Beyond Logic

Exploring the Netcomm NB5 - ADSL / ADSL-2/2+ Modem Router

    The Netcomm NB5 is an ADSL / ADSL-2/2+ modem/router incorporating unique features such as Quality of Service (QoS) not commonly found in many domestic units. Being a simple single ethernet port, single USB port modem, the NB5 has proven itself to be a rock solid unit built on a rugged embedded linux platform. This linux platform can allow the ability to exploit the hardware to its full potential, by running your own binaries on it.

      # cat version
      Linux version 2.4.17_mvl21-malta-mips_fp_le (guest1@localhost) (gcc version 2.95.3 
      20010315 (release/MontaVista)) #1 Thu Mar 25 18:10:36 CST 2004
    Under the Hood

    The Netcomm NB5 is built around the Texas Instrument's TNETD7300 AR7 Router which features a 32-bit RISC MIPS 4KEc V4.8 processor integrated with a DSP based digital transceiver and ADSL front end. Running at 150 BogoMIPS, it incorporates 2MB of Flash, 8 MB of RAM, a single 10/100 ethernet port and USB 1.1 port. The manufacturer builds upon the AR7 ADSL Network Support Package (NSP) as the software base. The 2Mbytes of flash stores the ADAM2 bootloader, MontaVista Linux 2.4.17 kernel and a squash 1.x read-only filesystem.

      # cat cpuinfo
      processor               : 0
      cpu model               : MIPS 4KEc V4.8
      BogoMIPS                : 149.91
      wait instruction        : no
      microsecond timers      : yes
      extra interrupt vector  : yes
      hardware watchpoint     : yes
      VCED exceptions         : not available
      VCEI exceptions         : not available

    The unit accepts a telnet or ssh session, spawning a BusyBox v0.61.pre Built-in shell (ash) allowing you to explore the NB5 filesystem and run your own binaries. The proc file system is always a good place to start. . .

      BusyBox on Netcomm login: root
      BusyBox v0.61.pre (2004.06.09-03:05+0000) Built-in shell (ash)
      Enter 'help' for a list of built-in commands.
      # ls
      bin      etc      proc     usr      var.tar
      dev      lib      sbin     var
      # cd proc
      # ls
      1            37           avalanche    fs           locks        slabinfo
      182          4            bus          interrupts   meminfo      stat
      2            463          cmdline      iomem        misc         swaps
      212          464          cpuinfo      ioports      modules      sys
      3            466          devices      kcore        mounts       sysvipc
      32           48           dma          kmsg         mtd          ticfg
      34           5            driver       ksyms        net          tty
      35           6            execdomains  led_mod      partitions   uptime
      36           7            filesystems  loadavg      self         version
      # cat /proc/avalanche/avsar_modem_stats
      AR7 DSL Modem Statistics:
      [DSL Modem Stats]
              US Connection Rate:     128     DS Connection Rate:     1536
              DS Line Attenuation:    51      DS Margin:              11
              US Line Attenuation:    26      US Margin:              31
              US Payload :            1248    DS Payload:             624
              US Superframe Cnt :     2489    DS Superframe Cnt:      2490
              US Transmit Power :     0       DS Transmit Power:      0
              LOS errors:             0       SEF errors:             0
              Frame mode:             3       Max Frame mode:         0
              Trained Path:           0       US Peak Cell Rate:      301
              Trained Mode:           2       Selected Mode:          1
              ATUC Vendor Code:       4244434D        ATUC Revision:  2
              Hybrid Selected:        1       Trellis:                1
              Showtime Count:         1       DS Max Attainable Bit Rate:     2208
              BitSwap:                1       US Max Attainable Bit Rate:     n/a
              [Upstream (TX) Interleave path]
              CRC:    0       FEC:    0       NCD:    1
              LCD:    0       HEC:    0
              [Downstream (RX) Interleave path]
              CRC:    0       FEC:    0       NCD:    0
              LCD:    0       HEC:    0
              [Upstream (TX) Fast path]
              CRC:    1       FEC:    0       NCD:    0
              LCD:    0       HEC:    0
              [Downstream (RX) Fast path]
              CRC:    0       FEC:    0       NCD:    0
              LCD:    0       HEC:    0
      [ATM Stats]
              Good Cell Cnt:  26
              Idle Cell Cnt:  12747
              Good Cell Cnt:  13
              Idle Cell Cnt:  153323
              Bad Hec Cell Cnt:       0
              Overflow Dropped Cell Cnt:      0
      [SAR AAL5 Stats]
              Tx PDU's:       6
              Rx PDU's:       6
              Tx Total Bytes: 302
              Rx Total Bytes: 438
              Tx Total Error Counts:  0
              Rx Total Error Counts:  0
      [OAM Stats]
              Near End F5 Loop Back Count:    0
              Near End F4 Loop Back Count:    0
              Far End F5 Loop Back Count:     0
              Far End F4 Loop Back Count:     0
    Getting Serious : Developing Code for the NB5

    After you have had a look around, itís now a good time to get serious and start compiling some of your own binaries for the NB5. As mentioned the NB5 runs on the MIPS processor, hence a MIPS toolchain or cross compiler is needed. Although you can build your own cross complier & uClibc C libraries, if youíre like me its quicker to download one.

    With the compiler installed, itís now time to test it. What better than the traditional Hello World program. We save the following source code as hello.c.

      void main(void)
      	printf("Hello World!\n");

    and now build it :

      [cpeacock@mars cpeacock]$ mipsel-uclibc-gcc hello.c -o hello
      hello.c: In function `main':
      hello.c:5: warning: return type of `main' is not `int'

    Once the binary is built, we must now get it onto the NB5 filesystem. The NB5 includes a tftp client and wget. My preference is to load the binary to a web server and use wget. You will need to use the writable ramfs mounted at /var.

      # cd /var
      # wget
      hello                100% |*****************************|  9860       00:00 ETA
      # chmod 700 hello
      # ./hello
      Hello World!

    If hello world doesn't turn you on, you could try compiling something useful like pppstats.

      # wget
      pppstats             100% |*****************************| 24716       00:00 ETA
      # chmod 700 pppstats
      # ./pppstats -c 10
      139971257 124187      0      0      0  |  3565109  72378      0      0  72378
         74485     61      0      0      0  |     1360     34      0      0     34
         67815     57      0      0      0  |     1280     32      0      0     32
         67735     55      0      0      0  |     1200     30      0      0     30
        102565     82      0      0      0  |     1760     44      0      0     44
        100220     80      0      0      0  |     1720     43      0      0     43
         68163     58      0      0      0  |     1325     33      0      0     33
         67823     57      0      0      0  |     1365     34      0      0     34
         79090     64      0      0      0  |     1400     35      0      0     35
        114520     91      0      0      0  |     1920     48      0      0     48

    Dynamic DNS is just one company providing free Dynamic DNS services. You can download the source code for a Linux / BSD / Unix Dynamic Update Client at : (2.1.1) This can be downloaded and re-compiled to execute on the NB5.

      # cd /var
      # mkdir noip
      # cd noip
      # wget
      noip2                100% |*****************************|   125 KB    00:00 ETA
      # chmod 700 noip2

    By default this client wants to store its configuration at /usr/local/etc/no-ip2.conf. As this is not a writable area on the NB5 filesystem, we must specify where to put the configuration file (-c /var/noip/noip.conf).

      # ./noip2 -C -c /var/noip/noip.conf
      Auto configuration for Linux client of
      Multiple network devices have been detected.
      Please select the Internet interface from this list.
      By typing the number associated with it.
      0       br0
      1       ppp0
      Please enter the login/email string for
      Please enter the password for user ''  *******
      Only one host [] is registered to this account.
      It will be used.
      Do you wish to run something at successful update?[N] (y/N)  n
      New configuration file '/var/noip/noip.conf' created.

    There appears to be a bug with noip running on the NB5. It erroneously reports another instance is running. I use the -M switch to get around this for the time being.

      # ./noip2 -M -c /var/noip/noip.conf

    Modifying the Squash FS

    Running new applications on the RAM filesystem is great for testing and debugging. However when the router is rebooted, the files are lost. In some cases it may also be handy to modify the start-up script to start some custom daemons at boot.

    The read-only Squash FS resides in MTD0 and is mounted at boot by the kernel. A ramfs is mounted to /var and provides room to store volatile files. The current read-only file system makes heavy use of symbolic links for files that are required to be writable. These symbolic links point to /var and is initialised by the startup script /etc/rc.d/init.d/rcS by extracting the var.tar tarball found in the root directory.

    Netcomm provides the original 38.51.2-001 firmware for download from their support site. The file consists of a zip archive that includes a handful of files including the ADAM2 bootloader binary (int_ephy.adam2.AR7RD.bin), the Linux Kernel (ram_zimage_pad.ar7rd.nsp.squashfs.bin) and the squashfs (nsp.annexA.img) among others.

    Extract the nsp.annexA.img to your linux box and mount the squashFS to give read-only access to the base filesystem used by the NB5, e.g.

      mkdir /mnt/squash
      mount -t squashfs nsp.annexA.img /mnt/squash -o loop

    Then copy this filesystem to writable folder where you can modify the filesystem. e.g

      mkdir /home/cpeacock/squashrw
      cd /mnt/squash
      cp -r * /home/cpeacock/squashrw

    Now you can modify the filesystem. Please note some writable files are found in var.tar. Once you are finished modifying your filesystem, you need to create a new Squash 1.x filesystem.

      [root@mars cpeacock]# mksquashfs /home/cpeacock/squashrw squashrw.fs
      Creating little endian filesystem on squashrw.fs, block size 32768.

    The web based firmware updater requires any new kernel or filesystem to have a correct checksum appended to the end of the file before it will be accepted as valid firmware.

    To create the checksum you will need the TI_chksum-0.1orig.tar.gz package released under a GPL.

      [root@mars TI-chksum-0.1]# ./tichksum ../squashrw.fs
      File doesn't contain the checksum, adding
      Calculated checksum is 38B3FF97
      Added successfully

    Once the checksum has been successfully added to your file, it is ready to be updated to your NB5. Please be warned that re-flashing your firmware can break your modem. You must also note that the NB5 filesystem is restricted by the size of the flash. Currently the 2Mbyte flash is partitioned as follows,

      # cat mtd
      dev:    size   erasesize  name
      mtd0: 00160000 00010000 "mtd0"	1447192 (1408kb)  SquashFS
      mtd1: 00080000 00010000 "mtd1"	524288 (512KB)  Kernel
      mtd2: 00010000 00008000 "mtd2"	65536 (64KB) ADAM2 Bootloader/Monitor
      mtd3: 00010000 00010000 "mtd3"	65536 (64KB) Config.xml (RAW)

    Currently the kernel appears to occupy the entire 524,288 bytes, and excluding the small amount of room allocated to the configuration and bootloader, the compressed Squash filesystem must fit into 1447192 bytes. The default filesystem shipped from Netcomm currently requires 1433600 bytes leaving a little more that 13kbytes left (compressed) for your own binaries. Therefore if it is intended to modify the filesystem, some existing files must be deleted to make room for any new ones.

    SquashFS & LZMA Compression

    Prior to firmware version 62.51.1, the squash filesystem contained within the NB5 was compressed using the conventional ZLIB library. There has been a shift in recent times to LZMA due to better compression size. There are some claims that LZMA can offer up to 30% better compression over ZLIB, however a 10 to 15% gain is normally achievable on the typical squashFS images found in modems such as the NB5.

    Recovering from Disaster : ADAM2

    Should your NB5 no longer boot, don't despair. The ADAM2 FTP Server can assist in reloading a bootable image. Otherwise if you want to find out at what stage the modem is halting, try using the console port with the ADAM2 Bootloader.

    Other sources

    The Texas Instruments AR7, ADAM 2 Bootloader and AR7 ADSL Network Support Package is a common platform for many ADSL routers. The following links are applicable to this platform.

Copyright 2005 Craig Peacock - 20th August 2005