Posted: Thu Sep 10, 2015 16:06 Post subject: K3.x builds for Netgear WNR3500L
Current K3.x builds do not fit in Linux partition for WNR3500L?!
Someone please correct me if I'm wrong:
1. K3.x Broadcom builds are 7,958,528 bytes as for example dd-wrt.v24-27600_NEWD-2_K3x_mega.bin
2. K3.x builds are provided for WNR3500L as for example dd-wrt.v24-27600_NEWD-2_K3.x_mega-WNR3500L.chk
3. WNR3500L partition goes something like (build 25697 K2.6 mini):
- 0x00000000 - 0x00040000. CFE
- 0x00040000 - 0x007b0000. Linux
- 0x007b0000 - 0x007f0000. board_data
- 0x007f0000 - 0x00800000. NVRAM
4. WNR3500L has 770000 (7,798,784 bytes) space available for firmware flash according to the partition structure.
So it's too big by only 156 KB!!
I almost want to cry ... lol.
I don't understand why the board_data partition is so big. Netgear (at least for this model) sets it at only 64 KB (vs. dd-wrt has it at 256KB with first 192KB is empty). Maybe it's so that a generic netgear build can accommodate multiple possible locations of the board_data.
So it won't flash with too-big error. If I force it to flash in serial console, it works (spills over into the empty part of the board_data partition?) and runs, but then the first time I reboot it fails chksum (I imagine it's computing chksum just up to the end of the Linux partition?, which of course would be wrong).
Questions:
1. Is it possible to persuade a developer to fix this size problem?
2. Is there a workaround someone could help me with (change Linux and board_data partition sizes OR fake the image chksum to match what it will calculate for just the Linux partition)?
Thanks in advance. Cheers!
Oh by the way, build 125697 K2.6 mini also reports "Flash to OEM for board U12H136T99_NETGEAR not supported yet" ...
Posted: Fri Sep 11, 2015 15:03 Post subject: K3.x builds for Netgear WNR3500L
Anybody?? ...
Isn't it odd that model specific .chk files would be generated for a model that the firmware won't fit on?
If nobody has an answer, can someone at least tell me how to get the devs' attention? (e.g., official place to report a bug/issue, name of a person here who wouldn't be bothered by receiving a PM, etc?)
Continuing to try to resolve myself ... it looks like faking the chksum is not really an option. It appears that the CFE consistently looks at address 0x0078fffc for the image chksum regardless of which firmware I install. That's 0x0074fffc in the firmware, which of course is not empty.
Options now appear to be to use Mod Kit to fix the size myself, but I don't have a Linux box. Maybe I should make one, but don't really want to do that just for this router.
Or maybe a custom CFE ... anyone have a different bootloader that they like for this model?
If you own a Netgear WNR3500L v1 and you want or need 64KB NVRAM, then I want to hear from you!! The K3.x builds come with increased NVRAM size, but boy I've had a heck of a time finding K3.x builds that fits our flash. Build 21605 is the only K3.x release that I've been able to find that fits w/o firmware modification; that after having searched back over three years And note, this build 21605 is NOT in the ftp area!! Or if it is, I don't know how to find it in there. Rather I happened to stumble across it here: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=171853 So far as I can tell, flash size cannot exceed 7,798,784 bytes.
If you have found some other K3.x build that fits, or if you can make your own that fits, then obviously you don't have to try to use this build 21605. If you have any luck with the former, please let me know. Lol
Unfortunately, clean install of this 21605 build results in broken wifi as documented in the thread linked above around page 13 to page 15. The first time I flashed this, I must have gotten lucky, because apparently not really knowing what I was doing, I failed to do a hard reset (twice!) -- with the end result however being working wifi. I didn't even know at the time that this build had wifi issues with WNR3500L, so truly dumb luck in every sense of the phrase, lol.
I've re-traced my steps tho, and here it is for anyone else who might be in a similar boat. It relies on build 22200M K2.4 (Kong Mod) to somehow retain required board parameters in I guess the right place for this 21605 build to find the wifi device when it otherwise wouldn't or shouldn't. Some other intermediate build could probably work, but this is the one I used. By the way, that 22200M Kong Mod build was absolutely awesome the few weeks I ran it!!
Started with clean install from missing kernel TFTP wait to build 27600 K2.6 mini. Then hard-reset, web-gui install build 22200M K2.6 (maybe could have started with this build, but I started with the mini build just to be safe). Now dirty-install (no hard-reset, no nvram erase, etc) this build 21605 via web-gui, file=dd-wrt.v24-21605_NEWD-2_K3.x_mega_a.bin. It was posted twice in that thread above; I flashed the first one. In internet explorer the web page almost immediately errors out, and the power light on the router starts flashing green - orange - orange - orange --- green - orange - orange - orange, etc. as it usually does when it is programming the flash chip. But if you wait long enough (an unusually long time)it will eventually turn solid green and you will still be on build 22200M! So this is the important part ... after the webpage kicked me out, I went right back into the web-gui and initiate another dirty upgrade; and this time it works, and voila, I'm on build 21605 AND my wifi is working!!
All other attempts at clean install of build 21605 flash resulted in broken wifi for me.
Oh, and why go to all this trouble? Well I use openVPN which stores a lot of data in NVRAM and I also have a lot of other stuff going on that runs my NVRAM right on up to 32KB, about 31.5KB to be exact even when just first setting it up. So I REALLY feel like I need 64KB NVRAM, which of course the K3.x builds have.
I hope this helps someone!!
In the meantime I'm hoping that the devs will get us some slightly smaller builds that fit. And I'm also messing around with a fairly advanced work-around for getting the newer builds (7,958,528 bytes) to flash and survive 1st reboot. More to follow when I have time in a week or two.
Joined: 29 Aug 2015 Posts: 10 Location: Research Triangle Area, North Carolina USA
Posted: Fri Oct 23, 2015 4:39 Post subject:
Quote:
Anybody have any help, status, or suggestions?
I have both WNR3500L and WNR3500Lv2 models, and I have experienced the same issues as you with exceeding nvram size on the WNR3500L.
If you're open to suggestions for working with existing builds, the best one I can make is really quite simple: Remove all of your OpenVPN certs and keys from the webif and put them on a USB stick. You can automount 2 partitions in Kong builds and 1 in BS builds, so it's quite painless to setup. You don't even need to use a Linux filesystem (FAT32 or NTFS is fine), but you do need to make sure your files are saved in "Unix" format (no extra LF at the ends of lines). In your OpenVPN Configuration (which you will keep in the webif and nvram), tell OpenVPN where to find those files.
For example, I'm using Kong build 22000++ (6/7/14) and all of the fields for keys/certs are empty. I have a USB stick automounted on /opt, and I have a directory under that called /openvpn. Now, in the Additional Config field on the webif, I have these lines (among others):
My nvram size (used space) is a little over 29,000 bytes of the 32k total.
Hope this helps and good luck to you. BTW, you do understand that there are *no* WNR3500L models with 64 kbytes of nvram? I have observed that BS has a wry sense of humor; you may have misinterpreted something he wrote. AFAIK, only the WNR3500Lv2 has 64 kbytes of nvram.
If you're open to suggestions for working with existing builds, ...
That's a very interesting suggestion, thanks! I may actually do that with one of my routers that is physically in another state where I can't get my hands on it.
drfranco wrote:
BTW, you do understand that there are *no* WNR3500L models with 64 kbytes of nvram? I have observed that BS has a wry sense of humor; you may have misinterpreted something he wrote. AFAIK, only the WNR3500Lv2 has 64 kbytes of nvram.
As far as I can tell, the NVRAM size is set by the firmware - and the K3.x firmware sets up a 64k nvram. When I JTAG the unit, I can clearly see that there are 2 or 3 each 64KB blocks that are in the right location for netgear board data and nvram (note the board data is very small) But as a test, I'll write some stuff to NVRAM taking it over 32KB on this K3.x setup and then back it up and see if the backup is as big as it's supposed to be (greater than 32KB).
Joined: 29 Aug 2015 Posts: 10 Location: Research Triangle Area, North Carolina USA
Posted: Sat Oct 24, 2015 2:04 Post subject:
rmedure wrote:
I just added about 20KB+ of custom script stuff, and the status screen reports 50KB+ nvram size used ... and the backup is 56KB as well.
Hmmm... interesting. What do you get from the "nvram show | grep left" commmand in a Telnet or SSH session? Whatever the two numbers are on the last line of output (and you might get only 1), add them together and that's your nvram size. Do not rely upon the webif to give you a correct reading of this. The Kong build I use incorrectly reports the size of the nvram as 64kbytes.
There is (and should be) a factory reset or default image for the nvram built into the firmware image, but once it is copied to the nvram itself (which lives, I think, inside the Broadcom VLSI chips, because I've never seen a discrete nvram chip on images of the WNR3500L/Lv2 boards), subsequent changes are made to nvram (in the VLSI chip), not to the image burned into the firmware. Being an old hardware guy, this is what I would expect, anyway.
You are suggesting that there is now some newfangled way of writing over an arbitrary block of the flash, and that this is where what is called the "nvram" now permanently resides. Could be, but then if the block you note in flash is rewritable for use as "nvram", then I want to know where the factory reset image lives.
Last edited by drfranco on Sat Oct 24, 2015 2:54; edited 1 time in total
I think there are actually 2 partitions commonly called nvram as far as I can tell.
1. The factory NVRAM resides at 0x00000000 - 0x00040000 (that's 4 ea 64KB blocks) It contains serial number, mac addresses, security pin, board data and some other stuff. If I recall correctly it's really mostly empty. And I expect that the firmware never writes to this location.
2. The firmware's NVRAM partition which is written to by the firmware (see below) can be varied in size and location depending on how the firmware defines it.
The factory reset image you mention - I believe you're referring to the CFE. This contains the tftp server and other boot loader stuff. And I expect the firmware never writes to this location as either.
You can get your firmware partition layout with:
# cat /proc/mtd
Mine currently looks like this (note, it doesn't list the factory NVRAM, so maybe it's not even mounted):
dev: size erasesize name
mtd0: 00040000 00010000 "cfe"
mtd1: 00770000 00010000 "linux"
mtd2: 00586800 00010000 "rootfs"
mtd3: 00010000 00010000 "nvram"
mtd4: 00010000 00010000 "ddwrt"
mtd5: 00040000 00010000 "board_data"
# nvram show | grep left
size: 32635 bytes (32901 left)
I was under the impression that those Kong builds reported the wrong size because they are not K3.x builds? I don't know, I took it for granted that it was reported wrong since Kong said so himself but maybe it's not? I never checked it.
Joined: 29 Aug 2015 Posts: 10 Location: Research Triangle Area, North Carolina USA
Posted: Sat Oct 24, 2015 3:10 Post subject:
Very interesting. I'm going to hunt up a copy of the specs for that flash ROM. And I took another look at some of the pictures of WNR3500 boards on the web, and I don't see a lithium backup battery of the sort that would typically be used to assure a continuous supply of power to "real" nvram. I suppose there could be a hold-up cap in there instead.
And you are certain you are using a WNR3500L or U or v2 and *not* a WNR3500Lv2? You don't have 128 MB of DRAM, do you?