RE: Beginning with REALTEK RTL-8186.

RE: Beginning with REALTEK RTL-8186.

[Don Hiatt]

I'd certainly like to here about it. Well done.

Cheers,

don
 

-----Original Message-----
From: linux-mips-bounce@linux-mips.org [mailto:linux-mips-bounce@linux-mips.org] On Behalf Of W.P.
Sent: Friday, January 26, 2007 1:32 PM
To: linux-mips@linux-mips.org
Subject: Beginning with REALTEK RTL-8186.

Hello there,

I just have bought an Edimax BR-6204Wg wireless router based on RTL-8186.
In only two days i have succesfully got to device serial port, and tried to generate firmware based on Edimax-supplied sources.
Anyone interested in photos/story?

W.Piotrzkowski.

Re: Beginning with REALTEK RTL-8186.

[W.P.]

Użytkownik Don Hiatt napisał:

>I'd certainly like to here about it. Well done.
>
>Cheers,
>
>don
> 
>
Let it be ;)

0). Model: EDIMAX BR-6204Wg, CPU: Realtek RTL-8186, bridge/NIC:
RTL-83055C, Flash: 1x MX-29LV160CBTC-70G, RAM: 2x PSC-.....

1). First of all, i have disassembled the device to get to it's serial
port. On PCB i've found a 4-pins header labeled JP2. Optical inspection
followed by ohmometer use shown that it is RTL's serial port. Pin
functions (from center to egde): +3.3Vcc, RxD (RTL's receiver), GND, TxD
(RTL's transmitter).
Then i connected an MAX232 level translator to those pins, using +3.3V
as power (CAUTION: 232 from Ti did not work @ 3.3V), as proposed on
mips-wiki pages. Parameters of transmission: 38400/8N1. BTW Edimax tech
support for Europe refused to tell if that header is serial.

2). On username/pass prompt working configuration was super/@gogolinux -
again from wiki.

3). Software instalation that comes from Edimax lacks nearly everything
;( no vi, not even ln.

4). Downloaded sources from Edimax Taiwanese site:
http://www.edimax.com.tw/download/drivers/GPL/BR-6204WG_GNU.tgz a little
71.5MB package. ;)
4a). what lacks from that tarball: /web directory, *.sh scripts from /bin
4b). using default build instructions found in tarball leads to lack of
webserver (webs), and two important other execs: /bin/setup and
/bin/flash. The latter is, as i realize an interface to store/fetch
variables from flash. The setup file SHOULD be in tarball: it is
referenced in build chain, but is missing (whole directory AP/console).
4c). I launched build, then I copied missing files from working system
and  then blocked script in rtl-11g-GPL/AP/mkimg/app_11g_script to NOT
regenerate top.11g directory. Then i ran build once again.

5). Flashed resulting bin file onto Edimax.

6). Boots OK, but have to manually start init.sh and webs& from serial
console.
6a). Much more options in Busybox enabled. ex: vi, ln, etc.

7). For this moment i have returned back to original (downloaded 1.48)
Edimax firmware.

Tomorrow I'll upload photos and boot-progress files somewhere.

W.P.

PS, there is a lot in configuration of this system, that i do not
understand clearly: ex: ifconfig shows: br0, br1 WITH ip-addresses,
eth0, eth1, wlan0 WITHOUT ip....
I'll have to investigate config files/scripts.

RTL-8186 follow-up

[W.P.]

>> Tomorrow I'll upload photos and boot-progress files somewhere.

Here it is: http://www.laurentp.republika.pl/edimax/index.html

W.P.

Re: RTL-8186 follow-up

[W.P.]

Użytkownik Florian Fainelli napisał:

<cut>

>>Which kernel did you run ? Which toolchain did you use ?

1). I used a toolchain found on Edimax site, I have described in earlier
post. It seems to be:
         gcc: mips-linux-gcc (GCC) 3.3.3,
        binutils: GNU ld version 2.14.90.0.7 20031029, compiled for/with
uClibc 0.9.26. Whole toolchain is in package named lexra-nnop-v5.
          kernel source: 2.4.18, apart normal kernel tree, there are two
directories: /rtl8186/ containing several modules:->

-rw-r--r-- 1 root root  14012 kwi 21  2005 fast_nat.o
-rw-r--r-- 1 root root   3804 kwi 21  2005 ip_conntrack_ipsec.o
-rw-r--r-- 1 root root   6532 kwi 21  2005 ip_nat_ipsec.o
-rw-r--r-- 1 root root   4100 kwi 21  2005 ip_nat_l2tp.o
-rw-r--r-- 1 root root 284100 kwi 21  2005 ipsec.o
-rw-r--r-- 1 root root  34692 kwi 21  2005 mtdlink_gw.o
-rw-r--r-- 1 root root  30152 kwi 21  2005 mtdlink.o
-rw-r--r-- 1 root root  17352 kwi 21  2005 rtl8186.o
-rw-r--r-- 1 root root 386016 kwi 21  2005 wireless_ag_net.o

and a directory rtkload with scripts and program cvimg.

2). On net i have uploaded some files from /proc directory - again from
1.48 firmware.

3). If you have more questions/proposals do not hesitate. Only one thing
to remember: i'm NOT a C programmer, i only try to little modify Edimax
firmware to use it as cheap RS-232->Ethernet converter.

W.P.

Re: RTL-8186 follow-up

[W.P.]

<cut>
1). I have added modules found in KERNEL_SRC/rtl8186 (that i wrote about
in other post), to image, but trying to load them gives "unresolved
symbol" errors:

<example>
# insmod ip_nat_l2tp
Using /lib/modules/2.4.18-MIPS-01.00/ip_nat_l2tp.o
insmod: unresolved symbol kmalloc
insmod: unresolved symbol create_proc_entry
insmod: unresolved symbol ip_nat_helper_register
insmod: unresolved symbol ip_nat_helper_unregister
insmod: unresolved symbol csum_partial
insmod: unresolved symbol sprintf
</example>

This problem is very of interest, because there are modules for IP_SEC,
and a module rtl8186 (NIC driver??) that is much SMALLER that module
with the same name rtl8186 generated during kernel compilation. There is
also module named wireless_ag_net.

2). Is there some possibility to "recover" using serial port if it
happens to corrupt kernel to point to not have network access? (I mean
NOT using JTAG).??

3). Florian, could you help me to "reverse engineer" Edimax-supplied
firmware image? AFAIR it is composed of header, compressed vmlinux and
compressed initrd. But how to find at what offset those images are?, and
how are they compressed.

W.P.

Re: RTL-8186 follow-up

[Florian Fainelli]

[-- Attachment #1: Type: text/plain, Size: 1859 bytes --]

Hi Laurent,

Le samedi 27 janvier 2007 18:31, W.P. a écrit :
> <cut>
> 1). I have added modules found in KERNEL_SRC/rtl8186 (that i wrote about
> in other post), to image, but trying to load them gives "unresolved
> symbol" errors:
>
> <example>
> # insmod ip_nat_l2tp
> Using /lib/modules/2.4.18-MIPS-01.00/ip_nat_l2tp.o
> insmod: unresolved symbol kmalloc
> insmod: unresolved symbol create_proc_entry
> insmod: unresolved symbol ip_nat_helper_register
> insmod: unresolved symbol ip_nat_helper_unregister
> insmod: unresolved symbol csum_partial
> insmod: unresolved symbol sprintf
> </example>

There might be version mismatch, or other modules to load before this one. 
This can also be a kernel configuration problem, related to modules that are 
expected to be in-kernel.

>
> This problem is very of interest, because there are modules for IP_SEC,
> and a module rtl8186 (NIC driver??) that is much SMALLER that module
> with the same name rtl8186 generated during kernel compilation. There is
> also module named wireless_ag_net.
>
> 2). Is there some possibility to "recover" using serial port if it
> happens to corrupt kernel to point to not have network access? (I mean
> NOT using JTAG).??

Well, unless you have erased the booloader, I think you should still be able 
to reflash the device using bootloader commands, even via xmodem if the 
loader allows it.

>
> 3). Florian, could you help me to "reverse engineer" Edimax-supplied
> firmware image? AFAIR it is composed of header, compressed vmlinux and
> compressed initrd. But how to find at what offset those images are?, and
> how are they compressed.

I think you should have a look at this page [1], where there are ressources to 
create custom rtl8181 firmwares.

>
> W.P.

[1] http://rtl8181.sourceforge.net/

-- 
Regards, Florian

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: RTL-8186 follow-up

[W.P.]

[-- Attachment #1: Type: text/plain, Size: 1046 bytes --]

<cut>

>There might be version mismatch, or other modules to load before this one. 
>This can also be a kernel configuration problem, related to modules that are 
>expected to be in-kernel.
>
>  
>
You gave me an idea: i think it's related to fact, that those modules
expect to be linked into kernel (they complain about basic kernel
symbols too). But how to make sure?? - not risking to render board unusable?
If you find a method (maybe trying to link a non network-critical module
into kernel, like ipsec), please provide step-by-step instructions to me.


<cut>
>>Well, unless you have erased the booloader, I think you should still
be able
>>to reflash the device using bootloader commands, even via xmodem if
the loader allows it.

You THINK or you KNOW? (in case of 8186!)

>>I think you should have a look at this page [1], where there are
ressources to create custom rtl8181 firmwares.

I will, but on my board there is 8186, not 8181. And very beginning of
bootstrap, in bootloader i can see no option of TFTP (see atached file).

W.P.

[-- Attachment #2: bootloader.txt --]
[-- Type: text/plain, Size: 637 bytes --]


UART1 output test ok
Uart init
mfid=000000c2 devid=00002249
Found 1 x 2M flash memory

---RealTek(RTL8186)at 2005.06.06-11:22+0800 version 1.3c [32bit](180MHz)

---Escape booting by user
<RealTek>help
----------------- COMMAND MODE HELP ------------------
HELP (?)				    : Print this help message
D <Address> <Len>
EW <Address> <Value1> <Value2>...
EH <Address> <Value1> <Value2>...
EB <Address> <Value1> <Value2>...
EC <Address> <Value1> <Length>...
CMP: CMP <dst><src><length>
IPCONFIG:<TargetAddress>
J: Jump to <TargetAddress>
FLW: FLW <dst><src><length>
FLR: FLR <dst><src><length>
LOADADDR: <Load Address>
AUTOBURN: 0/1
<RealTek>

Re: RTL-8186 follow-up2

[W.P.]

<cut>

>Which kernel did you run ? Which toolchain did you use ?
>  
>
I have unpacked the bigger of Edimax files for BR-6204Wg ->
BR-6204Wg_GPL.zip and there are 2 FRESH (2006 dated) patches named
realtek gcc/binutils. Maybe this is something for you.

W.P.