WGR826V - Alternate Firmware

Still working on it...

2008-04-10T11:42:00.001-04:00

Hello this is just a quick update, I have not abandon the project, I have been working with some people from the openWRT forums and irc #openwrt-devel channel. I have not being able to compile a 100% functional image, although I am able to enable Ethernet devices I am not able to assign the MAC address which then causes more issues. I will continue to work on this project and as always any advice is welcome.

Partial Success ;-)

2008-03-18T10:23:00.007-04:00

I looked into the OpenWRT project to see if they had some guidance or information that could help me with this task. They did have a great deal of information. I decided to try loading an image of a somewhat similar device and to my surplice I was able to boot and use the busybox. A few things do not work (wifi and ethernet for example), but I believe this will be corrected when I start building my own images. Here I have a screen splash of the boot process:



Restarting system.
+starting api entry
Ethernet eth0: MAC address 00:03:47:df:32:a8
IP: 192.168.15.169/255.255.255.0, Gateway: 192.168.15.168
Default server: 192.168.15.168, DNS server IP: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROM]
Red Hat certified release, version 1.92p1 - built 14:07:09, Oct  8 2004

Bootloader version 1.1
Platform: Intel Generic Residential Gateway (XScale)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x00000000-0x02000000, 0x0001e5c0-0x01fdd000 available
FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each.
RedBoot> fis load linux
RedBoot> exec
Using base address 0x00800000 and length 0x000e8034
Uncompressing Linux................................................................. done, booting the kernel.
Linux version 2.6.21.6 (nbd@ds10) (gcc version 4.1.2) #2 Sun Sep 30 20:44:34 CEST 2007
CPU: XScale-IXP42x Family [690541f1] revision 1 (ARMv5TE), cr=000039ff
Machine: Linksys WRT300N v2
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT undefined 5 cache
CPU0: I cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
CPU0: D cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
Built 1 zonelists.  Total pages: 8128
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 init=/etc/preinit
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 32MB = 32MB total
Memory: 30416KB available (1788K code, 167K data, 76K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
IXP4xx: Using 16MiB expansion bus window size
PCI: IXP4xx is host
PCI: IXP4xx Using direct access for memory space
PCI: bus0: Fast back to back transfers disabled
dmabounce: registered device 0000:00:01.0 on pci bus
Time: OSTS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NetWinder Floating Point Emulator V0.97 (double precision)
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
IXP4xx Watchdog Timer: heartbeat 60 sec
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xc8001000 (irq = 13) is a XScale
IXP4XX Q Manager 0.2.1 initialized.
IXP4XX NPE driver Version 0.3.0 initialized
ixp4xx_crypto 0.0.1 registered successfully
IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank
 Intel/Sharp Extended Query Table at 0x0031
Using buffer write method
cfi_cmdset_0001: Erase suspend on write enabled
Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0xfe0000
6 RedBoot partitions found on MTD device IXP4XX-Flash.0
Creating 6 MTD partitions on "IXP4XX-Flash.0":
0x00000000-0x00040000 : "RedBoot"
0x00040000-0x00140000 : "linux"
0x00140000-0x00fa0000 : "rootfs"
0x00240000-0x00fa0000 : "rootfs_data"
0x00fa0000-0x00fc0000 : "unallocated"
0x00fc0000-0x00fc1000 : "RedBoot config"
0x00fe0000-0x01000000 : "FIS directory"
i2c /dev entries driver
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP westwood registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear 
All bugs added by David S. Miller 
XScale DSP coprocessor detected.
ixp4xx_mac driver 0.3.1: eth0 on NPE-B with PHY[-1] initialized
ixp4xx_mac driver 0.3.1: eth1 on NPE-C with PHY[1] initialized
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
VFS: Mounted root (squashfs filesystem) readonly.
Freeing init memory: 76K
Warning: unable to open an initial console.
- preinit -
switching to jffs2
mini_fo: using base directory: /
mini_fo: using storage directory: /jffs
- init -
init started:  BusyBox v1.4.2 (2007-09-29 10:12:09 CEST) multi-call binary

Please press Enter to activate this console. eth0: NPE-B not running
eth0: NPE-B not running
PPP generic driver version 2.4.2
wlan: 0.8.4.2 (svn r2568)
ath_hal: module license 'Proprietary' taints kernel.
ath_hal: 0.9.30.13 (AR5210, AR5211, AR5212, AR5416, RF5111, RF5112, RF2413, RF5413, RF2133, REGOPS_FUNC)
ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (svn r2568)
ath_rate_minstrel: look around rate set to 10%
ath_rate_minstrel: EWMA rolloff level set to 75%
ath_rate_minstrel: max segment size in the mrr set to 6000 us
wlan: mac acl policy registered
ath_pci: 0.9.4.5 (svn r2568)



BusyBox v1.4.2 (2007-09-29 10:12:09 CEST) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (7.09) -----------------------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/mtdblock3           13.4M    648.0k     12.7M   5% /jffs
mini_fo:/jffs           960.0k    960.0k         0 100% /
root@OpenWrt:/# ifconfig
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

root@OpenWrt:/#

To perform the installation I used this link:
http://wiki.openwrt.org/OpenWrtDocs/Hardware/Gateworks/Avila_GW2348_4
And
http://www.dd-wrt.com/wiki/index.php/Installation#First_time_install

Once I build the perfect image I will put together a step by step upgrade how-to and publish the image, maybe it can be backported in.

More backups!!

2008-03-11T12:03:00.004-04:00

I had doubts of the integrity of the backups so I decided to re-do them based on the output of fis list. With this I may be able to restore the data in case I would like to revert to the original firmware.



RedBoot> fis list -c                                                          
Name              FLASH addr  Checksum    Length      Entry point             
RedBoot           0x50000000  0x00000000  0x00040000  0x00000000              
RedBoot config    0x50FC0000  0x00000000  0x00001000  0x00000000              
FIS directory     0x50FE0000  0x00000000  0x00020000  0x00000000              
appimg1           0x50040000  0x74FB22F9  0x00760000  0x00000000              
appimg2           0x507A0000  0x74FB22F9  0x00760000  0x00000000              
igwmisc           0x50F00000  0x6BA0CE01  0x00020000  0x00000000              
dhcpdl            0x50F20000  0x6BA0CE01  0x00020000  0x00000000              
igwpri            0x50F40000  0x6BA0CE01  0x00020000  0x00000000              
igwsec            0x50F60000  0x6BA0CE01  0x00020000  0x00000000              
prvcacfg          0x50F80000  0x6BA0CE01  0x00020000  0x00000000              
prvauth           0x50FA0000  0x6BA0CE01  0x00020000  0x00000000              
RedBoot>

jtag> readmem 0x50000000 0x00040000 RedBoot
address: 0x50000000
length:  0x00040000
reading:
addr: 0x50040000
Done.
jtag> readmem 0x50FC0000 0x00001000 RedBoot_config
address: 0x50FC0000
length:  0x00001000
reading:
addr: 0x50FC1000
Done.
jtag> readmem 0x50FE0000 0x00020000 FIS_directory
address: 0x50FE0000
length:  0x00020000
reading:
addr: 0x51000000
Done.
jtag> readmem 0x50F00000 0x00020000 igwmisc
address: 0x50F00000
length:  0x00020000
reading:
addr: 0x50F20000
Done.
jtag> readmem 0x50F20000 0x00020000 dhcpdl
address: 0x50F20000
length:  0x00020000
reading:
addr: 0x50F40000
Done.
jtag> readmem 0x50F40000 0x00020000 igwpri
address: 0x50F40000
length:  0x00020000
reading:
addr: 0x50F60000
Done.
jtag> readmem 0x50F60000 0x00020000 igwsec
address: 0x50F60000
length:  0x00020000
reading:
addr: 0x50F80000
Done.
jtag> readmem 0x50F80000 0x00020000 prvcacfg
address: 0x50F80000
length:  0x00020000
reading:
addr: 0x50FA0000
Done.
jtag> readmem 0x50FA0000 0x00020000 prvauth
address: 0x50FA0000
length:  0x00020000
reading:
addr: 0x50FC0000
Done.
jtag> readmem 0x50040000 0x00760000 appimg1
address: 0x50040000
length:  0x00760000
reading:
addr: 0x507A0000
Done.
jtag> readmem  0x507A0000  0x00760000 appimg2
address: 0x507A0000
length:  0x00760000
reading:
addr: 0x50F00000
Done.
jtag>

I made them in Big Endian and Little Endian.

Backup success!!

2008-02-23T14:04:00.006-05:00

After trying different ways to do the back up, I decided to build the Jtag wigller cable and do the backup that way. I used the program called urjtag. It takes about 6 hours to do the full backup, but finally is done. I made 2 backups, one in big endinan and the other little endian.


root@PINKY:~/wombat/urjtag/urjtag-0.8# /usr/local/bin/jtag 

UrJTAG 0.8 #1067
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008 Kolja Waschk and the respective authors

UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.

WARNING: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.


jtag> cable wiggler parallel 0x378
Initializing parallel port at 0x378
jtag> detect
IR length: 7
Chain length: 1
Device Id: 00011001001001110111000000010011 (0x0000000019277013)
  Manufacturer: Intel
  Part(0):         IXP425-266MHz
  Stepping:     B0
  Filename:     /usr/local/share/urjtag/intel/ixp425/ixp425
Please use the 'include' command instead of 'script'
jtag> detectflash 0
Query identification string:
        Primary Algorithm Command Set and Control Interface ID Code: 0x0001 (Intel/Sharp Extended Command Set)
        Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
Query system interface information:
        Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
        Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
        Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
        Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
        Typical timeout per single byte/word program: 256 us
        Typical timeout for maximum-size multi-byte program: 256 us
        Typical timeout per individual block erase: 2048 ms
        Typical timeout for full chip erase: 0 ms
        Maximum timeout for byte/word program: 1024 us
        Maximum timeout for multi-byte program: 1024 us
        Maximum timeout per individual block erase: 16384 ms
        Maximum timeout for chip erase: 0 ms
Device geometry definition:
        Device Size: 16777216 B (16384 KiB, 16 MiB)
        Flash Device Interface Code description: 0x0002 (x8/x16)
        Maximum number of bytes in multi-byte program: 32
        Number of Erase Block Regions within device: 1
        Erase Block Region Information:
                Region 0:
                        Erase Block Size: 131072 B (128 KiB)
                        Number of Erase Blocks: 128
jtag> readmem 0x50000000 0x01000000 wholeflash-LE.img
address: 0x50000000
length:  0x01000000
reading:
addr: 0x51000000
Done.
jtag>

I hope this backup works because I was taking a peek to the images with a HEX viewer, it does not look like there is very much on it. Is there a way to test or verify? I did 2 runs and then a binary diff. The 2 files were exactly the same.

Backing up firmware!?

2008-01-28T14:08:00.000-05:00

Before deleting or modifying the default image I would like to backup the factory image. This task has turned in to a nightmare. BusyBox has being stripped out off any useful command. I can see the different images on the /dev/mtdblock# devices but that is about it.

I have try many things such as:

-NFS: Some of the scripts do mention NFS, but the kernel does not add NFS support, and there are no modules to load.

-HTTPD: binary httpd is hard coded to read from the specified folder and the file system from where the HTML code is loaded is a cramfs mounted read only.

-BusyBox: There are about 10 commands available to the user and none of them seems to be helpful for this task.

-RedBoot: It can load from tftp some code, but I am new to RedBoot… this could be the solution, but I am still learning, maybe someone can guide me on this?

-JTag: This method looks like it is the most likely to succeed but considering the size of the flash, this could take hours? It will be my last thing to try.

So, for now I am a stock, but hopefully I will figure out or maybe someone can make a suggestion?

Boot up process:

2008-01-28T13:39:00.005-05:00

The boot process of the WGR826V can be divided in to 3 parts:

-RedBoot:


+starting api entry
Ethernet eth0: MAC address 00:0f:b5:##:##:##
IP: 192.168.15.169/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.15.168, DNS server IP: 10.1.5.112
RedBoot(tm) bootstrap and debug environment [ROM]Red Hat certified release, version 1.92p1 - built 14:07:09, Oct 8 2004
Bootloader version 1.2Platform: Intel Generic Residential Gateway (XScale)Copyright (C) 2000, 2001, 2002, Red Hat, Inc.
RAM: 0x00000000-0x02000000, 0x0001e5c0-0x01fdd000 available
FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each.
RedBoot> bootValidating application image from partition appimg2 ...
Booting application image from partition appimg2 ...
Downloading Image to RAM location 0x1600000 ...
Transfering control to downloading Image at address 0x160024c ...
powering down the PHYs
Uncompressing Linux................................................................. done, booting the kernel.

-Linux:


Linux version 2.4.18_mvl30-ixdp425 (root@dhcp-199.intoto.com) (gcc version 3.2.1 20020930 (MontaVista)) #3287 Fri Mar 25 19:12:47 PST 2005
CPU: Intel XScale-IXP4xx/IXC1100 revision 1
Machine: Intel IXP425 Residential Gateway Demo Platform
fixing rdisk start c001a000, end c00c8d32
Warning: bad configuration page, trying to continue
initrd (0x0001a000 - 0xc00e2d32) extends beyond physical memory - disabling initrd
bootmem_init: rdisk setup
rdisk start c001a000, end 000aed32
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,115200 ip=off root=/dev/ram mem=32M@0x00000000
Calibrating delay loop... 263.78 BogoMIPS
Memory: 32MB = 32MB total
Memory: 30116KB available (1103K code, 219K data, 72K init)
XScale Cache/TLB Locking Copyright(c) 2001 MontaVista Software, Inc.
XScale cache_lock_init called
Calling consistent alloc
low_level_page initialized
low_level_page @ 0xc2800000
icache_lock_fn @ 0xc2800080
dcache_lock_fn @ 0xc28000a0
icache_unlock_fn @ 0xc2800098
dcache_unlock_fn @ 0xc28000f0
Initializing TLB locking
TLB locking initialized
Dentry-cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode-cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
POSIX conformance testing by UNIFIX
PCI Autoconfig: Found Bus 0, Device 1, Function 0
PCI Autoconfig: BAR 0, Mem, size=0x2000, address=0x4bffe000
PCI: bus0: Fast back to back transfers disabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Disabling the Out Of Memory Killer
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xff001003 (irq = 13) is a XScale UART
block: 64 slots per queue, batch=16
RAMDISK driver initialized: 16 RAM disks of 4192K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.1
mtd: partition "RedBoot config" doesn't end on an erase block -- force read-only
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
RAMDISK: Compressed image found at block 0
Successfully loaded
VFS: Mounted root (ext2 filesystem).
Function , Line <890>
Freeing init memory: 72K
serial console detected. Disabling virtual terminals.
init started: BusyBox v0.60.3 (2002.12.19-12:19+0000) multi-call binary
Activating swap...
mount: /proc/filesystems: No such file or directory
mount: /proc/filesystems: No such file or directory
Checking all file systems...
fsck: No such file or directory

fsck failed. Please repair manually.

CONTROL-D will exit from this shell and continue system startup.

/etc/rc.d/rcS.d/S30checkfs.sh: /sbin/sulogin: No such file or directory
mkdir: invalid option -- -
BusyBox v0.60.3 (2002.12.19-12:19+0000) multi-call binary

Usage: mkdir [OPTION] DIRECTORY...

mkdir: invalid option -- -
BusyBox v0.60.3 (2002.12.19-12:19+0000) multi-call binary

Usage: mkdir [OPTION] DIRECTORY...

Mounting local filesystems...
mount: Mounting /dev/root on / failed: No such file or directory
Hostname: hostname: No such file or directory
.
Cleaning: /tmp find: No such file or directory
/var/lock find: No such file or directory
/var/runfind: No such file or directory
.
Initializing random number generator... done.
Using ixp400.o
Module init.
Using dsr.o
dspModule_init_module :: LOAD DSP MODULE...
Using ixp400_codelets_dspEng.o
ixDspCodelet_init_module :: LOADED SUCCESSFULLY IXDSPCODELET MODULE...
Initialising NPEs...
Rx Free pool has 128 buffers
Rtp successfully initialised.
DLcid 02060100-01
********************************************
* Intel IXP400 DSP Software *
* Release 2.6 *
* Sep 8 2004, 15:07:15 *
* Intel Corporation *
********************************************

Initializing Slic's, please wait...
Using rt2500ap.o
****** raylink driver version 1.5.8.6 ******
Using ../leddrv.o
Initializing .... takes few seconds
Using igateway.o
register_netdevice_notifier :registered
Bridge module inited successfully
Init TM
TMInit ::
qos values initialised
Using tcpmssmangler.o
Using drvpppoe.o
Using dhpktdrv.o
Stopping System log Daemons
ImgUpgrdIoctlHdlr. primary image information is unavailable
remaping physmem 507a0000 done
SIOCGIFFLAGS: No such device
ixp1::link down

-iGateway:


**************************************************************
Welcome To The iGateway Command Line Interface
**************************************************************

Voip initialized sip@8882 cp@8884 on 127.0.0.1

To change the current settings you may run /config/voip/deinit && /config/voip/init...
iGateway:/>Interface name ixp1
iGateway:/> Interface Bandwidth 12500000
iGateway:/>iGateway:/>iGateway:/>iGateway:/>iGateway:/>iGateway:/>iGateway:/>iGateway:/>
*************************************************
Goodbye! Hope you had good time!!
*************************************************
LoadConfigFilesFromFlashToRAMDisk: Invalid LdSv Flash File System Length -1
LoadConfigFilesFromFlashToRAMDisk: Invalid LdSv Flash File System Length -1
Loading Factory Default configuration
Registered Prov Params
Loads IP Policy
Error in Loading:Url Key-word Configuration DataBase
MsgcIoctlHandler : Invalid Command Number 0x11000020 Received.
MsgcIoctlHandler : Invalid Command Number 0x11000020 Received.
Unable to assign the address
The buffer size used is 64
For interface : lo
Iface addr : 0x7f000001
Ndevice ixp0 entered promiscuous mode
etmask : 0xffffff00
device ra0 entered promiscuous mode
MsgcIoctlHandler : Invalid Command Number 0x11000020 Received.
Exit:LdsvWrp_LoadAll

Please press Enter to activate this console.

Console up and running

2008-01-25T15:21:00.001-05:00

I was able to build the console cable and boot in to the device. I found a few interesting things . It uses RedBoot version 1.92p1 and It boots to Linux. It apparently has a very crippled BusyBox shell.

The output of "fis list" is as follow:

RedBoot> fis list

Name              FLASH addr  Mem addr    Length      Entry point

RedBoot           0x50000000  0x50000000  0x00040000  0x00000000

RedBoot config    0x50FC0000  0x50FC0000  0x00001000  0x00000000

FIS directory     0x50FE0000  0x50FE0000  0x00020000  0x00000000

appimg1           0x50040000  0x50040000  0x00760000  0x00000000

appimg2           0x507A0000  0x507A0000  0x00760000  0x00000000

igwmisc           0x50F00000  0x50F00000  0x00020000  0x00000000

dhcpdl            0x50F20000  0x50F20000  0x00020000  0x00000000

igwpri            0x50F40000  0x50F40000  0x00020000  0x00000000

igwsec            0x50F60000  0x50F60000  0x00020000  0x00000000

prvcacfg          0x50F80000  0x50F80000  0x00020000  0x00000000

prvauth           0x50FA0000  0x50FA0000  0x00020000  0x00000000

RedBoot>

Once iside the busybox the output of uname -a:

Linux (none) 2.4.18_mvl30-ixdp425 #3287 Fri Mar 25 19:12:47 PST 2005 armv5teb unknown

The WGR826V

2008-01-24T17:44:00.000-05:00

The WGR826V router was made in 2005 by NETGEAR in partnership with Intoto. It was licensed to AT&T for their CallVantage Service. In other words, the 2 FXS ports can only be used with that service.
The router has been discontinued by NETGEAR and it can now be purchased at a cheaper price in some discount stores. In my case, I purchased one from Big Lots at $29.99. Actually, I purchased 2 of them; I donated one of them to the OpenWRT organization, in hopes of helping them create a suitable image for the router. Sadly, the developer who received the router has not done much with it. So, I decided to do it on my own.

Information about the router:

The FCC ID number is: PY3WGR826V. With this piece of information, I was able to determine many things, such as components of the board:

• CPU: Intel IXP-425 @ 266MHz
• RAM: 32M-Byte supporting up to 533MHz CPU
• Flash: Intel TE28F128 16M-Byte
• Wi-Fi: 11g Ralink RT2500 mini PCI card
• SLIC: Silicon Labs Si3210
• Switch: Kendin KS8995X 5-Port switch
• RS-232 Console
• 7 green/amber LEDs and 2 green LEDs
• One Omni-directional Fixed Antenna
• 12Vdc 1.25A slim universal switching power adapter

Ok, it has 32MB of RAM and 16MB of flash. The CPU is an IXP425 and it has a serial console. This is more than enough for what I want to do with it. I should be able to install a custom image of the firmware with Asterisk and QoS support in order to make use of the FXS ports.

What I have done so far:

The serial port was one of the things that I needed to get to work first. So, I figured out the pin-out of the 5 pins mini-din port in the back of the router. I found that the port has 3.3V and GND, so you can power up the voltage level inverter to connect to a computer.

So, here is the pin-out:

Introduction

2008-01-24T11:41:00.000-05:00

The goal of this blog is to help me with the documentation of progress on my quest to install an alternate firmware on the Netgear WGR826V.