OpenWrt Forum Archive

Topic: OpenWrt for Sweex WF514 / LC000060?

The content of this topic has been archived on 6 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi All,

I'd like to install OpenWrt on my Sweex WF514 (aka LC000060), according to the firmware (google for the firmware already contains linux:

od -t x1 -t a WF514-200713T2.img

0020020 55 6e 63 6f 6d 70 72 65 73 73 69 6e 67 20 4c 69
          U   n   c   o   m   p   r   e   s   s   i   n   g  sp   L   i
0020040 6e 75 78 2e 2e 2e 20 0a 00 00 00 00 4f 6b 2c 20
          n   u   x   .   .   .  sp  nl nul nul nul nul   O   k   ,  sp
0020060 62 6f 6f 74 69 6e 67 20 74 68 65 20 6b 65 72 6e
          b   o   o   t   i   n   g  sp   t   h   e  sp   k   e   r   n
0020100 65 6c 2e 0a 00 00 00 00 1f 8b 08 08 a4 70 0f 41
          e   l   .  nl nul nul nul nul  us  vt  bs  bs   $   p  si   A
0020120 02 0b 55 4e 45 58 2d 47 49 53 4c 2d 54 2d 4c 32
        stx  vt   U   N   E   X   -   G   I   S   L   -   T   -   L   2
0020140 2d 32 30 30 37 31 33 54 32 5f 55 2e 62 69 6e 00
          -   2   0   0   7   1   3   T   2   _   U   .   b   i   n nul
0020160 ec 5c 7f 6c 14 d7 9d ff ce cc da ac cd 02 6b 7b
          l   \ del   l dc4   W  gs del   N   L   Z   ,   M stx   k   {
0020200 0d 6b 6a f0 6e 76 c7 5e 82 8f 2c 61 09 76 b3 09
         cr   k   j   p   n   v   G   ^ stx  si   ,   a  ht   v   3  ht

I've attached an serial cable to the board (MAX232) and the bootlog shows the following:

Power-On Self Testing...
Testing SYS Controller...
Testing MEM Controller...
SDRAM Configuration:ROW11_COL8_BANK2
Testing SDRAM Memory ...
From 0x80000000 - 0x807FFFFF
Testing CPU Data RAM...
Testing CPU Internal Registers...
Testing Timer 0...
Testing Timer 1...
Testing DMA Controller...
Testing INT Controller...
Testing PCMCIA Controller...
Testing USB Controller...
Testing Ethernet 0 MAC...
Testing Ethernet 1 MAC...
Testing Cardbus...
Testing PCI...
Power-On Self Test Passed

          Bootloader Version 00-03-02, Aug 29 2003 21:45:21

       Copyright 2003. All rights reserved. 

Press any key to stop auto-boot...

========POR reset========
****** Now used Flash Size: 1MB ******

Start of heap: 0x8065b390
End of heap: 0x80800000
Initializing LANSW!
Initializing LANSW done!
ifdata.if_name[0] is eth0
ifdata.if_name[0] is eth1
ifdata.if_name[0] is wls0

Firmware Version: 20-07-13T2, Aug 02 2004 11:53:05
Copyright 2002-2003. All rights reserved. 
Scanning PCI Bus...
    scan PCI deviceNo=1
      Found ISL3890 Wireless Device: PCIDEV=1, DEVNUM=4, NICNO=0
***iface=2, dev_num=4
PHY is switch controller ***IP175A***!
Network PORT 1 <--> 100M Full Duplex

WLAN0 Zone Number is 0
******** WLAN Disabled *******
******* AP CONFIG LAUNCHED *******
******** Isolated Disabled *******
********prohibited configuration Disabled *******
WLS Channel number is 6 
Finished wlan firmware download
br0: port rootport) entering listening state
br0: port rootport) entering listening state
NAT/Firewall starting...
MaxSessionNumber: 65536
NAT/Firewall started!
Now try to get the configuration file...
interface eth1 uses following ip settings:
Initialization of NAT/Firewall policy database succeeded!
load_pptp_wan: encryption option=e1
L2TP: started
network_thread started
WPA disabled!
WPA init.....
1x is disbled(0)!
dhcp_update_table called, iface=1
start_ip=, end_ip=
route_cfg_update: dycfg.tx_protocol=0, dycfg.rx_protocol=0, dycfg.mode=0
br0: port rootport) entering learning state
br0: port rootport) entering learning state
br0: port rootport) entering forwarding state
br0: topology change detected, propagating
br0: port rootport) entering forwarding state
br0: topology change detected, propagating
dhcp_update_table return

Entering help on the SD9218 promp shows the following:

   general         - main menu
   sysconfig       - sysconfig menu
   ifconfig        - ifconfig menu
   debug           - system debug menu
   diagnostic      - diagnostic aid menu
   dhcpsrv         - DHCP server
   firewall        - firewall menu
   sntp            - SNTP menu
   wdog            - Watch dog menu
   log             - WAN log menu
   mppp            - PPP managemnt menu
   wlan            - wlan menu
   pppoe           - pppoe menu
   pptp            - PPTP
   u_mctestc       - u_mctest client menu
   ping            - menu to set/view values for ping
   tftps           - tftp server menu
   rip             - RIP menu
   l2tp            - L2TP menu
   wpa             - wpa menu

These are pictures of the board:

The Mini PCI card is an ISL3890

Could someone please give me some hints / suggestions how I could run openwrt on this board?

Many thanks!

Looks like with 1MB space, you won't be too successful.

The boot menu shows the following:

                       Main menu

        ?         - print this menu
        f         - load from Flash and go
        l         - load from TFTP server to SDRAM (no save to Flash, no go)
        L         - load from TFTP server to SDRAM and go (no save to Flash)
        @         - load from TFTP server to SDRAM,save to Flash and go
        g         - go from address
        b         - show boot parameters
        c         - change boot parameters
        d         - display factory default parameters
        m         - modify/set factory default parameters
        p         - ping test (ping other station from the target)
        r         - read memory
        s         - change mac address only
        w         - write memory

Maybe I could/should use the load from TFTP server to SDRAM and go to overcome the 1MB flash limit?

There seems to be 8 MB SDRAM present, is this sufficient?

8mb ram is sufficient to run linux, but you will find it hard to do more then very specific tasks. loading from tftp to ram is very useful for testing, as it's fast and doesn't use flash cycles, but i'd think you'd want to get something fit into the flash for more normal use smile ?

It seems to use RTOS TX image format. Anyone know this format? I have the LC00060. I'm interested in testing.

I have a similar system, however it is inside a NC1200 WiFi enabled IP Camera.
So far I have hacked around, and added a serial port for debug and a USB port (it looks as though you can do the same with the LC000060 by populating the filter U3 and USB connctor J3).
I get debug saying that my USB memory stick has enumerated, but I don't have enough RAM to mount it (16MB RAM, 4MB Flash)

The bootloader is the same as above, and requires a specially formatted image file to TFTP correctly.
I have written some code that does this.

I am now at the stage where I am trying to modify the initrd image which ends up as the rootfs for the device after boot.
My motivation behind this is that the current firmware is too unstable, and can only stream images for about 4 hours, so I am re-using the hardware.
Unfortunately the manufacturer has not been forthcoming in providing the SD9218 linux kernel source - this is a shame, as it is the only step left to get this system on the open road!

It is running linux-2.4.17_mvl21, presumably from the board support package.

The following are my notes whilst trying to reverse engineer this thing:

Data organisation:
0x80010000 == Offset 0x00000070 (kernel?)
0x80100000 == Offset 0x000F0070
0x80200000 == offset 0x001f0070 (initrd)

The information below was learned from the NC1200-W10 firmware 

Image file format: 
File length = 0x27CF28

Header specific to the NC1200.
00 00 00 00 - unknown
00 27 ce f8 - data length? (file length - 0x30)
34 12 00 00 - unknown
04 9a 4f ba - unknown
40 00 93 bb - unknown
63 29 32 3c - unknown
2e 25 24 61 - unknown
65 40 71 00 - unknown
73 53 32 24 - unknown
37 5f 26 28 - unknown
40 30 49 7d - unknown
75 79 30 26 - unknown 

Header common to NC1200 and Sweex WF514 / LC000060
(This is what the bootloader tftp requires)
27 05 19 56 - Header Magic
ba 92 6e af - Header checksum (32-bit CRC init 0, XOR 0)
45 20 9f 14 - unknown
00 27 ce b8 - Data length
80 01 00 00 - Load address
80 01 00 00 - Entry point
a3 5a b4 66 - Data Checksum (32-bit CRC init 0, XOR 0)
12 0c 02 00 - Image type (12 0c 02 01 = R3000C RtosTx Kernel Image (gzip compressed)?)
                         (12 0c 02 00 = R3000C RtosTx Kernel Image (uncompressed)?)
32 bytes    - ASCII description for data.

Some offsets into the main .img file: 
(gzip data)
0x00003440 - gzipped data for the Linux kernel and filesystem (must be kernel + initrd)
Within this gzipped data, 
0x001f0000 - ramdisk ext2 filesystem. 

dd if=C61200-WX-2.00.01-61002-A0.img bs=13376 skip=1 of=offset_00003440
dd if=offset_00003440 bs=2031616 skip=1 of=offset_001f0000.gz

gunzip offset_001f0000.gz
mount -o loop offset_001f0000 mountpoint
This is the RAM disk mounted at boot.
umount mountpoint
gzip -9 offset_001f0000

Source code for create_header:

/* This is a hacked up application that will add a header to raw data
 * for loading into a SD9218 SoC. */
 /* It is completely dumb, and will probably wreck your hardware */
 /* You have been warned :) */

#include <stdio.h>
#include <string.h>
#include <sys/types.h>

static const unsigned long crcTable[256] = 

unsigned int calculateCrc(unsigned int crc, unsigned char * pucData, unsigned int length)
    unsigned int i;

    for(i = 0; i < length; i++)
        crc = crcTable[(crc ^ pucData[i]) & 0xff] ^ (crc >> 8);

    return crc;

write32ToBE(unsigned char *data, unsigned int value)
    *data++ = ((value >> 24) & 0xFF);
    *data++ = ((value >> 16) & 0xFF);
    *data++ = ((value >> 8) & 0xFF);
    *data++ = ((value >> 0) & 0xFF);

unsigned int read32FromBE(unsigned char *data)
    unsigned int value;

    value =  ((*data++ << 24) & 0xFF000000);
    value |= ((*data++ << 16) & 0x00FF0000);
    value |= ((*data++ <<  8) & 0x0000FF00);
    value |= ((*data++ <<  0) & 0x000000FF);

    return value;

unsigned int read16FromBE(unsigned char *data)
    unsigned int value;

    value = ((*data++ <<  8) & 0x0000FF00);
    value |= ((*data++ <<  0) & 0x000000FF);

    return value;

int main (int argc, char **argv)
    FILE *inFile, *outFile;
    char *filename;
    char outFileName[]="zrtos.img";
    long dataLength = 0;
    int i, j;
    unsigned char *ptr;
    unsigned char readBuffer[1024];
    unsigned char headerBuffer[64];
    int bytesRead;

    unsigned int headerChecksum = 0;
    unsigned int dataChecksum = 0;
    unsigned int loadAddress = 0x80010000;
    unsigned int entryAddress = 0x80010000;
    unsigned int imageType = 0x120C0200;

    if (argc != 2)
        printf("Please supply %s <filename>\r\n", argv[0]);
        return 1;

    filename = argv[1];

    printf("Creating SD9218 boot image...\r\n");

    inFile = fopen(filename, "rb");
    if (inFile == NULL)
        printf("Unable to open %s for reading.\r\n", filename);
        return -1;
    outFile = fopen(outFileName, "wb");
    if (outFile == NULL)
        printf("Unable to open %s for writing.\r\n", outFileName);
        return -1;

    // Ok, we have our source and destination files, lets generate the header.
    if (fseek(inFile, 0, SEEK_END))
        printf("Unable to get file length.\r\n");
        return -1;
    dataLength = ftell(inFile);
    if (dataLength == 0)
        printf("Please supply a file with some data in it!\r\n");
        return -1;

    // Reserve 64 bytes for the header.
    memset(headerBuffer, 0, sizeof(headerBuffer));
    fwrite(headerBuffer, 1, sizeof(headerBuffer), outFile);

    dataChecksum = 0;
    for (i=0; (i<dataLength) && (bytesRead > 0); i+=bytesRead)
        bytesRead = fread(readBuffer, 1, sizeof(readBuffer), inFile);
        fwrite(readBuffer, 1, bytesRead, outFile);
        dataChecksum = calculateCrc(dataChecksum, readBuffer, bytesRead);

    // Now populate the header.
    write32ToBE(&headerBuffer[0], 0x27051956);    // Magic number
    write32ToBE(&headerBuffer[4], 0x00000000); // Header Checksum
    write32ToBE(&headerBuffer[8], 0x45209f14);    // Unknown
    write32ToBE(&headerBuffer[12], dataLength);    // Data Length
    write32ToBE(&headerBuffer[16], loadAddress);    // Load Address
    write32ToBE(&headerBuffer[20], entryAddress);    // Entry Point
    write32ToBE(&headerBuffer[24], dataChecksum);    // Data Checksum
    write32ToBE(&headerBuffer[28], imageType);    // Image Type
    strcpy(&headerBuffer[32], "LinuxImage");

    // Calculate the header checksum.
    // (This isn't a checksum at all, it's a CRC...
    headerChecksum = calculateCrc(0, headerBuffer, sizeof(headerBuffer));

    write32ToBE(&headerBuffer[4], headerChecksum); // Header Checksum

    printf("Data Size:        %d Bytes\r\n", dataLength);
    printf("Load Address:     0x%08X\r\n", loadAddress);
    printf("Entry Point:      0x%08X\r\n", entryAddress);
    printf("Header Checksum:  0x%08X\r\n", headerChecksum);
    printf("Image Checksum:   0x%08X\r\n", dataChecksum);

    fwrite(headerBuffer, 1, sizeof(headerBuffer), outFile);

    fclose (outFile);
    fclose (inFile);

    return 0;

For anyone that cares, I have now successfully built and deployed my own root filesystem onto the NC1200-W10 IP camera (uses the SD9218 SoC).

Original image (required by script) is available from the manufacturer here: … 002-A0.rar

Using buildroot, MIPS I generic, big endian, softfloat and a minimal package selection, generate a new ramdisk with the apps that you require.

To create the ramdisk:

dd if=/dev/zero of=ramdisk bs=1024 count=6144
mkfs.ext2 ramdisk
mkdir mnt
mount -o loop ramdisk mnt

Now untar the rootfs generated by buildroot into the new ramdisk (mounted on mnt).

umount mnt
gzip -9 ramdisk

echo "Replacing ramdisk with $1"

# Extract the Kernel from firmware image
dd if=C61200-WX-2.00.01-61002-A0.img bs=13376 skip=1 of=kernel.gz
cp C61200-WX-2.00.01-61002-A0.img C61200-WX-custom.img
gunzip kernel.gz
# Overwrite the existing ramdisk with our new one
dd if=/dev/zero of=kernel bs=1 seek=2031616 conv=notrunc count=1929216
dd if=$1 of=kernel bs=2031616 seek=1 conv=notrunc
gzip kernel -v9

# Clear a space for our image.
dd if=/dev/zero of=C61200-WX-custom.img bs=13376 seek=1 conv=notrunc count=192

# Put it back into the firmware image.
dd if=kernel.gz of=C61200-WX-custom.img bs=13376 seek=1 conv=notrunc
rm kernel.gz

# Create a tftp compatible image
dd if=C61200-WX-custom.img of=C61200-WX-custom.raw bs=112 skip=1
./create_header C61200-WX-custom.raw

rm C61200-WX-custom.raw

This script will keep the existing kernel, but replace the ramdisk with a new one (./<script name> ramdisk.gz).

The output is a file "zrtos.img" fire up a tftp server, and point the bootloader of the SD9218 towards this file.
If you use the option 'L' in the bootloader, it will load the file into RAM, verify it, then boot it.
DO NOT use the '@' option until you want to flash it permanently.

Can you describe in details how to populate USB (J3, U3 of LC000060) ?
The offset 0x00003440 of LC000060 image isn't correct.
The kernel offset is 0x00002048. How find the correct ramdisk offset ?

(Last edited by neteagle on 18 Aug 2007, 08:09)

Hi neteagle,
I have not populated this board, the NC1200 camera PCB is completely different.
However, looking at just the images above, J3 looks like a standard USB connector (butcher an old USB HUB or something for one).
U3 looks like a USB filter IC.
Pins 1 and 5 should connect together.
Pins 4 and 8 should connect together.
Pins 2 and 6 should be connected with a 33 Ohm resistor.
Pins 3 and 7 should be connected with a 33 Ohm resistor.
Connect a 15K resistor between pins 2 and 4.
Connect a 15K resistor between pins 3 and 4.

As I said, I don't know if this will work, but it looks like it should (standard USB line matching).

Regarding the ramdisk offset - I wrote a script that went through the whole binary looking for gzip headers.

If it finds a header, it dumps the data to a file.
I then ran

for file in `ls *.gz`; do gunzip $file; done

To see if it was valid data.

I then worked out how long the original data was by re-gzipping (with -9 for max compression) to see what size it compressed back to.
I made my script zero out this area and put a new gzip back in it's place.
You will need to do this both for the ramdisk, and the gzipped kernel image.
(There is a gzip inside a gzip).

I hope this makes sense!

I found only the gzipped kernel:
UNEX-GISL-T-L2-200713T5_U.bin 1,83Mb uncompressed.

No gzipped ramdisk.


What's the J213 serial port pinout ?

Hi neteagle,

I have no idea what the pinout is!
On my camera board, I got an oscilloscope and probed each pin at boot until I saw serial data.
I then guessed which pin I thought would be RX, and tried it. (You'll need to make a 3.3v to RS232 serial converter too).

Regarding the kernel,
the ramdisk is embedded in the kernel - you will need to run the find_gzips exe on the .bin to find the ramdisk.

art103 wrote:

I have no idea what the pinout is!
On my camera board, I got an oscilloscope and probed each pin at boot until I saw serial data.
I then guessed which pin I thought would be RX, and tried it. (You'll need to make a 3.3v to RS232 serial converter too).

1) You didn't guess correctly and blew your board.
2) You're blind and can't see the soldered wire on your board.
3) You really have no clue and enjoy posting on info you really know nothing about.
4) You don't believe in free information and just want to be an ass.

I would like to repond to hi_five's very kind and constructive comments:

1) My guess was only for the TX pin, and it was a good guess as I got to an interactive shell. My board is still fine.
2) No, I just don't have much spare time, and going up into the loft to retrieve and pull apart my camera didn't really appeal.
3) I enjoy posting, as I hope some one will pick up the work I have started and make further progress.
I'd like to see you reverse engineer the image format and re-create your own rootfs - I assume the reason for your comments is that you can't smile
4) I think free information is essential. If you opened your eyes a little, you would see a number of (software) projects that I have undertaken and fed back into the community.

Below is an image of the serial pinout. You need a SP3232 or equivalent RS232 convertor.

TX and RX are relative to the Camera, not the PC.

The image that you found looks like the correct one, you need to compile and run the find_gzips.c code that I posted to find the offset into the image where the embedded ramdisk is stored.

The discussion might have continued from here.