot system code via Flash (default). You choosed 1 0 athrs17_enable_all_port 1: System Load Linux to SDRAM via TFTP. Please Input new ones /or Ctrl-C to discard Input device IP (192.168.99.9) ==:192.168.99.9 Input server IP (192.168.99.8) ==:192.168.99.8 Input Linux Kernel filename (uImageESR900C) ==:openwrt-ar71xx-generic-wlr8100-initramfs-uImage.bin dup 1 speed 1000 Using eth0 device TFTP from server 192.168.99.8; our IP address is 192.168.99.9 Filename 'openwrt-ar71xx-generic-wlr8100-initramfs-uImage.bin'. Load address: 0x80800000 Loading: *Got it ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ############################################ done Bytes transferred = 3882333 (3b3d5d hex) NetBootFileXferSize= 003b3d5d Automatic boot of image at addr 0x80800000 ... ## Booting image at 80800000 ... Image Name: MIPS OpenWrt Linux-3.10.36 Created: 2014-05-06 22:36:02 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 3882269 Bytes = 3.7 MB Load Address: 80060000 Entry Point: 80060000 Verifying Checksum at 0x80800040 ...OK Uncompressing Kernel Image ... OK Starting kernel ... [ 0.000000] Linux version 3.10.36 (cyrozap@The-Magic-Book) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r40698) ) #10 Tue May 6 18:35:27 EDT 2014 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 00019750 (MIPS 74Kc) [ 0.000000] SoC: Qualcomm Atheros QCA9558 rev 0 [ 0.000000] Clocks: CPU:720.000MHz, DDR:600.000MHz, AHB:240.000MHz, Ref:40.000MHz [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x00000000-0x07ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x07ffffff] [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512 [ 0.000000] Kernel command line: board=WLR8100 console=ttyS0,115200 mtdparts=spi0.0:192k(u-boot)ro,64k(u-boot-env)ro,1408k(kernel),14080k(rootfs),192k(unknown)ro,64k(art)ro,384k(unknown2)ro,15488k@0x40000(firmware) rootfstype=squashfs,jffs2 noinitrd [ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Memory: 123496k/131072k available (2217k kernel code, 7576k reserved, 592k data, 3012k init, 0k highmem) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:51 [ 0.000000] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048) [ 0.060000] pid_max: default: 32768 minimum: 301 [ 0.060000] Mount-cache hash table entries: 512 [ 0.070000] NET: Registered protocol family 16 [ 0.070000] MIPS: machine is Sitecom WLR-8100 [ 0.480000] registering PCI controller with io_map_base unset [ 0.490000] ar724x-pci ar724x-pci.1: PCIe link is down [ 0.490000] registering PCI controller with io_map_base unset [ 0.500000] bio: create slab <bio-0> at 0 [ 0.510000] PCI host bridge to bus 0000:00 [ 0.510000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff] [ 0.520000] pci_bus 0000:00: root bus resource [io 0x0000] [ 0.520000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.530000] pci 0000:00:00.0: invalid calibration data [ 0.530000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1001ffff 64bit] [ 0.540000] pci 0000:00:00.0: BAR 6: assigned [mem 0x10020000-0x1002ffff pref] [ 0.540000] PCI host bridge to bus 0000:01 [ 0.550000] pci_bus 0000:01: root bus resource [mem 0x12000000-0x13ffffff] [ 0.550000] pci_bus 0000:01: root bus resource [io 0x0001] [ 0.560000] pci_bus 0000:01: No busn resource found for root bus, will use [bus 01-ff] [ 0.560000] pci 0000:00:00.0: using irq 40 for pin 1 [ 0.570000] Switching to clocksource MIPS [ 0.570000] NET: Registered protocol family 2 [ 0.580000] TCP established hash table entries: 1024 (order: 1, 8192 bytes) [ 0.580000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.580000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.590000] TCP: reno registered [ 0.590000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.600000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.610000] NET: Registered protocol family 1 [ 3.380000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 3.390000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 3.400000] msgmni has been set to 241 [ 3.400000] io scheduler noop registered [ 3.400000] io scheduler deadline registered (default) [ 3.410000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled [ 3.440000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A [ 3.440000] console [ttyS0] enabled, bootconsole disabled [ 3.440000] console [ttyS0] enabled, bootconsole disabled [ 3.450000] ath79-spi ath79-spi: master is unqueued, this is deprecated [ 3.460000] m25p80 spi0.0: found mx25l12805d, expected m25p80 [ 3.470000] m25p80 spi0.0: mx25l12805d (16384 Kbytes) [ 3.470000] 8 cmdlinepart partitions found on MTD device spi0.0 [ 3.480000] Creating 8 MTD partitions on "spi0.0": [ 3.480000] 0x000000000000-0x000000030000 : "u-boot" [ 3.490000] 0x000000030000-0x000000040000 : "u-boot-env" [ 3.500000] 0x000000040000-0x0000001a0000 : "kernel" [ 3.500000] 0x0000001a0000-0x000000f60000 : "rootfs" [ 3.510000] mtd: device 3 (rootfs) set to be root filesystem [ 3.520000] mtdsplit: no squashfs found in "rootfs" [ 3.520000] mtdsplit: no squashfs found in "spi0.0" [ 3.530000] 0x000000f60000-0x000000f90000 : "unknown" [ 3.530000] 0x000000f90000-0x000000fa0000 : "art" [ 3.540000] 0x000000fa0000-0x000001000000 : "unknown2" [ 3.540000] 0x000000040000-0x000000f60000 : "firmware" [ 3.580000] switch0: Atheros AR8327 rev. 4 switch registered on ag71xx-mdio.0 [ 4.810000] libphy: ag71xx_mdio: probed [ 5.360000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd034, driver=Atheros AR8216/AR8236/AR8316] [ 5.370000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:RGMII [ 5.930000] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:SGMII [ 5.940000] TCP: cubic registered [ 5.940000] NET: Registered protocol family 17 [ 5.940000] 8021q: 802.1Q VLAN Support v1.8 [ 5.960000] Freeing unused kernel memory: 3012K (8031f000 - 80610000) procd: Console is alive procd: - watchdog - procd: - preinit - [ 6.010000] usbcore: registered new interface driver usbfs [ 6.030000] usbcore: registered new interface driver hub [ 6.030000] usbcore: registered new device driver usb [ 6.050000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 6.070000] ehci-platform: EHCI generic platform driver [ 6.070000] ehci-platform ehci-platform.0: EHCI Host Controller [ 6.080000] ehci-platform ehci-platform.0: new USB bus registered, assigned bus number 1 [ 6.090000] ehci-platform ehci-platform.0: TX-TX IDP fix enabled [ 6.090000] ehci-platform ehci-platform.0: irq 48, io mem 0x1b000000 [ 6.120000] ehci-platform ehci-platform.0: USB 2.0 started, EHCI 1.00 [ 6.130000] hub 1-0:1.0: USB hub found [ 6.130000] hub 1-0:1.0: 1 port detected [ 6.130000] ehci-platform ehci-platform.1: EHCI Host Controller [ 6.140000] ehci-platform ehci-platform.1: new USB bus registered, assigned bus number 2 [ 6.150000] ehci-platform ehci-platform.1: TX-TX IDP fix enabled [ 6.160000] ehci-platform ehci-platform.1: irq 49, io mem 0x1b400000 [ 6.180000] ehci-platform ehci-platform.1: USB 2.0 started, EHCI 1.00 [ 6.190000] hub 2-0:1.0: USB hub found [ 6.190000] hub 2-0:1.0: 1 port detected Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 7.360000] eth0: link up (1000Mbps/Full duplex) [ 9.300000] eth0: link down procd: - early - procd: - watchdog - procd: - ubus - procd: - init - Please press Enter to activate this console. [ 10.370000] NET: Registered protocol family 10 [ 10.380000] tun: Universal TUN/TAP device driver, 1.6 [ 10.390000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> [ 10.400000] nf_conntrack version 0.5.0 (1976 buckets, 7904 max) [ 10.410000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 10.430000] Loading modules backported from Linux version master-2014-03-31-1-0-g5c109d2 [ 10.440000] Backport generated by backports.git backports-20140221-0-g8e94650 [ 10.440000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 10.480000] xt_time: kernel timezone is -0000 [ 10.500000] cfg80211: Calling CRDA to update world regulatory domain [ 10.500000] cfg80211: World regulatory domain updated: [ 10.510000] cfg80211: DFS Master region: unset [ 10.510000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time) [ 10.520000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 10.530000] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 10.540000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A) [ 10.550000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 10.550000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 10.560000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A) [ 10.600000] PPP generic driver version 2.4.2 [ 10.620000] NET: Registered protocol family 24 [ 10.690000] cfg80211: Calling CRDA for country: US [ 10.690000] cfg80211: Regulatory domain changed to country: US [ 10.700000] cfg80211: DFS Master region: FCC [ 10.700000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time) [ 10.710000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 mBm), (N/A) [ 10.720000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 1700 mBm), (N/A) [ 10.730000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2300 mBm), (0 s) [ 10.740000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A) [ 10.750000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A) [ 10.750000] ieee80211 phy0: Atheros AR9550 Rev:0 mem=0xb8100000, irq=47 [ 10.760000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002) [ 10.770000] ath: phy1: eeprom contains invalid mac address: 01:02:03:04:05:06 [ 10.780000] ath: phy1: random mac address will be used: 66:87:40:3d:9d:1c [ 10.850000] ieee80211 phy1: Atheros AR9300 Rev:4 mem=0xb0000000, irq=40 [ 16.950000] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 16.950000] IPv6: ADDRCONF(NETDEV_UP): eth0.1: link is not ready [ 16.990000] device eth0.1 entered promiscuous mode [ 16.990000] device eth0 entered promiscuous mode [ 17.030000] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 17.050000] IPv6: ADDRCONF(NETDEV_UP): eth0.2: link is not ready [ 18.370000] eth0: link up (1000Mbps/Full duplex) [ 18.400000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 18.400000] br-lan: port 1(eth0.1) entered forwarding state [ 18.410000] br-lan: port 1(eth0.1) entered forwarding state [ 18.410000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready [ 18.420000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.2: link becomes ready [ 18.470000] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready procd: - init complete - [ 20.410000] br-lan: port 1(eth0.1) entered forwarding state
Notes
I haven't been able to figure out how to get a U-Boot prompt (Ctrl+C doesn't work). Fortunately, you can still boot uImages without it. Even though U-Boot doesn't show option 4, type 4 at it for the command prompt.
For the OEM firmware's console, the password is lin17 or aigo3d0a0tdagr; both are accepted and give you a root shell (/bin/sh). It also accepts admin, but you can't get a shell because /sbin/cli is missing.