OZOnet Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== OpenWRT-OZOnet HowTo ======

Το **openwrt** υποστηρίζει μια μεγάλη γκάμα συσκευών τις οποίες μπορεί να μετατρέψει σε linux κουτιά με υποστήριξη σε ότι τελευταίο υπάρχει γύρω από τον τομέα του **WiFi**.  Εδώ θα μιλήσουμε για το **asus-wl500** και το **toshiba wrc-1000** δύο συσκευές συμβατές με τη κλασσική συσκευή **wrt54g** της linksys με την διαφορά ότι έχουν mini PCI κάρτες οι οποίες αλλάζουν σε prism2 ή atheros.

Το βασικό στην αναβάθμιση αυτών των συσκευών είναι η δυνατότητα που έχουν για αυτόματο tftp flashing με το που ξεκινούν την  λειτουργία τους το λεγόμενο **bootwait**. Συγκεκριμένα το asus ακούει στην 192.168.1.1 και το toshiba στην 192.168.10.1 για tftp firmware flashing με το που ξεκινούν.

Παρακάτω ακολουθεί η διαδικασία αναβάθμισης των δύο αυτών συσκευών με openwrt-ozonet firmware.

Θα χρειαστούμε ένα linux περιβάλλον με ένα GNU/Linux LiveCD της αρεσκείας σας. Κατεβάζουμε το firmware από εδώ:
<code>
wget http://wifi.ozo.com/airo/openwrt/firmware/madwifi/latest/openwrt-brcm-2.4-jffs2-4MB.trx
</code>

Για το asus οι εντολές για firmware flashing είναι:
<code>
tftp 192.168.1.1
binary
trace
get ASUSSPACELINK\x01\x01\xa8\xc0 /dev/null
put openwrt-brcm-2.4-jffs2-4MB.trx ASUSSPACELINK
quit
</code>
και για το toshiba:
<code>
tftp 192.168.10.1
binary
rexmt 1
timeout 60
trace
put openwrt-brcm-2.4-jffs2-4MB.trx
quit
</code>
αφού τελειώσει με επιτυχία η διαδικασία του flash περιμένουμε 1-2 λεπτά και μετά κάνουμε ένα:
<code>
telnet 192.168.10.1 
</code>
ή 
<code>
telnet 192.168.1.1
</code>
ανάλογα τη συσκευή και δίνουμε ένα: 
<code>
reboot
</code>  

Μετά από 2 λεπτά κάνουμε πάλι telnet και είμαστε έτοιμοι να αρχίσουμε να εγκαθιστούμε τα βασικά προγράμματα που χρειάζονται για τη λειτουργία του router.

Η εντολή είναι: 
<code>
ipkg install http://wifi.ozo.com/airo/openwrt/Packages/ipkg/wr5-ozonet/file.ipk
</code>
Τα βασικά αρχεία που πρέπει να εγκατασταθούν είναι τα ακόλουθα:
<code>
iwlib_29.pre10-1_mipsel.ipk
wireless-tools_29.pre10-1_mipsel.ipk
quagga_0.98.6-1_mipsel.ipk
quagga-bgpd_0.98.6-1_mipsel.ipk
kmod-madwifi-ng_+r1730-20060924—1_mipsel.ipk
</code>
Επιπλέον μπορούν να εγκατασταθούν και τα ακόλουθα:
<code>
libelf_0.8.5-1_mipsel.ipk
libnetsnmp_5.1.2-2_mipsel.ipk
snmpd_5.1.2-2_mipsel.ipk
htpdate_0.9.2-1_mipsel.ipk
mtr_0.71-1_mipsel.ipk
tracepath_0.1-1_mipsel.ipk
</code>
Το ipkg δέχεται proxy settings από το περιβάλλον όπως το wget.  Για παράδειγμα μπορούμε να ορίσουμε ένα proxy ως εξής: 
<code>
export http_proxy=http://10.2.19.1:8080
</code>
Αν δεν έχουμε πρόσβαση στο εξωτερικό δίκτυο, μπορούμε να κατεβάσουμε τα πακέτα σε ένα τοπικό web server και να τα εγκαταστήσουμε από εκεί δίνοντας το σχετικό url στην εντολή: 
<code>
ipkg install
</code>

Δίνουμε την εντολή:
<code>
password 
</code>

και βάζουμε ένα password στον router που δεν θα ξεχάσουμε. Δημιουργούμε ένα directory nope στο /etc/init.d και μεταφέρουμε εκεί με την εντολή mv ότι δεν χρειαζόμαστε να τρέχει όταν ξεκινάει ο router. Για παράδειγμα 
<code>
mkdir /etc/init.d/nope 
cd /etc/init.d 
mv S60cron nope/
</code>
Δημιουργούμε το αρχείο /etc/init.d/S41awmn που μπορεί να περιέχει τα ακόλουθα:
<file>
#!/bin/sh
#insmod ath_hal
#insmod wlan
#insmod ath_rate_sample
#insmod ath_pci xchanmode=0 outdoor=1
#rmmod ath_pci
#insmod ath_pci autocreate=sta rfkill=0
#insmod wlan_scan_sta
/bin/echo Arxontas > /proc/sys/kernel/hostname
echo "3600" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established
#/bin/echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
/sbin/ifconfig eth0 10.2.19.9 netmask 255.255.255.224 broadcast 10.2.19.31
/sbin/ifconfig eth1 down
/sbin/ifconfig br0 down
/usr/sbin/brctl delbr br0
/usr/sbin/iwpriv ath0 mode 1
/usr/sbin/iwconfig ath0 mode managed essid awmn-3298-6200 rate 54M
/sbin/ifconfig ath0 10.2.49.86 netmask 255.255.255.248 broadcast 10.2.49.87
/usr/sbin/iwconfig ath0 txpower 0
/sbin/route add -net 10.2.19.32 netmask 255.255.255.224 gw 10.2.19.5
/sbin/route add -net 10.2.19.240 netmask 255.255.255.248 gw 10.2.19.5
/sbin/route add -net 10.2.44.252 netmask 255.255.255.252 gw 10.2.19.6
/sbin/route add -net 10.2.19.248 netmask 255.255.255.248 gw 10.2.19.7
/sbin/route add -net 10.2.19.224 netmask 255.255.255.248 gw 10.2.19.8
/sbin/route add -net 10.32.54.24 netmask 255.255.255.252 gw 10.2.19.11
/sbin/route add -net 10.2.19.232 netmask 255.255.255.248 gw 10.2.19.12
/sbin/route add -net 10.2.19.220 netmask 255.255.255.252 gw 10.2.19.12
/usr/sbin/athctrl -i wifi0 -d 1672
#/bin/mkdir /var/run/quagga
#/bin/chown quagga /var/run/quagga
#/usr/sbin/zebra -d
#/usr/sbin/bgpd -d
. /etc/init.d/S49quagga start
/usr/sbin/snmpd
/usr/bin/killall -9 udhcpc
/usr/bin/killall syslogd
/usr/bin/killall klogd
</file>
Επίσης κάνουμε
<code>
touch /etc/quagga/zebra.conf
</code>
και δημιουργούμε το: 
<code>
vi /etc/quagga/bgpd.conf 
</code>
που μπορεί να περιέχει τα ακόλουθα:
<file>
! -*- bgp -*-
!
! BGPd sample configuratin file
!
! $Id: bgpd.conf.sample,v 1.1.1.1 2002/12/13 20:15:29 paul Exp $
!
hostname bgpd
password zebra
!enable password please-set-at-here
!
ip prefix-list awmn-bgp seq 10 permit 10.0.0.0/8 ge 9 le 24
ip prefix-list awmn-bgp seq 20 deny any

!
!bgp mulitple-instance
!
router bgp 3298
 bgp router-id 10.2.19.9
! bgp cluster-id 3298
 network 10.2.19.0/24
! redistribute connected
 aggregate-address 10.2.19.0/24
 neighbor 10.2.19.1 remote-as 3298
 neighbor 10.2.19.1 timers 10 30
 neighbor 10.2.19.1 prefix-list awmn-bgp in
 neighbor 10.2.19.1 prefix-list awmn-bgp out
 neighbor 10.2.19.1 capability dynamic
 neighbor 10.2.19.1 capability orf prefix-list both
! neighbor 10.2.19.1 route-reflector-client
!neighbor 10.2.19.5 remote-as 3298
!neighbor 10.2.19.5 prefix-list awmn-bgp in
!neighbor 10.2.19.5 prefix-list awmn-bgp out
!neighbor 10.2.19.5 capability dynamic
!neighbor 10.2.19.5 capability orf prefix-list both
!neighbor 10.2.19.6 remote-as 3298
!neighbor 10.2.19.6 prefix-list awmn-bgp in
!neighbor 10.2.19.6 prefix-list awmn-bgp out
!neighbor 10.2.19.6 capability dynamic
!neighbor 10.2.19.6 capability orf prefix-list both
!neighbor 10.2.19.7 remote-as 3298
!neighbor 10.2.19.7 prefix-list awmn-bgp in
!neighbor 10.2.19.7 prefix-list awmn-bgp out
!neighbor 10.2.19.7 capability dynamic
!neighbor 10.2.19.7 capability orf prefix-list both
!neighbor 10.2.19.11 remote-as 3298
!neighbor 10.2.19.11 prefix-list awmn-bgp in
!neighbor 10.2.19.11 prefix-list awmn-bgp out
!neighbor 10.2.19.11 capability dynamic
!neighbor 10.2.19.11 capability orf prefix-list both
 neighbor 10.2.49.82 remote-as 6200
 neighbor 10.2.49.82 timers 10 30
 neighbor 10.2.49.82 prefix-list awmn-bgp in
 neighbor 10.2.49.82 prefix-list awmn-bgp out
 neighbor 10.2.49.82 capability dynamic
 neighbor 10.2.49.82 capability orf prefix-list both
!
! access-list all permit any
!
!route-map set-nexthop permit 10
! match ip address all
! set ip next-hop 10.0.0.1

!
!log file bgpd.log
!
!log stdout
</file>
κάνουμε έλεγχο το αρχείο /etc/modules.d/20-madwifi να περιέχει τα ακόλουθα:
<code>
wlan
#wlan_scan_ap
wlan_scan_sta
ath_hal
ath_rate_sample
ath_pci autocreate=sta rfkill=0
</code>
ακόμη μπορούμε να βάλουμε τα ακόλουθα στο /etc/snmp/snmpd.conf
<file>
rocommunity public 10.2.19.1
agentaddress 10.2.19.9:161
</file>
επιπλέον δίνουμε τη εντολή: 
<code>
rm /etc/resolv.conf
vi /etc/resolv.conf
</code>
και μέσα στην πρώτη γραμμή βάζουμε:
<file>
nameserver 10.2.19.1
</file>
κάνουμε 
<code>
vi /etc/default/htpdate 
</code>
και βάζουμε το ακόλουθο: 
<file>
OPTIONS="10.2.19.1" 
</file>
όπου 10.2.19.1 είναι ένας τοπικός web server

λίγο πολύ είμαστε έτοιμοι.  Πριν κάνουμε executable το /etc/init.d/S41awmn και κλειδωθούμε εκτός σε περίπτωση λάθους το ελέγχουμε πρώτα: 
<code>
sh /etc/init.d/S41awmn & 
</code>
Αν υπάρξει πρόβλημα, μπορούμε απλά να κάνουμε reboot και να ο διορθώσουμε μέχρι να λειτουργήσει σωστά και αν δουλέψει καλά, μόνο τότε το αλλάζουμε σε  executable: 
<code>
chmod +x /etc/init.d/S41awmn
</code>
Με τον τρόπο αυτό έχουμε στα χέρια μας ένα router με την quagga-0.98.6 και τους τελευταίους madwifi-ng drivers !!  ... όχι και τόσο άσχημα για ένα τόσο μικρό router του εμπορίου !!

===== Kamikaze 2.6 =====

==== Atheros Support ====
**Channels**

   Channel  34 : 5170* Mhz 11a          Channel 108 : 5540* Mhz 11a
   Channel  36 : 5180* Mhz 11a          Channel 112 : 5560* Mhz 11a
   Channel  38 : 5190* Mhz 11a          Channel 116 : 5580* Mhz 11a
   Channel  40 : 5200* Mhz 11a          Channel 120 : 5600* Mhz 11a
   Channel  42 : 5210* Mhz 11a          Channel 124 : 5620* Mhz 11a
   Channel  44 : 5220* Mhz 11a          Channel 128 : 5640* Mhz 11a
   Channel  46 : 5230* Mhz 11a          Channel 132 : 5660* Mhz 11a
   Channel  48 : 5240* Mhz 11a          Channel 136 : 5680* Mhz 11a
   Channel  52 : 5260* Mhz 11a          Channel 140 : 5700* Mhz 11a
   Channel  56 : 5280* Mhz 11a          Channel 149 : 5745* Mhz 11a
   Channel  60 : 5300* Mhz 11a          Channel 153 : 5765* Mhz 11a
   Channel  64 : 5320* Mhz 11a          Channel 157 : 5785* Mhz 11a
   Channel 100 : 5500* Mhz 11a          Channel 161 : 5805* Mhz 11a
   Channel 104 : 5520* Mhz 11a          Channel 165 : 5825* Mhz 11a


**Wistron CM9**
        Ethernet controller: Atheros Communications, Inc. AR5212 802.11abg NIC (rev 01)
        Subsystem: Wistron NeWeb Corp. Unknown device 1012
        Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 168 (2500ns min, 7000ns max), Cache Line Size 08
        Interrupt: pin A routed to IRQ 6
        Region 0: Memory at 40000000 (32-bit, non-prefetchable) [size=64K]
        Capabilities: [44] Power Management version 2
                Flags: PMEClk- DSI- D1- D2- AuxCurrent=375mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=2 PME-


**Nortel NTE312AA**
        Ethernet controller: Atheros Communications, Inc. AR5212 802.11abg NIC (rev 01)
        Subsystem: Atheros Communications, Inc. Unknown device 2028
        Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 168 (2500ns min, 7000ns max), Cache Line Size 08
        Interrupt: pin A routed to IRQ 6
        Region 0: Memory at 40000000 (32-bit, non-prefetchable) [size=64K]
        Capabilities: [44] Power Management version 2
                Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=2 PME-



**Askey AR5001X+**
        Ethernet controller: Atheros Communications, Inc. AR5212 802.11abg NIC (rev 01)
        Subsystem: Askey Computer Corp. Unknown device 7057
        Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 168 (2500ns min, 7000ns max), Cache Line Size 08
        Interrupt: pin A routed to IRQ 6
        Region 0: Memory at 40000000 (32-bit, non-prefetchable) [size=64K]
        Capabilities: [44] Power Management version 2
                Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=2 PME-


**Alps UGJZ1-502A ** 
        Ethernet controller: Atheros Communications, Inc. AR5212 802.11abg NIC (rev 01)
        Subsystem: Alps Electric Co., Ltd. Unknown device 1016
        Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 168 (2500ns min, 7000ns max), Cache Line Size 08
        Interrupt: pin A routed to IRQ 6
        Region 0: Memory at 40000000 (32-bit, non-prefetchable) [size=64K]
        Capabilities: [44] Power Management version 2
                Flags: PMEClk- DSI- D1- D2- AuxCurrent=375mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=2 PME-

==== Non Atheros Support ====

**RTL8180L 802.11b**
        Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8180L 802.11b MAC (rev 20)
        Subsystem: Actiontec Electronics Inc Unknown device 6109
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 64 (8000ns min, 16000ns max)
        Interrupt: pin A routed to IRQ 6
        Region 0: I/O ports at 0200 [size=256]
        Region 1: Memory at 40000100 (32-bit, non-prefetchable) [size=256]
        Capabilities: [50] Power Management version 2
                Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=375mA PME(D0-,D1+,D2+,D3hot+,D3cold+)
                Status: D0 PME-Enable- DSel=0 DScale=0 PME-


**Cisco AIR-MP20B**
        Network controller: AIRONET Wireless Communications Cisco Aironet Wireless 802.11b
        Subsystem: AIRONET Wireless Communications Unknown device 5000
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 64 (1000ns min, 1000ns max)
        Interrupt: pin A routed to IRQ 6
        Region 0: I/O ports at 0100 [size=256]
        Region 1: Memory at 40000000 (32-bit, non-prefetchable) [size=16K]
        Region 2: Memory at 40400000 (32-bit, non-prefetchable) [size=4M]
        [virtual] Expansion ROM at 40400000 [disabled] [size=2M]
        Capabilities: [40] Power Management version 2
                Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=2 PME-
        Capabilities: [48] Vital Product Data


**Cisco MPI350**
        Network controller: AIRONET Wireless Communications Cisco Aironet Wireless 802.11b
        Subsystem: AIRONET Wireless Communications Unknown device 5000
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 64 (1000ns min, 1000ns max)
        Interrupt: pin A routed to IRQ 6
        Region 0: I/O ports at 0100 [size=256]
        Region 1: Memory at 40000000 (32-bit, non-prefetchable) [size=16K]
        Region 2: Memory at 40400000 (32-bit, non-prefetchable) [size=4M]
        [virtual] Expansion ROM at 40400000 [disabled] [size=2M]
        Capabilities: [40] Power Management version 2
                Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=2 PME-
        Capabilities: [48] Vital Product Data


**Askey WLL030**
        Network controller: Intersil Corporation Prism 2.5 Wavelan chipset (rev 01)
        Subsystem: Intersil Corporation Prism 2.5 Wavelan chipset
        Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Interrupt: pin A routed to IRQ 6
        Region 0: Memory at 40000000 (32-bit, prefetchable) [size=4K]
        Capabilities: [dc] Power Management version 2
                Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA PME(D0+,D1+,D2+,D3hot+,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=0 PME-

=====Bandwidth Tests=====
  powered by nikosaei

Στην προσπάθειά μου να βοηθήσω κι εγώ στην δουλειά του acoul αποφάσισα να δοκιμάσω όλες τις εκδόσεις των firmware του acoul-ozonet καθώς
και του official openwrt firmware και να συγκρίνω διαφορές τόσο σε επίπεδο firmware αλλά και σε επίπεδο madwifi drivers ώστε να βγάλω
ένα συμπέρασμα γενικά για το ποιο firmware μου δίνει το υψηλότερο bandwidth.Το hardware που χρησιμοποίησα ήταν έαν wrc-1000 toshiba και
στο λινκ ο απέναντι μου είχε mikrotik έκδοση 2.9.6!
Κάθε φορά το μόνο που έκανα ήταν να αλλάζω firmware και madwifi driver(ng ή old) και να κάνω ένα bandwidth test!Τα αποτελέσματα ήταν τα εξής:

  Το official openwrt rc5 http://downloads.openwrt.org/whiterussian/rc5/bin/openwrt-brcm-2.4-jffs2-4MB.trx  με madwifi old 
  http://downloads.openwrt.org/whiterussian/rc5/packages/kmod-madwifi_2.4.30brcm+r1208-20060106-1_mipsel.ipk 
  η ταχύτητα ήταν: TX 20MBS RX 17MBS

  To ozonet-openwrt firmware stable 2-1-2006 
  http://wifi.ozo.com/airo/openwrt/firmware/madwifi/stable/snapshot-2006-01-02/openwrt-brcm-2.4-jffs2-4MB.trx
  που περιέχει τους madwifi-old η ταχύτητα ήταν: TX 23MBS και RX 19MBS

  Τελευταία χρησιμοποίησα και την έκδοση kamikaze με kernel 2.6. Εκεί τα αποτελέσματα ήταν καλά όσο αφορά την σταθερότητα του 
  firmware και αλλα απο bandwidth ακόμα πιο μειωμένο! Έτσι η έκδοση 4889 
  http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/4899-ozonet/ με madwifi old   
  http://wifi.ozo.com/airo/openwrt/Packages/ipkg/kamikaze-ozonet/kmod-madwifi_2.6.17+r1417-20060128-brcm-1_mipsel.ipk 
  η ταχύτητα ήταν: ΤΧ 16ΜΒS και Rx 13MBS
  
  ενώ με madwifi ng 
  http://wifi.ozo.com/airo/openwrt/Packages/ipkg/kamikaze-ozonet/kmod-madwifi_2.6.17+r1753-20061015-brcm-1_mipsel.ipk 
  η ταχύτητα ήταν:  TX 13ΜΒS και RX 10ΜΒS

  Τέλος να πω ότι και στο wr5-ozonet έλαβα κι εκεί χαμηλότερα bandwidth όπως και στην έκδοση kamikaze 2.4

Τελικά καταλήγω στο συμπέρασμα ότι προς το παρόν η καλύτερη έκδοση όσο αφορά το bandwidth είναι η έκδοση του acoul-ozonet stable 2-1-2006 όπου μου έδωσε το υψηλότερο bandwidth ακόμα πιο υψηλό κι από αυτό του official openwrt firmware

  Σε δοκιμή που έγινε σε openwrt kamikaze 2.6 mips, διαπιστώθηκε ότι στο ίδιο link, με MT 2.9.6 
  από την άλλη μεριά, οι madwifi-ng-r1796 drivers έχουν καλύτερη ευαισθησία στο ράδιο, συγκεκριμένα 
  -6dbm και η απόδοσή τους είναι σχεδόν 3 φορές καλύτερη σε bandwidth test σε σχέση με τους 
  madwifi-old-r1208.  Οι δοκιμές έγιναν στην σύνδεση ozonet <--> arxontas
----

====== OpenWRT AWMN setup (OZOnet way) ======
<code>
cd /etc/init.d
vi awmn
</code>
  πατάμε a
βάζουμε τα ακόλουθα παραμετροποιώντας όπου χρειάζεται:

  #!/bin/sh
  iwconfig ath0 mode managed essid awmn-3298-57
  ifconfig ath0 10.2.19.250 netmask 255.255.255.252 broadcast 10.2.19.252
  iwconfig ath0 txpower 1
  athctrl -i ath0 -d 1155
  wlanconfig ath1 destroy
  wlanconfig ath1 create wlandev wifi1 wlanmode ap
  iwconfig ath1 mode master essid awmn-3298 channel 5
  ifconfig ath1 10.2.183.65 netmask 255.255.255.192 broadcast 10.2.183.127
  iwconfig ath1 txpower 3
<code>
Στο vi πατάμε escape και μετά :
και γράφουμε wq
και πατάμε enter
</code>
<code>
chmod +x awmn
cd ../rc.d
ln -s ../init.d/awmn S41awmn
sync
reboot 
</code>
====== OpenWRT AWMN setup (kamikaze way) ======
  vi /etc/ipkg.conf 
  αλλάζουμε το url σε:
  http://xwrt.kicks-ass.org/xwrt/kamikaze/atheros-2.6/packages

  export http_proxy=http://10.2.19.1:8080
  export ftp_proxy=http://10.2.19.1:8080 
  ipkg update
  ipkg install quagga-bgpd 

  vi /etc/config/network 



====== Voyage-OZOnet HowTo ======

Voyage-ozonet ένα ωραίο, λειτουργικό και προπάντων ελεύθερο λογισμικό για σύγχρονους wifi routers

===== MS Windows cf HowTo =====

=== Πως να φτιάξουμε μια cf με voyage-ozonet από windows ===
**Χρειαζόμαστε:** 
----

  * ένα util που ονομάζεται  physdiskwrite και μπορείτε να το κατεβάσετε [[http://wifi.ozo.com/airo/wrap/images/WinTools/]] και να το σώσετε στο desktop του υπολογιστή σας.                                                 
  * το voyage-ozonet image που θέλετε να κάτσετε στην cf  voyage-ozonet-0.2.4-wrap.img και μπορείτε να το κατεβάσετε [[http://wifi.ozo.com/airo/wrap/images/old/]] και να το σώσετε στο desktop του υπολογιστή σας επίσης.

----

  Η διαδικασία από εδώ και πέρα είναι πάρα πολύ απλή κάνοντας κλικ απάνω στο αρχείο του voyage και κρατώντας το πλήκτρο 
  πατημένο το μεταφέρουμε πάνω στο εικονίδιο του physdiskwrite αν όλα πήγαν καλά θα δείτε το παρακάτω menu 

{{:how_to_cf.jpg|:how_to_cf.jpg}}
 

  * Επιλέγοντας το σωστό δίσκο που βρίσκεται η cf  και στην περίπτωση μας είναι το PhysicalDrive4 
  * πατώντας το αντίστοιχο νούμερο ξεκινά η διαδικασία εγγραφής της cf
  * Μας ρωτά αν είμαστε σίγουρη και περιμένει ένα Υ or N 
  * Για να γράψει το image πατάμε Υ και περιμένουμε την ολοκλήρωση της εγγραφής 
  * Τοποθετούμε την cf στο pc ή στο wrap και κάνουμε boot
  * Η default IP  είναι 192.168.1.1 και το default root password: voyage
  * Το αρχείο /etc/init.d/awmn περιέχει τις βασικές εντολές για την ρύθμιση του router
  * Το αρχείο /usr/local/etc/bgpd.conf  περιέχει τις βασικές εντολές για την ρύθμιση του BGP

----

  Για τις ρυθμίσεις θα αναφερθούμε εκτενέστερα σε επόμενο στάδιο.

----

  Από ένα user που δεν καταλαβαίνει πολλά από linux   
  Με φιλικούς χαιρετισμούς και ευχές να αποδώσει η προσπάθεια όλων αυτών 
  που θα προσπαθήσουν να ασχοληθούν με το μαγικό κόσμο του linux.

Katsaros_m


===== Linux cf HowTo =====

=== Πως να φτιάξουμε μια cf με voyage-ozonet από linux ===

Θα χρησιμοποιήσουμε την εντολή dd.
----
  * Βάλτε την compact flash στο card reader.
  * Mην την κάνετε mount!
  * Τρέξτε την εντολή dmesg για να δείτε ως τι device την αναγνώρισε.
  * π.χ. αν την αναγνώρισε ως /dev/sdc1 τότε εκτελούμε την εντολή dd ως: "dd if=voyage-image.img of=/dev/sdc bs=512"

ΠΡΟΣΟΧΗ: of=/dev/sdc και όχι of=/dev/sdc1. Αντίστοιχα of=/dev/sdd ή ότι device δει την καρτούλα το linuxάκι μας :)

Παρατηρήσεις για το Linux CF στον CyberAngel.


====== iBGP eBGP ======
<code>
1. IBGP (hosts in the same AS) does not require 
   the multihop option. IBGP is multihop by default.

2.  Do the IBGP peers have a route(s) to the next hop(s)
    learned by the EBGP peer? If they don't, the 
    IBGP peers will discard the routes from EBGP as invalid.
    Based on your description, it sounds like the IBGP
    peers don't have routes the next hop. 

    The next hop is not automatically changed when 
    advertised to IBGP peers, but it is changed when
    advertised to EBGP or confederation peers.

    If your IBGP peers don't have a route the next hop
    learned by BGP, you will need to do one of the following:

    1. Add static routes to the next hop(s) learned from EBGP
       on all the IBGP peers

    2. Run an internal routing protocol such as OSPF to between
       the IBGP peers that advertises the next hop(s) learned from
       EBGP

    3. Use route maps to change the next hop when advertising
       the routes learned from EBGP to the IBGP peers

    4. Use a confederation for you IBGP routers. Another benefit
       of confederations, is that they don't require full mesh.

Also, if there are multihops between the IBGP peers,
the IBGP peers will need routes to each other through the
intermediate nodes. Routes through intermediate nodes in a
multihop configurations are required for IBGP, EBGP, and 
confederations. These routes can either be static or carried
in an internal routing protocol so as OSPF.
</code>

====== Bird iBGP ====== 

  * kernel & bgp local AS routers: import/export all
  * static routes: local subnet wans
  * static routes: local whole network through bogus local ip/router



====== MikroTik & Quagga ======


=====WRT route reflector=====

  Ένα εξαιρετικό HowTo από τον Χάρη ακα middle_EAST_WEST.

Μία από τις υλοποιήσεις για την διασύνδεση Ασύρματων Δρομολογητών που ανοίκουν στο ίδιο AS, είναι η χρήση Dedicated εξοπλισμού για την κεντρική διαχείριση της Δρομολόγησης όσω αφορά το BGP.

**Πλεονεκτήματα:**

    * Κεντρική Διαχείριση
    * Δυνατότητα Debug μέσω Vty
    * Δεν απαιτείται άλλο Layer (πχ. VLans)
    * Αν πέσει ένας από τους Ασύρματους Δρομολογητές τότε οι υπόλοιποι συνεχίζουν να λειτουργούν κανονικά
    * Χαμηλό κόστος (δεν χρειάζεται να βάλουμε ένα υπερυπολογιστή να έχει και τις ασύρματες συνδέσεις αλλά και την δρομολόγηση)
    * Δεν δημιουργούνται Multipath (σε Mesh κατάσταση υπάρχει περίπτωση ένας δρομολογητής να επιλέγει τελείως διαφορετική διαδρομή από τον διπλανό του)

**Μειονεκτήματα:**

    * Βασική γνώση Linux
    * Single Point of Failure (αν πέσει ο Reflector, ο κόμβος "σπάει" σε N κομμάτια, όπου Ν ο αριθμός των δρομολογητών)
    * Μη γραφικό περιβάλλον

Στην περίπτωση μας θα χρησιμοποιήσουμε 3 Δρομολογητές μαζί με ένα Linksys φορτωμένο με OpenWRT.
Απαιτούμενος εξοπλισμός/Software:

   1 x Linksys WRT-54G(S) με OpenWRT
   3 x Ασύρματους Δρομολογητές με Router OS (Mikrotik)
   1 x Switch (Προεραιτικό)

Σε φυσικό επίπεδο οι Ασύρματων Δρομολογητές μπορούν να είναι πάνω στο Switch του Linksys, αν και προτιμότερο θα ήταν η χρήση ξεχωριστού Switch αν το μεταξύ τους Traffic ξεπερνά τα 30 Mbits.

Ας θεωρήσουμε ότι μας ανοίκει το C-Class 10.0.1.0/24 και ως Node-Id έχουμε το 6969.
Δρομολογητές Router OS
Ορίζουμε σε όλους τους Ασύρματους Δρομολογητές ένα υποδύκτιο που θα πάρουν οι Ethernet τους. Ας πούμε ότι παίρνουν το 10.0.1.0/28, αρκετά μεγάλο ώστε να χωράει αρκετό μεγάλο νούμερο από Δρομολογητές, αν αυτό κριθεί απαραίτητο στο μέλλον.

Αφού βεβαιωθούμε ότι οι ρυθμίσεις στα RouterOS είναι σωστες και επικοινωνούν μεταξύ τους οι 3 Ασύρματοι Δρομολογητές, προχωράμε στην προσθήκη των συνδέσεων BGP με τους απέναντι Ασύρματους Δρομολογητές, όπως δηλαδή θα κάναμε αν είχαμε μόνο έναν Ασύρματο Δρομολογητή.

Αφού ολοκληρώσουμε την δρομολόγηση με τα ασύρματα peers, προχωράμε στην σύνδεση του BGP των Ασύρματων Δρομολογητών με το Linksys. Έτσι προσθέτουμε ένα peer με Remote AS: 6969 (το ίδιο με το AS των RouterOS) καθώς και με Remote Address: 10.0.1.1 (την IP που έχει το Linksys). Το ίδιο κάνουμε σε όλους τα RouterOS.

**Προσοχή!!! ΡΥΘΜΙΖΟΥΜΕ ΤΟΥΣ TIMERS ΣΤΟ MIKROTIK**

Στην συνέχεια φτιάχνουμε το OSPF στα RouterOS (Routing OSPF). Στο router ID(κουμπί Settings) βάζουμε την ίδια IP που είχαμε ορίσει και στο BGP ως Router ID. Επίσης στην ίδια καρτέλα αλλάζουμε την επιλογή Redistribute Connected Routes σε "As Type 1".

Επόμενο βήμα είναι η προσθήκη του Interface που θα "ακούει" το OSPF που θα πρέπει να είναι ΜΟΝΟ η Ethernet του Ασύρματου Δρομολογητή. ’ρα στην επιλογή Interfaces επιλέγουμε την Ethernet που "κοιτάει" τους άλλους Δρομολογητές.
Στην καρτέλα Networks ορίζουμε το υποδίκτυο που βρίσκονται όλοι οι Δρομολογητές μας. Στην δικιά μας περίτωση είναι το 10.0.1.0/28.

Το επαναλαμβάνουμε σε όλα τα RouterOS

**Συγχαρητήρια!** Μόλις οι Ασύρματοι Δρομολογητές αναγνωρίζουν όλα τα υποδύκτια που έχει ο καθένας απάνω του.
Δρομολογητής OpenWRT
Αφού έχουμε εγκαταστήσει το OpenWRT, κάνουμε εγκατάσταση τα πακέτα quagga, quagga-bpgd, quagga-ospfd, quagga-vtysh (Προεραιτικό αν θέλουμε bgp terminal)
<code>
# ipkg update
# ipkg install quagga quagga-bpgd quagga-ospfd quagga-vtysh
</code>
Στην συνέχεια πάμε στον φάκελο /etc/quagga
<code>
# cd /etc/quagga
</code>
και φτιάχνουμε τα απαραίτητα conf για να τρέχει η quagga μας
<code>
# touch bgpd.conf; touch ospfd.conf; touch zebra.conf
</code>
Αφού έχουμε δημιουργήσει τα αρχεία με την βοήθεια του επεξεργαστή κειμένου (vi) προσθέτουμε τις ανάλογες ρυθμίσεις:
<code>
# vi bgpd.conf
!
! Zebra configuration saved from vty
! 2005/09/18 16:36:03
!
hostname LinksysRouter.nodeid.awmn
password awmn
enable password awmn
!
router bgp 6969
bgp router-id 10.0.1.1
network 10.0.1.0/24
! RouterOS 1
neighbor 10.0.1.2 remote-as 6969
neighbor 10.0.1.2 description RouterOS 1
neighbor 10.0.1.2 timers 10 30
neighbor 10.0.1.2 capability dynamic
neighbor 10.0.1.2 capability orf prefix-list both
! neighbor 10.0.1.2 next-hop-self
neighbor 10.0.1.2 prefix-list awmn-bgp in
neighbor 10.0.1.2 prefix-list awmn-bgp out
neighbor 10.0.1.2 filter-list maxaslength out
neighbor 10.0.1.2 route-reflector-client
! RouterOS 2
neighbor 10.0.1.3 remote-as 6969
neighbor 10.0.1.3 description RouterOS 2
neighbor 10.0.1.3 timers 10 30
neighbor 10.0.1.3 capability dynamic
neighbor 10.0.1.3 capability orf prefix-list both
! neighbor 10.0.1.3 next-hop-self
neighbor 10.0.1.3 prefix-list awmn-bgp in
neighbor 10.0.1.3 prefix-list awmn-bgp out
neighbor 10.0.1.3 filter-list maxaslength out
neighbor 10.0.1.3 route-reflector-client
! RouterOS 3
neighbor 10.0.1.4 remote-as 6969
neighbor 10.0.1.4 description RouterOS 3
neighbor 10.0.1.4 timers 10 30
neighbor 10.0.1.4 capability dynamic
neighbor 10.0.1.4 capability orf prefix-list both
! neighbor 10.0.1.4 next-hop-self
neighbor 10.0.1.4 prefix-list awmn-bgp in
neighbor 10.0.1.4 prefix-list awmn-bgp out
neighbor 10.0.1.4 filter-list maxaslength out
neighbor 10.0.1.4 route-reflector-client
!
ip prefix-list awmn-bgp seq 10 permit 10.0.0.0/8 ge 9 le 24
ip prefix-list awmn-bgp seq 20 deny any
!
!
ip as-path access-list maxaslength deny ([0-9]+){250}$
ip as-path access-list maxaslength permit .*
line vty
</code>
<code>
# vi ospfd.conf
hostname ospfd
password awmn
enable password awmn
!
router ospf
ospf router-id 10.0.1.1
redistribute connected metric 1 metric-type 1
network 10.0.1.0/28 area 0.0.0.0
line vty
</code>
<code>
# vi zebra.conf
hostname LinksysRouter.nodeid.awmn
password awmn
enable password awmn
! Sintaxi gia static routes an einai anagkaia
ip route 10.0.1.192/26 10.0.1.8
!
line vty
</code>
Μόλις σιγουρευτείτε ότι έχετε τις σωστές ρυθμίσεις, ξεκινάτε την Quagga:
<code>
# /etc/init.d/quagga start
</code>
Σε 10 δευτερόλεπτα περίπου θα έχετε και από τους 3 Ασύρματους Δρομολογήτες καταχωρήσεις στο Routing Table του Linksys. Αν κάτι πάει στραβά ελένξτε ότι έχετε κάνει τις σωστές ρυθμίσεις. Δοκιμάστε να κάνετε uncomment την γραμμή:
<code>
neighbor x.x.x.x next-hop-self
</code>
**Το πρόβλημα:**

  
  Το iBGP routing κομμάτι του MikroTik δεν δουλεύει σωστά.  Σε κόμβους με πολλούς routers  είναι 
  αναγκαίο να γίνει εγκατάσταση της quagga ώστε να λειτουργεί απροβλημάτιστα το BGP. Αυτό, σε όσους 
  κόμβους δουλεύουν με MikroTik για το RF κομμάτι, μπορεί να γίνει είτε με την λύση που έδωσε ο 
  acinonyx με το πακέτο quagga για MikroTik, είτε με την υλοποίηση route reflector που έχει 
  υλοποιηθεί στον κόμβο του dti και του ΤΕΙ Πειραιά. Το wrt παρέχει μια οικονομική και αξιόπιστη λύση 
  για να τρέξει εκεί η quagga σε περίπτωση που δεν θέλουμε να πειράξουμε καθόλου το MikroTik.

  Το βασικό πρόβλημα της υλοποίησης BGP από τη MikroTik είναι ότι δεν μπορεί να παίξει σωστά το iBGP 
  μεταξύ πολλών MikroTik router και δεν δουλεύουν τα prefix-list τουλάχιστο αυτά τα δύο είναι γνωστά από 
  πρώτο χέρι. Από εκεί και πέρα το eBGP παίζει ικανοποιητικά, διαφορετικά δεν θα δούλευε καθόλου το δίκτυο.  
  Το πρόβλημα του routing σε MikroTik κόμβους εμφανίστηκε όταν χρειάστηκε να σηκωθούν 2 και 3 BGP 
  στον ίδιο κόμβο και αυτά να μιλούν μεταξύ τους με iBGP. Εκεί το routing ήταν πραγματική ρουλέτα !! 

**Η λύση route reflector**

  Στην περίπτωση route reflector το iBGP γίνεται μόνο σε MikroTik <--> quagga και δεν υπάρχει 
  κανένα MikroTik <--> MikroTik iBGP. Δηλαδή ο κάθε MikroTik router βλέπει μόνο ένα iBGP 
  σε route reflector setup που είναι η quagga.

**Γιατί route reflector σε wrt**
<code>
  * Το συγκεκριμένο λογισμικό είναι ελεύθερο, δεν τίθεται θέμα νομιμότητας. Επιπλέον δεν επεμβαίνουμε 
    στο MikroTik, είμαστε και εκεί νόμιμοι και μπορούμε να έχουμε τη σχετική υποστήριξη από την εταιρία.

  * Όλες οι αποφάσεις για το routing παίρνονται κεντρικά από την quagga σαν να υπάρχει μόνο ένας 
    BGP router σε όλο τον κόμβο

  * Δουλεύουν σωστά και απροβλημάτιστα prefix-lists, φίλτρα, routing κλπ.

  * Το wrt δουλεύει μόνο quagga με 0% CPU load και 50% free memory 24x7 σε μικρό UPS 
    με αυτονομία 48 ωρών προσφέροντας αξιοπιστία και υψηλή διαθεσιμότητα.

  * Υπάρχει ένα αντίστοιχο wrt σε εφεδρεία στην ντουλάπα standby έτοιμο (καλό θα ήταν :-)

  * Αποσυμφόρηση του BGP CPU load και της μνήμη στους MikroTik routers

  * Το συγκεκριμένο σχήμα δουλεύει σε απλό επίπεδο routing.  Χωρίς vlans, bridging κλπ. που 
    ανεβάζουν το overhead, και μειώνουν την αξιοπιστία, ασφάλεια και αποτελεσματικότητα της λύσης. 
</code>

**Υλοποίηση**
  Όλοι οι routers πέφτουν σε ένα Gbit switch, όλοι οι routers είναι στο ίδιο subnet, το setup είναι 
  μόνο routing, όχι vlans, bridges κλπ. μια sexy quagga σε wrt με ρόλο route reflector στη μέση 
  και τα MT γύρω γύρω όλοι να μιλούν eBGP με τα WAN τους και iBGP μόνο με την quagga ... !! 
  ospf για ένα setup που αλλάζει συχνά, θα μπορούσε να γυρίσει σε static routing αν σταματήσει να 
  το πειράζει και να βάζει καινούργια ifs κάποια στιγμή ο dti. 

<code>
Below is a short summary of IBGP and the route reflector concept.

When running IBGP, all neighbors must be fully meshed in order to learn each
other's routes. The fully meshed topology is necessary because of the BGP
Split Horizon rule, which states that a route learned from one IBGP neighbor
will not be advertised to another IBGP neighbor. (The BGP Split Horizon rule
is more strict than the Conventional Split Horizon rule in that it prevents
routing updates from being sent to any other IBGP neighbor and not only to
the originator of the update). Therefore, IBGP updates about connected
networks can only be sent to immediate neighbors; every router in the AS
must have any other router in the same AS as an immediate neighbor, which is
a fully meshed topology. This is why route reflectors come into play. Route
reflectors are capable of ignoring the BGP Split Horizon rule and forward
routing updates from one IBGP neighbor to another IBGP neighbor. Therefore,
when route reflectors are configured, the fully meshed topology among the
route reflector's clients is no longer required. However, the Conventional
Split Horizon rule is still enforced; when a route reflector (router A)
receives an update about a network from route reflector client B, it
forwards it to every route reflector client EXCEPT router A.

Peer groups contain BGP routers that have common update policies. An update
sent to a peer group must be sent to every member. Therefore, if route
reflector clients are members of a peer group, the route reflector must send
an update received from Router A to every route reflector client (every
member of the peer group), INCLUDING router A. As you can see, this behavior
contravenes the Conventional Split Horizon Rule. Therefore, peer groups are
not compatible with route reflectors.
</code>

======iwconfig configuration======

After physically installing your Linux-compatible NIC, you need to configure your NIC's IP and wireless settings before Wireless Tools works.

You can configure your NIC's IP settings as if the NIC were a regular Ethernet device. After you use the ifup command the NIC becomes active, but it will not function correctly as its wireless settings haven't been configured yet.

The most commonly used command in Wireless Tools is iwconfig, which you can use to configure most of the wireless parameters, including the SSID and the wireless mode. For the wireless mode, Managed means that there is a wireless access point (WAP) on the network and Ad-hoc signifies that there is none.

For example, if your wireless NIC is named eth0 and your managed network's ESSID is homenet, then the commands would be. 

  iwconfig eth0 mode Managed
  iwconfig eth0 essid homenet

Your NIC should now become fully functional. You will need to run these iwconfig commands each time you use the ifup command, however; forgetting to do so can be problematic. The next section shows how to make these iwconfig changes permanent.



======Client ή κόμβος κορμού======
Η αίσθηση του να είσαι κόμβος κορμού είναι το κάτι άλλο.  Το wrap σηκώνει δυο (2) BB μόνο με GNU/Linux, δηλαδή κονσόλα.  Αν σε βοηθήσει κάποιος μπορείς να το στήσεις και να το ξεχάσεις ... αν θέλεις αυτονομία μπορείς να πας σε λύση RouterBoard που σηκώνει MikroTik που έχει γραφικό περιβάλλον και έτσι είναι κάπως πιο εύκολο ... σε κάθε περίπτωση καλό είναι να σε υιοθετήσει ένας κοντινός κόμβος και να σου δείξει τα βασικά.  Επαφές από κοντά σε συναντήσεις κλπ είναι χρήσιμες για απαντήσεις και να μαζέψεις σχετικό υλικό. Συζήτησε αν υπάρχει ενδιαφέρον να σηκώσεις κόμβο κορμού στην περιοχή σου, αξίζει το κόπο και θα κερδίσεις πολλά και σε επίπεδο γνώσεων αλλά και ταχύτητας.  Το κόστος για δυο (2) BB είναι κάτω των 500Ευρώ.

Αν βάλεις wrap ή RouterBoard για δυο (2) BB μόνο ένα ethernet καλώδιο χρειάζεται να κατεβάσεις κάτω.





======BCM4710 Pin Outs======
=====Asus WL500G 2x10 header=====
{{http://wiki.ozo.com/asus-WL500G.jpg }}
=====WRT54G V1.x, SE505 V1, early F5D7230s 20-pin jumper label: J25=====
{{http://wiki.ozo.com/siemens-SE505v1.jpg }}

======BCM4710 kamikaze debug======
  trunk 6306 gcc-3.4.6 binutils-2.17 ok --> diag, switch (M)
  trunk 6439 gcc-4.1.1binutils-2.16.1 nope --> diag, switch (M)
  trunk 6563 gcc-3.4.6 binutils-2.17 ok --> diag, switch (M)
  trunk 6564 gcc-3.4.6 binutils-2.17 nope --> diag, switch (M)
   trunk 6564 gcc-3.4.6 binutils-2.17 nope --> diag, switch (*)


======Boardtype Boardnum======

=====Askey RT220W=====
  boardtype: bcm94710r4
  boardnum: 100
=====Askey RT210=====
  boardtype: bcm94710r4
  boardnum: 100
=====Siemens SE505=====
  boardtype: bcm94710r4
  boardnum: 100

=====Toshiba wrc-1000=====
  boardtype: bcm94710r4
  boardnum: 100

=====Dell TrueMobile 2300=====
  boardtype: bcm94710ap
  boardnum: 44
=====Asus WL500g=====
  boardtype: bcm94710dev
  boardnum: asusX

=====MotorolaWR850G v1 =====
  boardtype: bcm94710dev
  boardnum: 2

<code>
tftp 192.168.10.1
binary
rexmt 1
trace
verbose
put openwrt-motorola-squashfs.bin
</code>
force bootwait on
<code>
shorting pin 15 & 16 on the flash chip
</code>

=====Netgear WGT634U=====
  boardtype: bcm95365r

======DNSMASQ setup======
/etc/dnsmasq.conf
<code>
interface=eth0
listen-address=10.2.19.2
bind-interfaces
dhcp-range=10.2.19.22,10.2.19.26,255.255.255.224,12h
dhcp-option=option:router,10.2.19.1
dhcp-option=option:dns-server,10.2.19.1
enable-tftp
dhcp-broadcast
bootp-dynamic
tftp-root=/extra/bootp
dhcp-boot=openwrt-ar71xx-nand-vmlinux-initramfs.elf
dhcp-leasefile=/tmp/dnsmasq.leases
dhcp-authoritative
</code>
======Tinyproxy transparent setup======
/etc/tinyproxy.conf
<code>
User nobody
Group nogroup
Port 8888
Listen 10.2.72.65
Bind 10.2.72.253
Timeout 120
DefaultErrorFile "/usr/share/tinyproxy/default.html"
StatHost "127.0.0.1"
StatFile "/usr/share/tinyproxy/stats.html"
SysLog Off
LogLevel Error
MaxClients 100
MinSpareServers 5
MaxSpareServers 20
StartServers 10
MaxRequestsPerChild 10000
Allow 127.0.0.1
Allow 10.2.72.64/26
ViaProxyName "tinyproxy"
FilterURLs Off
FilterExtended Off
FilterCaseSensitive Off
FilterDefaultDeny No
ConnectPort 22
ConnectPort 443
ConnectPort 563
ConnectPort 873
ConnectPort 1863
ConnectPort 6667
ConnectPort 9418
upstream 10.2.19.3:8080
</code>
<code>
iptables -t nat -N natcensor
iptables -t nat -I PREROUTING -j natcensor
iptables -t nat -F natcensor
iptables -t nat -A natcensor -p tcp -i wlan0 ! -d 10.0.0.0/8 --dport 80 -j REDIRECT --to-port 8888
</code>

======Ethtool tips======
  ethtool -s ethx autoneg on advertise 0x0F
<code>
10-half     = 0x01
10-full      = 0x02
100-half   = 0x04
100-full    = 0x08
1000-half = 0x10 (actually not supported by IEEE standards)
1000-full  = 0x20
auto        = 0x00 or 0x3F
</code>

======Admswconfig tips======
<code>
# admswconfig eth0 "1234c"
# admswconfig eth1 "0c"   
# admswconfig eth2 ""
# admswconfig eth3 ""
# admswconfig eth4 ""
# admswconfig eth0
ADM5120 switch detected with 5 ports
eth0 is vlan0

vlan    port0   port1   port2   port3   port4   CPU
0               1       1       1       1       1
1       1                                       1
2                                               
3                                               
4                                               

#
</code>
In the above example ports 1,2,3 and 4 form a single switch and are mapped to eth0 and port 0 is mapped to eth1. This is the default hardwired in the Edimax BR6104 routers.
<code>
admswconfig eth0 "2c"
admswconfig eth1 "1c"
admswconfig eth2 "0c"
</code>
the above example assigns each port of a RouterBoard 133 to a different ethernet such as eth0, eth1 and eth2.


======OZOnet Squid proxy/cache speed tips======
  3 ή 4 γρήγοροι δίσκοι με 20% ο κάθε ένας για cache με reiserfs-3, όχι μεγάλα cahe object >10Mb, & άφθονη RAM.  

  Squid uses approximately 10 MB of RAM per GB
  plus your cache_mem setting and about an additional 10-20MB
  It is recommended to have at least twice this amount of physical RAM 

  Στατιστικά κίνησης για fine tune και είσαι jet !! επιπλέον ένας dnscache με πλούσιους σε cache forwarders δίνει μια αίσθηση turbo στον squid !! 
  Όχι συνεργασίες με unmaintained ή default squid setups, δημιουργούν περισσότερα προβλήματα από όσα λύνουν !!
  Για περιορισμό κίνησης δεν χρησιμοποιώ pools, αλλά το squish.
βέβαια αν δεν πειράξεις τα ζιγκλέρ επιδόσεις δεν θα δεις, ο google και εδώ είναι ο πιο πιστός φίλος και δάσκαλος, οπότε:

<code>
# refresh patterns to enable caching of MS windows update
refresh_pattern http://.*\.windowsupdate\.microsoft\.com/ 0 80% 20160 reload-into-ims
refresh_pattern http://office\.microsoft\.com/            0 80% 20160 reload-into-ims
refresh_pattern http://windowsupdate\.microsoft\.com/     0 80% 20160 reload-into-ims

# the next two can be rewritten as one regexp, which should also match other
# SP versions.
#refresh_pattern http://wxpsp2\.microsoft\.com/           0 80% 20160 reload-into-ims
#refresh_pattern http://xpsp1\.microsoft\.com/            0 80% 20160 reload-into-ims
refresh_pattern http://w?xpsp[0-9]\.microsoft\.com/       0 80% 20160 reload-into-ims

# ditto for the next one.
#refresh_pattern http://w2ksp4\.microsoft\.com/           0 80% 20160 reload-into-ims
refresh_pattern http://w2ksp[0-9]\.microsoft\.com/        0 80% 20160 reload-into-ims

refresh_pattern http://download\.microsoft\.com/          0 80% 20160 reload-into-ims

# and some other windows updaters
refresh_pattern http://download\.macromedia\.com/         0 80% 20160 reload-into-ims
refresh_pattern ftp://ftp\.nai\.com/                      0 80% 20160 reload-into-ims
refresh_pattern http://ftp\.software\.ibm\.com/           0 80% 20160 reload-into-ims

# Google Maps
#refresh_pattern http://kh\.google\.com/                  0 80% 20160 reload-into-ims

# Images/video
refresh_pattern -i [.]jpg$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]jpeg$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]gif$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]png$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]swf$ 2880 50% 2880000 override-lastmod ignore-reload reload-into-ims
refresh_pattern -i [.]wmv$ 2880 50% 2880000 override-lastmod ignore-reload reload-into-ims
refresh_pattern -i [.]mp[g123]$ 2880 50% 2880000 override-lastmod ignore-reload reload-into-ims
refresh_pattern -i [.]mpeg$ 2880 50% 2880000 override-lastmod ignore-reload reload-into-ims
refresh_pattern -i [.]avi$ 2880 50% 2880000 override-lastmod ignore-reload reload-into-ims
# Data
refresh_pattern -i [.]gz$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]tgz$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]bz$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]bz2$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]zip$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]arj$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]rar$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]dat$ 2880 50% 2880000 reload-into-ims
# Probably generated content
refresh_pattern -i [.]php$ 0 20% 28800
refresh_pattern -i [?] 0 20% 28800
refresh_pattern -i cgi 0 20% 28800
# Probably plain HTML (first one is for http://host.com/dir/dir/ type URLs)
#refresh_pattern -i /$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]htm$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]html$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]xml$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]css$ 2880 50% 2880000 reload-into-ims
refresh_pattern -i [.]js$ 2880 50% 2880000 reload-into-ims
# All other
refresh_pattern . 0 50% 28800
</code>
το καλύτερο tip όμως είναι: εντομοκτόνο που ακούει στο όνομα iptables στους leechers στο παλίσιο: abuse it & you lose it !! 
<code>
iptables -A INPUT -s bad.boy.ip.or.net -d 10.2.19.1 -p tcp --dport 3128 -j DROP 
</code>
=======SSD Links=======
http://forums.mysql.com/read.php?123,194317,194317 (MySQL on SSD)\\
http://www.storagesearch.com/ssdmyths-endurance.html (SSD Myths and Legends - "write endurance")\\
http://en.wikipedia.org/wiki/GUID_Partition_Table (GUID Partition Table - GPT)\\
http://www.cyberciti.biz/tips/fdisk-unable-to-create-partition-greater-2tb.html (Creating a Partition Size Larger than 2TB)\\
http://thunk.org/tytso/blog/2009/02/20/aligning-filesystems-to-an-ssds-erase-block-size/ ( Aligning filesystems to an SSD’s erase block size)\\
http://en.gentoo-wiki.com/wiki/Apple_Macbook_Pro (Gentoo on a Apple Macbook Pro)\\
http://grub.enbug.org/TestingOnEFI (GRUB 2 on EFI)\\

======OpenHAL Quick HowTo======
  Get linux-2.6.14.7
Currently, OpenHAL works only with older versions of madwifi. A special branch is on if you want to try it out. \\
 \\
  svn checkout http://svn.madwifi.org/branches/madwifi-old-openhal madwifi
If you want unlimited channel availability, you need to do this change to openhal/opt_ah.h (be carefull when using this – you can break laws in your country very easy). \\
 \\
Before change:

  #define SUPERCHANNEL 0

After change:

  #define SUPERCHANNEL 1

And then usual make KERNELPATH=$KERNPATH, make install and modprobe ath_pci. I recommend to read opehal/README since there are some limitations when using OpenHAL.


======Atheros EEPROM recovery======
Credits: <krupaj@mobilnews.cz>

* get [[http://www.mobilnews.cz/honza/dnload/ath_eeprom_tool/1_0/ath_eeprom_tool.c|ath_eeprom_tool]] and [[http://www.mobilnews.cz/blog/files/ar5k_plnt.c|ar5k_plnt]]

* compile them
  gcc ./ath_eeprom_tool.c -o ath_eeprom_tool
  gcc ./ar5k_plnt.c -o ar5k_plnt

* or get them in binary (x86) [[http://wifi.ozo.com/airo/voyage-ozonet/bin/ath_eeprom_tool|ath_eeprom_tool]] and [[http://wifi.ozo.com/airo/voyage-ozonet/bin/ar5k_plnt|ar5k_plnt]]

* put the broken Atheros and boot with madwifi-openhal driver

* make copy of the original MAC of the broken card 

* put a working Atheros and boot with madwifi-openhal driver

* find the address of the card, we will use for the example: 0xdf000000

* issue the following:
  ath_eeprom_tool -r 0xdf000000 ./eeprom.dat

* put the broken Atheros and boot with madwifi-openhal drivers 

* find the address of the card, we will use for the example: 0xdf000000

* issue the following:
  ath_eeprom_tool -w 0xdf000000 ./eeprom.dat
  rmmod ath_pci
  modprobe ath_pci
 \\
to put the original MAC address back, you need to flash 1D, 1E, 1F (first location) and A5, A6, A7 (second location).  The second location will have the opossite order of the hex numbers. Here is an example of MAC address structure and location.

  MAC: 11:22:33:44:55:66

  1D - 0x5566
  1E - 0x3344
  1F - 0x1122

  A5 - 0x2211
  A6 - 0x4433
  A7 - 0x6655

  ar5k_plnt 0xdf000000 0x1d 0x5566
  ar5k_plnt 0xdf000000 0x1e 0x3344
  ar5k_plnt 0xdf000000 0x1f 0x1122

  ar5k_plnt 0xdf000000 0xa5 0x2211
  ar5k_plnt 0xdf000000 0xa6 0x4433
  ar5k_plnt 0xdf000000 0xa7 0x6655



======IXP4xx & OpenWRT======

  == Update from OpenWrt relative wiki page ==

  Redboot> ip_address -l 192.168.1.14 -h 192.168.1.254
  Redboot> fis unlock -f 0x50000000 -l 0x1000000
  Redboot> fis init -f
  Redboot> load -r -v -b 0x00800000 lede-ixp4xx-generic-avila-zImage
  Redboot> fis create linux
  Redboot> load -r -v -b 0x00800000 lede-ixp4xx-generic-squashfs.img
  Redboot> fis create rootfs
  Redboot> fconfig
  fis load linux
  exec
  Redboot> reset

Flashing OpenWRT on Gateworks Avila GW2348-4, you may find latest images [[http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/ixp4xx/|here]]

we need a tftpd server, I use dnsmasq, listening at 192.168.3.1, the default IP for the Gatework Avila is 192.168.3.2

Plug in the GW2348 power supply while watching the Hyperterminal Window. When you see the line:

  == Executing boot script in 2.500 seconds - enter ^C to abort
you have 2 and one half seconds to hit CTRL-C. When you do you should see a prompt that looks like this:
  ^C
  RedBoot>
At this prompt enter the line:
  fis init -f
The GW2348 will respond with:
  About to initialize [format] FLASH image system - continue (y/n)?
As long as you are ready to continue enter a Y to get the following response:
<code>
*** Initialize FLASH Image System
... Erase from 0x50080000-0x50fe0000: ...............................
.....................................................................
.......................
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x03fe0000-0x04000000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
RedBoot>
</code>
Enter the following line: (you may want to refer to the flashing.txt file for this and subsequent lines to enter since they could change in future builds) 
  load -r -v -b 0x00800000 openwrt-avila-2.6-zImage
At this point you will find out for sure if your TFTP server is working correctly. If it isn't you will get something like this:
<code>
Using default protocol (TFTP)
__udp_sendto: Can't find address of server
Can't load 'zImage': some sort of network error
RedBoot>
</code>
When I got this message it was because I had forgotten to set my TFTP server to use 192.168.3.1 as it's address so it was not seeing the TFTP request coming from the GW2348. I changed the setting and then the reply coming from the GW2348 looked like this:
<code>
Using default protocol (TFTP)
/
Raw file loaded 0x00800000-0x00967c93, assumed entry at 0x00800000
RedBoot>
</code>
This took several seconds as the zimage file was downloaded to the Gateworks board from my computer. After this completes execute the following command:
  fis create -b 0x00800000 -f 0x050080000 -l 0x00200000 -r 0x00800000 linux
The response should look like this:
<code>
... Erase from 0x50080000-0x50280000: ................
... Program from 0x00800000-0x00a00000 at 0x50080000: ................
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x03fe0000-0x04000000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
RedBoot>
</code>
Then enter this command:
  fis create -n linux
You will get a caution message:
<code>
An image named 'linux' exists - continue (y/n)? y
* CAUTION * about to program 'linux'
at 0x50080000..0x501e7c93 from 0x00800000 - continue (y/n)? y
</code>
The message repeats twice since this is when you are actually overwriting the original version of linux installed on the board. They really want you to be sure and it is wise to reread your command line to be sure that you aren't doing something stupid... but forge ahead... The GW2348 will respond:
<code>
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x03fe0000-0x04000000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
RedBoot> 
</code>
Now it is time to TFTP in the rootfs file:
  load -r -v -b 0x00800000 openwrt-ixp4xx-2.6-jffs2-128k.img
If all is working well the response should look something like this:
<code>
Using default protocol (TFTP)
/
Raw file loaded 0x00800000-0x00d13fff, assumed entry at 0x00800000
RedBoot>
</code>
When the loading of the root filesystem is complete (it will take a few seconds because it is a large file) you will create several files The first looks like this:
  fis create -b 0x00800000 -f 0x050280000 -l 0x00D20000 ramdisk
The response from the GW2348 will look like:
<code>
... Erase from 0x50280000-0x50fa0000: ...............................
.....................................................................
.....
... Program from 0x00800000-0x01520000 at 0x50280000: ...............
.....................................................................
.....................
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x03fe0000-0x04000000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
</code>
Programming this block of the flash memory takes quite a while because it is a very large file. You will now do two more similar commands that will execute in exactly the same way but will finish much faster. They are:
  fis create -b 0x00800000 -f 0x050FA0000 -l 0x00020000 mampf
  fis create -b 0x00800000 -f 0x050FC0000 -l 0x00020000 nvram
When these are done we will run the fconfig utility at the RedBoot> prompt. The GW2348's output is shown in regular type. Your entries are shown in italic:
<code>
RedBoot> fconfig
Run script at boot: true
Boot script: 
.. fis load ramdisk
.. fis load zimage
.. exec
Enter script, terminate with empty line
>> fis load linux
>> exec
>> 
Boot script timeout (100ms resolution): 25
Use BOOTP for network configuration: false
Gateway IP address: 
Local IP address: 192.168.3.2
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.3.1
Console baud rate: 115200
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Default network device: npe_eth0
Update RedBoot non-volatile configuration - continue (y/n)? y
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x03fe0000-0x04000000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
RedBoot>
</code>
yoy may now reset the unit:
  reset
some textshots
<code>
BusyBox v1.7.2 (2007-10-30 15:20:48 EET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r9462) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
</code>
<code>
Processor       : XScale-IXP42x Family rev 1 (v5b)
BogoMIPS        : 532.48
Features        : swp half fastmult edsp
CPU implementer : 0x69
CPU architecture: 5TE
CPU variant     : 0x0
CPU part        : 0x41c
CPU revision    : 1
Cache type      : undefined 5
Cache clean     : undefined 5
Cache lockdown  : undefined 5
Cache format    : Harvard
I size          : 32768
I assoc         : 32
I line length   : 32
I sets          : 32
D size          : 32768
D assoc         : 32
D line length   : 32
D sets          : 32

Hardware        : Gateworks Avila Network Platform
Revision        : 0000
Serial          : 0000000000000000
</code>
<code>
           CPU0
  3:        281      IXP4xx  qmgr
  5:       9299      IXP4xx  IXP4xx Timer Tick
 15:       1411      IXP4xx  serial
 27:          0      IXP4xx  wifi1
 28:          0      IXP4xx  wifi0
Err:          0
</code>
<code>
Linux version 2.6.21.6 (alex@orama) (gcc version 4.1.2) #2 Tue Oct 30 17:19:17 EET 2007
</code>






=====Flashing Titan Wireless TW-266-2 (LanReady)=====
<code>
ip_address -l 192.168.1.1 -h 192.168.1.254

fis init -f

load -r -b %{FREEMEMLO} openwrt-tw2662-zImage

fis create kernel

load -r -b %{FREEMEMLO} openwrt-ixp4xx-generic-jffs2-128k.img

fis create rootfs

fconfig

fis load kernel

exec
</code>
hit enter on the last command and then:
<code>
reset
</code>
<code>
Resetting to Factory Defaults

Deliberant products have the capability of being reset to defaults by pinging the device with a certain packet size when the radio is booting.
During the startup of the device, when the drivers of the ethernet interfaces are loaded, the discovery daemon is started. The daemon suspends
startup process for 3 seconds and waits for ICMP "echo request" packet of length 369 bytes. If the packet received, the discovery resets the
device to default configuration.

Steps to reset to default settings:

Step 1. Power off the device. 

Step 2. Obtain the device MAC address. 

Step 3. Connect a PC to the same physical subnet as the device.

Step 4. Execute 'arp -s' command to assign the IP address (IP address should be from the same subnet as PC) to the device MAC address:

    arp -s <IP address to assign> <device MAC address>
    
Step 5. Start pinging the device:
    
    ping <IP address> -s 369
    
Step 6. Power up device and wait about 30sec or more (depends from device hardware).
</code>

\\ [[http://ligowave.com/?q=downloads/30|Factory Firmware]]
\\ [[http://oldwiki.openwrt.org/OpenWrtDocs%282f%29Hardware%282f%29LigoWave%282f%29LGO2AGN.html|OpenWRT page]]
\\ [[http://forum.openwrt.org/viewtopic.php?id=18007|Openwrt forum thread]]
\\ [[http://www.dd-wrt.com/phpBB2/viewtopic.php?t=48031|DD-wrt forum thread]]
\\ [[http://www.ertos.nicta.com.au/software/fass/redboot-v1_92-ixdp425-mini-howto|RedBoot for the IXDP425 miniHOWTO]]
\\ [[http://ecos.sourceware.org/docs-latest/redboot/redboot-guide.html|RedBoot User's Guide]]
\\ [[http://citypw.blogspot.com/2010/04/port-gnulinux-kernel-2628-to-ixp4xx420.html|port GNU/Linux to ixp4xx(420)]]
\\ [[http://lxr.free-electrons.com/source/arch/arm/mach-ixp4xx/include/mach/irqs.h|IRQ definitions for IXP4XX based systems]]

=====Flashing Linksys WRT300nv2=====
tftpd server IP: 192.168.1.254
<code>
fis init

ether

ip -l 192.168.1.1 -h 192.168.1.254

load -r -b 0x70000 -m tftp openwrt-wrt300nv2-zImage

fis create kernel

load -r -b 0x70000 -m tftp openwrt-ixp4xx-generic-jffs2-64k.img

fis create rootfs

fis load kernel

fconfig

ether

fis load kernel

exec

</code>
====Pointers for reviving the Marvel 88E6060 switch====
\\  [[http://www.marvell.com/products/switching/linkstreet/marvell_linkstreet_88E6060_datasheet.pdf|88E6060 datasheet]]
\\  [[http://www.totalphase.com/support/kb/10042/|MDIO explained]]
\\  [[http://marc.info/?l=linux-netdev&m=122265586218156|Distributed Switch Architecture]]
\\  [[http://hegallis.blogspot.com/2009/07/distributed-switch-architecture.html| DSA explained]]
\\  [[http://lists.denx.de/pipermail/u-boot/2007-December/027033.html|MII-connected ethernet switch for IPX42x]]
\\  [[http://www.mail-archive.com/linux-embedded@vger.kernel.org/msg01290.html|mdio-gpio work without OF]]

<code>
check the:

/proc/iomem
/proc/ioports
</code>

======WGT634U======
{{http://wiki.ozo.com/wgt634u-rs232.jpg }}

=====Flash procedure=====
Images smaller than 4MB can be flashed via TFTP. You need to run a TFTP server on your local PC.

    * attach a serial console cable to the WGT634U
    * attach ethernet to the **WAN** port (next to the USB socket)
    * hold down CTRL-C while inserting power to enter CFE
    * configure ethernet from CFE (e.g. with a local DHCP server):

  CFE> ifconfig eth0 -auto
  Device eth0:  hwaddr 00-0F-B5-97-1C-3D, ipaddr 192.168.1.250, mask 255.255.255.0
  gateway 192.168.1.1, nameserver 192.168.1.1, domain foo.com
  *** command status = 0

    * for manual configuration use something like this:

  ifconfig eth0 -addr=192.168.1.250 -mask=255.255.255.0

    * then, flash the new openwrt-wgt634u-2.6-{squashfs,jffs2}.bin image:

  CFE> flash -noheader 192.168.1.254:openwrt-wgt634u-jffs2.bin flash0.os
  Reading 192.168.1.79:openwrt-wgt634u-jffs2.bin: Done. 1970176 bytes read
  Programming...done. 1970176 bytes written
  *** command status = 0

    * reboot with

  CFE> reboot

Flashing may take over a minute or more. After that you can use reboot to start OpenWrt.



=====Nvram reset=====

The flash chip is located on the bottom right of the PCB (if you look at it while it’s hanging with the LAN ports up and the leds down).

The 1st and 2nd pin are in the bottom right corner of the chip (see page 15 of the datasheet).

Alright so I put a small piece of metal between them, connect the power adapter to the WGT634U et voilà, nvram is cleared.

This time I’m more careful. I setup all the missing environment variable using the -p option, so that I can correct any mistake:
<code>
setenv -p STARTUP "ifconfig eth0 -addr=192.168.1.1 -mask=255.255.255.0; boot -elf flash0.os:"
setenv -p et0phyaddr 254
setenv -p et0mdcport 0
setenv -p configvlan 0x1
setenv -p et0macaddr 00-09-5b-f7-XX-XA
setenv -p et1macaddr 00-09-5b-f7-XX-XB
setenv -p NET_DEVICE eth0
setenv -p NET_IPADDR 192.168.1.1
setenv -p NET_NETMASK 255.255.255.0
setenv -p kernel_args "console=ttyS1,115200 root=/dev/ram0 init=/linuxrc rw syst_size=8M"
</code>
**Credits**: the above procedure was taken from **Luca Gibelli**: [[http://www.nervous.it/2009/07/unbricking-wgt634u/ |Unbricking Netgear WGT634U via serial console]]

======Netgear WGT634U serial======
{{http://wifi.ozo.com/images/wgt634u-ser.jpg }}
======Compex WP54-wrt Jtag & serial======
{{http://wiki.ozo.com/wp54.jpg?160 }}  {{http://wifi.ozo.com/images/wp54-serial-port-pic.jpg }}

=====Credits=====
I would like to thank Compex support dept. for their help and feedback. But mainly the OpenWrt developer Gabor for his valuable and infinite help and feedback for this quest.









=====pointers=====
http://wiki.openwrt.org/OpenWrtDocs/Hardware/Compex/WP54G \\
http://forum.openwrt.org/viewtopic.php?pid=52842 \\
http://www.amelek.gda.pl/rtl8181/jtag/  or http://wifi.ozo.com/airo/jtag/ (mirror) \\
http://midge.vlad.org.ua/forum/viewtopic.php?p=1316 \\
http://www.urjtag.org/book/x283.html \\
http://midge.vlad.org.ua/forum/viewtopic.php?p=1299 \\
http://adm5120.narod.ru/netpassage_27g.htm \\
http://openwrt.pastebin.ca/584081 \\





=====bits & bytes=====

  Regarding rom. The first 4 bytes is a signature, then 4 byte checksum if changed to 0, the information is not checked. 
  with the displacement of 0x10 repeated 2 times the code device, for example, np27g 0xf6, 0x11, 0x78, 0x0.  replacing it 
  could sews firmware from other devices in this series (while noting the reset counter. amount).  0x50 shift - 4 bytes mean 
  size of the kernel and that starts with rootfs 0x10100 + 8 bytes (which contain the lenght of kernel + rootfs and presumably 
  kontrolnyya amount). 

  If retain Reset button during power, it is possible to fill the firmware on tftp directly via email 192.168.168.1/24 loader. 

  х100 f8 shift 0 - 4 bytes in length file linux.img kompressirovannom form 

  0x100fc shift - 4 bytes certain checksum modification time taking into account the contents of the archive linux.img 
  (runtime gzip th with a maximum compression), with the changing values in the field of Linux NE STARTUET although 
  without passport problems 

  there is a crc32 of gzipped image (from the 0x10100 to the end) on offset 0x100fc on my wp54ag, setting it and disabling 
  first crc on 0x4 allows me to boot my modified firmware. I bet it will be same for np27g... I bet it will be same for np27g ... 

  BTW: do you know how to compute first crc (is it really crc32?) on 0x4, it will be better to have it corectly set instead of 
  disabled (00000000) BTW: do you know how to compute first crc (is it really crc32?) On 0x4, it will be better to have it 
  correctly set instead of disabled (00000000) 




=====System Map=====
<code>

+------------------------------------+
|     Boot loader (64k)              |
+------------------------------------+
|     System Parameter (64k)         |
+------------------------------------+
|                                    |
|       vmlinuz (Remaining)          |
~                                    ~
~                                    ~
|                                    |
|                                    |
+------------------------------------+
</code>
Compex's fork of OpenWRT use the following as a partition table:
<code>
0x00000000-0x00010000 : "MyLoader"
0x00010000-0x00020000 : "Partition Table"
0x00020000-0x00030000 : "lzma loader"
0x00030000-0x00100000 : "kernel"
0x00100000-0x00400000 : "rootfs"
0x002f0000-0x00400000 : "rootfs_data"
</code>
the /proc/mtd for an official OpenWrt
<code>
dev:    size   erasesize  name
mtd0: 00040000 00010000 "cfe"
mtd1: 003b0000 00010000 "linux"
mtd2: 001e1c00 00010000 "rootfs"
mtd3: 00010000 00010000 "nvram"
mtd4: 00150000 00010000 "OpenWrt"
</code>







=====quick howto=====
 * I managed to quickly brick this device. \\
 * I got the required files from Compex for the jtag recovery. \\
 * I am not sure if they are the correct ones for the hardware I have. \\
 * Don't ask me for the files.  Please contact Compex support instead. \\
 * The flash chip is a 4MB labeled MX 64621, 29LV320CBTC-70G \\
 * I used a self build [[http://wifi.ozo.com/images/jtag-unbuf.jpg|unbuffered jtag cable]] \\
 * the pinouts for the wp54 device are [[http://wifi.ozo.com/?Development:Serial%2C_Jtag_Interfaces:WP54_devices|here]] \\
 * I had to convert the OCD macro file to a script file for the openwince-jtag <-- (this step is not necessary) \\


=====step by step=====
  The .mac init macro for OCD Commander can be made into a script for jtag tools. 
  You need to change the "word 0x...... = 0x....." commands to "poke 0x... 0x..." commands. 

  For instance, the command in the .mac file: "word 0xb20000bc = 0x0" would become "poke 0x520000bc 0x0" in a jtag tools script. 
  The command in the .mac file: "word 0xb20000bc" would become "peek 0xb20000bc"
  The 0x5 at the start is in the range of 32-bit memory access which is what you need for writing to the ADM5120 registers. 

Following [[http://midge.vlad.org.ua/forum/viewtopic.php?p=1314&#1314|these]] instructions I was able to get some respond from the bricked box. \\
These are the steps from inside the jtag program:
<code>
cable ppdev /dev/parport0 DLC5
detect
include admtek/adm5120/adm5120
poke 0x520000bc 0x00000000 
# wait a few seconds
poke 0x520000b8 0x01ffff01 
# wait a few seconds
poke 0x5200001c 0x00000423 
# wait a few seconds
poke 0x51000220 0x00000081 
# wait a few seconds
poke 0x51000224 0x00000000
poke 0x51000228 0x00000000
poke 0x5100022c 0x00000009
poke 0x51000230 0x0000001f
poke 0x51000234 0x00000009
poke 0x51000238 0x00000005
poke 0x51000000 0x00000001
poke 0x51000030 0x00000001
poke 0x51000034 0x00000004
poke 0x51000038 0x0000000f
poke 0x5100003c 0x00000001
poke 0x5100003c 0x00000001
poke 0x51000040 0x00000003
poke 0x51000044 0x00000001
poke 0x51000048 0x00000006
poke 0x5100004c 0x00000006
poke 0x51000050 0x00000007
poke 0x51000054 0x00000001
poke 0x51000058 0x00000001
poke 0x51000020 0x00000003
poke 0x51000100 0x00000000
poke 0x51000020 0x00000183
poke 0x51000020 0x00000103
poke 0x51000024 0x00000002
poke 0x51000024 0x00000055
poke 0x51000104 0x00000202
poke 0x51000100 0x14c04480
poke 0x51000124 0x00000202
poke 0x51000120 0x14c04480
poke 0x51000020 0x00000083
peek 0x40044000
poke 0x51000020 0x00000001
poke 0x51000100 0x14c84480
poke 0x3fc13c00 0x00f0 
# wait a few seconds
poke 0x1fc13c00 0xf0
poke 0x1fc00aaa 0xaa
poke 0x1fc00554 0x55
poke 0x1fc00aaa 0x90
peek 0x1fc00000
peek 0x3fc00002
peek 0x1fc00006 
</code>
  detectflash 0x3fc00000
and here is the output:
<code>
Query identification string:
        Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set)
        Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
Query system interface information:
        Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
        Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
        Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
        Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
        Typical timeout per single byte/word program: 16 us
        Typical timeout for maximum-size multi-byte program: 0 us
        Typical timeout per individual block erase: 1024 ms
        Typical timeout for full chip erase: 0 ms
        Maximum timeout for byte/word program: 512 us
        Maximum timeout for multi-byte program: 0 us
        Maximum timeout per individual block erase: 16384 ms
        Maximum timeout for chip erase: 0 ms
Device geometry definition:
        Device Size: 4194304 B (4096 KiB, 4 MiB)
        Flash Device Interface Code description: 0x0002 (x8/x16)
        Maximum number of bytes in multi-byte program: 1
        Number of Erase Block Regions within device: 2
        Erase Block Region Information:
                Region 0:
                        Erase Block Size: 8192 B (8 KiB)
                        Number of Erase Blocks: 8
                Region 1:
                        Erase Block Size: 65536 B (64 KiB)
                        Number of Erase Blocks: 63
</code>
and now on a trail and error basis
  flashmem 0x3fc00000 zMylo.bin
<code>
Chip: AMD Flash
        Manufacturer: Macronix
        Chip: Unknown (ID 0x22a8)
        Protected: 0000
program:
flash_unlock_block 0x3FC00000 IGNORE

block 0 unlocked
flash_erase_block 0x3FC00000
flash_erase_block 0x3FC00000 DONE
erasing block 0: 0
flash_unlock_block 0x3FC02000 IGNORE

block 1 unlocked
flash_erase_block 0x3FC02000
flash_erase_block 0x3FC02000 DONE
erasing block 1: 0
flash_unlock_block 0x3FC04000 IGNORE

block 2 unlocked
flash_erase_block 0x3FC04000
flash_erase_block 0x3FC04000 DONE
erasing block 2: 0
flash_unlock_block 0x3FC06000 IGNORE

block 3 unlocked
flash_erase_block 0x3FC06000
flash_erase_block 0x3FC06000 DONE
erasing block 3: 0
flash_unlock_block 0x3FC08000 IGNORE

block 4 unlocked
flash_erase_block 0x3FC08000
flash_erase_block 0x3FC08000 DONE
erasing block 4: 0
flash_unlock_block 0x3FC0A000 IGNORE

block 5 unlocked
flash_erase_block 0x3FC0A000
flash_erase_block 0x3FC0A000 DONE
erasing block 5: 0
flash_unlock_block 0x3FC0C000 IGNORE

block 6 unlocked
flash_erase_block 0x3FC0C000
flash_erase_block 0x3FC0C000 DONE
erasing block 6: 0
flash_unlock_block 0x3FC0E000 IGNORE

block 7 unlocked
flash_erase_block 0x3FC0E000
flash_erase_block 0x3FC0E000 DONE
erasing block 7: 0
addr: 0x3FC0F040 (done)
verify:
addr: 0x3FC0F03E
Done.
</code>
and from the serial port:
<code>
MyLoader version 2.43.0706
System memory: 16MB

Probe Flash Device: 00400000 at bfc00000
Flash Device: Found 1 x16 devices at 0x0 in 16-bit mode
 Amd/Fujitsu Extended Query Table v1.1 at 0x0040
number of CFI chips: 1

Flash memory: 4MB

Update System Paramters ............. Done
Update Board Parameters ............. Done
Update Partition Table .............. Done

Load Firmware

Loading Firmware  No active partition.

Update Firmware (Image Mode)

Mini TFTP Server 1.0 (IP : 192.168.168.1)
Usage (Windows 2000/XP) :
  tftp -i 192.168.168.1 put <filename>
</code>




=====hacks=====
Here is an Edimax extended bootloader loaded through the jtag  
<code>
ADM5120 Boot:


Evolution version.Only for testing
CPU: ADM5120-175MHz
SDRAM: 2x16MB
Flash: NOR-2MB
Boot System: ADM5120-Linux
Loader Version: 1.00.05
Creation Date: 2004.12.20

Press <space> key tree times to enter boot menu..
3

Loader Menu
============0.04===============
 [1] Xmodem Download to SDRAM (4M)
 [2] TFTP Client Download to SDRAM (4M)
 [3] Print Boot Params
 [4] Set Boot Params
 [5] Update bootloader to FLASH (Xmodem)
 [6] Start from SDRAM
 [7] Write SDRAM to flash (2M)

Please enter your number:
</code>
Here is CFE bootloader loaded through the jtag  <-- this bood loader did the trick
<code>
CFE version 1.2.5 for WP54G (32bit,SP,LE,MIPS)
Build Date: Mon Jan 29 11:12:45     2007 (Yuhi@jonagold)
Copyright (C) 2000,2001,2002,2003,2004,2005 Broadcom Corporation.
Copyright (C) 2006,2007 Gabor Juhos

Initializing Arena.
Initializing PCI. [normal]
PCI bus 0 slot 0/0: ADMtek ADM5120 Host Bridge (host bridge)
Initializing Devices.
CPU type 0x1800B: 175MHz
Total memory: 0x1000000 bytes (16MB)

Total memory used by CFE:  0x80F85000 - 0x80FFF3E0 (500704)
Initialized Data:          0x80FBA260 - 0x80FBC4D0 (8816)
BSS Area:                  0x80FBC4D0 - 0x80FBD3E0 (3856)
Local Heap:                0x80FBD3E0 - 0x80FFD3E0 (262144)
Stack Area:                0x80FFD3E0 - 0x80FFF3E0 (8192)
Text (code) segment:       0x80F85000 - 0x80F93490 (58512)
Boot area (physical):      0x00F44000 - 0x00F84000
Relocation Factor:         I:E1385000 - D:E1385000

Loader:raw Filesys:raw Dev:flash1.trx File:0x1c Options:(null)
Loading: .. 8112 bytes read
Entry at 0x80001000
Starting program at 0x80001000
</code> 





=====OpenWrt Power=====
After flashing the CFE loader, the commands we need are the following:
  CFE> nvram set STARTUP="load -z -raw -max=0x400000 -addr=0x80001000 flash1.trx:0x1c;go" 
  CFE> nvram commit 
  CFE> ifconfig eth0 -addr=192.168.1.1 
  CFE> flash -noheader 192.168.1.10:openwrt-adm5120-wp54g-wrt-squashfs.trx flash1.trx 
  CFE> reset 
On the above setup the tftp server is on 192.168.1.10. OpenWrt powers finally the Compex C-54PWE Rev A6.1

** I had issues with the above procedure (jffs2 errors). For best results use the upgrade procedure bellow. **
<code>
LZMA loader for WP54G-WRT, Copyright (C) 2007 OpenWrt.org

Looking for TRX header... found at 00050000, kernel:00001118 len:000BEEE8
decompressing kernel... done!
launching kernel...

Linux version 2.6.23.12 (alex@orama) (gcc version 4.2.2) #1 Mon Jan 14 22:08:28 EET 2008
console [early0] enabled
CPU revision is: 0001800b
SoC      : ADM5120 revision 8, running at 175MHz
Bootdev  : NOR flash
Prom     : Generic
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists in Zone order.  Total pages: 4064
Kernel command line: console=ttyS0,115200 rootfstype=squashfs,yaffs2,jffs2 init=/etc/preinit
Primary instruction cache 8kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 64 (order: 6, 256 bytes)
Using 87.500 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13956k/16384k available (1751k kernel code, 2428k reserved, 308k data, 112k init, 0k highmem)
Mount-cache hash table entries: 512
adm5120: registered board 'Generic ADM5120 board'
adm5120: registered board 'Cellvision CAS-630/630W'
adm5120: registered board 'Cellvision CAS-670/670W'
adm5120: registered board 'Cellvision CAS-700/700W'
adm5120: registered board 'Cellvision CAS-771/771W'
adm5120: registered board 'Cellvision CAS-790'
adm5120: registered board 'Cellvision CAS-861/861W'
adm5120: registered board 'Compex WPP54G'
adm5120: registered board 'Compex WPP54AG'
adm5120: registered board 'Compex WP54G-WRT'
adm5120: registered board 'Compex WP54G'
adm5120: registered board 'Compex WP54AG'
adm5120: registered board 'Compex NetPassage 28G'
adm5120: registered board 'Compex NetPassage 27G'
adm5120: registered board 'Edimax BR-6104WG/6114WG'
adm5120: registered board 'Edimax BR-6104K/6104KP'
adm5120: registered board 'Infineon EASY 83000 Reference Board'
adm5120: registered board 'Infineon EASY 5120-WVoIP Reference Board'
adm5120: registered board 'Infineon EASY 5120-RT Reference Board'
adm5120: registered board 'Infineon EASY 5120P-ATA Reference Board'
adm5120: registered board 'Mikrotik RouterBOARD 192'
adm5120: registered board 'Mikrotik RouterBOARD 153'
adm5120: registered board 'Mikrotik RouterBOARD 150'
adm5120: registered board 'Mikrotik RouterBOARD 133C'
adm5120: registered board 'Mikrotik RouterBOARD 133'
adm5120: registered board 'Mikrotik RouterBOARD 112'
adm5120: registered board 'Mikrotik RouterBOARD 111'
adm5120: registered board 'ZyXEL Prestige 335/335WT'
adm5120: registered board 'ZyXEL Prestige 334WT'
NET: Registered protocol family 16
adm5120: setting up board 'Compex WP54G-WRT'
adm5120: system has PCI BIOS
registering PCI controller with io_map_base unset
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  ώώ 2001-2006 Red Hat, Inc.
yaffs Jan 14 2008 22:07:25 Installing.
io scheduler noop registered
io scheduler deadline registered (default)
Serial: AMBA driver $Revision: 1.41 $
APB:UART0: ttyS0 at MMIO 0x12600000 (irq = 9) is a AMBA
console handover: boot [early0] -> real [ttyS0]
APB:UART1: ttyS1 at MMIO 0x12800000 (irq = 10) is a AMBA
ADM5120 built-in ethernet switch driver version 0.1.0
adm5120-flash.0: probing at 0x1FC00000, size:4096KiB, width:16 bits
adm5120-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
adm5120-flash.0: found at 0x1FC00000, size:4096KiB, width:16 bits
adm5120-flash.0: adding static partitions
Creating 3 MTD partitions on "adm5120-flash.0":
0x00000000-0x00050000 : "cfe"
0x00050000-0x003f0000 : "trx"
0x003f0000-0x00400000 : "nvram"
adm5120_wdt: Watchdog Timer version 0.1
TCP vegas registered
NET: Registered protocol family 1
NET: Registered protocol family 17
trxsplit: searching TRX header in 'cfe'
trxsplit: searching TRX header in 'trx'
trxsplit: TRX header found at 0x0
trxsplit: creating TRX partitions in 'trx' (31,1)
Creating 3 MTD partitions on "trx":
0x0000001c-0x00001118 : "loader"
mtd: partition "loader" doesn't start on an erase block boundary -- force read-only
0x00001118-0x000c0000 : "kernel"
mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only
0x000c0000-0x003a0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "trx"
yaffs: dev is 32505861 name is "mtdblock5"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.5, "mtdblock5"
yaffs: MTD device is not NAND it's type 3
jffs2_scan_eraseblock(): End of filesystem marker found at 0xf0000
jffs2_build_filesystem(): unlocking the mtd device... done.
jffs2_build_filesystem(): erasing all blocks after the end marker... done.
VFS: Mounted root (jffs2 filesystem) readonly.
Freeing unused kernel memory: 112k freed
Warning: unable to open an initial console.
Algorithmics/MIPS FPU Emulator v1.5
- preinit -
- init -

Please press Enter to activate this console.


BusyBox v1.8.2 (2008-01-14 22:02:18 EET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r10194) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/#
</code>



=====Firmware upgrade=====
<code>
cd /tmp/
wget http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/adm5120/latest/openwrt-adm5120-wp54g-wrt-jffs2.trx
mtd write openwrt-adm5120-wp54g-wrt-jffs2.trx linux mtd1 && reboot
mtd write -r openwrt-adm5120-wp54g-wrt-jffs2.trx mtd1 <-- new format
</code>
<code>
update 06/2017

root@LEDE:/tmp# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00050000 00010000 "cfe"
mtd1: 003a0000 00010000 "trx"
mtd2: 00010000 00010000 "nvram"
mtd3: 00001048 00001048 "loader"
mtd4: 000e479c 00010000 "kernel"
mtd5: 002ba800 00010000 "rootfs"
mtd6: 001e0000 00010000 "rootfs_data"
mtd7: 001e0000 00010000 "rootfs_data"

root@LEDE:/tmp# mtd -r write  lede-adm5120-router_le-wp54g-wrt-squashfs.trx trx
Unlocking trx ...

Writing from lede-adm5120-router_le-wp54g-wrt-squashfs.trx to trx ...     
Rebooting ...
</code>
======Avila gateworks======

=====Firmware upgrade=====
<code>
RedBoot> ^C
RedBoot> fis init -f
About to initialize [format] FLASH image system - continue (y/n)? y
*** Initialize FLASH Image System
... Erase from 0x50080000-0x50fe0000: .....................................................................................................................
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x03fe0000-0x04000000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
RedBoot> load -r -b %{FREEMEMLO} openwrt-avila-zImage
Using default protocol (TFTP)
Raw file loaded 0x00029c00-0x0010d0e3, assumed entry at 0x00029c00
RedBoot> fis create kernel
... Erase from 0x50080000-0x50180000: ........
... Program from 0x00029c00-0x0010d0e4 at 0x50080000: ........
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x03fe0000-0x04000000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
RedBoot> load -r -b %{FREEMEMLO} openwrt-ixp4xx-jffs2-128k.img
Using default protocol (TFTP)
Raw file loaded 0x00029c00-0x00129bff, assumed entry at 0x00029c00
RedBoot> fis create -l 0xe00000 rootfs
... Erase from 0x50180000-0x50f80000: ................................................................................................................
... Program from 0x00029c00-0x00129c00 at 0x50180000: ........
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x03fe0000-0x04000000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
RedBoot> fis free
  0x50F80000 .. 0x50FE0000
RedBoot> fconfig
Run script at boot: true
Boot script:
.. fis load linux
.. exec
Enter script, terminate with empty line
>> fis load kernel
>> exec
>>
Boot script timeout (100ms resolution): 25
Use BOOTP for network configuration: false
Gateway IP address: 192.168.3.1
Local IP address: 192.168.3.2
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.3.1
Console baud rate: 115200
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Default network device: npe_eth0
Update RedBoot non-volatile configuration - continue (y/n)? y
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x03fe0000-0x04000000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
RedBoot> fis load kernel
RedBoot> exec
Using base address 0x00029c00 and length 0x000e34e4
Uncompressing Linux................................................................ done, booting the kernel.
Linux version 2.6.23.14 (alex@orama) (gcc version 4.2.2) #2 Sun Jan 20 19:14:43 EET 2008
CPU: XScale-IXP42x Family [690541c1] revision 1 (ARMv5TE), cr=000039ff
Machine: Gateworks Avila Network Platform
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT undefined 5 cache
CPU0: I cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
CPU0: D cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
Built 1 zonelists in Zone order.  Total pages: 16256
Kernel command line: rtc-ds1672.probe=0,0x68 root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 init=/etc/preinit
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 64MB = 64MB total
Memory: 62860KB available (1748K code, 165K data, 88K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
IXP4xx: Using 16MiB expansion bus window size
PCI: IXP4xx is host
PCI: IXP4xx Using direct access for memory space
PCI: bus0: Fast back to back transfers enabled
dmabounce: registered device 0000:00:03.0 on pci bus
dmabounce: registered device 0000:00:04.0 on pci bus
NET: Registered protocol family 2
Time: OSTS clocksource has been installed.
Switched to high resolution mode on CPU 0
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
IXP4xx Queue Manager initialized.
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  ώώ 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xc8000000 (irq = 15) is a XScale
console [ttyS0] enabled
serial8250.0: ttyS1 at MMIO 0xc8001000 (irq = 13) is a XScale
eth0: MII PHY 0 on NPE-B
eth1: MII PHY 1 on NPE-C
IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank
 Intel/Sharp Extended Query Table at 0x0031
Using buffer write method
cfi_cmdset_0001: Erase suspend on write enabled
Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0xfe0000
6 RedBoot partitions found on MTD device IXP4XX-Flash.0
Creating 6 MTD partitions on "IXP4XX-Flash.0":
0x00000000-0x00080000 : "RedBoot"
0x00080000-0x00180000 : "kernel"
0x00180000-0x00f80000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "IXP4XX-Flash.0"
0x00f80000-0x00fe0000 : "unallocated"
0x00fe0000-0x00fff000 : "FIS directory"
0x00fff000-0x01000000 : "RedBoot config"
i2c /dev entries driver
ds1672 0-0068: chip found, driver version 0.3
ds1672 0-0068: rtc core: registered ds1672 as rtc0
ds1672 0-0068: Oscillator not enabled. Set time to enable.
i2c-gpio i2c-gpio.0: using pins 7 (SDA) and 6 (SCL)
IXP4xx Watchdog Timer: heartbeat 60 sec
TCP westwood registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
XScale DSP coprocessor detected.
ds1672 0-0068: setting the system clock to 2055-08-31 17:01:54 (2703344514)
jffs2_scan_eraseblock(): End of filesystem marker found at 0xe0000
jffs2_build_filesystem(): unlocking the mtd device... done.
jffs2_build_filesystem(): erasing all blocks after the end marker... done.
VFS: Mounted root (jffs2 filesystem).
Freeing init memory: 88K
Warning: unable to open an initial console.
- preinit -

- init -

Please press Enter to activate this console.

BusyBox v1.8.2 (2008-01-20 13:29:36 EET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r10225) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@(none):/# NPE-B: firmware's license can be found in /usr/share/doc/LICENSE.IPL
NPE-B: firmware functionality 0x0, revision 0x2:1
eth0: link down
eth0: link up, 100Mbps, full-duplex, lpa 0x45E1
</code>

======RouterBoard RB333======
  
\\ http://mike.it-loops.com/dump/
\\ http://cynigram.com/~nfontes/rb600/
\\ http://lists.ozlabs.org/pipermail/linuxppc-dev/2009-March.txt
\\ http://www.pubbs.net/linuxppc/200912/14233/
\\ http://markmail.org/message/h5xdnfiis4vnzmho
\\ http://forum.routerboard.com/forum/viewtopic.php?f=10&t=3857

\\ http://www.pubbs.net/linuxppc/200912/14233/
\\ http://www.mail-archive.com/linuxppc-dev@lists.ozlabs.org/msg20867.html

\\ http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.33.y.git;a=tree;f=arch/powerpc/boot/dts;h=f9c348b3a4f78463fe3eacead5d5b0755a1028a3;hb=HEAD

\\ FreeBSD:
\\ http://lists.freebsd.org/pipermail/freebsd-ppc/2008-July/002950.html

\\ http://forums.xilinx.com/xlnx/board/message?message.uid=35090

\\ http://www.mail-archive.com/linuxppc-dev@lists.ozlabs.org/msg30010.html

\\ http://old.nabble.com/MPC83xx-console-:-no-output-after-handover-td22814207.html

\\ http://lists.ozlabs.org/pipermail/devicetree-discuss/2009-August/001049.html
<code>The binding didn't change, but bugs were fixed in the parsing code so 
that what was common practice (but wrong) in 2.6.23 doesn't work anymore.

Your tsi108 node only provides a ranges translation for its own 
registers, but you have a PCI child node with ranges outside of that. 
It's a bit awkward, but what we currently tend to do is move the PCI 
node out to the root level (make sure to change the reg property to be 
the full address rather than the tsi108 offset).
</code>

\\ http://www.silica.com/fileadmin/02_Products/07_Designers-Choice-Online/DC3_06/DC_3_2006_13.pdf

\\ http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.33.y.git;a=blob;f=Documentation/powerpc/booting-without-of.txt

\\ http://www.mail-archive.com/linuxppc-dev@lists.ozlabs.org/msg40430.html
=====RouterBoard RB333 goes OpenWRT=====

Openwrt supports this platform as of [[https://dev.openwrt.org/changeset/21256/trunk/target/linux/mpc83xx|r21256]]. r23630 boots a fine 2.6.36 kernel on this device.

* for some reason, dhcp is not working on my rb333, had to use bootp and enable the bootp functionality on dnsmasq (--dhcp-broadcast --bootp-dynamic)
<code>
RouterBOOT booter 2.18

RouterBoard 333

CPU frequency: 333 MHz
  Memory size:  64 MB

Press any key within 2 seconds to enter setup..
loading kernel from nand... OK
setting up elf image... OK
jumping to kernel code
Memory <- <0x0 0x4000000> (64MB)
CPU clock-frequency <- 0x13de3650 (333MHz)
CPU timebase-frequency <- 0x1fc9f08 (33MHz)

zImage starting: loaded at 0x00490000 (sp: 0x005ebfb0)
Allocating 0x2cb054 bytes for kernel ...
gunzipping (0x00000000 <- 0x0049d000:0x005ead34)...done 0x2b2fcc bytes

Linux/PowerPC load: console=ttyS0,115200 board=mpc8323 boot=1
Finalizing device tree... flat tree at 0x5f8300
Using MikroTik RouterBOARD 333/600 series machine description
Linux version 2.6.36 (alex@motard) (gcc version 4.5.1 (GCC) ) #1 Tue Oct 26 15:00:04 EEST 2010
bootconsole [udbg0] enabled
Found FSL PCI host bridge at 0x00000000e0008500. Firmware bus number: 0->0
PCI host bridge /pci@e0008500 (primary) ranges:
MEM 0x0000000080000000..0x000000009fffffff -> 0x0000000080000000
  IO 0x00000000d0000000..0x00000000d3ffffff -> 0x0000000000000000
Zone PFN ranges:
  DMA      0x00000000 -> 0x00004000
  Normal   empty
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 board=mpc8323 boot=1
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 62044k/65536k available (2644k kernel code, 3492k reserved, 120k data, 96k bss, 140k init)
Kernel virtual memory layout:
  * 0xfffdf000..0xfffff000  : fixmap
  * 0xfcef8000..0xfe000000  : early ioremap
  * 0xc5000000..0xfcef8000  : vmalloc & ioremap
NR_IRQS:512 nr_irqs:512
IPIC (128 IRQ sources) at c5000700
clocksource: timebase mult[78004ea] shift[22] registered
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI: Probing PCI hardware
pci 0000:00:12.0: BAR 0: assigned [mem 0x80000000-0x8000ffff]
pci 0000:00:12.0: BAR 0: set to [mem 0x80000000-0x8000ffff] (PCI address [0x80000000-0x8000ffff]
bio: create slab <bio-0> at 0
SCSI subsystem initialized
Freescale Elo / Elo Plus DMA driver
Switching to clocksource timebase
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
of:fsl-elo-dma e00082a8.dma: #0 (fsl,elo-dma-channel), irq 71
of:fsl-elo-dma e00082a8.dma: #1 (fsl,elo-dma-channel), irq 71
of:fsl-elo-dma e00082a8.dma: #2 (fsl,elo-dma-channel), irq 71
of:fsl-elo-dma e00082a8.dma: #3 (fsl,elo-dma-channel), irq 71
WDT driver for MPC8xxx initialized. mode:reset timeout=65535 (-65536 seconds)
Registering mini_fo version $Id$
JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 121
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Generic RTC Driver v1.07
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xe0004500 (irq = 16) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Freescale QUICC Engine UART device driver
rbppc_nand_probe: MikroTik RouterBOARD 333/600 series NAND driver, version 0.0.2
NAND device: Manufacturer ID: 0xad, Chip ID: 0x76 (Hynix NAND 64MiB 3,3V 8-bit)
Scanning device for bad blocks
Creating 2 MTD partitions on "NAND 64MiB 3,3V 8-bit":
0x000000000000-0x000000400000 : "kernel"
0x000000400000-0x000004000000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "NAND 64MiB 3,3V 8-bit"
of:mpc8xxx_spi e0100500.spi: at 0xc508c500 (irq = 18), CPU mode
of:mpc8xxx_spi e01004c0.spi: at 0xc50904c0 (irq = 20), CPU mode
Fixed MDIO Bus: probed
ucc_geth: QE UCC Gigabit Ethernet Controller
ucc_geth: UCC3 at 0xe0102200 (irq = 34)
ucc_geth: UCC4 at 0xe0103200 (irq = 35)
ucc_geth: UCC2 at 0xe0103000 (irq = 17)
Freescale PowerQUICC MII Bus: probed
TCP cubic registered
NET: Registered protocol family 17
yaffs: dev is 32505857 name is "mtdblock1" ro
yaffs: passed flags ""
VFS: Mounted root (yaffs filesystem) readonly on device 31:1.
Freeing unused kernel memory: 140k init
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
- init -

Please press Enter to activate this console. wlan: trunk
ath_hal: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 2009-05-08 (AR5210, AR5211, AR5212, AR5416, RF5111, RF5112, RF2413, RF5413, RF2133, RF2425, REGOPS_FUNC, XR)
ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (trunk)
ath_rate_minstrel: look around rate set to 10%
ath_rate_minstrel: EWMA rolloff level set to 75%
ath_rate_minstrel: max segment size in the mrr set to 6000 us
wlan: mac acl policy registered
ath_pci: trunk
ath_pci 0000:00:12.0: enabling device (0000 -> 0002)
Atheros HAL provided by OpenWrt, DD-WRT and MakSat Technologies
wifi0: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wifi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
wifi0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wifi0: turboG rates: 6Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wifi0: H/W encryption support: WEP AES AES_CCM TKIP
ath_pci: wifi0: Atheros 5212: mem=0x80000000, irq=19
PHY: mdio@e0102320:01 - Link is Up - 100/Full



BusyBox v1.17.3 (2010-10-26 14:46:35 EEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
KAMIKAZE (bleeding edge, r23637) ------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
---------------------------------------------------
root@OpenWrt:/# 
</code>

======RouterBoard RB532======











=====Firmware upgrade=====
First we have to start with a clean NAND.  We need to format the NAND.  You can say goodbye to the RouterOS.  Open source is better.
<code>
RouterBOOT booter 2.8

RouterBoard 532A

CPU frequency: 399 MHz
  Memory size:  64 MB

Press any key within 2 seconds to enter setup

RouterBOOT-2.8
What do you want to configure?
   d - boot delay
   k - boot key
   s - serial console
   o - boot device
   u - cpu mode
   f - try cpu frequency
   c - keep cpu frequency
   r - reset configuration
   e - format nand
   g - upgrade firmware
   i - board info
   p - boot protocol
   t - do memory testing
   x - exit setup
your choice: e - format nand


Do you realy want to format your nand?
that would result in losing all your data
type "yes" to confirm: yes
formating nand... done!
</code>
Now we need to choose a netboot method.  I use dnsmasq for this.
<code>
your choice: p - boot protocol

Choose which boot protocol to use:
   1 - bootp protocol
 * 2 - dhcp protocol
your choice: 2 - dhcp protocol
</code>
Now that the NAND is empty it's a good practice to select the following boot method:
<code>
your choice: o - boot device

Select boot device:
   e - boot over Ethernet
 * n - boot from NAND, if fail then Ethernet
   c - boot from CompactFlash only
   1 - boot Ethernet once, then NAND
   2 - boot Ethernet once, then CompactFlash
   o - boot from NAND only
   b - boot chosen device
your choice: n - boot from NAND, if fail then Ethernet
</code>
now we can netboot since the NAND flash is empty. You can get a netboot image from[[http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/rb5xx/9705-latest-madwifi/openwrt-rb532-vmlinux|here]]:
<code>
your choice: x - exit setup




RouterBOOT booter 2.8

RouterBoard 532A

CPU frequency: 399 MHz
  Memory size:  64 MB

Press any key within 2 seconds to enter setup..
kernel not found
trying dhcp protocol............... OK
resolved mac address 00:0C:76:A5:6E:45
Gateway: 192.168.1.66
transfer started ........... transfer ok, time=0.39s
setting up elf image... OK
jumping to kernel code
Linux version 2.6.23.14 (alex@orama) (gcc version 4.2.2) #2 Tue Jan 29 09:07:23 EET 2008
CPU revision is: 0001800a
Determined physical RAM map:
 memory: 03fffa00 @ 00000400 (usable)
Wasting 32 bytes for tracking 1 unused pages
Initrd not found or empty - disabling initrd
Built 1 zonelists in Zone order.  Total pages: 16256
Kernel command line: console=ttyS0,115200 gpio=16383 kmac=00:0C:42:0F:C3:54 board=500r5 boot=1
korina mac = 00:0C:42:0F:C3:54
Primary instruction cache 8kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 8kB, 4-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Initializing IRQ's: 168 out of 256
PID hash table entries: 256 (order: 8, 1024 bytes)
calculating r4koff... 001e846c(1999980)
CPU frequency 400.00 MHz
Using 199.998 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 60572k/65528k available (2060k kernel code, 4892k reserved, 319k data, 812k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI: Initializing PCI
registering PCI controller with io_map_base unset
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
squashfs: version 3.0 (2006/03/15) Phillip Lougher
JFFS2 version 2.2. (NAND) (SUMMARY)  ώώ 2001-2006 Red Hat, Inc.
yaffs Jan 29 2008 09:02:37 Installing.
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 104) is a 16550A
Using NAPI with weight 64
eth0: Rx IRQ 40, Tx IRQ 41, 00:0c:42:0f:c3:54
via-rhine.c:v1.10-LK1.4.3 2007-03-06 Written by Donald Becker
PCI: Enabling device 0000:00:02.0 (0080 -> 0083)
io_map_base of root PCI bus 0000:00 unset.  Trying to continue but you better
fix this issue or report it to linux-mips@linux-mips.org or your vendor.
eth1: VIA Rhine III at 0xb8800000, 00:0c:42:0f:c3:55, IRQ 142.
eth1: MII PHY found at address 1, status 0x7849 advertising 05e1 Link 0000.
PCI: Enabling device 0000:00:03.0 (0080 -> 0083)
eth2: VIA Rhine III at 0xb8800100, 00:0c:42:0f:c3:56, IRQ 143.
eth2: MII PHY found at address 1, status 0x7849 advertising 05e1 Link 0000.
block2mtd: version $Revision: 1.30 $
NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Creating 2 MTD partitions on "NAND 128MiB 3,3V 8-bit":
0x00000000-0x00400000 : "Routerboard NAND boot"
0x00400000-0x08000000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "NAND 128MiB 3,3V 8-bit"
input: gpio-keys as /devices/platform/gpio-keys/input/input0
Registered led device: rb500led:amber
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP vegas registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Freeing unused kernel memory: 812k freed
Algorithmics/MIPS FPU Emulator v1.5
/bin/uci: line 189: cannot create /var/state/network: nonexistent directory
/bin/uci: line 189: cannot create /var/state/network: nonexistent directory
Can't open /var/lock/dhcp-eth0
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
udhcpc (v1.8.2) started
init started: BusyBox v1.8.2 (2008-01-29 08:57:18 EET)

Please press Enter to activate this console. /bin/uci: line 189: cannot create /var/state/network: nonexistent directory
/sbin/hotplug-call: .: line 1: can't open /var/state/network
Sending discover...
Sending select for 192.168.1.57...
Lease of 192.168.1.57 obtained, lease time 43200
adding router 192.168.1.66
deleting old routes
adding dns 192.168.1.79
: udhcpc (v1.8.2) started

: Sending discover...

: Sending select for 192.168.1.57...

: Lease of 192.168.1.57 obtained, lease time 43200

: adding router 192.168.1.66

: deleting old routes

: adding dns 192.168.1.79

: sysctl: error: 'net.ipv6.conf.all.forwarding' is an unknown key




BusyBox v1.8.2 (2008-01-29 08:57:18 EET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r10304) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/#
</code>
check the NAND partitions:
<code>
root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00400000 00020000 "Routerboard NAND boot"
mtd1: 07c00000 00020000 "rootfs"
</code>
the first block is where the [[http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/rb5xx/9705-latest-madwifi/kernel|kernel]] resides and the second is where the [[http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/rb5xx/9705-latest-madwifi/openwrt-rb532-2.6-rootfs.tgz|root file system]] is.
<code>
root@OpenWrt:/# mount /dev/mtdblock0 /mnt
yaffs: dev is 32505856 name is "mtdblock0"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.0, "mtdblock0"
yaffs: auto selecting yaffs2
yaffs: restored from checkpoint
root@OpenWrt:/# cd /mnt
root@OpenWrt:/tmp# wget http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/rb5xx/9705-latest-madwifi/kernel
Connecting to wifi.ozo.com (212.70.193.242:80)
kernel               100% |*******************************|   765k 00:00:00 ETA
root@OpenWrt:/mnt# cd /
root@OpenWrt:/# umount /mnt
root@OpenWrt:/# mount /dev/mtdblock1 /mnt
yaffs: dev is 32505857 name is "mtdblock1"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.1, "mtdblock1"
root@OpenWrt:/# cd /mnt
root@OpenWrt:/tmp# wget http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/rb5xx/9705-latest-madwifi/openwrt-rb532-2.6-rootfs.tgz
Connecting to wifi.ozo.com (212.70.193.242:80)
openwrt-rb532-2.6-ro 100% |*******************************|   701k 00:00:00 ETA
root@OpenWrt:/mnt# gzip -d openwrt-rb532-2.6-rootfs.tgz
root@OpenWrt:/mnt# tar xvf openwrt-rb532-2.6-rootfs.tar
./
./var
./proc/
./usr/
./usr/share/
 .
 .
 .
./bin/nice
./bin/login
./bin/false
./tmp/
root@OpenWrt:/mnt# cd /
root@OpenWrt:/# umount /mnt
save exit: isCheckpointed 1
root@OpenWrt:/# reboot
The system is going down NOW!
Sending SIGTERM to all processes
Requesting system reboot
Restarting system.
</code>
The unit will now boot from the NAND:
<code>
RouterBOOT booter 2.8

RouterBoard 532A

CPU frequency: 399 MHz
  Memory size:  64 MB

Press any key within 2 seconds to enter setup..
loading kernel from nand... OK
setting up elf image... OK
jumping to kernel code
Linux version 2.6.23.14 (alex@orama) (gcc version 4.2.2) #1 Tue Jan 29 09:03:53 EET 2008
CPU revision is: 0001800a
Determined physical RAM map:
 memory: 03fffa00 @ 00000400 (usable)
Wasting 32 bytes for tracking 1 unused pages
Initrd not found or empty - disabling initrd
Built 1 zonelists in Zone order.  Total pages: 16256
Kernel command line: console=ttyS0,115200 gpio=16383 kmac=00:0C:42:0F:C3:54 board=500r5 boot=1 root=/dev/mtdblock1 rootfstype=yaffs2 init=/etc/preinit
korina mac = 00:0C:42:0F:C3:54
Primary instruction cache 8kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 8kB, 4-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Initializing IRQ's: 168 out of 256
PID hash table entries: 256 (order: 8, 1024 bytes)
calculating r4koff... 001e846c(1999980)
CPU frequency 400.00 MHz
Using 199.998 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61272k/65528k available (2060k kernel code, 4196k reserved, 319k data, 116k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI: Initializing PCI
registering PCI controller with io_map_base unset
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
squashfs: version 3.0 (2006/03/15) Phillip Lougher
JFFS2 version 2.2. (NAND) (SUMMARY)  ώώ 2001-2006 Red Hat, Inc.
yaffs Jan 29 2008 09:02:37 Installing.
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 104) is a 16550A
Using NAPI with weight 64
eth0: Rx IRQ 40, Tx IRQ 41, 00:0c:42:0f:c3:54
via-rhine.c:v1.10-LK1.4.3 2007-03-06 Written by Donald Becker
PCI: Enabling device 0000:00:02.0 (0080 -> 0083)
io_map_base of root PCI bus 0000:00 unset.  Trying to continue but you better
fix this issue or report it to linux-mips@linux-mips.org or your vendor.
eth1: VIA Rhine III at 0xb8800000, 00:0c:42:0f:c3:55, IRQ 142.
eth1: MII PHY found at address 1, status 0x7849 advertising 05e1 Link 0000.
PCI: Enabling device 0000:00:03.0 (0080 -> 0083)
eth2: VIA Rhine III at 0xb8800100, 00:0c:42:0f:c3:56, IRQ 143.
eth2: MII PHY found at address 1, status 0x7849 advertising 05e1 Link 0000.
block2mtd: version $Revision: 1.30 $
NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Creating 2 MTD partitions on "NAND 128MiB 3,3V 8-bit":
0x00000000-0x00400000 : "Routerboard NAND boot"
0x00400000-0x08000000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "NAND 128MiB 3,3V 8-bit"
input: gpio-keys as /devices/platform/gpio-keys/input/input0
Registered led device: rb500led:amber
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP vegas registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
yaffs: dev is 32505857 name is "mtdblock1"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.1, "mtdblock1"
yaffs: restored from checkpoint
VFS: Mounted root (yaffs2 filesystem) readonly.
Freeing unused kernel memory: 116k freed
Please be patient, while OpenWrt loads ...
Algorithmics/MIPS FPU Emulator v1.5
- preinit -
- init -

Please press Enter to activate this console.


BusyBox v1.8.2 (2008-01-29 08:57:18 EET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r10304) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/#
</code>
you may find some additional packages [[http://wifi.ozo.com/airo/openwrt/packages/mipsel/|here]]



======RouterStation======


[[http://wiki.ubnt.com/wiki/index.php/RouterStation_OpenWRT_SW_Setup_Guide|Official RouterStation Howto]]


=====Serial Circuit=====
I am using [[http://wifi.ozo.com/images/wgt-serial.png|this]] setup.
=====Firmware upgrade=====
* It's good practice to first start the tftp server on the RouterStation before starting the tftp transfer of the firmware.

====Openwrt====
<code>
Hi,

for me the following options work:

easiest way is using ssh to scp and login into the kamikaze system installed 
by default. e.g.:

scp bin/openwrt-ar71xx-vmlinux.lzma bin/openwrt-ar71xx-root.squashfs 
r...@192.168.1.20:/tmp/

then login and do:
mtd -e kernel write /tmp/openwrt-ar71xx-vmlinux.lzma kernel
mtd -r -e rootfs write /tmp/openwrt-ar71xx-root.squashfs rootfs

via redboot also works. This are my noted:
115200 Baud, No Parity, 8Bits, 1 Stop Bit, No Flow Control. 
S_In  on board means RX on computer
S_out on board means TX on computer
screen /dev/ttyUSB0 115200

reset device
ctrl-c to enter redboot
ip_address -l 192.168.1.20/24 -h 192.168.1.2
urescue

urescue -f (to flash U-boot bootloader too, use with caution)

on your computer:
ifconfig eth0 192.168.1.2
cd kamikaze/bin
tftp 192.168.1.20 # and then one by one..
        binary
        trace   # alternates to on
        rexmt 1
        timeout 60
        put openwrt-ar71xx-ubnt-rs-squashfs.bin



best
/axel
</code>

====DD-wrt====
<code>
push the reset button. plugin the power cord. hold the button for 10 seconds
then do tftp -i 192.168.1.20 put RS.dd-wrt.bin
your local computer ip must be staticly configured to 192.168.1.100
thats all 
</code>
====Ubiquity====
* There is a performance and stability issue concearning RAM speed and LAN stability with early RouterStation devices. Upgrading to [[http://wifi.ozo.com/airo/ubiquity/routerstation/firmware/RSx.ar7100.OpenWrt.r15349M-BETA-upgrade.bin|this ubiquiti image]] resolves these issues. Details of this image:
<code>r15349, Linux version 2.6.28.9 (mtaylor@ubnt-dev) (gcc version 4.1.2) #1 Fri Apr 24 16:19:02 PDT 2009</code>

you may also get ubiquiti "latest" released image from [[http://wifi.ozo.com/airo/ubiquity/routerstation/firmware/RSx.ar7100.OpenWrt.bin|here]] dated:
<code>r13658, Linux version 2.6.26.8 (jm@hpu) (gcc version 4.1.2) #7 Wed Dec 17 17:00:48 EET 2008</code>

===Known Issues===
* Some early RouterStation devices (first two quarters of 2009) have a very poor or non working LAN port attached on the eth1 (the one near to the corner).

* Official support for the RouterStation line of products just froze only a few months after their official release. It looks like as ubiquity used OpenWrt hype as a promotion campaign for their products while never returned any actual support to the open source community.

====OpenWrt OZOnet images====
OZOnet images are bleeding edge openwrt images trimmed down to minimum for stability and performance.  They are targeted just for wifi long range links.  All builds are tested on real hardware and production setups. You may find those images  [[http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/ar71xx/|here]]. Details of these images:
<code>r23674, Linux version 2.6.36 (alex@motard) (gcc version 4.5.1 (GCC) ) #4 Wed Oct 27 18:45:43 EEST 2010</code>

====== brcm47xx ======
<code>
The bridge is created due to lan_ifname being set to br0 .. any time any of the *_ifname variables is a br* the script will create a bridge and parse the corresponding *_ifnames variable.

So, you could do the following:

lan_ifname=vlan0
wan_ifname=vlan1
wifi_ifname=eth1

(assumes a v2 or above)
</code>
<code>
Siemens SE505 v1 (http://wiki.openwrt.org/OpenWrtDocs/Hardware/Siemens/SE505):
CPU: Broadcom 4710 @ 125MHz 
Wireless NIC: Broadcom (mini-PCI) 
Switch: BCM5325 
Flash: 4MB 
RAM: 16MB
</code>

====== Bullet M5 ======
===== J10 serial pins =====
<code>
In the J10 connector, from the antenna side,
1st pin = GND
2nd pin = Tx
3rd pin = Rx
4th pn = 3.3v
</code>
Configure the serial to be 115200 8N1
===== firmware tftp =====
just bumped into this.  A fairly new Bullet M5 would not respond on the classic 192.168.1.20.  Searching the net found the following.  Don't get tricked though, your Bullet will not respond to regular pings (icmp).  You need to use arping.  Best way to figure out the IP of the unit is to put it on tftp ready and use tcpdump on the network cable that connects it to your linux workstation.

My Bullet M5 happened to listen to IP 192.168.1.33.  This is only for the tftp state.
<code>

Devices manufactured using any v5.0-RC (pre-productionFW) are configured with the following IP in TFTP rescue mode:

192.168.1.30
192.168.1.31
192.168.1.32
192.168.1.33
192.168.1.34
192.168.1.145

These IPs are set in u-boot configuration.

ICMP ping to these IPs are not allowed. Correct IP you can find only uploading firmware through TFTP, when device is in TFTP rescue mode.

Devices manufactured using v5.0 final release and newer firmware versions, will use default IP set to 192.168.1.20.
</code>
*** Another silly issue that I recently bumped on is that some times is better to start the tftp transfer before getting the Bullet-M on tftp ready status, otherwise the tftp transfer may fail.


===A few issues as of May 2017 with lede/openwrt===

1). the on-board ethernet wrongly identifies the network connection as Gbit. I believe the device does not support Gbit, just fast ethernet. Thereof prior to flashing, an off/on is recommended just on the ethernet port @ the poe or switch.

2). After the above procedure, it's recommended to first start the tftp on the server before starting the tftp transfer procedure at the bullet-m.

===Further annoying issues as of October 2017==

1). to avoid any networking locking issues it's better to connect the device on a fast 100Mbit switch.

2). start the tftp (I use atftp)

3). cold reboot the Bullet-M 

4). either hold the reset for 10 seconds and then release it or start the urescue from the U-boot menu on the serial console.

====== bullet 5 Openwrt ======

<code>Linux version 2.6.31.3 (alex@motard) (gcc version 4.4.1 (GCC) ) #1 Sat Oct 10 08:32:23 EEST 2009
CPU revision is: 0001800a (MIPS 4Kc)                                                            
Determined physical RAM map:                                                                    
 memory: 01000000 @ 00000000 (usable)                                                           
Initrd not found or empty - disabling initrd                                                    
Zone PFN ranges:                                                                                
  Normal   0x00000000 -> 0x00001000                                                             
Movable zone start PFN for each node                                                            
early_node_map[1] active PFN ranges                                                             
    0: 0x00000000 -> 0x00001000                                                                 
On node 0 totalpages: 4096                                                                      
free_area_init_node: node 0, pgdat 8026fe10, node_mem_map 802a6000                              
  Normal zone: 32 pages used for memmap                                                         
  Normal zone: 0 pages reserved                                                                 
  Normal zone: 4064 pages, LIFO batch:0                                                         
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064                      
Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2                               
PID hash table entries: 64 (order: 6, 256 bytes)                                                
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)                                    
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)                                     
Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.                                 
Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 16 bytes                             
Memory: 13528k/16384k available (1860k kernel code, 2856k reserved, 382k data, 124k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1                               
NR_IRQS:128                                                                                          
console [ttyS0] enabled                                                                              
Calibrating delay loop... 179.81 BogoMIPS (lpj=899072)                                               
Mount-cache hash table entries: 512                                                                  
NET: Registered protocol family 16                                                                   
bio: create slab <bio-0> at 0                                                                        
Switched to high resolution mode on CPU 0                                                            
NET: Registered protocol family 2                                                                    
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)                                       
TCP established hash table entries: 512 (order: 0, 4096 bytes)                                       
TCP bind hash table entries: 512 (order: -1, 2048 bytes)                                             
TCP: Hash tables configured (established 512 bind 512)                                               
TCP reno registered                                                                                  
NET: Registered protocol family 1                                                                    
Radio config found at offset 0x2000(0x100)                                                           
squashfs: version 4.0 (2009/01/31) Phillip Lougher                                                   
Registering mini_fo version $Id$                                                                     
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.                                       
msgmni has been set to 26                                                                            
alg: No test for lzma (lzma-generic)                                                                 
alg: No test for stdrng (krng)                                                                       
io scheduler noop registered                                                                         
io scheduler deadline registered (default)
gpiodev: gpio device registered with major 254
gpiodev: gpio platform device registered with access mask FFFFFFFF
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0xbc000003 (irq = 37) is a 16550A
eth0: Atheros AR231x: 00:15:6d:be:0b:1f, irq 4
ar231x_eth_mii: probed
eth0: attached PHY driver [Generic PHY] (mii_bus:phy_addr=0:00)
physmap platform flash device: 00800000 at 1e000000
physmap-flash.0: Found 1 x16 devices at 0x0 in 8-bit bank
physmap-flash.0: Found an alias at 0x400000 for the chip at 0x0
 Amd/Fujitsu Extended Query Table at 0x0040
physmap-flash.0: Swapping erase regions for broken CFI table.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
cmdlinepart partition parsing not available
Searching for RedBoot partition table in physmap-flash.0 at offset 0x3d0000
Searching for RedBoot partition table in physmap-flash.0 at offset 0x3e0000
6 RedBoot partitions found on MTD device physmap-flash.0
Creating 6 MTD partitions on "physmap-flash.0":
0x000000000000-0x000000030000 : "RedBoot"
0x000000030000-0x000000100000 : "kernel"
0x000000100000-0x0000003e0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "physmap-flash.0"
0x0000003e0000-0x0000003ef000 : "FIS directory"
eth0: Configuring MAC for full duplex
0x0000003ef000-0x0000003f0000 : "RedBoot config"
0x0000003f0000-0x000000400000 : "boardconfig"
TCP westwood registered
NET: Registered protocol family 17
VFS: Mounted root (jffs2 filesystem) readonly on device 31:2.
Freeing unused kernel memory: 124k freed
Please be patient, while OpenWrt loads ...
wlan: trunk
ath_hal: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 2009-05-08 (AR5212, AR5312, RF5111, RF5112, RF2316, RF2317, REGOPS_FUNC, TX_DESC_SWAP, XR)
ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (trunk)
ath_rate_minstrel: look around rate set to 10%
ath_rate_minstrel: EWMA rolloff level set to 75%
ath_rate_minstrel: max segment size in the mrr set to 6000 us
wlan: mac acl policy registered
ath_ahb: trunk
Atheros HAL provided by OpenWrt, DD-WRT and MakSat Technologies
wifi0: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wifi0: turboA rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wifi0: H/W encryption support: WEP AES AES_CCM TKIP
ath_ahb: wifi0: Atheros 2313 WiSoC: mem=0xb8500000, irq=5
IRQ 5/wifi0: IRQF_DISABLED is not guaranteed on shared IRQs
Unable to load needed module: wlan_scan_ap; no support for automatic module loading
unable to load wlan_scan_ap
</code>
<code>
cat /proc/mtd

dev:    size   erasesize  name
mtd0: 00030000 00010000 "RedBoot"
mtd1: 000d0000 00010000 "kernel"
mtd2: 002e0000 00010000 "rootfs"
mtd3: 0000f000 0000f000 "FIS directory"
mtd4: 00001000 00001000 "RedBoot config"
mtd5: 00010000 00002000 "boardconfig"
</code>

<code>
this "text file" worked for me on the bullet5; it's part of the mkfwimage tool from ubnt.com!
cat ../../../mkfwimage-1.2/ls5-openwrt.txt
kernel          0x01    0xBE030000      0x000D0000      0x80041000      0x80041000      openwrt-atheros-2.6-vmlinux.lzma
rootfs          0x02    0xBE100000      0x002C0000      0x00000000      0x00000000      openwrt-atheros-2.6-root.jffs2-64k


mkfwimage -v XS5.ar2313.Openwrt.xxx -i ls5-openwrt.txt -o test5.bin
</code>

====== Bullet M5 AirOS ======
* Default user/pass: ubnt
<code>
 Linux version 2.6.15--LSDK-7.3.0.300 (ubnt@devint) (gcc version 4.1.2) #199 Thu Jul 16 15:04:53 EEST 2009
 flash_size passed from bootloader = 8                                                                    
 arg 1: console=ttyS0,115200                                                                              
 arg 2: root=31:03                                                                                        
 arg 3: rootfstype=squashfs                                                                               
 arg 4: init=/init                                                                                        
 arg 5: mem=32M                                                                                           
 arg 6: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM)
 CPU revision is: 00019374                                                                                 
 Determined physical RAM map:                                                                              
  memory: 02000000 @ 00000000 (usable)                                                                     
 User-defined physical RAM map:                                                                            
  memory: 02000000 @ 00000000 (usable)                                                                     
 On node 0 totalpages: 8192                                                                                
   DMA zone: 8192 pages, LIFO batch:1                                                                      
   DMA32 zone: 0 pages, LIFO batch:0                                                                       
   Normal zone: 0 pages, LIFO batch:0                                                                      
   HighMem zone: 0 pages, LIFO batch:0                                                                     
 Built 1 zonelists                                                                                         
 Kernel command line: console=ttyS0,115200 root=31:03 rootfstype=squashfs init=/init mem=32M mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM) 
 Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.                                                                                                                    
 Primary data cache 32kB, 4-way, linesize 32 bytes.                                                                                                                                              
 Synthesized TLB refill handler (20 instructions).                                                                                                                                               
 Synthesized TLB load handler fastpath (32 instructions).                                                                                                                                        
 Synthesized TLB store handler fastpath (32 instructions).                                                                                                                                       
 Synthesized TLB modify handler fastpath (31 instructions).                                                                                                                                      
 Cache parity protection disabled                                                                                                                                                                
 PID hash table entries: 256 (order: 8, 4096 bytes)                                                                                                                                              
 Using 200.000 MHz high precision timer.                                                                                                                                                         
 Console: colour dummy device 80x25                                                                                                                                                              
 Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)                                                                                                                                   
 Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)                                                                                                                                    
 Memory: 30324k/32768k available (1573k kernel code, 2428k reserved, 318k data, 120k init, 0k highmem)                                                                                           
 Calibrating delay loop... 265.21 BogoMIPS (lpj=132608)                                                                                                                                          
 Mount-cache hash table entries: 512                                                                                                                                                             
 Checking for 'wait' instruction...  available.                                                                                                                                                  
 NET: Registered protocol family 16                                                                                                                                                              
 PCI: Scanning bus 0000:00                                                                                                                                                                       
 PCI: Found 0000:00:00.0 [168c/002a                                                                                                                                                              
 PCI: Calling quirk 801ee7ac for 0000:00:00.0                                                                                                                                                    
 PCI: Fixups for bus 0000:00                                                                                                                                                                     
 PCI: Bus scan for 0000:00 returning with max=00                                                                                                                                                 
   got res [10000000:1000ffff                                                                                                                                                                    
 PCI: moved device 0000:00:00.0 resource 0 (204) to 0                                                                                                                                            
 Returning IRQ 48                                                                                                                                                                                
 PCI: fixup irq: (0000:00:00.0) got 48                                                                                                                                                           
 AR7240 GPIOC major 0                                                                                                                                                                            
 squashfs: version 3.4 (2008/08/26) Phillip Lougher                                                                                                                                              
 Initializing Cryptographic API                                                                                                                                                                  
 io scheduler noop registered                                                                                                                                                                    
 io scheduler deadline registered                                                                                                                                                                
 PCI: Calling quirk 801ef9a8 for 0000:00:00.0                                                                                                                                                    
 PCI: Calling quirk 801f37d4 for 0000:00:00.0                                                                                                                                                    
 Serial: 8250/16550 driver $Revision: #1 $ 1 ports, IRQ sharing disabled                                                                                                                         
 serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A                                                                                                                                          
 6 cmdlinepart partitions found on MTD device ar7240-nor0                                                                                                                                        
 Creating 6 MTD partitions on "ar7240-nor0":                                                                                                                                                     
 0x00000000-0x00040000 : "u-boot"                                                                                                                                                                
 0x00040000-0x00050000 : "u-boot-env"                                                                                                                                                            
 0x00050000-0x00150000 : "kernel"                                                                                                                                                                
 0x00150000-0x007b0000 : "rootfs"                                                                                                                                                                
 0x007b0000-0x007f0000 : "cfg"                                                                                                                                                                   
 0x007f0000-0x00800000 : "EEPROM"                                                                                                                                                                
 u32 classifier                                                                                                                                                                                  
     input device check on                                                                                                                                                                       
 Netfilter messages via NETLINK v0.30.                                                                                                                                                           
 NET: Registered protocol family 2                                                                                                                                                               
 IP route cache hash table entries: 512 (order: -1, 2048 bytes)                                                                                                                                  
 TCP established hash table entries: 2048 (order: 1, 8192 bytes)                                                                                                                                 
 TCP bind hash table entries: 2048 (order: 1, 8192 bytes)                                                                                                                                        
 TCP: Hash tables configured (established 2048 bind 2048)                                                                                                                                        
 TCP reno registered                                                                                                                                                                             
 GRE over IPv4 tunneling driver
 TCP bic registered
 NET: Registered protocol family 1
 NET: Registered protocol family 17
 Bridge firewalling registered
 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
 All bugs added by David S. Miller <davem@redhat.com>
 VFS: Mounted root (squashfs filesystem) readonly.
 Freeing unused kernel memory: 120k freed
 Warning: unable to open an initial console.
 Algorithmics/MIPS FPU Emulator v1.5
 AG7240: unit 0, MAC address 00:15:6d:e5:22:47
 AG7240: unit 1, MAC address 02:15:6d:e5:22:47
 CSLIP: code copyright 1989 Regents of the University of California
 PPP generic driver version 2.4.2
 PPP MPPE Compression module registered
 NET: Registered protocol family 24
 wlan: module license 'BSD' taints kernel.
 wlan: 0.8.4.2 (Atheros/multi-bss)
 <6>ubnt_poll: Initializing polling module...
 ath_hal: 0.9.17.1 (AR5416, REGOPS_FUNC, 11D)
 ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
 wlan: mac acl policy registered
 wlan_me: Version 0.1
 Copyright (c) 2008 Atheros Communications, Inc. All Rights Reserved
 ath_dfs: Version 2.0.0
 Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
 ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
 ath_pci: 0.9.4.5 (Atheros/multi-bss)
 PCI: Setting latency timer of device 0000:00:00.0 to 64
 ath_hal: Ubiquiti Merlin
 wifi0: Atheros 9280: mem=0x10000000, irq=48 hw_base=0xb0000000
 ar7240-gpio 1.0 initialised
 fuse init (API version 7.8)
 fuse distribution version: 2.7.3
 rssi-leds 1.0 loaded
 device eth0_real entered promiscuous mode
 device eth1_real entered promiscuous mode
 ubnt_poll: Attaching hooks...
 ubnt_poll: Setting timing params to min:1000 max:4000 offset:8000
 ubnt_poll: Setting aggregation params to non-txop:0 tx-op:2 scheduling:1
 ubnt_poll: Setting TXOP Window parameters to size:25 timeout-perc:5
 ubnt_poll: Module started in STA mode
 Ebtables v2.0 registered
 device ath0 entered promiscuous mode
 br0: port 3(ath0) entering learning state
 br0: port 1(eth0_real) entering learning state
 br0: topology change detected, propagating
 br0: port 3(ath0) entering forwarding state
 br0: topology change detected, propagating
 br0: port 1(eth0_real) entering forwarding state
</code>
<code>
cat /proc/mtd

dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00100000 00010000 "kernel"
mtd3: 00660000 00010000 "rootfs"
mtd4: 00040000 00010000 "cfg"
mtd5: 00010000 00010000 "EEPROM"
</code>
<code>
cat /proc/interrupts
 
           CPU0       
  2:          0            MIPS  cascade
  4:        626            MIPS  eth0_real
  5:          0            MIPS  eth1_real
  6:          0            MIPS  cascade
  7:      60571            MIPS  timer
 18:          0     AR7240 MISC  cascade
 19:         39     AR7240 MISC  serial
 28:         15     AR7240 MISC  eth0_real
 48:        351      AR7240 PCI  wifi0

ERR:          0
</code>

====== Atheros AR231x/AR5312, Ubiquiti WiSP station ======
<code>Baud rate on serial port is 9600</code>

====== brcm47xx hacks against latest trunk ======
make these boards behave as actual routers, not lan extenders  
this setup provides a 40%+ lan performance boost, less resources, better stability.

nuke bridge kernel support
remove diag, switch and related options from menuconfig
edit/fix the default setup on target/linux/brcm47xx/base-files/etc/init.d/netconfig

====== live reflash from a running router ======
  ssh to the box
  cd to /tmp
  wget  the backfire 10.03 .trx
  flash with   mtd -r write /tmp/openwrt-*.trx linux
  
====== Ubiquiti txpower offsets ======
    * Bulelt 2: [[http://www.ubnt.com/forum/showthread.php?t=11473|+4dB power offset in its EEPROM]]
    * SR2,XR2,XR5,XR9: +10dB power offset
    * SR5: +7dB power offset
    * NanoStation2, Loco2: +4 - 6dB power offset in its EEPROM
    * Bulelt 5: [[http://www.ubnt.com/forum/showthread.php?t=14772|+3dB power offset in its EEPROM]]
    * Bullet M5: [[http://www.ubnt.com/forum/showthread.php?t=12681|+6 dBm]]
    * WISPStation: +6dB power offset in its EEPROM (speculated)
    * UB5 miniPCI: [[http://www.ubnt.com/forum/showthread.php?t=4805|no offset but issues when used with <10db setup]]
[[http://www.ubnt.com/downloads/SRXR_power_offset.pdf|Ubiquiti reference]]

====== iwpriv rate commands ======
  iwpriv wlan0 getbasic_rates
  iwpriv wlan0 getoper_rates
  
====== rb4xx quick howto ======
  * you may safely format the flash (openwrt runs rock stable on rb4xx devices for some time now)
  * setup dnsmasq on a linux system (liveCD or liveUSB is fine too, check [[http://www.sysresccd.org/Sysresccd-manual-en_How_to_install_SystemRescueCd_on_an_USB-stick|sysresccd]])
  * select from bootloader to boot from ethernet

Update (2017): Lede firmware moved from yaffs2 to ubi file-system.

  * netboot the device, use [[http://www.ozo.com/airo/openwrt/firmware/lede-ozonet-2017/ar71xx/r5112/targets/ar71xx/mikrotik/lede-ar71xx-mikrotik-vmlinux-initramfs-lzma.elf|this image]]
  * after net_booting wget or scp [[http://www.ozo.com/airo/openwrt/firmware/lede-ozonet-2017/ar71xx/r5112/targets/ar71xx/mikrotik/lede-ar71xx-mikrotik-nand-64m-squashfs-sysupgrade.bin|this image]] on /tmp
  * finally issue: sysupgrade /tmp/lede-ar71xx-mikrotik-nand-64m-squashfs-sysupgrade.bin and enjoy the power, beauty and magic of open source transforming an ancient device to a brand new !

Older instructions: (kept for historical and scientific reasons)

  * netboot the device, use [[http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/ar71xx/RB/26744/openwrt-ar71xx-nand-vmlinux-initramfs.elf|this image]]
  * follow the next steps:

  mount /dev/mtdblock5 /mnt
  cd /tmp
  export http_proxy://your.hhtp.proxy:port_number
  wget http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/ar71xx/RB/26744/openwrt-ar71xx-nand-vmlinux.elf
  mv openwrt-ar71xx-vmlinux.elf /mnt/kernel
  umount /mnt
  mount /dev/mtdblock6 /mnt
  cd /mnt
  wget http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/ar71xx/RB/26744/openwrt-ar71xx-nand-rootfs.tar.gz
  gzip -d openwrt-ar71xx-nand-rootfs.tar.gz
  tar xvf openwrt-ar71xx-nand-rootfs.tar
  rm openwrt-ar71xx-nand-rootfs.tar
  cd /
  umount /mnt
  sync
  reboot

  * select from bootloader to boot from nand
  * edit /etc/opkg

  src/gz snapshots http://wifi.ozo.com/airo/openwrt/firmware/kamikaze/2.6/ar71xx/23674/packages
  src/gz packages http://wifi.ozo.com/airo/openwrt/packages/uclibc-0.9.31/gcc-4.5.1/ar71xx

  * you may now update & install packages & kernel modules 
  * do not forget to set your http_proxy or network connectivity

  opkg update
  opkg install kmod-madwifi
  opkg install quagga-bgpd
  
====== rb711 serial pins ======
{{http://wiki.ozo.com/rb711-5hn-m_s.jpg?140 }}


====== rb711 flash howto ======
a full detailed picture of the board [[http://wiki.ozo.com/rb711-5hn-m.jpg|here]]

Connect ethernet to the RouterBoard device 

Hold the S301 button pressed while booting it up. LED LD301 starts lighting up, then flashing and then turns off. 

After this you can release the button. The router will start looking for a TFTP server providing an initramfs-elf image.

After successful openwrt/lede flashing, router will "beep" and listen for ssh @ 192.168.1.1

cd /tmp; wget lede-ar71xx-mikrotik-nand-64m-squashfs-sysupgrade.bin; sysupgrade /tmp/lede-ar71xx-mikrotik-nand-64m-squashfs-sysupgrade.bin
  
====== ZTE ZXHN H108NS unlocking howto ======

It's annoying to have anyone pocking any settings on your network setup. At some point my second adsl started having problems with packet loss on the LAN. It was that bad that I had to switch to a backup standby adsl device that I always keep for such occasions. I never used to worry about my adsl setup as long as it's stable with decent bandwidth, decent low latency and 0% packet loss.

The latest firmware for this box provided by otenet that has changed couple of names and I think lately goes by cosmote is called: H108NSV1.0.7u_ZRD_GR2_A68_20150720

it has a royal disabled web functionality with most menus locked down, telnet/ssh is also disabled and nmap/scan show couple of "unfriendly" ports listening.

Searching the web I bumped on [[https://vasvir.wordpress.com/2015/03/08/reverse-engineering-trendchip-firmware-zte-h108ns-part-i/|vasvir page]], a kind soul that had similar experiences and feelings about this device. His work and documentation helped me greatly in order to extract, modify and create a decent new firmware that unlocks and restores total control to the device. I will document here the steps that I followed in order to do this:

  - compile and install [[https://github.com/rampageX/firmware-mod-kit|firmware-mod-kit]]
  - compile and install [[https://github.com/devttys0/binwalk|binwalk]]
  - compile and install [[https://github.com/vasvir/tcrevenge|tcrevenge]]

you can download the [[https://www.cosmote.gr/fixed/help-and-support/faq/-/support/article/644601/1184521|latest firmware]] or in case it has been removed you may also find it [[http://wifi.ozo.com/airo/zte/zxhn_h108ns/H108NSV1.0.7u_ZRD_GR2_A68_20150720.zip|here]]

here are the commands for extracting, editing and composing back the new firmware:

<code>
cd /tmp
unzip H108NSV1.0.7u_ZRD_GR2_A68_20150720.zip
binwalk -e tclinux.bin
cd _tclinux.bin.extracted/squashfs-root/
...
do your thing, edit, delete, put new files
...
cd /tmp
mksquashfs-lzma _tclinux.bin.extracted/squashfs-root /tmp/squashfs-root.sp-1.7u
dd if=tclinux.bin of=kernel-1.7u skip=256 count=`binwalk tclinux.bin | awk '/Squash/ {print $1 - 256;}'` bs=1
tcrevenge -k kernel-1.7u -s  squashfs-root.sp-1.7u -o header-1.7u -p padding-1.7u 
cat header-1.7u kernel-1.7u squashfs-root.sp-1.7u padding-1.7u > tclinux_new.bin
</code>

in order to upload through the web interface the new image needs to be renamed back to its original form:

<code>
mv tclinux_new.bin tclinux.bin
</code>

in case you brick your device (I did) here are the serial pins:
----
{{http://wifi.ozo.com/images/zte_h108ns_relial_pins.jpg }}
----
on the boot-loader prompt you may issue:

<code>
ipaddr 192.168.1.1
httpd
</code>

you may now proceed with the web interface new image upload.

good luck and have fun!

====== ZTE ZXHN H108NS adsl optimizations ======

gathered through the web I summarize them here:

===== telnet commands for tunning adsl =====

<code>
wan dmt2 set snrmoffset 4096 4096
wan adsl reset
</code>

review adsl statistics:

<code>
adslphxcmd info --show
</code>

attetunation/noise margin:
<code>
wan adsl linedata near
cat /var/log/messages

wan adsl chandata
cat /var/log/messages
</code>

errors:
<code>
wan adsl perfdata
cat /var/log/messages
</code>

various:
<code>
wan ghs show vendor
cat /var/log/messages
</code>

===== SNRM values to db =====

<code>
+9 dB|wan dmt2 set snrmoffset -4608 -4608
+8 dB|wan dmt2 set snrmoffset -4096 -4096
+7 dB|wan dmt2 set snrmoffset -3584 -3584
+6 dB|wan dmt2 set snrmoffset -3072 -3072
+5 dB|wan dmt2 set snrmoffset -2560 -2560
+4 dB|wan dmt2 set snrmoffset -2048 -2048
+3 dB|wan dmt2 set snrmoffset -1536 -1536
+2 dB|wan dmt2 set snrmoffset -1024 -1024
+1 dB|wan dmt2 set snrmoffset -512 -512
-1 dB|wan dmt2 set snrmoffset +512 +512
-2 dB|wan dmt2 set snrmoffset +1024 +1024
-3 dB|wan dmt2 set snrmoffset +1536 +1536
-4 dB|wan dmt2 set snrmoffset +2048 +2048
-5 dB|wan dmt2 set snrmoffset +2560 +2560
-6 dB|wan dmt2 set snrmoffset +3072 +3072
-7 dB|wan dmt2 set snrmoffset +3584 +3584
-8 dB|wan dmt2 set snrmoffset +4096 +4096
</code>

===== embed startup commands =====

  - ROMFILE backup (Maintainace -> Firmware -> Romfile backup) save as: romfile.cfg
  - romfile.cfg is a non-valid XML. text editing is ok

the /etc/autoexec.sh:

<code>
w dmt2 db tlb 2b
wan ghs set multi_number 9 3
wan dmt2 set largeD 2
w dmt eoc dyingasp off
w dmt2 set lpr off
echo 1 > /proc/tc3162/port_reverse
</code>

the code in romfile.cfg:

<code>
<Autoexec>
        <Entry cmd1="w dmt2 db tlb 2b"
cmd2="wan ghs set multi_number 9 3" cmd3="wan dmt2 set largeD 2"
cmd4="w dmt eoc dyingasp off" cmd5="w dmt2 set lpr off"
cmd6="echo 1 &gt; /proc/tc3162/port_reverse" />
</Autoexec>
</code>

you may add any commands you wish and push the romfile.cfg back to the device
===== it's all Greek to me =====

Παράδειγμα
Για να μειώσετε από 9 dB σε 6 dB, θα πρέπει να μειώσετε κατά 3 dB (δηλαδή -3 dB): 
<code>
wan dmt2 set snrmoffset +1536 +1536
</code>

Ενώ για να τεθεί σε λειτουργία η νέα ρύθμιση, πρέπει να γράψετε: wan adsl reset (κάνοντας επανασυγχρονισμό).

Σημείωση: Κάτι που παρατήρησα είναι ότι αν και ο συγχρονισμός πραγματικά αλλάζει (το ίδιο και οι ταχύτητες κατεβάσματος), το web interface συνεχίζει να δείχνει στατιστικά SNR βάσει του αρχικού SNRM (πχ 9.5 dB αντί αντί για 3.5 dB κλπ).

μέσω telnet (telnet 192.168.1.1): 

<code>
sys ? 
</code>

  * Μπορώ να δω το γράφημα/φάσμα συχνοτήτων (για τυχόν gaps), όπως με το DMT σε άλλα modems;

Ναι (thanks gio7 (https://www.adslgr.com/forum/showpost.php?p=3852304&postcount=84)), κατεβάζοντας το OrbMT (http://download.orbmu2k.de/files/OrbMT.zip) και επιλέγοντας P-653HWI ως Modem Type.

Το γράφημα μεταξύ άλλων δείχνει πάνω δεξιά και σε τι DSLAM chipset βρισκόμαστε (Broadcom, Globespan, Infineon κλπ).

  * Μπορώ να δω σε τι μάρκας DSLAM είμαι συνδεδεμένος;

Ναι, με την εντολή:
<code>
wan adsl farituid
</code>

βλέπουμε το vendor ID σε Hex. Για παράδειγμα:

=== ID|ATUC|Manufacture ===
<code>
41 4C 43 42|ALCB|Alcatel
41 4E 44 56|ANDV|Analog Devices (ADI)
42 44 43 4D|BDCM|Broadcom
47 53 50 4E|GSPN|Globespan
49 46 54 4E|IFTN|Infineon
53 54 4D 49|STMI|St Micro
54 4D 4D 42|TMMB|Thomson Multimedia Broadband
54 53 54 43|TSTC|Texas Instruments
</code>

Διαφορετικά η πιο απλή λύση είναι με το OrbMT, που το αναφέρει πάνω δεξιά.

  * Μπορώ να χρησιμοποιήσω την Port #4, εάν δεν έχω IPTV δέκτη;

Ναι με την εξής διαδικασία από το web interface και θα λειτουργεί ως κανονικό switch port μετά (ενώ για να βάλετε IPTV δέκτη, αντιστρέφετε την διαδικασία):

  * Advanced > Port Mapping:
  * Group Index: 2 -> ξετσεκάρισμα του Ethernet Port #4 -> Submit
  * Group Index: 1 -> τσεκάρισμα του Ethernet Port #4 -> Submit
  * Basic > DHCP -> σεκάρισμα Ethernet Port #4 -> Submit

====== FRITZ!Box WLAN 3370 ======
==== Converting from German to International firmware ====

you will need a linux box & a windows, preferably a win7 box (side by side)

if you are familiar with windows & ftp and are able to find an ftp client with similar features to the lftp under linux, you may well skip the linux box

searching the netland about this, I bumped on the [[https://help.axcient.com/x360recover-faqs-specific-to-linux/lftp4win-linux-ftp-client-for-windows|LFTP4WIN]]

my advice is to go with a linux/lftp box or even use the [[https://www.system-rescue.org/Download/|systemrescue Live usb]] linux

it's recommended to network connect all the devices through a simple hub

if you have flashed your Fritz with an alternative firmware, you will need to get back to your official firmware using the [[https://download.avm.de/archive/fritz.box/fritzbox.wlan_3370/x_misc/deutsch/|German recovery utility]]

on the linux box, set a secondary ip 192.168.178.10/24

get lftp if not already installed and issue the following:
  lftp
  set net:timeout 1;
  set net:max-retries 80;
  set net:reconnect-interval-multiplier 1;
  set net:reconnect-interval-base 1;
  open 192.168.178.1
  user adam2 adam2
you may now enter the following command and very quickly power on your Fritz box
  quote GETENV firmware_version
  
if the result is:
  firmware_version avm
that means, your Fritz box is the German version and you may switch it to the intentional one by issuing the following command:
  quote SETENV firmware_version avme
that's it !  you have now switched your German Fritz box to an International Fritz box

you can even power off and then power on again your device and without disconnecting your linux lftp, issue the 
  quote GETENV firmware_version
in-order to confirm that your Fritz returns the international ID
  firmware_version avme
you may now use the [[https://download.avm.de/archive/fritz.box/fritzbox.wlan_3370/x_misc/english/|international recovery tool]] to flash your Fritz box with the international firmware which supports both Annex A & Annex B

the above steps, successfully converted my two German Fritz 3370 to the international version. this same procedure may or may not work on your similar but not exact Fritz box

Good Luck       
==== Flashing openwrt ====
you need [[https://github.com/openwrt/openwrt/blob/main/scripts/flashing/eva_ramboot.py|eva_ramboot.py]] along with an [[https://downloads.openwrt.org/releases/22.03.6/targets/lantiq/xrx200/|initramfs-kernel.bin]] image

remove power from your fritz box and issue the following command (use the appropriate initramfs-kernel for your box):
  eva_ramboot.py 192.168.178.1 openwrt-22.03.6-lantiq-xrx200-avm_fritz3370-rev2-micron-initramfs-kernel.bin
power on your fritz box, wait a few minutes and you should be able to log in 192.168.1.1

you can now download the proper sysupgrade image and finalize your install
OZOnet Wiki

User Tools

Site Tools

Page Tools
