Trendnet TEW-652BRP, Atheros AR9130, DLink DIR-615 C1

Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware
Goto page Previous  1, 2, 3, ... 24, 25, 26  Next
Author Message
Crimson_Fox
DD-WRT Novice


Joined: 06 Dec 2008
Posts: 8

PostPosted: Sun Dec 07, 2008 0:00    Post subject: Reply with quote
RoundSparrow, I am also trying to get dd-wrt loaded on this unit. I was able to get telnet to work with it using the firmware at http://www.bitsum.com/tew632brp.php

I used the same trick that works with the DIR-615 firmware: I used a hex editor to change the hardware ID at the end of the file from "AP81-AR9130-RT-070614-00" to "AP81-AR9130-RT-080609-05".

I'm able to telnet into the unit now, but I'm not sure how to proceed. My guess would be to use wget to get the image on the router and then use dd to load it on. I'm not sure which device in /dev I'm supposed to write the image to however. Any thoughts?
Sponsor
RoundSparrow
DD-WRT User


Joined: 28 Nov 2008
Posts: 112

PostPosted: Sun Dec 07, 2008 3:18    Post subject: Reply with quote
Crimson_Fox wrote:
RoundSparrow, I am also trying to get dd-wrt loaded on this unit. I was able to get telnet to work with it using the firmware at http://www.bitsum.com/tew632brp.php

I used the same trick that works with the DIR-615 firmware: I used a hex editor to change the hardware ID at the end of the file from "AP81-AR9130-RT-070614-00" to "AP81-AR9130-RT-080609-05".

I'm able to telnet into the unit now, but I'm not sure how to proceed.


First off, good job, I was considering trying that but wanted to see what others thought.

As for your ideas on what to do next... no, you don't use dd to flash. You use special flash writing software. But we have already figured out how to flash whatever we want on the router (as you have just done).

You have a choice - now with telnet access to the router, we can do things the webpages do not support from the command line. We can also load additional applications onto the native Linux environment assuming they are compiled correctly. But this is still working within the native DLink/Trendnet firmware environment.

We can also use the telnet root to fully identify all the hardware drivers, etc.

I think we have accomplished the first phase of mastering what it takes to get into these routers as root - and how to flash them. Next steps as I see it:

1. Is there any existing dd-wrt router that is similar to these on hardware level that use u-boot, etc. Does an existing dd-wrt firmware already work on these routers or just a minor change?

2. If no exiting dd-wrt image will work... we have now identified several routers that are all pretty similar. This makes additional development work on dd-wrt worth some effort - especially since these routers are pretty capable with 4MB FLASH and 32MB of RAM. Is it time to have someone donate one of these to the right dd-wrt developer and see if they can build a new compatible dd-wrt?
Crimson_Fox
DD-WRT Novice


Joined: 06 Dec 2008
Posts: 8

PostPosted: Sun Dec 07, 2008 6:12    Post subject: Reply with quote
I agree that it's a great router for dd-wrt, I got it because it was a cheap N capable router. However, I was under the impression that it was already supported: http://www.dd-wrt.com/wiki/index.php/Supported_Devices#TRENDnet

Is this not the case? According to the notes it's supposed to be the same hardware as a Sitecom WL-111 and SparkLAN WX-6615GT, but it seems to me it has more in common with a DLink DIR-615 as the firmware is interchangeable between the two devices. Is the list wrong or am I missing something?

Edit: This might be handy, has specs listed for this router: http://wiki.x-wrt.org/index.php/Trendnet_TEW-632BRP

Edit: Looks like it's a typo on the Supported Devices page, what's actually supported is a TEW-411BRP.
RoundSparrow
DD-WRT User


Joined: 28 Nov 2008
Posts: 112

PostPosted: Sun Dec 07, 2008 17:20    Post subject: Reply with quote
Crimson_Fox wrote:
I agree that it's a great router for dd-wrt, I got it because it was a cheap N capable router. However, I was under the impression that it was already supported: http://www.dd-wrt.com/wiki/index.php/Supported_Devices#TRENDnet

Edit: Looks like it's a typo on the Supported Devices page, what's actually supported is a TEW-411BRP.


I don't believe it is supported; that Wiki page needs fixed. As it mentions Broadcom, I think we have pretty well established this as Atheros.

Someone want to edit the Wiki?
Crimson_Fox
DD-WRT Novice


Joined: 06 Dec 2008
Posts: 8

PostPosted: Sun Dec 07, 2008 19:44    Post subject: Reply with quote
While the Wiki is being updated, might as well add that it's the same hardware as a D-Link DIR-615_C http://www.dd-wrt.com/phpBB2/viewtopic.php?p=236990

Currently the router is WIP at OpenWRT. If they come up a port I'm sure the same flashing method could be used for DD-WRT.

As it stands I'm going to run the DIR-615 firmware, it has a lot more features accessible from the web interface than the stock firmware from TRENDnet. If I need to add anything else I can always play around with the Firmware Modification Kit.
RoundSparrow
DD-WRT User


Joined: 28 Nov 2008
Posts: 112

PostPosted: Tue Dec 09, 2008 23:08    Post subject: Reply with quote
I setup a serial port. I used the second serial on a WRT54GL and minicom under OpenWRT as I didn't have a 3.3 volt TTL converter handy Wink Worked like a champ.

Sock firmware boot:

Code:

U-Boot 1.1.4 (Feb 22 2008 - 18:38:53)

AP81 (ar7100) U-boot
DRAM:
sri
32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 176k for U-Boot at: 81fd0000
Reserving 192k for malloc() at: 81fa0000
Reserving 44 Bytes for Board Info at: 81f9ffd4
Reserving 36 Bytes for Global Data at: 81f9ffb0
Reserving 128k for boot params() at: 81f7ffb0
Stack Pointer at: 81f7ff98
Now running in RAM - U-Boot at: 81fd0000
id read 0x10000107
flash size 4MB, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
eth0: 00:14:d1:5b:36:29
eth0 up
eth0
## Booting image at bf030000 ...
   Image Name:   Linux Kernel Image
   Created:      2008-07-11  15:49:11 UTC
   Image Type:   MIPS Linux Kernel Image (lzma  compressed)
   Data Size:    847187 Bytes = 827.3 kB
   Load Address: 80060000
   Entry Point:  802ab000
   Verifying Checksum ... OK
   LZMA Umcompressing Kernel Image ...  Image loaded from 80060000-802cc085
 OK
No initrd
## Transferring control to Linux (at address 802ab000) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

Linux version 2.6.15--LSDK-7.1.2.27 (root@localhost.localdomain) (gcc version 3.4.4) #639 Fri Jul 11 16:55:8
setup_arch:

cpu_probe:
PRID_COMP_MIPS CPU
prom_init:flash_size passed from bootloader = 4M
arg 1: console=ttyS0,115200
arg 2: root=31:03
arg 3: rootfstype=squashfs,jffs2
arg 4: init=/sbin/init
arg 5: mtdparts=ar7100-nor0:128k(u-boot),64k(Config),1024k(vmlinux),2752k(rootfs),128k(ART)
cpu_report:CPU revision is: 00019374
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
setup_arch: end

Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=31:03 rootfstype=squashfs,jffs2 init=/sbin/init mtdparts=ar7
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 256 (order: 8, 4096 bytes)
Using 200.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 29120k/32768k available (1951k kernel code, 3632k reserved, 392k data, 136k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
calling simple_config callback..
SCSI subsystem initialized
TC classifier action (bugs to netdev@vger.kernel.org cc hadi@cyberus.ca)
AR7100 GPIOC major 0
squashfs: version 3.1 (2006/08/19) Phillip Lougher
Initializing Cryptographic API
io scheduler noop registered
io scheduler deadline registered
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
RAMDISK driver initialized: 1 RAM disks of 8192K size 1024 blocksize
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.7.12
5 cmdlinepart partitions found on MTD device ar7100-nor0
Creating 5 MTD partitions on "ar7100-nor0":
0x00000000-0x00020000 : "u-boot"
0x00020000-0x00030000 : "Config"
0x00030000-0x00130000 : "vmlinux"
0x00130000-0x003e0000 : "rootfs"
0x003e0000-0x00400000 : "ART"
GACT probability on
Mirror/redirect action on
Simple TC action Loaded
netem: version 1.1
u32 classifier
    Perfomance counters on
    input device check on
    Actions configured
NET: Registered protocol family 2
IP route cache hash table entries: 512 (order: -1, 2048 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
ip_conntrack version 2.4 (256 buckets, 2048 max) - 232 bytes per conntrack
ip_conntrack_pptp version 3.1 loaded
ip_nat_pptp version 3.0 loaded
ip_tables: (C) 2000-2002 Netfilter core team
ipt_time loading
ipt_recent v0.3.1: Stephen Frost <sfrost@snowman.net>.  http://snowman.net/projects/ipt_recent/
ClusterIP Version 0.8 loaded successfully
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ar7100wdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 136k freed
init started:  BusyBox v1.01 (2008.07.11-08:56+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5

Please press Enter to activate this console. insmod /lib/modules/2.6.15/net/ag7100_mod.ko wan_speed=auto
ag7100_mod: module license 'unspecified' taints kernel.
AG7100: Length per segment 1536
ifconfig eth0 down
ifconfig eth0 hw ether 0014d15b3629
ifconfig eth0 up
Writing 4
eth0: Cannot assign requested address
ifconfig eth1 down
ifconfig eth1 hw ether 0014d15b362a
ifconfig eth1 up
ATHRS26: resetting s26
ATHRS26: s26 reset done
Writing 6
eth1: Cannot assign requested address
brctl addbr br0
brctl stp br0 off
brctl setfd br0 0
brctl addif br0 eth0
device eth0 entered promiscuous mode
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
ImgCheckSum=670f150
hostname "TEW-652BRP"
date -s  071116562008
Fri Jul 11 16:56:00 UTC 2008
syslogd -s 20 -b 0 &
insmod /lib/modules/2.6.15/net/gpio_mod.ko
Entry gpio_ioctl init_module !!
sh: dcc: not found
lld2d br0 &
rc is BUSY now!
eth1: Cannot assign requested address
/var/sbin/wantimer &
udhcpc -w dhcpc -i eth1 -H "TEW-652BRP"  -s /usr/share/udhcpc/default.bound-dns  &
ifconfig eth1 mtu 1500
DHCP client start.
eth0: Cannot assign requested address
tftpd &
eth1      Link encap:Ethernet  HWaddr 00:14:D1:5B:36:2A
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

TFTP main
standard_tftp_server launched on port 69.
miniupnpd &
deleting routers
route: SIOC[ADD|DEL]RT: No such process
ifconfig eth1 0.0.0.0
Sending discover...
dnsmasq -i br0 &
date -s  071116562008
Fri Jul 11 16:56:00 UTC 2008
igmpproxy &
ERRO: There must be at least 2 Vif's where one is upstream.
ifconfig eth1 0.0.0.0
wantimer: dhcpc_release (VCT_DISCONNECT)
Sending discover...
DHCPC Received SIGUSR2=>DHCPC Release
Performing a DHCPC release
Entering released state
wan_ipaddr == NULL, firewall don't start
Start Firewall: Clear iptables
rc is IDLE now!
RoundSparrow
DD-WRT User


Joined: 28 Nov 2008
Posts: 112

PostPosted: Tue Dec 09, 2008 23:30    Post subject: Reply with quote
So far, I haven't found any way to stop at the u-boot prompt with the factory firmware. It just blazes on past into booting the kernel.
Crimson_Fox
DD-WRT Novice


Joined: 06 Dec 2008
Posts: 8

PostPosted: Wed Dec 10, 2008 8:31    Post subject: Reply with quote
Very nice! According to this:

http://wiki.x-wrt.org/index.php/Trendnet_TEW-632BRP#Recovery_mode_-_UBoot_httpd

Holding down the reset button while applying power will run Uboot over a web interface. Is this what you're looking for?
RoundSparrow
DD-WRT User


Joined: 28 Nov 2008
Posts: 112

PostPosted: Thu Dec 11, 2008 2:13    Post subject: Reply with quote
Crimson_Fox wrote:
Very nice! According to this:

http://wiki.x-wrt.org/index.php/Trendnet_TEW-632BRP#Recovery_mode_-_UBoot_httpd

Holding down the reset button while applying power will run Uboot over a web interface. Is this what you're looking for?


No, it is not. I do not get the u-boot command prompt from serial. I do however get the httpd recovery website on 192.168.0.1 port 8.

Here is the serial output when booting in recovery mode:

Code:

U-Boot 1.1.4 (Feb 22 2008 - 18:38:53)

AP81 (ar7100) U-boot
DRAM:
sri
32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 176k for U-Boot at: 81fd0000
Reserving 192k for malloc() at: 81fa0000
Reserving 44 Bytes for Board Info at: 81f9ffd4
Reserving 36 Bytes for Global Data at: 81f9ffb0
Reserving 128k for boot params() at: 81f7ffb0
Stack Pointer at: 81f7ff98
Now running in RAM - U-Boot at: 81fd0000
id read 0x10000107
flash size 4MB, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
eth0: 00:14:d1:5b:36:29
eth0 up
eth0
httpd init

hostaddr = 0xc0a8   1


I'm going to say the only way we can probably get to u-boot command prompt is to rewrite the contents of the u-boot configuration partition. something nobody has taken on yet Wink
bkmartin
DD-WRT Novice


Joined: 05 Dec 2008
Posts: 15

PostPosted: Thu Dec 11, 2008 2:47    Post subject: Reply with quote
why do you need a u-boot command line if you can put down a new linux kernel and rootfs?
RoundSparrow
DD-WRT User


Joined: 28 Nov 2008
Posts: 112

PostPosted: Thu Dec 11, 2008 16:18    Post subject: Reply with quote
bkmartin wrote:
why do you need a u-boot command line if you can put down a new linux kernel and rootfs?


Howdy. Just so I'm clear... are you sure we _can_ put a new Linux kernel and rootfs? I'm assuming there are four ways we could flash:

1) Use the standard webpage method of updating firmware and make sure the binary is in a format the webpage expects.

2) Use telnet root and dd to the mtd partitions.

3) Use the recovery website flash mode, making sure the binary is in a format this flash will take

4) revise contents of the u-boot configuration partition so that u-boot pauses and allows you to gain control before loading the kernel and rootfs. It is then possible to flash from u-boot.

====================

The concern I have is what if you brick the router. If you load the proposed dd-wrt firmware via method #1 or #2, you could brick the router. Nobody has confirmed (tested) that #3 works if kernel and rootfs are trashed.

The main thing I saw as a benefit of getting u-boot command prompt: you could use u-boot's tftpboot to test out dd-wrt builds with no risk of bricking the router, as it does not write to flash at all.

Or is there an existing firmware for dd-wrt that looks compatible with this device and I'm over-concerned?[/b]
bkmartin
DD-WRT Novice


Joined: 05 Dec 2008
Posts: 15

PostPosted: Thu Dec 11, 2008 20:40    Post subject: Reply with quote
I certainly don't know for sure that it can be done, but I thought we could flash via method (1) (building a custom firmware.bin in the correct format) and if that firmware is not bootable, you could get back to a working state via the recovery mode (3).

This assumes the recovery mode httpd code is stored inside the u-boot partition (or maybe the ART partition) and is not modified by flashing in (1).

Also, I assume someone with a JTAG cable could program the flash directly to unbrick the router if required.
Crimson_Fox
DD-WRT Novice


Joined: 06 Dec 2008
Posts: 8

PostPosted: Thu Dec 11, 2008 21:08    Post subject: Reply with quote
I can confirm that it can be done. That is exactly the method I used to recover after I flashed mine with a bad firmware file using the web interface.

As long as a build that will work with the router can be made, getting it on there shouldn't be a problem.
bbcardwiz
DD-WRT Novice


Joined: 12 Dec 2008
Posts: 3

PostPosted: Fri Dec 12, 2008 4:57    Post subject: help! Reply with quote
Sorry to be dense here guys but I've got a 652 and I've read the whole thread. Most of it is over my head to be honest, but my goal, for now, until dd-wrt is ready for the 652, assuming it ever will, is to put the D-Link 615 FW on it.

I tried the power on/reset trick and I cannot access anything. What am I doing wrong? Can someone put a series of steps together for a newbie to load the D-Link Firmware on it?

Thanks.
Crimson_Fox
DD-WRT Novice


Joined: 06 Dec 2008
Posts: 8

PostPosted: Fri Dec 12, 2008 8:17    Post subject: Reply with quote
Try setting your IP to 192.168.0.2 and pointing your browser to 192.168.0.1

Any luck?
Goto page Previous  1, 2, 3, ... 24, 25, 26  Next Display posts from previous:    Page 2 of 26
Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum