 |
|
|
The Netcomm NB5 is an ADSL / ADSL-2/2+ modem/router incorporating unique features such as Quality of Service (QoS) not commonly found in many domestic units. Being a simple single ethernet port, single USB port modem, the NB5 has proven itself to be a rock solid unit built on a rugged embedded linux platform. This linux platform can allow the ability to exploit the hardware to its full potential, by running your own binaries on it. # cat version Linux version 2.4.17_mvl21-malta-mips_fp_le (guest1@localhost) (gcc version 2.95.3 20010315 (release/MontaVista)) #1 Thu Mar 25 18:10:36 CST 2004Under the Hood The Netcomm NB5 is built around the Texas Instrument's TNETD7300 AR7 Router which features a 32-bit RISC MIPS 4KEc V4.8 processor integrated with a DSP based digital transceiver and ADSL front end. Running at 150 BogoMIPS, it incorporates 2MB of Flash, 8 MB of RAM, a single 10/100 ethernet port and USB 1.1 port. The manufacturer builds upon the AR7 ADSL Network Support Package (NSP) as the software base. The 2Mbytes of flash stores the ADAM2 bootloader, MontaVista Linux 2.4.17 kernel and a squash 1.x read-only filesystem. # cat cpuinfo processor : 0 cpu model : MIPS 4KEc V4.8 BogoMIPS : 149.91 wait instruction : no microsecond timers : yes extra interrupt vector : yes hardware watchpoint : yes VCED exceptions : not available VCEI exceptions : not available The unit accepts a telnet or ssh session, spawning a BusyBox v0.61.pre Built-in shell (ash) allowing you to explore the NB5 filesystem and run your own binaries. The proc file system is always a good place to start. . .
BusyBox on Netcomm login: root
Password:
BusyBox v0.61.pre (2004.06.09-03:05+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
# ls
bin etc proc usr var.tar
dev lib sbin var
#
# cd proc
#
# ls
1 37 avalanche fs locks slabinfo
182 4 bus interrupts meminfo stat
2 463 cmdline iomem misc swaps
212 464 cpuinfo ioports modules sys
3 466 devices kcore mounts sysvipc
32 48 dma kmsg mtd ticfg
34 5 driver ksyms net tty
35 6 execdomains led_mod partitions uptime
36 7 filesystems loadavg self version
# cat /proc/avalanche/avsar_modem_stats
AR7 DSL Modem Statistics:
--------------------------------
[DSL Modem Stats]
US Connection Rate: 128 DS Connection Rate: 1536
DS Line Attenuation: 51 DS Margin: 11
US Line Attenuation: 26 US Margin: 31
US Payload : 1248 DS Payload: 624
US Superframe Cnt : 2489 DS Superframe Cnt: 2490
US Transmit Power : 0 DS Transmit Power: 0
LOS errors: 0 SEF errors: 0
Frame mode: 3 Max Frame mode: 0
Trained Path: 0 US Peak Cell Rate: 301
Trained Mode: 2 Selected Mode: 1
ATUC Vendor Code: 4244434D ATUC Revision: 2
Hybrid Selected: 1 Trellis: 1
Showtime Count: 1 DS Max Attainable Bit Rate: 2208
BitSwap: 1 US Max Attainable Bit Rate: n/a
[Upstream (TX) Interleave path]
CRC: 0 FEC: 0 NCD: 1
LCD: 0 HEC: 0
[Downstream (RX) Interleave path]
CRC: 0 FEC: 0 NCD: 0
LCD: 0 HEC: 0
[Upstream (TX) Fast path]
CRC: 1 FEC: 0 NCD: 0
LCD: 0 HEC: 0
[Downstream (RX) Fast path]
CRC: 0 FEC: 0 NCD: 0
LCD: 0 HEC: 0
[ATM Stats]
[Upstream/TX]
Good Cell Cnt: 26
Idle Cell Cnt: 12747
[Downstream/RX)]
Good Cell Cnt: 13
Idle Cell Cnt: 153323
Bad Hec Cell Cnt: 0
Overflow Dropped Cell Cnt: 0
[SAR AAL5 Stats]
Tx PDU's: 6
Rx PDU's: 6
Tx Total Bytes: 302
Rx Total Bytes: 438
Tx Total Error Counts: 0
Rx Total Error Counts: 0
[OAM Stats]
Near End F5 Loop Back Count: 0
Near End F4 Loop Back Count: 0
Far End F5 Loop Back Count: 0
Far End F4 Loop Back Count: 0
Getting Serious : Developing Code for the NB5
After you have had a look around, it’s now a good time to get serious and start compiling some of your own binaries for the NB5. As mentioned the NB5 runs on the MIPS processor, hence a MIPS toolchain or cross compiler is needed. Although you can build your own cross complier & uClibc C libraries, if you’re like me its quicker to download one. With the compiler installed, it’s now time to test it. What better than the traditional Hello World program. We save the following source code as hello.c. #include and now build it : [cpeacock@mars cpeacock]$ mipsel-uclibc-gcc hello.c -o hello hello.c: In function `main': hello.c:5: warning: return type of `main' is not `int' Once the binary is built, we must now get it onto the NB5 filesystem. The NB5 includes a tftp client and wget. My preference is to load the binary to a web server and use wget. You will need to use the writable ramfs mounted at /var. # cd /var # wget http://www.beyondlogic.org/nb5/hello hello 100% |*****************************| 9860 00:00 ETA # chmod 700 hello # ./hello Hello World! If hello world doesn't turn you on, you could try compiling something useful like pppstats.
# wget http://www.beyondlogic.org/nb5/pppstats
pppstats 100% |*****************************| 24716 00:00 ETA
# chmod 700 pppstats
# ./pppstats -c 10
IN PACK VJCOMP VJUNC VJERR | OUT PACK VJCOMP VJUNC NON-VJ
139971257 124187 0 0 0 | 3565109 72378 0 0 72378
74485 61 0 0 0 | 1360 34 0 0 34
67815 57 0 0 0 | 1280 32 0 0 32
67735 55 0 0 0 | 1200 30 0 0 30
102565 82 0 0 0 | 1760 44 0 0 44
100220 80 0 0 0 | 1720 43 0 0 43
68163 58 0 0 0 | 1325 33 0 0 33
67823 57 0 0 0 | 1365 34 0 0 34
79090 64 0 0 0 | 1400 35 0 0 35
114520 91 0 0 0 | 1920 48 0 0 48
Dynamic DNS www.no-ip.com is just one company providing free Dynamic DNS services. You can download the source code for a Linux / BSD / Unix Dynamic Update Client at : http://www.no-ip.com/client/linux/noip-duc-linux.tar.gz (2.1.1) This can be downloaded and re-compiled to execute on the NB5. # cd /var # mkdir noip # cd noip # wget http://www.beyondlogic.org/nb5/noip2 noip2 100% |*****************************| 125 KB 00:00 ETA # chmod 700 noip2 By default this client wants to store its configuration at /usr/local/etc/no-ip2.conf. As this is not a writable area on the NB5 filesystem, we must specify where to put the configuration file (-c /var/noip/noip.conf). # ./noip2 -C -c /var/noip/noip.conf Auto configuration for Linux client of no-ip.com. Multiple network devices have been detected. Please select the Internet interface from this list. By typing the number associated with it. 0 br0 1 ppp0 1 Please enter the login/email string for no-ip.com xxxxx.xxxxxx@beyondlogic.org Please enter the password for user 'xxxxx.xxxxxx@beyondlogic.org' ******* Only one host [xxxxxxxx.no-ip.info] is registered to this account. It will be used. Do you wish to run something at successful update?[N] (y/N) n New configuration file '/var/noip/noip.conf' created. # ./noip2 -M -c /var/noip/noip.conf Modifying the Squash FS Running new applications on the RAM filesystem is great for testing and debugging. However when the router is rebooted, the files are lost. In some cases it may also be handy to modify the start-up script to start some custom daemons at boot. The read-only Squash FS resides in MTD0 and is mounted at boot by the kernel. A ramfs is mounted to /var and provides room to store volatile files. The current read-only file system makes heavy use of symbolic links for files that are required to be writable. These symbolic links point to /var and is initialised by the startup script /etc/rc.d/init.d/rcS by extracting the var.tar tarball found in the root directory. Netcomm provides the original 38.51.2-001 firmware for download from their support site. The file consists of a zip archive that includes a handful of files including the ADAM2 bootloader binary (int_ephy.adam2.AR7RD.bin), the Linux Kernel (ram_zimage_pad.ar7rd.nsp.squashfs.bin) and the squashfs (nsp.annexA.img) among others. Extract the nsp.annexA.img to your linux box and mount the squashFS to give read-only access to the base filesystem used by the NB5, e.g. mkdir /mnt/squash mount -t squashfs nsp.annexA.img /mnt/squash -o loop Then copy this filesystem to writable folder where you can modify the filesystem. e.g mkdir /home/cpeacock/squashrw cd /mnt/squash cp -r * /home/cpeacock/squashrw Now you can modify the filesystem. Please note some writable files are found in var.tar. Once you are finished modifying your filesystem, you need to create a new Squash 1.x filesystem. [root@mars cpeacock]# mksquashfs /home/cpeacock/squashrw squashrw.fs Creating little endian filesystem on squashrw.fs, block size 32768. The web based firmware updater requires any new kernel or filesystem to have a correct checksum appended to the end of the file before it will be accepted as valid firmware. To create the checksum you will need the TI_chksum-0.1orig.tar.gz package released under a GPL. [root@mars TI-chksum-0.1]# ./tichksum ../squashrw.fs File doesn't contain the checksum, adding Calculated checksum is 38B3FF97 Added successfully Once the checksum has been successfully added to your file, it is ready to be updated to your NB5. Please be warned that re-flashing your firmware can break your modem. You must also note that the NB5 filesystem is restricted by the size of the flash. Currently the 2Mbyte flash is partitioned as follows, # cat mtd dev: size erasesize name mtd0: 00160000 00010000 "mtd0" 1447192 (1408kb) SquashFS mtd1: 00080000 00010000 "mtd1" 524288 (512KB) Kernel mtd2: 00010000 00008000 "mtd2" 65536 (64KB) ADAM2 Bootloader/Monitor mtd3: 00010000 00010000 "mtd3" 65536 (64KB) Config.xml (RAW) Currently the kernel appears to occupy the entire 524,288 bytes, and excluding the small amount of room allocated to the configuration and bootloader, the compressed Squash filesystem must fit into 1447192 bytes. The default filesystem shipped from Netcomm currently requires 1433600 bytes leaving a little more that 13kbytes left (compressed) for your own binaries. Therefore if it is intended to modify the filesystem, some existing files must be deleted to make room for any new ones. SquashFS & LZMA CompressionPrior to firmware version 62.51.1, the squash filesystem contained within the NB5 was compressed using the conventional ZLIB library. There has been a shift in recent times to LZMA due to better compression size. There are some claims that LZMA can offer up to 30% better compression over ZLIB, however a 10 to 15% gain is normally achievable on the typical squashFS images found in modems such as the NB5. Recovering from Disaster : ADAM2 Should your NB5 no longer boot, don't despair. The ADAM2 FTP Server can assist in reloading a bootable image. Otherwise if you want to find out at what stage the modem is halting, try using the console port with the ADAM2 Bootloader. Other sources The Texas Instruments AR7, ADAM 2 Bootloader and AR7 ADSL Network Support Package is a common platform for many ADSL routers. The following links are applicable to this platform. |