WGR826V - Alternate Firmware

The goal of this blog is to help me with the documentation of progress on my quest to install an alternate firmware on the now discontinued Netgear WGR826V.

Thursday, September 10, 2015

Long-overdue update

A couple of weeks ago I stumbled upon the old router and decided to take a second look at it.

The Good:
I am now able to install openwrt and have WAN/LAN and WiFi working like a standard router. In addition I still have about 11 Mb of free space on the flash to install anything I want. I am not sure what yet, but there is room.

The Bad: 
I am still not able to enable the Si3210 chipset as an FXS interface. I am not sure if I will be able to achieve my original goal:  All in one asterisk pbx with 2 build in FXS ports.

The Ugly:
Despite successfully setting up my openwrt development environment and compiling my own openWRT using these instructions I found that the WGR826V is very close to the WRT300nV2 hardware-wise which already has official support from the OpenWRT team. The main difference besides the FXS chip is the use of a different mini-pci wifi card (ar5416 or ar5418) on the WRT300nv2. This can be easily fixed once the router is up and running. I decided to instead of creating my own fork, I would use the WRT300nV2 image provided by the developers.

Now to the good stuff: 

Just for references, my dev machine is now running Ubuntu 14.04 LTS. 
Since I had erased and modified the flash on the router while experimenting different things I needed to re-install redboot. Luckily I had made backups. All I needed was download the Big Endian version of the backups from below.
If you still have redboot running, feel free to skip this next step:

Re-installing redboot:

For this step I used my home-brew jtag cable and the urjtag software from the repository. 
root@tech:/home/tech# jtag

UrJTAG 0.10 #2007
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors

UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.

warning: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.

jtag> cable wiggler parallel 0x378
Initializing parallel port at 0x378
jtag> detect
IR length: 7
Chain length: 1
Device Id: 00011001001001110111000000010011 (0x19277013)
  Manufacturer: Intel (0x013)
  Part(0):      IXP425-266MHz (0x9277)
  Stepping:     B0
  Filename:     /usr/share/urjtag/intel/ixp425/ixp425
jtag> detectflash 0
Query identification string:
        Primary Algorithm Command Set and Control Interface ID Code: 0x0001 (Intel/Shar                                                                      p Extended Command Set)
        Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
Query system interface information:
        Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
        Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
        Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
        Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
        Typical timeout per single byte/word program: 256 us
        Typical timeout for maximum-size multi-byte program: 256 us
        Typical timeout per individual block erase: 2048 ms
        Typical timeout for full chip erase: 0 ms
        Maximum timeout for byte/word program: 1024 us
        Maximum timeout for multi-byte program: 1024 us
        Maximum timeout per individual block erase: 16384 ms
        Maximum timeout for chip erase: 0 ms
Device geometry definition:
        Device Size: 16777216 B (16384 KiB, 16 MiB)
        Flash Device Interface Code description: 0x0002 (x8/x16)
        Maximum number of bytes in multi-byte program: 32
        Number of Erase Block Regions within device: 1
        Erase Block Region Information:
                Region 0:
                        Erase Block Size: 131072 B (128 KiB)
                        Number of Erase Blocks: 128
jtag> eraseflash 0x0 128
Manufacturer: Intel
Chip: 28F128J3A

Erasing 128 Flash blocks from address 0x0
(100% Completed) FLASH Block 127 : Unlocking ... Erasing ... Ok.

Erasing Completed.
jtag> endian
Endianness for external files: little
jtag> endian big
jtag> endian
Endianness for external files: big
jtag> flashmem 0x0 RedBoot-BE.img
Manufacturer: Intel
Chip: 28F128J3A
program:

block 0 unlocked
erasing block 0: 0
addr: 0x0001F000
block 1 unlocked
erasing block 1: 0
addr: 0x0003FFFE
verify:
addr: 0x0003FFFE
Done.
jtag>
jtag> quit
root@tech:/home/tech#

After redboot:

For this step I used an USB-to-serial cable, minicom, tftpd and the zImage/rootfs images from this website.

At the moment of this post the latest openwrt release was Chaos Calmer 15.05 RC3. You will want the IXP4xx -> Generic architecture and then download WRT300nV2 for the zImage and the generic-squashfs.img file for the rootfs. Copy those files to your tftpd directory.

I configured redboot to access and work on my network, you may want to change the IP details to match your environment. Make sure to connect the ethernet cable to any of the LAN ports of the router.
+starting api entry
FLASH configuration checksum error or invalid key
Ethernet eth0: MAC address 00:03:47:df:32:a8
IP: 0.0.0.0/255.255.255.0, Gateway: 0.0.0.0
Default server: 0.0.0.0, DNS server IP: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROM]
Red Hat certified release, version 1.92p1 - built 14:07:09, Oct  8 2004

Bootloader version 1.1
Platform: Intel Generic Residential Gateway (XScale)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x00000000-0x02000000, 0x0001e5c0-0x01fdd000 available
FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each.
RedBoot> fis free
  0x50040000 .. 0x51000000
RedBoot> 
RedBoot> fconfig
Run script at boot: false
Use BOOTP for network configuration: false
Gateway IP address: 192.168.0.1
Local IP address: 192.168.0.190
Local IP address mask: 255.255.255.0
Product Info: WGR826V
Default server IP address: 192.168.0.180
Version Info: 1
Console baud rate: 115200
DNS server IP address: 8.8.8.8
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Default network device: npe_eth0
Network hardware address [MAC] for NPE eth0: 0x00:0x03:0x47:0xDF:0x32:0xA8
Network hardware address [MAC] for NPE eth1: 0x00:0x03:0x47:0xDF:0x32:0xAA
... Unlock from 0x50fc0000-0x50fc1000: .
... Erase from 0x50fc0000-0x50fc1000: .
... Program from 0x01fde000-0x01fdf000 at 0x50fc0000: .
... Lock from 0x50fc0000-0x50fc1000: .
RedBoot> fis init -f
*** Initialize FLASH Image System
... Erase from 0x50040000-0x50fc0000: .......................................................................................................................
... Erase from 0x50fe0000-0x50fe0000:
... Erase from 0x51000000-0x51000000:
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x01fdf000-0x01fff000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
RedBoot> load -r -b %{FREEMEMLO} openwrt-ixp4xx-generic-wrt300nv2-zImage
Using default protocol (TFTP)
Raw file loaded 0x0001e800-0x0014a2af, assumed entry at 0x0001e800
RedBoot> fis create zImage
arg1 = fis, arg2 = create, arg3 = zImage
... Erase from 0x50040000-0x50180000: ..........
... Program from 0x0001e800-0x0014a2b0 at 0x50040000: ..........
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x01fdf000-0x01fff000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
RedBoot> load -r -b %{FREEMEMLO} openwrt-ixp4xx-generic-squashfs.img
Using default protocol (TFTP)
Raw file loaded 0x0001e800-0x001fe7ff, assumed entry at 0x0001e800
RedBoot> fis create rootfs
arg1 = fis, arg2 = create, arg3 = rootfs
... Erase from 0x50180000-0x50360000: ...............
... Program from 0x0001e800-0x001fe800 at 0x50180000: ...............
... Unlock from 0x50fe0000-0x51000000: .
... Erase from 0x50fe0000-0x51000000: .
... Program from 0x01fdf000-0x01fff000 at 0x50fe0000: .
... Lock from 0x50fe0000-0x51000000: .
RedBoot> 
RedBoot> reset

First openwrt boot:

The first boot will take longer. The root file-system is automatically re-sized to fit the free flash available space.
... Resetting.
+starting api entry
Ethernet eth0: MAC address 00:03:47:df:32:a8
IP: 192.168.0.190/255.255.255.0, Gateway: 192.168.0.1
Default server: 192.168.0.180, DNS server IP: 8.8.8.8

RedBoot(tm) bootstrap and debug environment [ROM]
Red Hat certified release, version 1.92p1 - built 14:07:09, Oct  8 2004

Bootloader version 1
Platform: Intel Generic Residential Gateway (XScale)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x00000000-0x02000000, 0x0001e5c0-0x01fdd000 available
FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each.
RedBoot> fis load zImage
RedBoot> exec
Using base address 0x0001e800 and length 0x0012bab0
Uncompressing Linux... done, booting the kernel.
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 3.18.21 (thepeople@trabant) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r46802) ) #1 Mon Sep 7 16:16:48 CEST 2015
[    0.000000] CPU: XScale-IXP42x Family [690541f1] revision 1 (ARMv5TE), cr=000039ff
[    0.000000] CPU: VIVT data cache, VIVT instruction cache
[    0.000000] Machine: Linksys WRT300N v2
[    0.000000] Memory policy: Data cache writeback
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Memory: 28868K/32768K available (2414K kernel code, 133K rwdata, 680K rodata, 128K init, 183K bss, 3900K reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xffe00000   (2048 kB)
[    0.000000]     vmalloc : 0xc2800000 - 0xff000000   ( 968 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc2000000   (  32 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .text : 0xc0008000 - 0xc030dd7c   (3096 kB)
[    0.000000]       .init : 0xc030e000 - 0xc032e000   ( 128 kB)
[    0.000000]       .data : 0xc032e000 - 0xc034f4d0   ( 134 kB)
[    0.000000]        .bss : 0xc034f4d0 - 0xc037d460   ( 184 kB)
[    0.000000] NR_IRQS:64
[    0.000032] sched_clock: 32 bits at 66MHz, resolution 15ns, wraps every 64425153520ns
[    0.000743] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[    0.070202] pid_max: default: 32768 minimum: 301
[    0.070745] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.070792] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.072489] CPU: Testing write buffer coherency: ok
[    0.073567] Setting up static identity map for 0x10360 - 0x103b0
[    0.080709] NET: Registered protocol family 16
[    0.082635] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.085030] IXP4xx: Using 16MiB expansion bus window size
[    0.087196] PCI: IXP4xx is host
[    0.087245] PCI: IXP4xx Using direct access for memory space
[    0.087651] PCI host bridge to bus 0000:00
[    0.087725] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]
[    0.087777] pci_bus 0000:00: root bus resource [mem 0x48000000-0x4bffffff]
[    0.087823] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.088886] PCI: bus0: Fast back to back transfers disabled
[    0.089078] pci 0000:00:01.0: BAR 0: assigned [mem 0x48000000-0x48001fff]
[    0.106515] Switched to clocksource OSTS
[    0.110483] NET: Registered protocol family 2
[    0.113462] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.113564] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.113637] TCP: Hash tables configured (established 1024 bind 1024)
[    0.113896] TCP: reno registered
[    0.113937] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.114009] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.114766] NET: Registered protocol family 1
[    0.115894] IXP4xx Queue Manager initialized.
[    0.119139] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.124513] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.124596] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.125760] msgmni has been set to 56
[    0.127322] io scheduler noop registered
[    0.127387] io scheduler deadline registered (default)
[    0.246277] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.257252] console [ttyS0] disabled
[    0.257397] serial8250.0: ttyS0 at MMIO 0xc8001000 (irq = 13, base_baud = 921600) is a XScale
[    0.614349] console [ttyS0] enabled
[    0.622141] IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000089 Chip ID 0x000018
[    0.632578] Intel/Sharp Extended Query Table at 0x0031
[    0.637820] Intel/Sharp Extended Query Table at 0x0031
[    0.643021] Using buffer write method
[    0.646734] cfi_cmdset_0001: Erase suspend on write enabled
[    0.652722] Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0xfe0000
[    0.779584] 5 RedBoot partitions found on MTD device IXP4XX-Flash.0
[    0.785894] Creating 5 MTD partitions on "IXP4XX-Flash.0":
[    0.791561] 0x000000000000-0x000000040000 : "RedBoot"
[    0.799700] 0x000000040000-0x000000180000 : "zImage"
[    0.807500] 0x000000180000-0x000000fc0000 : "rootfs"
[    0.815190] mtd: device 2 (rootfs) set to be root filesystem
[    0.821082] 1 squashfs-split partitions found on MTD device rootfs
[    0.827330] 0x000000340000-0x000000fc0000 : "rootfs_data"
[    0.835469] 0x000000fc0000-0x000000fc1000 : "RedBoot config"
[    0.844034] 0x000000fe0000-0x000001000000 : "FIS directory"
[    1.122608] libphy: IXP4xx MII Bus: probed
[    1.129349] eth0: MII PHY 32 on NPE-B
[    1.135683] eth1: MII PHY 1 on NPE-C
[    1.140711] i2c /dev entries driver
[    1.145454] ixp4xx_wdt: timer heartbeat 60 sec
[    1.151726] TCP: cubic registered
[    1.155115] NET: Registered protocol family 17
[    1.159960] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    1.172822] Bridge firewalling registered
[    1.176937] 8021q: 802.1Q VLAN Support v1.8
[    1.181449] XScale DSP coprocessor detected.
[    1.198765] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[    1.219572] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    1.227535] Freeing unused kernel memory: 128K (c030e000 - c032e000)
[    3.233783] init: Console is alive
[    3.237861] init: - watchdog -
[    5.297520] init: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   37.450754] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[   37.487483] procd: - early -
[   37.490642] procd: - watchdog -
[   40.399376] procd: - ubus -
[   41.404373] random: ubusd urandom read with 64 bits of entropy available
[   41.436090] procd: - init -
Please press Enter to activate this console.
[   45.290014] NET: Registered protocol family 10
[   45.340212] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   45.395728] Loading modules backported from Linux version master-2015-07-21-0-g47cd203
[   45.403788] Backport generated by backports.git backports-20150626-0-gc1a4168
[   45.430939] ip_tables: (C) 2000-2006 Netfilter Core Team
[   45.468032] nf_conntrack version 0.5.0 (453 buckets, 1812 max)
[   45.662670] xt_time: kernel timezone is -0000
[   45.733895] cfg80211: World regulatory domain updated:
[   45.739178] cfg80211:  DFS Master region: unset
[   45.743545] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   45.753344] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   45.761400] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   45.769451] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   45.777513] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (N/A)
[   45.787050] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[   45.796582] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   45.804694] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   45.812749] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   46.028617] PPP generic driver version 2.4.2
[   46.050074] NET: Registered protocol family 24
[   72.507229] NPE-B: firmware's license can be found in /usr/share/doc/LICENSE.IPL
[   72.514669] NPE-B: firmware functionality 0x2, revision 0x2:1
[   72.522864] eth0: link up, speed 0 Mb/s, full duplex
[   72.578507] device eth0 entered promiscuous mode
[   72.619114] br-lan: port 1(eth0) entered forwarding state
[   72.624611] br-lan: port 1(eth0) entered forwarding state
[   74.616661] br-lan: port 1(eth0) entered forwarding state
[   81.436715] random: nonblocking pool is initialized
[   93.097456] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   93.104454] jffs2_build_filesystem(): unlocking the mtd device... done.
[  120.681143] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
[  237.841450] jffs2: notice: (2041) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 de.


BusyBox v1.23.2 (2015-09-07 16:05:31 CEST) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 CHAOS CALMER (Bleeding Edge, r46802)
 -----------------------------------------------------
  * 1 1/2 oz Gin            Shake with a glassful
  * 1/4 oz Triple Sec       of broken ice and pour
  * 3/4 oz Lime Juice       unstrained into a goblet.
  * 1 1/2 oz Orange Juice
  * 1 tsp. Grenadine Syrup
 -----------------------------------------------------
root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
rootfs                   12.5M    656.0K     11.9M   5% /
/dev/root                 1.8M      1.8M         0 100% /rom
tmpfs                    14.2M     48.0K     14.1M   0% /tmp
tmpfs                    14.2M     32.0K     14.1M   0% /tmp/root
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/mtdblock3           12.5M    656.0K     11.9M   5% /overlay
overlayfs:/overlay       12.5M    656.0K     11.9M   5% /
root@OpenWrt:/# reboot
root@OpenWrt:/# 
[  386.067388] br-lan: port 1(eth0) entered disabled state
[  386.077435] device eth0 left promiscuous mode
[  386.081977] br-lan: port 1(eth0) entered disabled state
[  386.097317] eth0: link down
[  386.102297] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[  390.450188] reboot: Restarting system

Finishing up:

Now all is left is re-configure redboot so it automatically boots to openWRT.
+starting api entry
Ethernet eth0: MAC address 00:03:47:df:32:a8
IP: 192.168.0.190/255.255.255.0, Gateway: 192.168.0.1
Default server: 192.168.0.180, DNS server IP: 8.8.8.8

RedBoot(tm) bootstrap and debug environment [ROM]
Red Hat certified release, version 1.92p1 - built 14:07:09, Oct  8 2004

Bootloader version 1
Platform: Intel Generic Residential Gateway (XScale)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x00000000-0x02000000, 0x0001e5c0-0x01fdd000 available
FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each.
RedBoot> fconfig
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis load zImage
>> exec
>>
Boot script timeout (1000ms resolution): 10
Use BOOTP for network configuration: false
Gateway IP address: 192.168.0.1
Local IP address: 192.168.0.190
Local IP address mask: 255.255.255.0
Product Info: WGR826V
Default server IP address: 192.168.0.180
Version Info: 1
Console baud rate: 115200
DNS server IP address: 8.8.8.8
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Default network device: npe_eth0
Network hardware address [MAC] for NPE eth0: 0x00:0x03:0x47:0xDF:0x32:0xA8
Network hardware address [MAC] for NPE eth1: 0x00:0x03:0x47:0xDF:0x32:0xAA
... Unlock from 0x50fc0000-0x50fc1000: .
... Erase from 0x50fc0000-0x50fc1000: .
... Program from 0x01fde000-0x01fdf000 at 0x50fc0000: .
... Lock from 0x50fc0000-0x50fc1000: .
RedBoot> reset

Now what?:

There are a few things that need to be done to have an usable router.

- Change the IP to match your LAN:
Use the command: vi /etc/config/network
For more information visit: http://wiki.openwrt.org/doc/uci/network
*My router is connected to my home LAN so I had to add the gateway for this to work.

- Install modules for WIFI:
Use the commands: 
opkg update
opkg install kmod-rt2500-pci
reboot

- Connect to the web interface:
With Luci up you can change pretty much anything you want like any router in the market.For more information visit: http://wiki.openwrt.org/doc/howto/luci.essentials

Now you are at a good starting point. I will look into getting the FXS chip working, but at this point I have no hope.

Feel free to leave comments below. 

Thursday, April 10, 2008

Still working on it...

Hello this is just a quick update, I have not abandon the project, I have been working with some people from the openWRT forums and irc #openwrt-devel channel. I have not being able to compile a 100% functional image, although I am able to enable Ethernet devices I am not able to assign the MAC address which then causes more issues.  I will continue to work on this project and as always any advice is welcome.

Tuesday, March 18, 2008

Partial Success ;-)

I looked into the OpenWRT project to see if they had some guidance or information that could help me with this task. They did have a great deal of information. I decided to try loading an image of a somewhat similar device and to my surplice I was able to boot and use the busybox. A few things do not work (wifi and ethernet for example), but I believe this will be corrected when I start building my own images. Here I have a screen splash of the boot process:


Restarting system.
+starting api entry
Ethernet eth0: MAC address 00:03:47:df:32:a8
IP: 192.168.15.169/255.255.255.0, Gateway: 192.168.15.168
Default server: 192.168.15.168, DNS server IP: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROM]
Red Hat certified release, version 1.92p1 - built 14:07:09, Oct 8 2004

Bootloader version 1.1
Platform: Intel Generic Residential Gateway (XScale)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x00000000-0x02000000, 0x0001e5c0-0x01fdd000 available
FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each.
RedBoot> fis load linux
RedBoot> exec
Using base address 0x00800000 and length 0x000e8034
Uncompressing Linux................................................................. done, booting the kernel.
Linux version 2.6.21.6 (nbd@ds10) (gcc version 4.1.2) #2 Sun Sep 30 20:44:34 CEST 2007
CPU: XScale-IXP42x Family [690541f1] revision 1 (ARMv5TE), cr=000039ff
Machine: Linksys WRT300N v2
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT undefined 5 cache
CPU0: I cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
CPU0: D cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
Built 1 zonelists. Total pages: 8128
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 init=/etc/preinit
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 32MB = 32MB total
Memory: 30416KB available (1788K code, 167K data, 76K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
IXP4xx: Using 16MiB expansion bus window size
PCI: IXP4xx is host
PCI: IXP4xx Using direct access for memory space
PCI: bus0: Fast back to back transfers disabled
dmabounce: registered device 0000:00:01.0 on pci bus
Time: OSTS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NetWinder Floating Point Emulator V0.97 (double precision)
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
IXP4xx Watchdog Timer: heartbeat 60 sec
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xc8001000 (irq = 13) is a XScale
IXP4XX Q Manager 0.2.1 initialized.
IXP4XX NPE driver Version 0.3.0 initialized
ixp4xx_crypto 0.0.1 registered successfully
IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank
Intel/Sharp Extended Query Table at 0x0031
Using buffer write method
cfi_cmdset_0001: Erase suspend on write enabled
Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0xfe0000
6 RedBoot partitions found on MTD device IXP4XX-Flash.0
Creating 6 MTD partitions on "IXP4XX-Flash.0":
0x00000000-0x00040000 : "RedBoot"
0x00040000-0x00140000 : "linux"
0x00140000-0x00fa0000 : "rootfs"
0x00240000-0x00fa0000 : "rootfs_data"
0x00fa0000-0x00fc0000 : "unallocated"
0x00fc0000-0x00fc1000 : "RedBoot config"
0x00fe0000-0x01000000 : "FIS directory"
i2c /dev entries driver
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP westwood registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear
All bugs added by David S. Miller
XScale DSP coprocessor detected.
ixp4xx_mac driver 0.3.1: eth0 on NPE-B with PHY[-1] initialized
ixp4xx_mac driver 0.3.1: eth1 on NPE-C with PHY[1] initialized
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
VFS: Mounted root (squashfs filesystem) readonly.
Freeing init memory: 76K
Warning: unable to open an initial console.
- preinit -
switching to jffs2
mini_fo: using base directory: /
mini_fo: using storage directory: /jffs
- init -
init started: BusyBox v1.4.2 (2007-09-29 10:12:09 CEST) multi-call binary

Please press Enter to activate this console. eth0: NPE-B not running
eth0: NPE-B not running
PPP generic driver version 2.4.2
wlan: 0.8.4.2 (svn r2568)
ath_hal: module license 'Proprietary' taints kernel.
ath_hal: 0.9.30.13 (AR5210, AR5211, AR5212, AR5416, RF5111, RF5112, RF2413, RF5413, RF2133, REGOPS_FUNC)
ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (svn r2568)
ath_rate_minstrel: look around rate set to 10%
ath_rate_minstrel: EWMA rolloff level set to 75%
ath_rate_minstrel: max segment size in the mrr set to 6000 us
wlan: mac acl policy registered
ath_pci: 0.9.4.5 (svn r2568)



BusyBox v1.4.2 (2007-09-29 10:12:09 CEST) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
KAMIKAZE (7.09) -----------------------------------
* 10 oz Vodka Shake well with ice and strain
* 10 oz Triple sec mixture into 10 shot glasses.
* 10 oz lime juice Salute!
---------------------------------------------------
root@OpenWrt:/# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock3 13.4M 648.0k 12.7M 5% /jffs
mini_fo:/jffs 960.0k 960.0k 0 100% /
root@OpenWrt:/# ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

root@OpenWrt:/#
To perform the installation I used this link:
http://wiki.openwrt.org/OpenWrtDocs/Hardware/Gateworks/Avila_GW2348_4
And
http://www.dd-wrt.com/wiki/index.php/Installation#First_time_install

Once I build the perfect image I will put together a step by step upgrade how-to and publish the image, maybe it can be backported in.

Tuesday, March 11, 2008

More backups!!

I had doubts of the integrity of the backups so I decided to re-do them based on the output of fis list. With this I may be able to restore the data in case I would like to revert to the original firmware.



RedBoot> fis list -c
Name FLASH addr Checksum Length Entry point
RedBoot 0x50000000 0x00000000 0x00040000 0x00000000
RedBoot config 0x50FC0000 0x00000000 0x00001000 0x00000000
FIS directory 0x50FE0000 0x00000000 0x00020000 0x00000000
appimg1 0x50040000 0x74FB22F9 0x00760000 0x00000000
appimg2 0x507A0000 0x74FB22F9 0x00760000 0x00000000
igwmisc 0x50F00000 0x6BA0CE01 0x00020000 0x00000000
dhcpdl 0x50F20000 0x6BA0CE01 0x00020000 0x00000000
igwpri 0x50F40000 0x6BA0CE01 0x00020000 0x00000000
igwsec 0x50F60000 0x6BA0CE01 0x00020000 0x00000000
prvcacfg 0x50F80000 0x6BA0CE01 0x00020000 0x00000000
prvauth 0x50FA0000 0x6BA0CE01 0x00020000 0x00000000
RedBoot>

jtag> readmem 0x50000000 0x00040000 RedBoot
address: 0x50000000
length: 0x00040000
reading:
addr: 0x50040000
Done.
jtag> readmem 0x50FC0000 0x00001000 RedBoot_config
address: 0x50FC0000
length: 0x00001000
reading:
addr: 0x50FC1000
Done.
jtag> readmem 0x50FE0000 0x00020000 FIS_directory
address: 0x50FE0000
length: 0x00020000
reading:
addr: 0x51000000
Done.
jtag> readmem 0x50F00000 0x00020000 igwmisc
address: 0x50F00000
length: 0x00020000
reading:
addr: 0x50F20000
Done.
jtag> readmem 0x50F20000 0x00020000 dhcpdl
address: 0x50F20000
length: 0x00020000
reading:
addr: 0x50F40000
Done.
jtag> readmem 0x50F40000 0x00020000 igwpri
address: 0x50F40000
length: 0x00020000
reading:
addr: 0x50F60000
Done.
jtag> readmem 0x50F60000 0x00020000 igwsec
address: 0x50F60000
length: 0x00020000
reading:
addr: 0x50F80000
Done.
jtag> readmem 0x50F80000 0x00020000 prvcacfg
address: 0x50F80000
length: 0x00020000
reading:
addr: 0x50FA0000
Done.
jtag> readmem 0x50FA0000 0x00020000 prvauth
address: 0x50FA0000
length: 0x00020000
reading:
addr: 0x50FC0000
Done.
jtag> readmem 0x50040000 0x00760000 appimg1
address: 0x50040000
length: 0x00760000
reading:
addr: 0x507A0000
Done.
jtag> readmem 0x507A0000 0x00760000 appimg2
address: 0x507A0000
length: 0x00760000
reading:
addr: 0x50F00000
Done.
jtag>
I made them in Big Endian and Little Endian.

Saturday, February 23, 2008

Backup success!!

After trying different ways to do the back up, I decided to build the Jtag wigller cable and do the backup that way. I used the program called urjtag. It takes about 6 hours to do the full backup, but finally is done. I made 2 backups, one in big endinan and the other little endian.

root@PINKY:~/wombat/urjtag/urjtag-0.8# /usr/local/bin/jtag

UrJTAG 0.8 #1067
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008 Kolja Waschk and the respective authors

UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.

WARNING: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.


jtag> cable wiggler parallel 0x378
Initializing parallel port at 0x378
jtag> detect
IR length: 7
Chain length: 1
Device Id: 00011001001001110111000000010011 (0x0000000019277013)
Manufacturer: Intel
Part(0): IXP425-266MHz
Stepping: B0
Filename: /usr/local/share/urjtag/intel/ixp425/ixp425
Please use the 'include' command instead of 'script'
jtag> detectflash 0
Query identification string:
Primary Algorithm Command Set and Control Interface ID Code: 0x0001 (Intel/Sharp Extended Command Set)
Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
Query system interface information:
Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
Typical timeout per single byte/word program: 256 us
Typical timeout for maximum-size multi-byte program: 256 us
Typical timeout per individual block erase: 2048 ms
Typical timeout for full chip erase: 0 ms
Maximum timeout for byte/word program: 1024 us
Maximum timeout for multi-byte program: 1024 us
Maximum timeout per individual block erase: 16384 ms
Maximum timeout for chip erase: 0 ms
Device geometry definition:
Device Size: 16777216 B (16384 KiB, 16 MiB)
Flash Device Interface Code description: 0x0002 (x8/x16)
Maximum number of bytes in multi-byte program: 32
Number of Erase Block Regions within device: 1
Erase Block Region Information:
Region 0:
Erase Block Size: 131072 B (128 KiB)
Number of Erase Blocks: 128
jtag> readmem 0x50000000 0x01000000 wholeflash-LE.img
address: 0x50000000
length: 0x01000000
reading:
addr: 0x51000000
Done.
jtag>
I hope this backup works because I was taking a peek to the images with a HEX viewer, it does not look like there is very much on it. Is there a way to test or verify? I did 2 runs and then a binary diff. The 2 files were exactly the same.

Monday, January 28, 2008

Backing up firmware!?

Before deleting or modifying the default image I would like to backup the factory image. This task has turned in to a nightmare. BusyBox has being stripped out off any useful command. I can see the different images on the /dev/mtdblock# devices but that is about it.

I have try many things such as:

-NFS: Some of the scripts do mention NFS, but the kernel does not add NFS support, and there are no modules to load.

-HTTPD: binary httpd is hard coded to read from the specified folder and the file system from where the HTML code is loaded is a cramfs mounted read only.

-BusyBox: There are about 10 commands available to the user and none of them seems to be helpful for this task.

-RedBoot: It can load from tftp some code, but I am new to RedBoot… this could be the solution, but I am still learning, maybe someone can guide me on this?

-JTag: This method looks like it is the most likely to succeed but considering the size of the flash, this could take hours? It will be my last thing to try.

So, for now I am a stock, but hopefully I will figure out or maybe someone can make a suggestion?

Boot up process:

The boot process of the WGR826V can be divided in to 3 parts:

-RedBoot:

+starting api entry
Ethernet eth0: MAC address 00:0f:b5:##:##:##
IP: 192.168.15.169/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.15.168, DNS server IP: 10.1.5.112
RedBoot(tm) bootstrap and debug environment [ROM]Red Hat certified release, version 1.92p1 - built 14:07:09, Oct 8 2004
Bootloader version 1.2Platform: Intel Generic Residential Gateway (XScale)Copyright (C) 2000, 2001, 2002, Red Hat, Inc.
RAM: 0x00000000-0x02000000, 0x0001e5c0-0x01fdd000 available
FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each.
RedBoot> bootValidating application image from partition appimg2 ...
Booting application image from partition appimg2 ...
Downloading Image to RAM location 0x1600000 ...
Transfering control to downloading Image at address 0x160024c ...
powering down the PHYs
Uncompressing Linux................................................................. done, booting the kernel.


-Linux:


Linux version 2.4.18_mvl30-ixdp425 (root@dhcp-199.intoto.com) (gcc version 3.2.1 20020930 (MontaVista)) #3287 Fri Mar 25 19:12:47 PST 2005
CPU: Intel XScale-IXP4xx/IXC1100 revision 1
Machine: Intel IXP425 Residential Gateway Demo Platform
fixing rdisk start c001a000, end c00c8d32
Warning: bad configuration page, trying to continue
initrd (0x0001a000 - 0xc00e2d32) extends beyond physical memory - disabling initrd
bootmem_init: rdisk setup
rdisk start c001a000, end 000aed32
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,115200 ip=off root=/dev/ram mem=32M@0x00000000
Calibrating delay loop... 263.78 BogoMIPS
Memory: 32MB = 32MB total
Memory: 30116KB available (1103K code, 219K data, 72K init)
XScale Cache/TLB Locking Copyright(c) 2001 MontaVista Software, Inc.
XScale cache_lock_init called
Calling consistent alloc
low_level_page initialized
low_level_page @ 0xc2800000
icache_lock_fn @ 0xc2800080
dcache_lock_fn @ 0xc28000a0
icache_unlock_fn @ 0xc2800098
dcache_unlock_fn @ 0xc28000f0
Initializing TLB locking
TLB locking initialized
Dentry-cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode-cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
POSIX conformance testing by UNIFIX
PCI Autoconfig: Found Bus 0, Device 1, Function 0
PCI Autoconfig: BAR 0, Mem, size=0x2000, address=0x4bffe000
PCI: bus0: Fast back to back transfers disabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Disabling the Out Of Memory Killer
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xff001003 (irq = 13) is a XScale UART
block: 64 slots per queue, batch=16
RAMDISK driver initialized: 16 RAM disks of 4192K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.1
mtd: partition "RedBoot config" doesn't end on an erase block -- force read-only
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
RAMDISK: Compressed image found at block 0
Successfully loaded
VFS: Mounted root (ext2 filesystem).
Function , Line <890>
Freeing init memory: 72K
serial console detected. Disabling virtual terminals.
init started: BusyBox v0.60.3 (2002.12.19-12:19+0000) multi-call binary
Activating swap...
mount: /proc/filesystems: No such file or directory
mount: /proc/filesystems: No such file or directory
Checking all file systems...
fsck: No such file or directory

fsck failed. Please repair manually.

CONTROL-D will exit from this shell and continue system startup.

/etc/rc.d/rcS.d/S30checkfs.sh: /sbin/sulogin: No such file or directory
mkdir: invalid option -- -
BusyBox v0.60.3 (2002.12.19-12:19+0000) multi-call binary

Usage: mkdir [OPTION] DIRECTORY...

mkdir: invalid option -- -
BusyBox v0.60.3 (2002.12.19-12:19+0000) multi-call binary

Usage: mkdir [OPTION] DIRECTORY...

Mounting local filesystems...
mount: Mounting /dev/root on / failed: No such file or directory
Hostname: hostname: No such file or directory
.
Cleaning: /tmp find: No such file or directory
/var/lock find: No such file or directory
/var/runfind: No such file or directory
.
Initializing random number generator... done.
Using ixp400.o
Module init.
Using dsr.o
dspModule_init_module :: LOAD DSP MODULE...
Using ixp400_codelets_dspEng.o
ixDspCodelet_init_module :: LOADED SUCCESSFULLY IXDSPCODELET MODULE...
Initialising NPEs...
Rx Free pool has 128 buffers
Rtp successfully initialised.
DLcid 02060100-01
********************************************
* Intel IXP400 DSP Software *
* Release 2.6 *
* Sep 8 2004, 15:07:15 *
* Intel Corporation *
********************************************

Initializing Slic's, please wait...
Using rt2500ap.o
****** raylink driver version 1.5.8.6 ******
Using ../leddrv.o
Initializing .... takes few seconds
Using igateway.o
register_netdevice_notifier :registered
Bridge module inited successfully
Init TM
TMInit ::
qos values initialised
Using tcpmssmangler.o
Using drvpppoe.o
Using dhpktdrv.o
Stopping System log Daemons
ImgUpgrdIoctlHdlr. primary image information is unavailable
remaping physmem 507a0000 done
SIOCGIFFLAGS: No such device
ixp1::link down

-iGateway:

**************************************************************
Welcome To The iGateway Command Line Interface
**************************************************************

Voip initialized sip@8882 cp@8884 on 127.0.0.1

To change the current settings you may run /config/voip/deinit && /config/voip/init...
iGateway:/>Interface name ixp1
iGateway:/> Interface Bandwidth 12500000
iGateway:/>iGateway:/>iGateway:/>iGateway:/>iGateway:/>iGateway:/>iGateway:/>iGateway:/>
*************************************************
Goodbye! Hope you had good time!!
*************************************************
LoadConfigFilesFromFlashToRAMDisk: Invalid LdSv Flash File System Length -1
LoadConfigFilesFromFlashToRAMDisk: Invalid LdSv Flash File System Length -1
Loading Factory Default configuration
Registered Prov Params
Loads IP Policy
Error in Loading:Url Key-word Configuration DataBase
MsgcIoctlHandler : Invalid Command Number 0x11000020 Received.
MsgcIoctlHandler : Invalid Command Number 0x11000020 Received.
Unable to assign the address
The buffer size used is 64
For interface : lo
Iface addr : 0x7f000001
Ndevice ixp0 entered promiscuous mode
etmask : 0xffffff00
device ra0 entered promiscuous mode
MsgcIoctlHandler : Invalid Command Number 0x11000020 Received.
Exit:LdsvWrp_LoadAll

Please press Enter to activate this console.


Friday, January 25, 2008

Console up and running

I was able to build the console cable and boot in to the device. I found a few interesting things . It uses RedBoot version 1.92p1 and It boots to Linux. It apparently has a very crippled BusyBox shell.


The output of "fis list" is as follow:


RedBoot> fis list

Name FLASH addr Mem addr Length Entry point

RedBoot 0x50000000 0x50000000 0x00040000 0x00000000

RedBoot config 0x50FC0000 0x50FC0000 0x00001000 0x00000000

FIS directory 0x50FE0000 0x50FE0000 0x00020000 0x00000000

appimg1 0x50040000 0x50040000 0x00760000 0x00000000

appimg2 0x507A0000 0x507A0000 0x00760000 0x00000000

igwmisc 0x50F00000 0x50F00000 0x00020000 0x00000000

dhcpdl 0x50F20000 0x50F20000 0x00020000 0x00000000

igwpri 0x50F40000 0x50F40000 0x00020000 0x00000000

igwsec 0x50F60000 0x50F60000 0x00020000 0x00000000

prvcacfg 0x50F80000 0x50F80000 0x00020000 0x00000000

prvauth 0x50FA0000 0x50FA0000 0x00020000 0x00000000

RedBoot>
Once iside the busybox the output of uname -a:
Linux (none) 2.4.18_mvl30-ixdp425 #3287 Fri Mar 25 19:12:47 PST 2005 armv5teb unknown 

Thursday, January 24, 2008

The WGR826V

The WGR826V router was made in 2005 by NETGEAR in partnership with Intoto. It was licensed to AT&T for their CallVantage Service. In other words, the 2 FXS ports can only be used with that service.
The router has been discontinued by NETGEAR and it can now be purchased at a cheaper price in some discount stores. In my case, I purchased one from Big Lots at $29.99. Actually, I purchased 2 of them; I donated one of them to the OpenWRT organization, in hopes of helping them create a suitable image for the router. Sadly, the developer who received the router has not done much with it. So, I decided to do it on my own.

Information about the router:

The FCC ID number is: PY3WGR826V. With this piece of information, I was able to determine many things, such as components of the board:

• CPU: Intel IXP-425 @ 266MHz
• RAM: 32M-Byte supporting up to 533MHz CPU
• Flash: Intel TE28F128 16M-Byte
• Wi-Fi: 11g Ralink RT2500 mini PCI card
• SLIC: Silicon Labs Si3210
• Switch: Kendin KS8995X 5-Port switch
• RS-232 Console
• 7 green/amber LEDs and 2 green LEDs
• One Omni-directional Fixed Antenna
• 12Vdc 1.25A slim universal switching power adapter

Ok, it has 32MB of RAM and 16MB of flash. The CPU is an IXP425 and it has a serial console. This is more than enough for what I want to do with it. I should be able to install a custom image of the firmware with Asterisk and QoS support in order to make use of the FXS ports.

What I have done so far:

The serial port was one of the things that I needed to get to work first. So, I figured out the pin-out of the 5 pins mini-din port in the back of the router. I found that the port has 3.3V and GND, so you can power up the voltage level inverter to connect to a computer.

So, here is the pin-out:

Introduction

The goal of this blog is to help me with the documentation of progress on my quest to install an alternate firmware on the Netgear WGR826V.

Archive