OpenWrt Forum Archive

Topic: Support for Marvell 88F5xx81 based routers

The content of this topic has been archived between 18 Jan 2014 and 6 May 2018. Unfortunately there are posts – most likely complete pages – missing.

To check if sysupgrade is available on your current installation, see if "/lib/upgrade/platform.sh" exists.

Square brackets mark optional parts of the command, here "-v" if you want verbose output, otherwise leave it out.

Do you really want to upgrade to the current/last snapshot of the OpenWrt team?
( http://downloads.openwrt.org/snapshots/trunk/orion/ openwrt-wrt350nv2-squashfs.img )
If so, then there is no combined flash image available officially yet.
Check out the other posts (e.g #341) how to get the rootfs and create a combined flash image with it (uImage + padding + rootfs).

(Last edited by maddes.b on 8 Sep 2009, 17:57)

DaBigMac wrote:

Tried using sysupgrade, results as follows

root@OpenWrt:/# sysupgrade [-v] http://downloads.openwrt.org/snapshots/trunk/ori
on/openwrt-wrt350nv2-squashfs.img
Firmware upgrade is not implemented for this platform.

Did I do something wrong? I used the firmware posted on your ftp site..

The sysupgrade stuff isn't upstream yet, so when you upgraded base-files you lost the ability to sysupgrade. You could try downgrading base-files.

I've been watching this forum for a few months and would like to thank Maddes for the incredible work he has done. You must have put in a lot of time and effort.

I've managed to make a RAM image from the tutorials in this thread as it was running fine so I flashed a image from the FTP ftp://ftp.maddes.net/openwrt/kamikaze/o … l_ipv6.img     everything is running perfect but OpenVPN crashes with "Unable to handle kernel NULL pointer dereference at virtual address" Am I the only one with this issue?

As I've read in the thread http://forum.openwrt.org/viewtopic.php?id=20713 I will create my own image with the kmod-tun precompiled. Will keep you posted.

Thanks and a big bow for Maddes.

The major tasks were done by Kaloz, DirkNL, StrikerNL and Lennert (kernel, drivers, initial webupgrade, etc.).
I'm just trying to get the administrative tasks done (sysupgrade, webupgrade, etc.).

Note it's still beta (currently investigating the WLAN problems)
I'm just an experienced user with some programming background.

@dallienl:
Was "kmod-tun" set to "Y" (included in uImage) or just normally set to "M" (separate module, must be installed)

(Last edited by maddes.b on 8 Sep 2009, 18:16)

drizzt81 wrote:

Drizzt81's list of stupid things not to do:

1. running opkg upgrade semi-bricked my router (serial access still worked), but no network interfaces were available
... to be continued

Never to be outdone in the performing of stupidity, I decided to see if I could reproduce drizzt's error. Suprise, suprise! I did.. with similar results..

I know what the problem is though, opkg detects new versions of the default, installed packages and downloads/installs them to the /root partition, which of course, quickly fills (a df in a 2nd session confirmed that the /root partition had reached 100%) and the upgrade hangs...

Perhaps maddes.b would be kind enough to create another image set with a /root partition size large enough to accommodate the installation of upgrades to the base system? Or perhaps that's unnecessary, can anyone suggest a workaround? The updates may not be so vital now, but it won't be long before newer packages require dependencies which cannot be met by the default modules.

Cheers,

DBM

Nope currently I'm using the precompiled image from the FTP the kmon-tun is not included. Tomorrow will compile a new image with the kmod-tun and see if OpenVPN then runs.

/rom is 100% full on my un-upgraded system - it's a read-only squashfs filesystem. I'm not totally familiar with sysupgrade, but I suspect it rewrites /rom with the new filesystem image. Using opkg to upgrade packages that are part of /root is less than ideal, as it duplicates the contents in /jffs, but it's not normally encountered when using proper releases as the package versions are stable.

(Last edited by Watha on 8 Sep 2009, 18:50)

If you want to restart with your current installation, just execute "firstboot", then reboot.
All your configs will be gone, and it will be just as it was when you flashed it.

About the modules:
There is no workaround.
It's not stable, it is ongoing developement (trunk version = BETA and sometime ALPHA).
If your system is working with it, then do not upgrade, just wait for a stable release (hopefully somewhen).
If you need additional or newer modules (or kernel), then backup everything and reflash with the latest BETA.

@dallienl
Keep an eye on the log when installing OpenVPN: From what site is the module downloaded?

Otherwise install your own build module directly.
Reboot, do *not* call "opkg update", copy your module to /tmp and install via "opkg install /tmp/kmod...."

P.S.:
Does NL at the end of your nick indicate the netherlands?

(Last edited by maddes.b on 8 Sep 2009, 18:41)

Watha is correct, /root (home dir of root user) or just / (root of filesystem) is always 100% full.
The base of the filesystem is a read-only squashfs, which is then overlayed by a read-writeable JFFS (see /jffs).

So if you change /etc/firewall.user, then you will find your version in /jffs/etc/firewall.user, while the original version is still in /rom/etc/firewall.user.
Deletion of a file results in a metafile inside /jffs/path/to/deleted/
That's why you can return to the initial state with firstboot.

To find out how much flash space is free use "df /jffs"

(Last edited by maddes.b on 8 Sep 2009, 18:48)

I switched back to r17264 and WLAN worked again, seems that something got brocken somewhere down the road.
Will try to narrow it done.

Updating your WLAN/Wifi driver should fix this problem!!! (e.g. worked for me on Intel 3945ABG)

Worked: r17264
Broken: r17296, r17357, r17399

Created defect ticket #5815 for this.

Rebuild r17264 with the most current sysupgrade and webupgrade patches, and posted it on my ftp space.
It is recommended to only use kernel modules from this repository and hold them.
After installing the kernel modules I holded all installed packages (will now continue and install the other packages)

opkg list_installed | cut -d ' ' -f 1 | xargs opkg flag hold ; # semicolon forces the necessary space at the end

(Last edited by maddes.b on 10 Sep 2009, 22:53)

Currently using the 17456 only problem with wireless was my Vista wouldn't connect. It was visible but not response. Using Windows 7 everything was okay, think it was an OS issue. Had to manually edit wireless file file though, using only webif no sugar, see config below.

config 'wifi-device' 'wlan0'
    option 'type' 'mac80211'
    option 'country' 'nl'
    option 'hwmode' '11bg'
    option 'channel' '05'
    option 'maxassoc' ''
    option 'distance' '10'
    option 'diversity' ''
    option 'txantenna' ''
    option 'rxantenna' ''
    option 'disabled' '0'
    option 'antenna' ''

config 'wifi-iface'
    option 'device' 'wlan0'
    option 'network' 'lan'
    option 'mode' 'ap'
    option 'ssid' 'XXXXXXX'
    option 'bssid' ''
    option 'encryption' 'psk2'
    option 'server' ''
    option 'port' ''
    option 'hidden' '0'
    option 'isolate' '0'
    option 'txpower' ''
    option 'bgscan' '0'
    option 'frag' ''
    option 'rts' ''
    option 'wds' '0'
    option 'key' 'XXXXXXXX'
    option 'key1' ''
    option 'key2' ''
    option 'key3' ''
    option 'key4' 'root'
    option '80211h' ''
    option 'compression' ''
    option 'bursting' ''
    option 'ff' ''
    option 'wmm' ''
    option 'xr' ''
    option 'ar' ''
    option 'turbo' ''
    option 'macpolicy' 'none'
    option 'maclist' ''

Just finished compiling the new image including kmod-tun for the OpenVPN issue and flashed it. Will do some testing tomorrow.

If you need any assistance in alpha / beta testing I will be glad to help your effort.

Yes the NL stands for the Netherlands I'm Dutch / German.

Just to make sure, you can connect via WLAN to the router when using Windows 7?
No cable connected to the computer, rebooted, then connected to WLAN?
But not when using Vista?

If that would be the case then it maybe fixed via router configuration.

(Last edited by maddes.b on 8 Sep 2009, 22:11)

maddes, what are the WLAN issue you are talking about ?
I use your image (r17456) and have no issue with WLAN. I have also managed to get 11n working... well exception made of the 5 GHz band but I can use the HT40 capability.
Vista and Linux clients can connect seamlessly.

Hm, people reported that they have WLAN issues.
So I retested my WLAN again and also have connection issues.
I only need WLAN rarely, so I didn't noticed before.

Can you post your result of "uci show wireless" (remember to remove your keys).
Or better contact me per mail so we can check step by step what you installed and configured.

(Last edited by maddes.b on 9 Sep 2009, 01:17)

operron wrote:

maddes, what are the WLAN issue you are talking about ?
I use your image (r17456) and have no issue with WLAN. I have also managed to get 11n working... well exception made of the 5 GHz band but I can use the HT40 capability.
Vista and Linux clients can connect seamlessly.

Quick detail on my WLAN Issue: I am using the router as an AP, i.e. the WAN port is not connected. I set up a WLAN and tried to connect from WinXP (Thinkpad T40, Intel WLAN afaik) and was unable to acquire an IP, which led my windows client to connect to the other WLAN, which is also in range.

Due to time constraints, I have not been able to debug this neatly and eliminate variables to pinpoint the issue just yet. More testing next week at the earliest.

Hello ppl,

I bricked my router (wrt350n v2.1). i tried opkg upgrade... sad
Power led and lan are still blinking, still no access via http, ssh or telnet.
How can i solve this?
Thanks

(Last edited by falso on 9 Sep 2009, 03:29)

I am trying to enter to failsafe but i cant. I dont know what i'm doing wrong.
I am pushing reset two secs after power on but nothing happens incl. ping! sad
What type of serial cable do i need? I haveWRTt350n v2.1!
Thanks.

(Last edited by falso on 9 Sep 2009, 06:40)

Upgrading to 128M

The inital ground work was done by jdoering in this thread

http://forum.dsmg600.info/viewtopic.php?id=2388&p=1

Kmper made a post in the WRT350Nv2/Marvell thread in the Open-WRT forum about his upgrade

https://forum.openwrt.org/viewtopic.php … 468#p78468

However Kmpers patches did not work.

There is an error in Kmpers u-boot patches that will display 128M ok - but fail to work.

I suspect Kmper followed jdoering too closely to the letter and was looking for the pattern

10 60 A0 E3

however the WRT350N-V2 only comes with 32M RAM instead of the 64M standard on the Slug

This means the pattern he should have been looking for was

00 60 A0 E3

I initially followed Kmper to the letter, got the boot screens to show me 128M and then have my router fall over when using more than 32M of memory.  This sent me off on a bit of a wild goose chase for bad soldering.

Using the MD command in u-boot I compared my registers on the 350n with DNS-323

address   WRT350Nv2     DNS-323     Description                    WRT350Nv2-After-Kmper_patch

f1001400: 03148400      03148400    SDRAM_CONFIG_REG                03148400
          04041000      04041000    SDRAM_DUNIT_CTRL_REG            04041000
          11602220      11602220    SDRAM_TIMING_CTRL_LOW_REG       11602220
          0000040c      0000040c    SDRAM_TIMING_CTRL_HIGH_REG      0000040c
f1001410: 00000000      00000010    SDRAM_ADDR_CTRL_REG             00000000  <<WRONG
          00000000      00000000    SDRAM_OPEN_PAGE_CTRL_REG        00000000
          00000000      00000000    SDRAM_OPERATION_REG             00000000
          00000062      00000062    SDRAM_MODE_REG                  00000062
f1001420: 00000000      00000000    SDRAM_EXTENDED_MODE_REG         00000000
          00000000      00000000                                    00000000
          00063305      00063305                                    00063305
          00000000      00000000    SDRAM_OPERATION_CTRL_REG        00000000
          

f1001500: 00000000      00000000                                    00000000
          01ff0001      03ff0001    SDRAM_BANK0_SIZE                07ff0001
          10000000      10000000                                    10000000
          00000000      00000000                                    00000000
f1001510: 20000000      20000000                                    20000000
          00000000      00000000                                    00000000
          30000000      30000000                                    30000000
          00000000      00000000                                    00000000

This shows two differences

SDRAM_ADDR_CTRL_REG is 00000000 on WRT350N and 00000010 on DNS-323
SDRAM_BANK0_SIZE    is 01ff0001 on WRT350N and 03ff0001 on DNS-323

So Kmpers first patch of changing memory location 0x315f to 10 00 ff 07 is correct

However the second one is obv wrong as the WRT350 does not have 01 as the value in SDRAM_ADDR_CTRL_REG  in the first place.  The pattern 00 60 A0 E3 is also so common it will be dangerous to just trying random instances of that.

So search begins for corrent patch.

First up downloaded source codes from linksys GPL center

http://www.linksysbycisco.com/gpl

And also download Dis-Arm by Christoph Gießelink

http://hp.giesselink.com/pcuti.htm

Type the following at the linux shell prompt to get your MTD partition map

>cat /proc/mtd

dev:    size    erasesize name
mtd0: 00100000 00010000 "kernel"
mtd1: 00650000 00010000 "rootfs"
mtd2: 00510000 00010000 "rootfs_data"
mtd3: 00040000 00010000 "lang"
mtd4: 00020000 00010000 "nvram"
mtd5: 00040000 00010000 "u-boot"
mtd6: 00010000 00010000 "eRcOmM_do_not_touch"
mtd7: 00760000 00010000 "image"

So in my case the u-boot is in mtd5 so I use the following command to save the image to my USB stick

dd if=/dev/mtdblock5 of=/home/usb/mtd5.bin count=00010000

Your u-boot partition may be in a different block than mtd5.  Your USB stick may be mounted at a different location to mine.


<Continued Next Post>

(Last edited by andrewm1973 on 9 Sep 2009, 09:35)

Upgrading to 128M continued

Then go to your desktop and use Dis-Arm to turn the hex file into something semi human readable

(in my case I typed  >disarm -o mt5.bin > uboot.asm)

You can now open up the disassembled file (uboot.asm) in an editor (notepad etc)

out of curiosty do a search for

0000315c:

and you should see

0000315c:  01ff0001  mvneqs   r0,r1

The "mvneqs r0,r1" is jibberish because this is constant data.  The 01ff0001 should look familiar though big_smile

Now onto the search for the other patch.

In the source code I search for

SDRAM_ADDR_CTRL_REG

and come up with this in the source code

Density:        
    bl     _getDensity
    mov     r8, r7
    mov     r8, r8, LSR #20 /* Move density 20 bits to the right  */
                            /* For example 0x10000000 --> 0x1000 */
        
    mov     r6, #0x00
    cmp     r8, #DRAM_DEV_DENSITY_128M
    beq     densCont
        
    mov     r6, #0x10
    cmp     r8, #DRAM_DEV_DENSITY_256M
    beq     densCont
        
    mov     r6, #0x20
    cmp     r8, #DRAM_DEV_DENSITY_512M
    beq     densCont

    /* This is an error. return */
    b       exit_ddrAutoConfig
        
densCont:
    MV_REG_WRITE_ASM (r6, r5, SDRAM_ADDR_CTRL_REG)

However reading a bit further I see that _getDensity is issuing I2C commands to an SPD-ROM and the WRT350N does not have one.

So the search continues and I find in the file

mvDramIfBasicInit

#if 0
/* DDR 1 256M samsung M368L3223ETM-CCC */
#define SDRAM0_BANK0_SIZE    0x7ff0001
#define SDRAM_CONFIG    0x3248400    
#define SDRAM_MODE    0x62    
#define DUNIT_CTRL_LOW    0x4041040
#define SDRAM_ADDR_CTRL    0x10
#define SDRAM_TIME_CTRL_LOW    0x1501110
#define SDRAM_TIME_CTRL_HI    0x409
#define SDRAM_ODT_CTRL_LOW    0x0
#define SDRAM_ODT_CTRL_HI    0x0    
#define SDRAM_DUNIT_ODT_CTRL    0x0
#define SDRAM_EXT_MODE                0x0
#endif

/* DDR 1 32M micron MT46VSM16P-6T */
#define STATIC1_SDRAM0_BANK0_SIZE         0x1ff0001
#define STATIC1_SDRAM_CONFIG         0x3148400    
#define STATIC1_SDRAM_MODE         0x62    
#define STATIC1_DUNIT_CTRL_LOW         0x4041000
#define STATIC1_SDRAM_ADDR_CTRL         0x0
#define STATIC1_SDRAM_TIME_CTRL_LOW     0x11602220
#define STATIC1_SDRAM_TIME_CTRL_HI         0x40c
#define STATIC1_SDRAM_ODT_CTRL_LOW         0x0
#define STATIC1_SDRAM_ODT_CTRL_HI         0x0    
#define STATIC1_SDRAM_DUNIT_ODT_CTRL    0x0
#define STATIC1_SDRAM_EXT_MODE          0x0

So the data being loaded into SDRAM_ADDR_CTRL is likely stored together.

From Kmpers post we at least know the address of the SDRAM0_BANK0_Size (being at 0x315C)

So here is the disassembly of memory locations in that area (ignore opcodes they are still jibberish)

0000314c:  f1001504  mrs??    r1,cpsr
00003150:  f100150c  mrs??    r1,cpsr
00003154:  f1001514  mrs??    r1,cpsr
00003158:  f100151c  mrs??    r1,cpsr
0000315c:  01ff0001  mvneqs   r0,r1
00003160:  f101011c  mrs??    r0,cpsr
00003164:  03148400  tsteq    r4,#0
00003168:  f1020318  mrs??    r0,cpsr
0000316c:  f1020114  mrs??    r0,cpsr
00003170:  04041000  streq    r1,[r4],#-0
00003174:  f1020320  mrs??    r0,cpsr
00003178:  f1020404  mrs??    r0,cpsr
0000317c:  11602220  msrne    spsr_all,r0

Bit of pattern matching and we can see

315C contains 01ff0001     which is STATIC1_SDRAM0_BANK0_SIZE        0x1ff0001
3160
3164 contains 03148400     which is STATIC1_SDRAM_CONFIG            0x3148400
3168
316c
3170 contains 04041000     which is STATIC1_DUNIT_CTRL_LOW             0x4041000
3174
3178
317c contains 11602220     which is STATIC1_SDRAM_TIME_CTRL_LOW        0x11602220

The other statics are not 4 bytes long so will be either packed together OR inlined by the assembler

There is NO data-bytes anywhere near address 315c that contain 62 (something else searchable for as it is pointless looking for what we are really after the 0x00 as it is everywhere where as 0x62 will be less common)

So we go in search of

STATIC1_SDRAM_ADDR_CTRL

And we find in the file

mvDramIfBasicInit

in a subroutine with a snippit shown below

_mvDramIfStatic1Init:

    ldr    r6, = STATIC1_SDRAM_ADDR_CTRL
    MV_REG_WRITE_ASM(r6, r5, DRAM_BUF_REG4)

SO - the STATIC1_SDRAM_ADDR_CTRL is being loaded into the location DRAM_BUF_REG4



<Continued Next Post>

Upgrading to 128M continued-2

We search for the text

DRAM_BUF_REG4

And we find in the file

mvDramIf

    /* calc SDRAM_ADDR_CTRL_REG  and save it to temp register */
    temp = sdramAddrCtrlRegCalc(&bankInfo[0]);
    if(-1 == temp)
    {
        mvOsPrintf("Dram: ERR. sdramAddrCtrlRegCalc failed !!!\n");
        return MV_ERROR;
    }
    MV_REG_WRITE(DRAM_BUF_REG4, temp);

The comment at the start of this file says

/*******************************************************************************
* mvDramIfDetect - Prepare DRAM interface configuration values.
*
* DESCRIPTION:
*       This function implements the full DRAM detection and timing 
*       configuration for best system performance.
*       Since this routine runs from a ROM device (Boot Flash), its stack 
*       resides on RAM, that might be the system DRAM. Changing DRAM 
*       configuration values while keeping vital data in DRAM is risky. That
*       is why the function does not preform the configuration setting but 
*       prepare those in predefined 32bit registers (in this case IDMA 
*       registers are used) for other routine to perform the settings.
*       The function will call for board DRAM SPD information for each DRAM 
*       chip select. The function will then analyze those SPD parameters of 
*       all DRAM banks in order to decide on DRAM configuration compatible 
*       for all DRAM banks.
*       The function will set the CPU DRAM address decode registers.
*       Note: This routine prepares values that will overide configuration of
*       mvDramBasicAsmInit().
*       
* INPUT:
*       forcedCl - Forced CAL Latency. If equal to zero, do not force.
*
* OUTPUT:
*       None.
*
* RETURN:
*       None.
*
*******************************************************************************/

So we have confirmation that the SDRAM_ADDR_CTRL_REG is definitly being loaded into a temp register.  However this file is looking for I2C SPD eeproms again

So look or other instances of DRAM_BUF_REG4

and we find it in the file

mvDramIfBasicInit

#define DRAM_BUF_REG4    0x20404    /* sdram address control        */

So we now have an address of the IDMA? register being used for DRAM_BUF_REG4.  That info will be usefull when we are looking through the DISASSEMBLED file

It also appears in the file

mvDramIfConfig

_mvDramIfConfig:      
        
        /* 3) Write SDRAM address control register */ 
        ldr     r1, =(INTER_REGS_BASE + DRAM_BUF_REG4)
        ldr     r4, [r1]
        ldr     r1, =(INTER_REGS_BASE + SDRAM_ADDR_CTRL_REG)
        str     r4, [r1]

Which is the part that writes to the SDRAM control register

This is in the dissaembled file

00003240:  e59f13b4  ldr      r1,#0x35fc ; = #0xf1020404
00003244:  e5914000  ldr      r4,[r1,#0]
00003248:  e59f13b0  ldr      r1,#0x3600 ; = #0xf1001410
0000324c:  e5814000  str      r4,[r1,#0]

So now we just have to find all the parts in the disassembled file that put info INTO location f1020404 and work out which one coresponds to the static load of 0x00

We search for #0xF1020404 in the Disassembled file and fine three likely candidates

00002ac4:  e3a06000  mov      r6,#0
00002ac8:  e59f56a8  ldr      r5,#0x3178 ; = #0xf1020404
00002acc:  e5856000  str      r6,[r5,#0]

00002b84:  e3a06020  mov      r6,#0x20
00002b88:  e59f55e8  ldr      r5,#0x3178 ; = #0xf1020404
00002b8c:  e5856000  str      r6,[r5,#0]

00003588:  e3a04000  mov      r4,#0
0000358c:  e59f1068  ldr      r1,#0x35fc ; = #0xf1020404
00003590:  e5814000  str      r4,[r1,#0]

My bet would be candidate 1

remeber code that we first found to load the static value in was

_mvDramIfStatic1Init:

    ldr    r6, = STATIC1_SDRAM_ADDR_CTRL
    MV_REG_WRITE_ASM(r6, r5, DRAM_BUF_REG4)

(note mov and ldr are similar instructions.  I am not an ARM expert but from a quick read mov is like ldr for an 8 bit literal)

othe other two options are precluded due to

option 2 is loading the literal 0x20 into the temp register (we are looking for the value 0x00)
option 3 is using the register r4 (the code we are looking for is using r6)

SO we have a new location to try modify

00002ac4:   e3a06000

must become

00002ac4:   e3a06030


So in your favorite Hex-Editor (I used Notepad++ with HEX plugin) you have to modify your bin file so that

Address 0000315f changes from 0x01 to 0x07
Address 00002ac4 changes from 0x00 to 0x30

Save the file to the USB stick.

Go back to the Linux Prompt on the router and use the DD command to write the two updated bytes (315F = 12639 decimal, 2AC4 = 10948 decimal)

dd if=/home/usb/mtd5.bin of=/dev/mtdblock5 bs=1 skip=12639 seek=12639 count=1
dd if=/home/usb/mtd5.bin of=/dev/mtdblock5 bs=1 skip=10948 seek=10948 count=1

Reboot and Robert is your aunties husband.


<Continued Next Post>

(Last edited by andrewm1973 on 9 Sep 2009, 08:31)

Upgrading to 128M continued-3

The paint by numbers version

_STEP ONE_  Read and understand previous 3 posts and more importantly read post by jdoering on the SLUG forum
_STEP TWO_ dont continue if you love your router too much to risk loosing it

Steps 3 and onwards......

go to u-boot

type

>md fffc3150

fffc3150: f100150c f1001514 f100151c 01ff0001    ................               
fffc3160: f101011c 03148400 f1020318 f1020114    ................               
fffc3170: 04041000 f1020320 f1020404 11602220    .... ....... "`.               
fffc3180: f102040c 0000040c f1040108 f1040114    ................               
fffc3190: f1041910 f1041a08 f1041a30 0fff0001    ........0.......               
fffc31a0: 03248400 0000030f f1001400 f1040000    ..$.............               
fffc31b0: 00005181 00005182 00005281 f1040008    .Q...Q...R......               
fffc31c0: f1001418 f100141c 00041040 f1001404    ........@.......               
fffc31d0: f1001410 f1001420 f1001494 f1001498    .... ...........               
fffc31e0: 00000a01 f100149c f10014c0 f10014c4    ................               
fffc31f0: 00f95001 f1010010 0047f001 0044d001    .P........G...D.               
fffc3200: f1001484 f1001408 f100140c 11812220    ............ "..               
fffc3210: ffff0000 e35d0000 0a000000 e92d001e    ......].......-.               
fffc3220: e59f13c4 e5914000 e59f13c0 e5814000    .....@.......@..               
fffc3230: e59f13bc e5914000 e59f13b8 e5814000    .....@.......@..               
fffc3240: e59f13b4 e5914000 e59f13b0 e5814000    .....@.......@..

If your output is not identical dont continue

type

>md fffc2ac0

fffc2ac0: e5856000 e3a06000 e59f56a8 e5856000    .`..0`...V...`..               
fffc2ad0: e59f66a4 e59f56a4 e5856000 e59f66a0    .f...V...`...f..               
fffc2ae0: e59f56a0 e5856000 e3a06000 e59f5698    .V...`...`...V..               
fffc2af0: e5856000 e3a06000 e59f5690 e5856000    .`...`...V...`..               
fffc2b00: e3a06000 e59f5688 e5856000 e3a06000    .`...V...`...`..               
fffc2b10: e59f5680 e5856000 e3a0d000 eb0001bc    .V...`..........               
fffc2b20: e1a0200a e1a0f00b e1a0b00e e1a0a002    . ..............               
fffc2b30: e3a06000 e59f5610 e5856000 e59f560c    .`...V...`...V..               
fffc2b40: e5856000 e59f5608 e5856000 e59f5604    .`...V...`...V..               
fffc2b50: e5856000 e59f6640 e59f5600 e5856000    .`..@f...V...`..               
fffc2b60: e59f6638 e59f55fc e5856000 e3a06062    8f...U...`..b`..               
fffc2b70: e59f55f4 e5856000 e59f65f0 e59f55f0    .U...`...e...U..               
fffc2b80: e5856000 e3a06020 e59f55e8 e5856000    .`.. `...U...`..               
fffc2b90: e59f65e4 e59f55e4 e5856000 e59f6600    .e...U...`...f..               
fffc2ba0: e59f55e0 e5856000 e3a06000 e59f55d8    .U...`...`...U..               
fffc2bb0: e5856000 e3a06000 e59f55d0 e5856000    .`...`...U...`..

If your output is not identical dont continue

type

>md f1001400

f1001400: 03148400 04041000 11602220 0000040c    ........ "`.....               
f1001410: 00000000 00000000 00000000 00000062    ............b...               
f1001420: 00000000 00000000 00063305 00000000    .........3......               
f1001430: 76543210 fedcba98 000100ff 00000000    .2Tv............               
f1001440: 00000000 00000000 00000000 00000000    ................               
f1001450: 00000000 00000000 00000000 00000000    ................               
f1001460: 00000000 00000000 00000000 00000000    ................               
f1001470: 065528d5 00000052 00000000 00006330    .(U.R.......0c..               
f1001480: 00000000 0047f001 00000102 00000001    ......G.........               
f1001490: 00000000 00000000 00000000 00000000    ................               
f10014a0: 00000000 00000000 00000001 00000000    ................               
f10014b0: 000001e0 00000000 00000000 00000000    ................               
f10014c0: 071f128a 071f128a 00000000 00000000    ................               
f10014d0: 00000000 00000000 00000000 00000000    ................               
f10014e0: f7ff4cff 00000000 00000000 0000000f    .L..............               
f10014f0: 00000000 00000000 00000000 00000000    ................

Make sure address f1001410 = 00000000

type

>md f1001500

f1001500: 00000000 01ff0001 10000000 00000000    ................               
f1001510: 20000000 00000000 30000000 00000000    ... .......0....               
f1001520: 00000000 00000000 00000000 00000000    ................               
f1001530: 00000000 00000000 00000000 00000000    ................               
f1001540: 00000000 00000000 00000000 00000000    ................               
f1001550: 00000000 00000000 00000000 00000000    ................               
f1001560: 00000000 00000000 00000000 00000000    ................               
f1001570: 00000000 00000000 00000000 00000000    ................               
f1001580: 00000000 00000000 00000000 00000000    ................               
f1001590: 00000000 00000000 00000000 00000000    ................               
f10015a0: 00000000 00000000 00000000 00000000    ................               
f10015b0: 00000000 00000000 00000000 00000000    ................               
f10015c0: 00000000 00000000 00000000 00000000    ................               
f10015d0: 00000000 00000000 00000000 00000000    ................               
f10015e0: 00000000 00000000 00000000 00000000    ................               
f10015f0: 00000000 00000000 00000000 00000000    ................

make sure location f1001504 = 01ff0001

boot to linux shell

type

cat /proc/mtd

dev:    size    erasesize name
mtd0: 00100000 00010000 "kernel"
mtd1: 00650000 00010000 "rootfs"
mtd2: 00510000 00010000 "rootfs_data"
mtd3: 00040000 00010000 "lang"
mtd4: 00020000 00010000 "nvram"
mtd5: 00040000 00010000 "u-boot"
mtd6: 00010000 00010000 "eRcOmM_do_not_touch"
mtd7: 00760000 00010000 "image"

Take note of you u-boot location

use the following command to save a binary image to the USB rive

dd if=/dev/mtdblock5 of=/home/usb/mtd5.bin count=00010000

(Note: your USB location and your MTDBlock number may be different than mine)

Use a hex editor to modify the following locations

Address 0000315f changes from 0x01 to 0x07 (data around this should look like 10 00 ff 01 if not dont continue)
Address 00002ac4 changes from 0x00 to 0x30 (data around this should look like 00 60 A0 E3 if not dont continue)

Save the file to the USB stick.

Go back to the Linux Prompt on the router and use the DD command to write the two updated bytes (315F = 12639 decimal, 2AC4 = 10948 decimal)

dd if=/home/usb/mtd5.bin of=/dev/mtdblock5 bs=1 skip=12639 seek=12639 count=1
dd if=/home/usb/mtd5.bin of=/dev/mtdblock5 bs=1 skip=10948 seek=10948 count=1

(Note: your USB location and your MTDBlock number may be different than mine)

reboot and go back to u-boot prompt

type >md f1001400 and >md F1001500 again to check the two locations of interest have changed.

f1001400: 03148400 04041000 11602220 0000040c    ........ "`.....               
f1001410: 00000030 00000000 00000000 00000062    ............b...               
f1001420: 00000000 00000000 00063305 00000000    .........3......               
f1001430: 76543210 fedcba98 000100ff 00000000    .2Tv............               
f1001440: 00000000 00000000 00000000 00000000    ................               
f1001450: 00000000 00000000 00000000 00000000    ................               
f1001460: 00000000 00000000 00000000 00000000    ................               
f1001470: 065528d5 00000052 00000000 00006330    .(U.R.......0c..               
f1001480: 00000000 0047f001 00000102 00000001    ......G.........               
f1001490: 00000000 00000000 00000000 00000000    ................               
f10014a0: 00000000 00000000 00000001 00000000    ................               
f10014b0: 000001e0 00000000 00000000 00000000    ................               
f10014c0: 071f128a 071f128a 00000000 00000000    ................               
f10014d0: 00000000 00000000 00000000 00000000    ................               
f10014e0: f7ff4cff 00000000 00000000 0000000f    .L..............               
f10014f0: 00000000 00000000 00000000 00000000    ................          

f1001500: 00000000 07ff0001 10000000 00000000    ................               
f1001510: 20000000 00000000 30000000 00000000    ... .......0....               
f1001520: 00000000 00000000 00000000 00000000    ................               
f1001530: 00000000 00000000 00000000 00000000    ................               
f1001540: 00000000 00000000 00000000 00000000    ................               
f1001550: 00000000 00000000 00000000 00000000    ................               
f1001560: 00000000 00000000 00000000 00000000    ................               
f1001570: 00000000 00000000 00000000 00000000    ................               
f1001580: 00000000 00000000 00000000 00000000    ................               
f1001590: 00000000 00000000 00000000 00000000    ................               
f10015a0: 00000000 00000000 00000000 00000000    ................               
f10015b0: 00000000 00000000 00000000 00000000    ................               
f10015c0: 00000000 00000000 00000000 00000000    ................               
f10015d0: 00000000 00000000 00000000 00000000    ................               
f10015e0: 00000000 00000000 00000000 00000000    ................               
f10015f0: 00000000 00000000 00000000 00000000    ................

Did a quick test with another XP system, also this system could't connect. Seems the only system that can connect with my config is the windows 7 system.

Tonight I will do some wireless sniffing to see what's the difference between Windows 7 and XP connecting. Starting my OpenVPN tests now.

maddes - i have not forgotten about you.

I just got tied up a bit with the ram upgrade and have not had a chance to open one of the new routers to take photos and save images for you.

will do that in the next day or so.  right now i need rest