(Further notes on changes at the bottom.)
This is a collection of information and resources I've come across in my attempts to get Linux running on the Network Everywhere NWR04b wireless router. This work has stopped; I managed to get a shell going, but did not succeed at either getting all the ethernet ports working or writing to the flash memory from Linux. Old blog entries can be found here; these days, I write about other things here.
iLinux version 2.4.19-uc1-cx84200-4 (email@example.com) (gcc version 2.95.3 20010315 (release)) #115 Processor: Conexant CX84200 revision 1 Architecture: cx84200 On node 0 totalpages: 2048 zone(0): 0 pages. zone(1): 2048 pages. zone(2): 0 pages. Kernel command line: root=/dev/nfs nfsroot=192.168.23.254:/home/aardvark/nwr04b/nfsroot ip=192.168.23.12:192.168.23.254:::testf Calibrating delay loop... 6.57 BogoMIPS Memory: 8MB = 8MB total Memory: 6448KB available (1002K code, 331K data, 52K init) Dentry cache hash table entries: 1024 (order: 1, 8192 bytes) Inode cache hash table entries: 512 (order: 0, 4096 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 2048 (order: 1, 8192 bytes) POSIX conformance testing by UNIFIX Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB. RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize eth0: a0:98:76:54:32:10 NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 512) IP-Config: Guessing netmask 255.255.255.0 IP-Config: Complete: device=eth0, addr=192.168.23.12, mask=255.255.255.0, gw=255.255.255.255, host=test, domain=, nis-domain=(none), bootserver=192.168.23.254, rootserver=192.168.23.254, rootpath= Looking up port of RPC 100003/2 on 192.168.23.254 Looking up port of RPC 100005/1 on 192.168.23.254 VFS: Mounted root (nfs filesystem). Freeing init memory: 52K Using fallback suid method init: Bummer, can't write to log on /dev/tty5! console=/dev/console init started: BusyBox v1.00 (2005.08.27-21:20+0000) multi-call binary command='-/bin/sh' action='4' terminal='/dev/console' init: Bummer, can't write to log on /dev/tty5! Starting pid 9, console /dev/console: '/bin/sh' Using fallback suid method / # ifconfig -a Using fallback suid method ifconfig: Warning: cannot open /proc/net/dev. Limited output.: No such file or directory eth0 Link encap:Ethernet HWaddr A0:98:76:54:32:10 inet addr:192.168.23.12 Bcast:192.168.23.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:7 / # mount -t proc proc /proc Using fallback suid method / # cat /proc/cpuinfo Using fallback suid method Processor : Conexant CX84200 rev 1 (v3l) BogoMIPS : 6.57 Hardware : cx84200 Revision : 0000 Serial : 0000000000000000
Don't upgrade using the firmware from the Network Everywhere FTP site! I tried upgrading using the file nwr04bv102_1220_fw.zip from ftp.networkeverywhere.com, and the became router unresponsive. From the comments I've received in my blog, this is not unusual. See the sections on resurrection and making a serial port adapter for help on getting it back from the dead.
Newsflash! Andrew discovers a way to recover without a serial port! Details in the resurrection section!
This all used to be in a wiki, and then it got spammed. I've recovered all this from backups, and am fixing it up as I go along. There are bound to be some mistakes in here somewhere; please leave a note on my blog if you find something confusing, missing or just plain wrong.
Also, a lot of people contributed to this; I no longer have the records of who did what. If you'd like credit, please shoot me an email.
It looks like this router was manufactured or rebranded by Runtop as a WR1133. Judging by their product page, there doesn't seem to be a lot of difference within the WR11xx series. Also, the board I've got has a series of boxes printed on it marked WR1134 through WR1139, so I assume it's just a matter of different bits being added. (FIXME: Need a picture here...)
Network Everywhere sold this unit as the NWR04B; their FTP server appears to be run by Cisco, which makes it seem likely that this is also the same as the Linksys BEF11S4. It also seems to be the same as the Repotec IP2014 or RP-WR1134. I'm sure there's lots of others, too; a Google for WR1133 turns up at least a few other models (along with details on the WR1133 uncultured eubacterium...).
Unfortunately, I haven't been able to get in touch with Codeman. Codeman: if you're out there, we could definitely use your help!
As for my own progress...doing well! I've managed to get a shell on the thing, and have released tarballs with the work I've done so far. You can read more about what I want to do next here, but it includes:
As I mentioned, my blog will have the latest and up-to-datest.
Following Voidman's example, Andrew has discovered that you can get your dead NWR04B working again without attaching a serial port. If you only want to upgrade the firmware (and by all accounts it makes things a lot better), this would be the easiest method.
Here's what Andrew has to say:
I used a cheap wire from and old electronics kit I regularly pillage for various needs, taped one end to one of the screws holding down the wireless PCMCIA card, and one by one, I tried grounding a pin on the memory chip (the one that has a sticker on it) and powering it on and looking for any changes (couldnt get deader, right?). Eventually, one of the pins caused a change - the red diag light came on and blinked regularly, and the connection light for the ethernet port I had plugged in came on and stayed constant. I was able to hop over to http://192.168.1.1 and give it my firmware of choice (I fed it the Lanware firmware, and its been going nonstop for about a month now!). I was a little too amazed with the fact that it was working to record everything properly, but I do believe that it was pin 17 on the chip that I grounded.
Mind you, I may have fat-fingered a dual grounding of pins 16/17 or 17/18, but it shouldnt take more than a couple tried to find out for sure. Just to be a little more imprecise: if memory serves, around pin 14, the visible traces on the board stop, and then there is one pin ~around~ pin 17 that has a trace, and then one that doesnt, and then a whole lot that do. The pin I was focusing on is the one that had a trace and was surrounded by pins that didnt have traces, and I ~think~ that was pin 17. Vague enough? If I could find a high res picture of the area on the board, Id gladly show, but I dont have a camera, and Im not going to break this router again trying silly things.
The pin is somewhere around here.
The recovery page that should be accessible if you get the router in diag mode looks like this.
The original blog comment is here.
This can also be fixed if you can get the serial port working; the bootloader is still working, but the image it's trying to load is scuppered. You can download the Runtop firmware then upload it to the router using Xmodem. Seems to work for me; see this blog entry for details.
Other firmware that appears to be similar is the firmware from Repotec -- at least, the bootloader looks the same, and the structure inside is also the same. I have not tried this out, so don't try it unless you have a serial port working and are prepared to toast your router! You have been warned!
Quick reviews of different firmware:
Al Pierce was kind enough to make a schematic of the serial port adapter. This is the same circuit that the HRI folks have on their site, but Al has customized it for the NWR04B. The part marked "Router connector" in his schematic is JP2 on the board itself. Thanks, Al!
BTW: The circuit calls for a MAX3232 chip; however, the store I went to only had a SIPEX3232. This worked fine.
On JP2 itself:
Firmware from Network Everywhere, Repotec, Runtop and Lanware (user name "lanware", password "router" for that last one; no quotes) seems to all have the same structure.
First off, if it comes in a zip file, unzip it. After that, you're left with a file that generally ends in ".dlf" (unfortunately, Kai Gossner's dlftool doesn't seem to work with these) or ".img" (for the Runtop firmware).find-zlib turns up a gzip archive in each, and splitgzip will extract it. The Gzip archive is named "application.bin.gz", and can be uncompressed using gunzip (available with any Unix or Unix workalike).
Application.bin contains the filesystem for the router. Running strings (Unix etc) on it will show you the contents of the webpages. The names of the files can also be gleaned; in the Network Everywhere firmware, they begin around 0x00155110 with AppSysTask. It looks like each filename is null-terminated, but padded to a multiple of four bytes. The files are listed first; the contents come much later.
The application.bin from nwr04bv102_1220_fw.zip is 2261384 bytes. The application.bin from SPWR1133-3190-NB1F.zip is 1692540 btyes -- a lot smaller.
The bootloader can be obtained by taking the remainder of the firmware file. Taking the Network Everywhere firmware as an example: NWR04Bv1.02D1220.dlf is 764090 bytes long. splitgzip spits out application.bin.gz, which is 743898 bytes long. That leaves 20192 bytes for the bootloader, which we can obtain using dd:
dd if=NWR04Bv1.02D1220.dlf of=bootloader bs=20192 count=1
In the Network Everywhere firmware, the checksum is at the end of the bootloader. It's generated by doing a sum of bytes of application.bin.gz, which can be done easily enough in Perl. (This script is just a stripped down version of this one, BTW...bless the GPL, and bless all who write Free software.) After the sum of bytes comes the size of application.bin.gz.
Details on other checksums at the checksum page.
Inside the router there is a PCMCIA card that can be used, in itself, as a wireless networking card. It is a ATMEL 11Mbps WIRELESS RFMD REVISION E PCMCIA CARD. The kernal module it uses is called "atmel_cs". The only tricky part about this is that this card needs to have its firmware supplied by the system so you will also need to have the firmware installed. On a Toshiba Satellite P20-8PW running Mandrake 10.0, the standard kernal rpm packages, pcmcia-cs-3.2.5-3mdk, and atmel-firmware-0.7-1mdk make this work without a hitch! If you have managed to get this to work on your system, please add the info here. The Mandrake packages use the driver from http://at76c503a.berlios.de. There is an alternative, open source driver available at http://www.wireless.org.au/~jhecker/atmeldrv/.
$Log: index.html,v $ Revision 1.15 2007/02/04 20:53:56 aardvark Update page to note that I'm no longer working on this project. Revision 1.14 2007/02/04 20:51:33 aardvark Update links to blog to reflect old, archived location. Revision 1.13 2005/12/20 14:51:02 aardvark Version 0.3 available for download. Woohoo! Revision 1.12 2005/12/20 14:48:30 aardvark GPIO on the WRTG54G... Revision 1.11 2005/08/31 02:08:34 aardvark Version 0.1 of the NWR04B Linux firmware is now available. Update the progress report. Revision 1.10 2005/08/27 21:37:16 aardvark Shell working! WOOHOO! Revision 1.9 2005/07/05 21:06:18 aardvark Kernel panic hurrah! Revision 1.8 2005/05/12 02:23:24 aardvark Added anchor for section on wireless card. Revision 1.7 2005/04/08 04:15:36 aardvark More about ME! Revision 1.6 2005/04/08 04:07:08 aardvark *** empty log message *** Revision 1.5 2005/04/08 04:06:12 aardvark Added info on Andrew's method of recovering a dead NWR04B. Revision 1.4 2005/04/06 14:25:05 aardvark Formatting changes; make layout a bit more logical; link to Al Pierce's schematic for the serial port adapter. Revision 1.3 2005/03/30 03:53:07 aardvark *** empty log message ***