Hi,
I want to use OpenWRT on my Ravotek WRT54G (very similar to the Belkin 7230, if not the same).

I downloaded the buildroot-20040916, let it build (with pppoecd embedded), prepended the (PMON?-)Header to the trx file and loaded  it to the router.
It boots fine but won't connect to my ISP via PPPOE.

The nvram-setup seemed to be fine, so I tried pppoecd with param "-d" (and username&password) and it just printed "Sending PADI" and timed out,
it doesn't retrieve any data from the modem, the wan-interface (eth1) also just shows TX and no RX.

Furthermore, does someone know how I can get wlan up on this router, the belkin firmware does the job, but no Linksys-like firmware.
Does that depend on the miniPCI interface on my router?
It's not that critical because I don't use wlan at the moment, but it would be fine being able to run it.

Any ideas?

Thanks,
antimac.

Don't know exactly what but the "150-mppe-mppc-0.98.patch" broke the ability of my router to dial in via pppoe (no ret packages).
I am trying to figure out more but if someone knows on what this may depend, tell it.

After exchanging the belkin "wl" "shared" and "et" folders with these used by openwrt (in OEM buildroot) wireless lan worked!
But I think it mostly depended on the shared folder in this case.

Some more about the router:
boardtype=bcm94710r4
proc/pci output appended

Hope it helps to integrate other routers.

Ciao,
antimac.

Big mistake of me.
I think the pppoe problem came from the et drivers, I think in /et/sys/etc-47xx.c (may test this later when no one needs the net-connection ).

The wlan-card problem should has been in the /shared/sbpci.c, a 4712-"Workaround" denied my router to probe the mini-PCI, there's no need to use the belkin wl-module-binaries, those packaged works well (as far as I tested ).

I appended a patch for bcm94710r4 (check with 'nvram get boardtype') boards, to be applied from buildroot. (with WRT54GS-src 2.07.1!! the 3. version might work)

antimac

This patch was also needed for my Belkin F5D7230-4 version 1111tt.  Without it, wl.o did not load and thus I had no WLAN connectivity.

Thanks for your help.

WCB, you suggestin' that you've got OpenWRT on the F5D7230-4?  I've just published my work online here; http://midnightcode.org/papers/OpenWRT% … 7230-4.pdf for a root shell and additional info -- but I haven't yet found a way to get the OpenWRT works installed.

Any info would be helpful.

Can't help you on how to get openwrt on it. However, with only 2M flash, it is unlikely you can squeeze openswan into it. Even the bare system is a bit tight, you may need to give up the jffs2 in order for it to function.

The only way I see to have openwrt working on this 2M device is to use NFS, i.e. boot into the bare openwrt which is a standard feature NAT router(already quite flexible and powerful) then chroot/pivot_root to a nfs root. The only issue seems to be it that it would be a bit noisy for a 24/7 NFS server in a home. May be get the NSLU2 as the server. But why not get a better one in the first place,  WRT54G(S) is pretty cheap now and the WL500G even has USB port.

I have a V2 which has only 4M flash and is already pretty tight to have my desired feature on it.

Space shouldn't be too bad.  I've worked on embedded systems before (though I have had more space to work with) - the busybox in the OpenWRT distro is pretty fat .. prolly cause its quite feature rich.  The squashfs also buys a fair chunk of space.

If I could get my own kernel booting to my own init ... I'd be a happy dude ..

Don't know about Belkin, but standard WRT use 256k for its boot loader, 64k for its nvram leaving only about 1.7M for you. The bare system now takes about 1.5M, which is already squashed. You may be able to trim a bit from busybox but I failed to gain too much from it. Beside, it really is needed to be as it is now(in fact some is missing) if you need anything beyond the standard features.

So I should put you down for an order of one when I get it working then, eh?  ;-)

huh ? I am lost.

You're saying its not really do-able, I'm saying I'm going to do it - so if you want one when I'm done let me know

If I can get my own kernel and my own rootfs booting, then I should be right to finish the job.

The 1111tt has a 4MB flash, so the only hurdle I encountered was in finding out I needed this patch (and finding all of the openwrt prereqs that are no longer available online).  Since I only bought it a week or two ago, I suspect there may still be a few of these on store shelves.

As for the new 1444 (2MB) unit, I just modified the cramfs for a root shell and uploaded the new trx (with no LOAD header) via the bootloader.  It's nice to see that you documented the combined trx+nvram format, since bricking the unit in order to reflash was not exactly optimal.

I expect to use the 1444 for some simple task which does not involve the use of openwrt.

Actually, I took a look at the F5D7231-4 at Harvey Norman last weekend .. @ AU$179 ... and it looks like it might be the WRT54GS equivalent ... might be worth a buy later on ... wanna get the 7230-4 sorted first.

Ok .. so how did you upload and write it? 

Ie;  Retrieved it -
  Mount an NFS?
  wget the file?

Wrote it -
  dd to the flash ..?

Thanks for this info - very helpful.

First time around, I started to upload a real Belkin flash through the web interface, and yanked out the power after it had written a few sectors.  I then used tftp to upload a .trx through the bootloader, since the checksum was (intentionally) messed up from the partial reflash.

After I bricked it by uploading an incompatible 3.x firmware, I started shorting pins on the flash to get CFE to take a tftp upload.

Keep in mind that I'm paying about $20 USD after rebate for these devices and can reflash out of circuit, so my tolerance for activities likely to fry them might be higher than average.

That's odd .. I tried the pre-shelled 3.x firmware, which failed - then used the OpenWRT-published tftp method to upload the factory 4.00.03 firmware. So this suggests that the PMON (as referred in the Broadcomm PDF - see below) firmware ("bios") is capable of receiving both formats (TRX and Extended) ?  I got the impression (through experimentation) that incorrectly formated / checksummed / sized / etc firmware was simply dropped, and the old firmware kept for next boot.

What's more surprising is that this means that the OpenWRT TRX works, as-is ? (at least for booting the device and getting onto the network -- noting your patch requirement above for wireless).

If that's the case, then are you open to experimenting with a serial port on this board?  If I can get console output it would greatly aid debugging.

I downloaded the GPL tar bundle from Belkin a couple of weeks ago, but only started reading it last night. In there is a PDF (Linux and VxWorks Resource Guide)from Broadcomm that covers the entire development environment that Belkin published in that same tar ball.

On Page 27 of that PDF there is a section called "Choosing Internal or External UART". It basically provides details for using one of the ethernet ports as a serial console. However, I'm not sure I can get the correct software configuration for this to operate correctly.

If, however, the OpenWRT TRX should be working, then perhaps my extended header builder is not quite correct .. (?)  Which OpenWRT build did you boot successfully?  I might try to replicate your work.  I built mine in a VM - I didn't use one of the bre-built nightly's ..

The custom trx I uploaded was a 4.03.03 firmware I modified as follows:

stripped the LOAD header and nvram vars
split the kernel and cramfs
copied the cramfs contents to my hard drive
deleted a bunch of stuff (web pages, binaries, etc.) to make space
added the fake httpd (which is really busybox set up as a telnetd), from the hacked 3.00.07 image
repacked the cramfs
ran "trx" to merge the kernel and cramfs
uploaded via tftp

This got me a shell with minimal effort.

I did not have any luck uploading the openwrt firmware to the 2MB device.  IIRC the flash took but it just kept rebooting.  I did not investigate it further.

I used a valid Belkin image with LOAD header, but interrupted it during flashing.  Since the device erases a block at a time, then programs a byte at a time, power interruptions are very likely to corrupt the image (which was the point).

Sure.

Ok - thanks for explaining the process - makes sense.

Yes, there is roughly what I saw too - even with the correct header wrapped around it.  I suspect its not finding something ... rootfs or similar ...

With the serial port stuff ... I have a sticker on mine that says its a version "1000" .. internally it has no compact PCI board ... and it has two header connectors ...  J7 and J2.

-- J7 is a 10pin connector with pins 1,2,3,5,7,9 at +3.3v - the others grounded.
This connector is physically different, but logically looks like it might be the Linksys dual-serial interface; http://www.rwhitby.net/wrt54gs/serial.html

If it was the same as the Linksys, then this would be great, as the linksys appears to use the same main i/o chip - the BM4712; http://rage.against.org/LinksysWRT54G

-- J2 is a 4pin connector with pins 1,3 at +3.3v and the other two at ground.
This connector looks a lot like an internal USB connector; http://www.starmount.co.uk/s_usbpin.htm

I used a HIN232CP chip (instead of the MAX232) or the circuit on J7, but failled to find any serial output from the Belkin.  I know it is configured to use a 115,200bps serial interface as its console .. but I can't find that console.

I had considered adapting J2 to a USB connector for my PC, but figured that it was probably a master device on the Belkin ... so *perhaps* a USB-to-Serial cable on this port might work .. but that's getting pricey too .. especially if it doesn't work ...

Any ideas?

Further to this, in another forum, a good netizen found a Sveasoft post and published it;

http://www.clanspace.com/forum/remark,1 … 9~start=20

.. giving the pinouts of J2, as;

"The 4 pin white connector is definitely the serial port (well my scope say so anyhow) running at 115Kbps, with 3.3V levels. The markings on it seems to be CKN16, and it looks like a 2mm pin-pitch. Looking down with the notch on the left side and calling the top-most pin 1:

Code:

+-----+
| 1 | RXD
2 | GND
3 | TXD
| 4 | NC
+-----+

"

... I'm still not sure what I'm missing .. I can get garbage out of that port (with the port at 115,200 8n1) at about the rate that would be consistent with a kernel boot on such a device ... I've posted (big) images here;
http://midnightcode.org/projects/f5d7230-4/

I'll get smaller pix up when the page design is done.

Any thoughts are welcome ... (I've tried various speeds and port settings, but this speed and setting combo gives the "best" results).

I had the following link posted to me last night just after we got serial working too;

  http://www.efn.org/~rick/work/f5d7230/

D'oh.  Cool tho - good to see people working on this.

You definitely want J2 .. the pinouts are;

   ____________________ 
   |_PWR_GND  TXD_RXD_| 

.. or .. 

  +-----+ 
  |  1  | PWR 
     2  | GND 
     3  | TXD 
  |  4  | RXD 
  +-----+

A new PDF will be posted on the weekend.

Thanks for your help guys .. next step is kernel differences .. patching and booting ...

Hello all,

  The Belkin F5D7230-4 Serial Console document has been published.

The work of the first paper has been widely accepted, but successful deployment of
OpenWRT has not ensued. Hidden or unknown errors in the boot process have lead
the author to seek a means for attaining console access so that productive debugging
(rather than guesswork) could be employed in the development process.

By collating a mass of publicly available information, and experimenting with a single
unit, the paper concludes by providing a physical console into the device, providing
local root user level access, and a schematic diagram for a solder-less project that will
allow individuals to try this experiment for themselves. It is hoped that this
information can be used to debug open source firmware and to then adapt the
OpenWRT, and Sveasoft, embedded Linux distributions for this Belkin router.

Document URL;
  http://midnightcode.org/papers/OpenWRT% … onsole.pdf

Document Directory URL;
  http://midnightcode.org/papers/

Thanks,

commited to the CVS, thanks

The latest paper is completed;
  OpenWRT on the Belkin F5D7230-4 - Compiling and Installing the GPL Broadcom Reference Firmware

  "
  Belkin published the Broadcom reference firmware;
  a small Linux distribution, designed to act as a 
  proof-of-concept and development environment for 
  the Belkin engineers. To minimize the amount of 
  experimentation required to adapt the OpenWRT and
  Sveasoft firmware for use on the Belkin, the 
  published Broadcom reference firmware was compiled
  to see if it was functional, and able to provide 
  driver and configuration information for the open
  source distributions.
  ...
  Furthermore, this process was developed rapidly
  due to the excellent work performed by Rick
  Bronson. Rick published the findings of his work
  on his web site and has been very supportive of 
  the development process;
    http://www.efn.org/~rick/work/f5d7230/
  "

Document URL;
  http://www.midnightcode.org/papers/Open … rmware.pdf

Document Directory URL;
  http://midnightcode.org/papers/

This is a photo of the board from the new Belkin f5d7230-4 version 2000.  Obvious physical changes from v1444:

comes in a white box (not red anymore)
smaller cpu form factor
flash is a 16Mbit serial device, instead of a 16Mbit parallel device
RAM is a 64Mbit ISSI device
BCM5325 is used in place of the ADM 6996L chip
case is only as wide as the board (v1444 case was wider)
disassembly involves removal of two screws; damaging/removing the sticker is no longer needed

I found this device today (2004/12/26) at CompUSA for $9.99 AR.

anyone get the 2mb f5d7230 working with openwrt?

I tried several of the latest trx files and the belkin keeps rebooting.

openwrt b3 runs but it puts me in fail safe mode and the ethernet ports don't work.  I can telnet through the wireless connection though.

I have forced the transmit power on my v1444 F5D7230-4 to ~47mW (dB=0x43) by making the following modifications to wl.o on firmware 4.03.03:

77b4: 7f -> 43
b9d4: 21 18 40 00 -> 43 00 03 24

Observations:

- I could not find a copy of belky.c, so I had to extract it from the pdf file and correct the formatting (attached)
- belky.c didn't work anyway; I wound up bricking it again to reflash, because the new image generated by belky supposedly had a checksum error
- there is no "wl" binary on this firmware version, and I wasn't able to locate the userland program that calls the "set power" ioctl; therefore patching the kernel module was the quickest way to get the job done
- oddly, the new cramfs is about 9k smaller than the original, even though I only changed 5 bytes