hey,

nice discussion! I just ordered a WGT634U and will try to compile my own kernel asap I got it

Just a stupid question. I didn't any researches on the topic. But isn't it possible to extract the Atheros HAL of the driver used by Netgear to get 108 Mbps mode working?

Hi,

Well the hal comes in binary object code for several platforms.
It's just linked together with some glue code.
Normally you have an ath_hal module which contains all of this stuff.
Is there an ath_hal module?

Hm, I should get one of those devices...

Thanks Florian, I've edged a bit closer, on doing a make I got a couple of undefined references to ... , most of which I've been able to fix. The only ones left are as follows:

 arch/mips/bcm47xx/broadcom/built-in.o: In function `osl_pci_read_config':
arch/mips/bcm47xx/broadcom/built-in.o(.text+0x3e50): undefined reference to `pcibios_read_config_dword'
arch/mips/bcm47xx/broadcom/built-in.o: In function `osl_pci_write_config':
arch/mips/bcm47xx/broadcom/built-in.o(.text+0x3ef4): undefined reference to `pcibios_write_config_dword'
arch/mips/pci/built-in.o: In function `pcibios_enable_device':
arch/mips/pci/built-in.o(.text+0x348): undefined reference to `pcibios_plat_dev_init'

I've tried grepping the source for these three functions to identify which source files they are defined in, but with no sucess (so far). Any ideas ?

The Makefile in arch/mips/bcm47xx/broadcom/shared now looks like so:

obj-y := bcmsrom.o bcmutils.o  hnddma.o linux_osl.o sbmips.o  sbpci.o sbutils.o sflash.o

And the one in arch/mips/bcm47xx/broadcom/ is:

obj-y := shared/

Many thanks Florian for your patience on this one, once I've got this working I'm going to write it up.

Cheers,

Simon

Ok here's an update:

I managed to get rid of 2 of the 3 previous errors by editing /arch/mips/bcm47xx/broadcom/shared/linux_osl.c.

Here is the diff.

80c80
<               pcibios_read_config_dword(pdev->bus->number, pdev->devfn, offset, &val);---
>               pci_read_config_dword(pdev, offset, &val);
101c101
<               pcibios_write_config_dword(pdev->bus->number, pdev->devfn, offset, val);---
>               pci_write_config_dword(pdev, offset, val);

The other one I fixed with the following diff on arch/mips/pci/fixup-bcm47xx.c

18a19,23
> /* Do platform specific device initialization at pci_enable_device() time */
> int pcibios_plat_dev_init(struct pci_dev *dev)
> {
>       return 0;
> }

Could someone who knows about the kernel confirm that this is correct ?

So finally the kernel compiled and I got a vmlinux in to top directory. I copied this to /tftpboot , gziped it and set the router up to boot from the tftp file. Now it says the following:

CFE> boot -z -elf -tftp 192.168.1.10:vmlinux.gz
Loader:elf Filesys:tftp Dev:eth0 File:192.168.1.10:vmlinux.gz Options:(null)
***************************
****  MAC Client V1.0  ****
***************************
et0macaddr value :flag =0 value=00-09-5b-f7-0c-84
et1macaddr value :flag =0 value=00-09-5b-f7-0c-85
MAC exist at least one
system ethernet mac exist and not default....
Skip mac client process.....
Loading: 0x80001000/2924678 0x802cb086/97218 Entry at 0x8027d000
Closing network.
et0: link down
Starting program at 0x8027d000

At which point I get nothing more on the terminal. I'm thinking this might be because I haven't told it to use ttyS1 as a console. I tried booting with

CFE> boot -z -elf -tftp 192.168.1.10:vmlinux.gz  console=ttyS1,115200

but exactly the same thing happened.

Until tomorrow...

Simon

This is the same behavius as when trying to boot the plain openwrt kernel, and i have got some unverified respones to this about that the wlan-card needed some type of delay during the init-phase of the router.

Still awaiting some more information and a working (non netgear) 2.4.x kernel that will be able to boot on the device.
Will post more information about this as soon as i get any.

Just as a follow up on this, I tried booting without the minipci card attached. I still get the same behaviour.

Netgear have "Changed" the GPL-source for 1.4.1.8 !!!??

It looks like they disabled FreeSwan and something with Iptables (maybe afraid of Harald Welte...)

I found it when I noticed that the source was dated: 01/17/05      16:50:00, so I downloaded it and run a diff against my earlier copy of this version.

/Claes

PS They have not added the telnetd source...

Try this patch:

--- printk.c    26 Oct 2004 09:30:19 -0000      1.1.1.2
+++ printk.c    6 Feb 2005 17:32:39 -0000
@@ -463,8 +463,25 @@ static void call_console_drivers(unsigne
        _call_console_drivers(start_print, end, msg_level);
 }

+#include <linux/serial_reg.h>
+
+static void
+serialputc(char c)
+{
+#if 1
+       if (c == 'n')
+               serialputc('r');
+
+//#define SER_PORT1(reg)       (*((volatile unsigned char *)(0xbf800000+reg)))
+#define SER_PORT1(reg) (*((volatile unsigned char *)(0xb8000400+reg)))
+       while (!(SER_PORT1(UART_LSR) & UART_LSR_THRE));
+       SER_PORT1(UART_TX) = c;
+#endif
+}
+
 static void emit_log_char(char c)
 {
+       serialputc(c);
        LOG_BUF(log_end) = c;
        log_end++;
        if (log_end - log_start > log_buf_len)

This will give you early printk output. You'll probably oops before the serial driver is loaded.

Best,
  Florian

Hi all,

I'm relatively new to the router-hacking scene but have read more on the specs of this router and think it's almost got it spot-on from a spec PoV (for me).

I'd like to use these as VPN endpoints so the Mini-PCI  card is intriguing.  Might compatibility with the Soekris engineering VPN1411 be possible?

As well, what about booting from a USB mass storage device?

Thanks for the patch Florian. It seems to be crapping out in the do_earlyinitcalls(void) function in arch/mips/kernel.setup.c

I added a bunch of printk's which all work fine until the top of the 

for (call = start; call < end; call++)

  loop.

After that it just starts printing symbols on the screen and then stops after a few seconds.

Looking around the source to me it looks like this loop is initialising the modules that have been linked into the kernel. So I'm guessing if this is the case, then one of the modules is causing the problem ?

Florian: are you able to post a copy of your .config file so I can check mine against your's ?

On another note, I've just checked out a new copy from cvs so I'm now using 2.6.11 . I'm getting the following when I try and compile :

  LD      init/built-in.o
  LD      .tmp_vmlinux1
arch/mips/mm/built-in.o(.init.text+0x3680): In function `ld_mmu_r4xx0':
: undefined reference to `read_c0_config7'
make: *** [.tmp_vmlinux1] Error 1

grepping the source shows that read_c0_config7 isn't defined anywhere ( I could only find references to read_c0_config[0..3] )

I've attached a copy of my .config file in case it helps

Simon

Hi Everybody!

I managed to get telnet access to the router :-)

When you try to connect with telnet the router simply terminates the connection.

I already gained access to the root filesystem with the ftp root hack, and I created a samba share for /, so I can browse through it using my favourite tools.

All of the configuration seemed right for the telnetd, but it didn't work.

After a look at the binaries from /usr/bin/in.telnetd, I noticed the string "/tmp/telnetenable" somewhere in it.

Then I tried to create a dummy file /tmp/telnetenable, and suddenly it worked!

Somewhere in the process I found out, I had a problem in /etc/hosts.allow, since I changed the default subnet from 192.168.1.0 to 192.168.0.0.
So be careful to the change the subnet there if you reconfigure the router via the web interface, this setting is not changed automatically. 

After a reboot you have to create /tmp/telnetenable again!

I hope this helps you folks :-)
   
Martin, Vienna, Austria

P.S.  I have a card reader attached with 128MB CF. It would be fine, if someone found out how to boot from there, or just move /tmp & /var/log to the CF-Card and use the freed space for more RAM or the root fs. Then there would be plenty of space to install additional software like sshd, I won't like to remove the samba server or other stuff.
Has anyone looked at the open source code from the ASUS WL-500G Spacelink Wireless Home Gateway? Is it compatible with the Netgear firmware? I'd like to have the USB print server on the Netgear :-)

Maybe time to start to "organize" some Wiki-pages on this site!?

If we look on the counter of this thread, it says (today) over 8000 readings and if we could give more info/ideas of what's possible to do with the 634U-thing, maybe a lot of others could/would contribute....

My sugestion is that we should start to organize facts and info on the Wiki at this site.

Example of documents to write:

How to hack through the webinterface (../../ for FTP and SMB)

How to hack through a config-save (*)

How to extract a image-file (*)

How to get telnet running (1.4.1.8 img got one)

How to add and build a dropbear SSH-server

How to build a (or 2) serial interface(s) with info on circuits possible to use

How to setup up a uclib-toolchain (what choices when make...)

How to setup up a hndtools-mipsel toolchain (and build the Netgear source)

Howto emulate "boot wait" with STARTUP env

How to build and modify a Netgear "origanal" stuff

How to patch and get a diff of a current 2.6-kernel

How to boot or use storage on a USB-device

How to do "nice" things with the Madwifi HAL, like boosting

Some basic tutorials about:

CRC32 checksums (*)

JFFS2 filesystem and mounting a "loopback" howto (on Linux) (*)

LRP-packages

Minix filesystem and mounting it "loopback" howto (on Linux) (*)

Other stuff like:

Info about GPL-violations done by Netgear with this box

Links to information that's useable

Ideas about what we could do with the box

Scoreboard (like Netfilter project had in the begining)

What I sugesst is that it's possible to cooperate a bit more on this!

And Jolt, do you realy got your 634 running with a 2.6-kernel? (Everybody else looks to have problems)

If this place is wrong I have some machines with 10Mbit connection where we could put the Wiki on (for example a Sparc64 running OpenBSD -current and Python 2.3.4 installed or some Intel machine with Gentoo)

As an alternative I could give people "accounts" to a chrooted apache enviroment with some quoata and register a domain for it.

I wont to go ahead a bit speedier then it's happening here right now, and I have no resources (time) to do/investigate all things by myself! So, lets share and investigate together...

What do you think?

/Claes

PS Excuse me fpr my bad spelling, clock is 01:35 and I had some glases of wine this evening after a long workday and my mother tongue is not English!

(*) = Stuff that I like to fill in when I have time (in a near future)

Hi Claes,

I've started documenting what I've been doing here: http://www.nomis52.net/?section=project … page=about

Hopefully that can address a few of the items on the list.

Some sections aren't filled in yet, but I'll try and get around to it as soon as I can.

After talking to Jolt I've also got a 2.6 kernel running. At the moment I'm trying to sort out why my USB devices aren't working.

Cheers,

Simon

Hi Simon,

Your newly added "documention" (and style) looked good!

I'm not sure if I'm going to build the serial interface. I have found MAX3180E/MAX3182E which not need any capacitors (I think). But is very very small for an amataur to solder. Anybody who know any other interface chip which don't need any "extras" (and board)?

An idea of how to changing the "SETUP" parameter for the "Boot-process" to be tftp-aware: If you don't have the CFE-shell (read: serial console), you could dd /dev/mtdblock4 to your USB-storage and modify it before you put it back with dd.

I'm also thinking of small tarball (or ZIP-file) to upload with smb to get ssh (dropbear) and/or telnet shell after root hacked in Samba. I install it through add cronjob in /etc/crontab (which reloads "automagicly"). With this "concept" people need:
1. Webbrowser to do the /../../ hack with the share.
2. A machine with smb (almost every platform has it) to upload the extras to get a shell.
You need to edit /etc/samba/smb.conf (with FTP) to give the share / as path before you could do #2. I need to figure out how to get the box to get the change in smb.conf permanent.... I did it through hacking of config-save file (which needs some tools and setup). Anybody with some ideas about above?

/Claes

Excuse me if I am missing something here, but I just ran the command 'save-config', which essentially saves everything in /config/config.list, which happends to include that smb.conf. After a reboot, it turns up with the changes.

/Pjotrek :idea:

Automagic installation of scripts & binaries

Pondering on the consequences of my last post – 23/2 – I decided this could be an opening into installing scripts & binaries automagically after a reboot. To make a long story short, I found that opening.

The script /bin/save-config saves all files in /config/config.list to make them appear again after a reboot. config.list contains configuration files, no scripts. But, it contains /etc/cron.d/nfqueue. nfqueue is included in cron’s tabs if the option ‘Keyword Blocking’ is selected to ‘Always’ in ‘Block Sites’ of the HTML Router Configurator.

So: simply add an extra line into the /etc/cron.d/nfqueue, to run a script periodically, run save-config, add a few scripts here and there – and we are there! We can have that script run every minute and do something useful, for instance, first time it is run, to install all our extra goodies. Automagically again and again, after each reboot.

I made a shadow filesystem on the USB-drive, running everything from there, including Idc’s DropBear SSH and alternate BusyBox. All put into action by that cron entry.

I also had some problems with the router not renewing it’s DHCP lease, so I added a script wanlease.sh to fix that. (Maybe someone knows what should really be done to fix that?) I also noted on several occasions (not always) that 5 or 6 upnpd processes started growing, up to 10 times the original footprint in less than an hour. Each time they reached that size, the router stopped working.
Since it seems to be working OK without them, I also added code to wanlease.sh to kill them. Since then I have much better stability in my router.
Plus all the other fun…
Download my freeride and see if it can do something for you, too.

If wanted/needed, I can add a step-by-step description.

Included: tar of the freeride.
P.S. All attributes in the USB fs are 777, since I am running from a USB Flash memory only allowing fat32.

/Pjotrek :idea:

Hi Pjotrek!

Your freeride package inspired me a lot :-)

There are some points of improvement though:
- Your script cannot install the new busybox automatically, when I tried it, it failed running it with "--install", trying to create hard links, which are not allowed to span different file system. It works if you copy it to the rootfs first.
BUT: I figured out, you can tell it to use symbolic links by specifying "--install -s", at least it worked for me :-)
When I ran "ps" of the new busybox, the "Command" column contained only garbage. Anybody else with this problem?
- have you tried to modify /config/config.list to include any other file? Then you could create new scripts. You would have to include config/config.list itself. I added serveral files modified by me to config.list, and the newly saved netgear.cfg seemed to contain a lot more data. I never tried to reboot the device, though.
- I extended your fixafterboot.sh to copy a whole directory tree to the root fs, so you can bulk replace patech or add new files, e. g. I patched in.telnetd to test the existence of "/bin" instead of "/tmp/telnetenable".

My intention is to move as much as possible to the USB drive, to get free RAM for additional features, like a web server, vpn server, print server,...
/var/log and /tmp are good candidates for this.
I tried to move all files from /var/log to /share/partition1/fs/var/log and then wanted to umount the tmpfs and create a symbolic link to the new folder, but that didn't work. umount returned "device busy" or so.
When I used mount with the bind option, I could replace the /var/log folder, but the tmpfs still exists :-(
Same on /tmp.
Are there better ways to do that?

My current status:

# free
              total         used         free       shared      buffers
  Mem:        30452        27180         3272            0          324
Swap:            0            0            0
Total:        30452        27180         3272

# mount
rootfs on / type rootfs (rw)
/dev/root on / type tmpfs (rw)
/proc on /proc type proc (rw)
tmpfs on /tmp type tmpfs (rw)
tmpfs on /var/log type tmpfs (rw)
usbfs on /proc/bus/usb type usbfs (rw)
/dev/sda1 on /share/partition1 type vfat (rw)
/dev/sda1 on /tmp type vfat (rw)
/dev/sda1 on /var/log type vfat (rw)

Has anybody tried to use pivot_root to replace the whole rootfs? Does it only work at the init stage, or can it be used afterwards?
It would be fine to move/copy the whole rootfs fs to the USB drive, switch to it and destroy the original fs in RAM.

How long would a CF Card withstand the continous changes and writes to log files? Maybe it would be better to use a microdrive or real hard disk?

I think, it would be possible to format the CF/Disk with ext2 or ext3 fs to enable permissions. Maybe one could create a swapper area too with mkswap and swapon?

Many things to try :-)

Martin

Hi Martin,
Happy that you could use & build on my ideas.

Yes, I have tried that. It does not work - config.list is gotten from the preloaded image every reboot, not from the saved config. So, even if you modify it, that does not count at next reboot.

Sounds interesting, I want that too. But first I will try your ideas to see where that leads me. Must leave now, lets communicate later!

/Pjotrek 

Hi Pjotrek!

I rebooted the router with 'shutdown -r now', and all modified files I added to config.list reappeared correctly :-)
Note: I included config/config.list in the file itself.

Maybe you did't run save-config to store the changed settings before reboot?

Or does 'shutdown -r now' behave differenty than power off? I don't think so, all my redirected tmp and log are gone...

P.S. Did anybody know?
http://192.168.1.1/cgi-bin/plrh_log.html
;-)

Hi MMCM,
I am glad it worked for you - I must have missed something :oops: . But cooperation is what all these communities are there for. Together we achieve more than the sum of of our individual work.
I will try some more things in the weekend - I will post the proceedings.
I suggest you post your scripts, for anybody to try and  play with.
/Pjotrek [|-:{>

I've confirmed this works. I don't know the format of the nvram but running strings on the image shows the nvram variables.

If anyone wants a copy of an image let me know and I'll post it on the web.

Cheers,

Simon

Hi, Simon,

I am trying to build a 2.6.x kernel for WGT634U according to your steps in
this thread. I have successfully created a toolchain from
buildroot-0.9.27.tar.gz and created a vmlinux ELF file. However, after
setting the router to boot from the tftp file 'vmlinux.gz', there is nothing
on the terminal. Even with jolt's patch of printk.c, I can see only scrambled
messages on the terminal (terminal setting is still 115200,8N1, right?)
Since you have got a 2.6 kernel running, is it possible for you to share
your 2.6.x kernel source and the corresponding .config and vmlinux.gz with us?

Best regards,

Jason

Hi,

unfortunately my patch is incomplete. Open the file:  arch / mips / bcm47xx / setup.c and serach for sb_serial_init. Comment out this line.

Best,
  Florian

DS275  but it's hard to find, even Dallas SemiConductors website has a 1 week lead time on it.

DS275  but it's hard to find, even Dallas SemiConductors website has a 1 week lead time on it.