Linux based Access Points

This page is a bit about some Accesspoint customisations, that i come across. Currently it covers the last two Dell Accesspoints (TrueMobile 1184 and 2300), but since I do a lot with WLan and alike, this page will surely evolve in time.

Dell TrueMobile 1184

In April 2003 i bought a Dell TrueMobile 1184 accesspoint together with the notebook.
	This piece of hardware is actually a bit more than just an accesspoint. It's a router, nat firewall, accesspoint and 4 port switch.
Of course people get interested, how things look like inside this little box, so I had to open it.
	By the look on the board we'll find a Samsumg ARM cpu, Realtec Ethernet controller, a chip for the 4 port switch, the wlan card (covered with metal) and a couple of other components. Now it comes to thought, that this actually is a neat platform and how nifty it could be to run Linux on it.

A few troubleshooting tips for this little unit, things, that you might run into:

• You resetted your unit (running FW 2.12) and the webinterface is gone, on the previously configured ip address, as well as 192.168.2.1. No access to anything.
  • Re-run the configuration software from Dell, that came with the box, step for step and it'll be up and running again
  
  
• You seem not to be able to ping or access the router from your workstations anymore. The laptop has no trouble accessing it.
  • MAC address filtering is not only for the Wlan side of things, no it's also limiting your access to the webinterface. MAC addresses not listet can't even ping the thing. Actually it wouldn't wonder me, if it doesn't let you access the internet also.

Anyhow, continuing exploring and after a upgrade to firmware 2.12 (released on February 21st, 2003 by Dell) this little unit suddenly had telnet open on port 333. Login user "root" and the password from the webinterface let you log in. You can imagine my surprise, when i saw, that the thing allready is running Linux

Here is all the interesting stuff about the router:

~$ telnet 192.168.2.1 333
Trying 192.168.2.1...
Connected to 192.168.2.1.
Escape character is '^]'.

login: root

Password:

# cat /proc/cpuinfo
Processor       : S3C4510/SEC arm7tdmi rev 0
BogoMips        : 44.24
Hardware        : 

# cat /proc/version

Linux version 2.2.14-v1.9 (root@localhost.localdomain) (gcc version 2.9-vLinux-armtool-0523) #5357 Sat Jan 25 17:39:42 CST 2003

# cat /proc/meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  12271616  9465856  2805760        0  3526656  1449984
Swap:        0        0        0
MemTotal:     11984 kB
MemFree:       2740 kB
MemShared:        0 kB
Buffers:       3444 kB
Cached:        1416 kB
SwapTotal:        0 kB
SwapFree:         0 kB

# ifconfig
br0       Link encap:Ethernet  HWaddr 00:90:4B:33:1B:E2     
          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1895 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1258 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0

eth0      Link encap:Ethernet  HWaddr 00:90:4B:33:1B:E2
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1895 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1258 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100

eth1      Link encap:Ethernet  HWaddr 00:90:4B:33:1B:E3
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:21 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          Base address:0x600 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:3924  Metric:1   
          RX packets:2 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 

prism0    Link encap:Ethernet  HWaddr 00:90:4B:33:1B:E2
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:510 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          Interrupt:2 Base address:0x8000 

# cat /proc/mounts
/dev/root / romfs rw 0 0
/proc /proc proc rw 0 0 
/dev/ram0 /var ext2 rw 0 0
/dev/ram1 /etc/config ext2 rw 0 0

# cat /proc/kmsg
<4>
<4>Linux version 2.2.14-v1.9 (root@localhost.localdomain) (gcc version 2.9-vLinux-armtool-0523) #5357 Sat Jan 25 17:39:42 CST 2003
<4>Samsung-S3C4 series device are selected
<4>Memory Usage : 
<4>      TEXT     = 0xc0009000 - 0xc00da268
<4>      DATA     = 0xc00da268 - 0xc00eace4
<4>      ROMFS    = 0xc00eace4 - 0xc0408000
<4>      BSS      = 0xc0408000 - 0xc04233c4
<4>      FREE MEM = 0xc04233c4 - 0xc1000000
<4>Calibrating delay loop... 44.24 BogoMIPS
<4>Memory: 11980k/16M available (840k code, 3208k reserved, 352k data, 4k init)
<4>Dentry hash table entries: 2048 (order 2, 16k)
<4>Buffer cache hash table entries: 16384 (order 4, 64k)
<4>Page cache hash table entries: 4096 (order 2, 16k)   
<4>POSIX conformance testing by UNIFIX
<6>Linux NET4.0 for Linux 2.2
<6>Based upon Swansea University Computer Society NET3.039
<6>NET4: Unix domain sockets 1.0 for Linux NET4.0.
<6>NET4: Linux TCP/IP 1.0 for NET4.0
<6>IP Protocols: ICMP, UDP, TCP, IGMP
<4>TCP: Hash tables configured (ehash 16384 bhash 16384)
<6>IPv4 over IPv4 tunneling driver
<6>early initialization of device tunl0 is deferred
<6>mssclampfw v1.2 (written by Marc Boucher . Thanks to Rebel.com)
<6>IP_VS: Initializing WLC scheduling
<4>Register PPTP & GRE Masquerade
<4>Register L2TP Masquerade
<4>Register IPSEC(ISAKMP, ESP) Masquerade
<6>ip_masq_icq: using TCP port range 60200-61000
<6>ip_masq_icq: loaded support on port 4000/UDP 
<4>Initializing RT netlink socket
<4>Starting kswapd v 1.2 
<6>Serial driver for S3C4XXX series device version 1.00 with
<6>      ttyS00 at 0x3ffd000 (irq = 5) is a S3C4XXX
<6>      ttyS01 at 0x3ffe000 (irq = 7) is a S3C4XXX
<6>Registering PPPoE driver
<4>RAM disk driver initialized:  16 RAM disks of 4096K size
<4>BLKMEM Copyright (C) 2000 Vitals Systems Inc.
<4>BLKMEM 1 disk images:
<4>      0: C00EACE4-C04080E3 (RO)
<4>Flash Driver Copyright (C) 2000 Vitals Systems Inc.
<4>Flash Device 3 partitions:
<4>      Flash 0 : AMD Am29LV160DB at 1000000-100FFFF
<4>      Flash 1 : AMD Am29LV160DB at 1010000-11EFFFF
<4>      Flash 2 : AMD Am29LV160DB at 11F0000-11FFFFF
<6>NET4: Ethernet Bridge 008 for NET4.0
<4>EXTACON1=0x0e990e99
<4>C101 C103 C100 C100 C1FF C117 C104 C167 C15A C108 C1FF C11D C105 C103 C167 C15A C108 C1FF C115 C139 <6>prism0: init
<4>prism0: Start to init hw
<4>prism0: Base address 7608000
<4>reg = 8 
<6>ident: nic h/w: id=0x15 1.1.0
<6>ident: pri f/w: id=0x15 1.1.0
<6>ident: sta f/w: id=0x1f 1.4.9
<6>prism0: card SN: 00 00 00 00 00 00 00 00 00 00 00 00
<6>prism0: AP MODE
<4>readpda OK!!!! 
<6>prism0: MAC address:  00 90 4b 33 1b e2
<4>prism0: Finish probe
<6>prism0: initialized 
<6>PPP: version 2.3.7 (demand dialling)
<6>TCP compression code copyright 1989 Regents of the University of California
<6>PPP line discipline registered.
<6>PPP Deflate Compression registered
<6>eth_s3c4.c : v1.0.0 25/Apr/2000 Vitals System Inc (yskim@vitals.co.kr)
<6>eth0  00:90:4b:33:1b:e2 
<6>rtl8019.c : v1.0.0 28/Dec/2001 Vitals System Inc (yskim@vitals.co.kr)
<6>eth1  00:90:4b:33:1b:e3 
<4>VFS: Mounted root (romfs filesystem).
<4>Freeing unused kernel memory: 4k init
<4>RAM Download Enable Succcess
<4>reg = 8 
<6>ident: nic h/w: id=0x15 1.1.0
<6>ident: pri f/w: id=0x15 1.1.0
<6>ident:  ap f/w: id=0x14b 1.2.1
<6>prism0: card SN: 00 00 00 00 00 00 00 00 00 00 00 00
<6>prism0: AP MODE
<4>readpda OK!!!! 
<4>Set SSID : pacman
<4>Set WEP flags=0  
<4>Set beacon period=100.
<4>Set preamble = 0.
<4>Set channel=6.   
<4>Set basicrates=15.
<4>Set supprates=15. 
<4>Set txrates=15.   
<4>Set DTMI Period=1.
<4>Set Tick Timer = 200 ms.
<4>Set RTS=2432.
<4>Set fragmentation threshold=2346.
<4>Enabling...
<4>prism0: port_enabled = 0
<6>device eth0 entered promiscuous mode
<6>device prism0 entered promiscuous mode
<6>br0: port 2(prism0) entering listening state
<6>br0: port 1(eth0) entering listening state  
<6>br0: port 2(prism0) entering learning state 
<6>br0: port 1(eth0) entering learning state   
<6>br0: port 2(prism0) entering forwarding state
<6>br0: topology change detected, propagating   
<6>br0: port 1(eth0) entering forwarding state  
<6>br0: topology change detected, propagating   

After looking a bit around on the system, I also found the "sysconf" command, that shows a generic overview of the box:

# sysconf view
Sysconf Reading System Parameters from FLASH...DONE!
current parameter size 4204

+==================================================+
|     System Configuration Table : valid !!!       |
+==================================================+
|                System Parameters                 |
|  Host Name          :                            | 
|  System User ID     : root                       |
|  System Password    : admin                      |
+--------------------------------------------------+
|               Boot Configuration                 |
|  Boot Method : Auto Boot                         |
|  Vendor Name : Gemtek Taiwan                     |
|  Boot File Name : /home/tftp/vLinux.bin          |
|  TFTP Server IP Address : 192.168.2.239          |
+--------------------------------------------------+
|          LAN (Ethernet) Configuration            |
|  Ethernet H/W Address : 00:90:4b:33:1b:e2        |
|  Ethernet IP Address : 192.168.2.1               |
|  Ethernet Default Gateway : 0.0.0.0              |
|  Ethernet Subnet Mask : 255.255.255.0            |
+--------------------------------------------------+
Press return key for next ...
+==================================================+
|                      WAN Setup                   |
+--------------------------------------------------+
|  No Connection Type Selected                     |
+--------------------------------------------------+
|                  PPP Configuration               |
|  PPP User Identifier : Invalid                   |
+--------------------------------------------------+
|          IP (Cable Modem) Configuration          |
|  MAC H/W Address  : 00:90:4b:33:1b:e3            |
|  IP Address       : 0.0.0.0                      |
|  Default Gateway  : 0.0.0.0                      |
|  Subnet Mask      : 0.0.0.0                      |
|  Using DHCP for WAN Port                         |
+--------------------------------------------------+
Press return key for next ...
+==================================================+
|           DHCP Server Configuration              |
|    Invalid DHCP Configuration                    |
+--------------------------------------------------+
|            DNS Server Configuration              | 
|  Domain Name Server      :                       |
|  Primary DNS Server IP   : 0.0.0.0               |
+--------------------------------------------------+
|       NAT Virtual Server Configuration           |
|  Virtual  Server : 0.0.0.0   |
|  Virtual  Server : 0.0.0.0   |
|  Virtual  Server : 0.0.0.0   |
|  Virtual  Server : 0.0.0.0   |  
|  Virtual  Server : 0.0.0.0   |
|  Virtual  Server : 0.0.0.0   |
|  Virtual  Server : 0.0.0.0   |

I was looking to find a replacement Linux for this box, various people have been posting on LKML and I know that some have been looking at getting the ARM Linux on this box replaced, but I never got around to do something about it.

Colm MacCairthaig has been in contact with Dell's legal department about this and got them to send him a copy of the License and the source for the kernel in the box. He posted his findings on LKML (here is his original post, email-adresses despammed). Unfortunatly the tar-ball is a default kernel tar-ball without build notes as of his mail on the ILUG mailinglist . Not to much use. So i did not even bother to upload it here.

Other findings, that Jon Burford and C. Magnus Hedemark came up with, are that the little 6 pin header on the board (left of the Samsung CPU) actually are two serial ports. From left to right the pins are like this:

Be aware, that the pins are 5V TTL, so you will need a level shifter, once you've got that in place, you get cleartext console output, at least on ttyS0.

Dell TrueMobile 2300

The next accesspoint I got in my fingers was the Dell TrueMobile 2300, which is the next generation. This box actually is a lot like the old one, but port 333 wasn't open here. Also the webinterface seemed to be a mix of .asp and cgi pages.
Now actually this box is again produced by GemTek, but it seems to be based on a different CPU. Also the inside looks quite different.

Beyond the "Dell TrueMobile 2300" on the front, the box looks all the same.
	Also around the ports everything looks the same.
Ok .. now this is a difference. The board is a lot smaller.
	After removing the cover a regular MiniPCI Wlan card shows up, Broadcom based, which usually not is Linux supported. Bad news. Also the CPU seems to come from Broadcom.

A bit research revealed, that this board actually is not very far, from what is in the Linksys WRT54g etc. It is a bit older revision (some boards say V01, mine actually says V02) and also the flash chips are from different manufacturers (i've seen some with flash chips from AMD, this has them from MX).

But in the end being the same as the WRT54g means, that this actually can run Linux.

I've installed OpenWRT on mine. The snapshot from Oct 26, 2004 works quite well. You can download it here. The MD5 sum for that is here. Make sure that you enable boot_wait (has to be set to "on") as soon as you have Linux on the box.

Initially the box will have telnet open and no password, you can then start installing packages like ssh, quagga, iptraf, radvd, ip6 modules, wondershaper or chillispot.

Some data on the box:

root@OpenWrt:~# cat /proc/cpuinfo 
system type             : Broadcom BCM947XX
processor               : 0
cpu model               : BCM4710 V0.0
BogoMIPS                : 82.94
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available
dcache hits             : 2272803103
dcache misses           : 302908063
icache hits             : 4272266822
icache misses           : 3554474689
instructions            : 3532850940

root@OpenWrt:~# uname -a
Linux OpenWrt 2.4.20 #1 Tue Oct 26 04:13:43 EDT 2004 mips unknown

root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root               896.0k    896.0k         0 100% /rom
/dev/mtdblock/4           2.2M      1.9M    336.0k  85% /

root@OpenWrt:~# dmesg
CPU revision is: 00024000
Loading BCM4710 MMU routines.
Primary instruction cache 8kb, linesize 16 bytes (2 ways)
Primary data cache 4kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (mbm@reboot2.lan) (gcc version 3.3.3) #1 Tue Oct 26 04:13:43 EDT 2004
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs init=/etc/preinit noinitrd console=ttyS0,115200
CPU: BCM4710 rev 0 at 125 MHz
!unable to setup serial console!
Calibrating delay loop... 82.94 BogoMIPS
Memory: 14188k/16384k available (1408k kernel code, 2196k reserved, 100k data, 68k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: Fixing up bus 0
PCI: Fixing up bridge
PCI: Fixing up bus 1
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
Software Watchdog Timer: 0.05, timer margin: 60 sec
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
 Amd/Fujitsu Extended Query Table v1.1 at 0x0040
number of CFI chips: 1
Flash device: 0x400000 at 0x1fc00000
Physically mapped flash: squashfs filesystem found at block 913
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003f0000 : "linux"
0x000e4480-0x001b5854 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "nvram"
0x001c0000-0x003f0000 : "OpenWrt"
sflash: chipcommon not found
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
ip_conntrack version 2.1 (128 buckets, 1024 max) - 352 bytes per conntrack
ip_conntrack_pptp version 1.9 loaded
ip_nat_pptp version 1.5 loaded
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
Bridge firewalling registered
802.1Q VLAN Support v1.7 Ben Greear 
All bugs added by David S. Miller 
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 68k freed
Warning: unable to open an initial console.
Algorithmics/MIPS FPU Emulator v1.5
diag boardtype: 0000041d
using v1 hardware
led -> 00
led -> 01
jffs2.bbc: SIZE compression mode activated.
eth0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.50.21.10
eth1: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.50.21.10
PCI: Enabling device 01:01.0 (0004 -> 0006)
eth2: Broadcom BCM43XX 802.11 Wireless Controller  3.50.21.10 (Compiled in . at 20:53:00 on Jan 21 2004)
device eth0 entered promiscuous mode
device eth2 entered promiscuous mode
br0: port 2(eth2) entering listening state
br0: port 1(eth0) entering listening state
br0: port 2(eth2) entering learning state
br0: port 1(eth0) entering learning state
br0: port 2(eth2) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating
led -> 00

I have still lot's to explore in this little fella, so this page will get updated while i get on. The plan is eventually to replace the broadcom card with something different, like a a/b/g atheros based or something like that. Thanks to OpenWRT there is a lot more freedom in modifying the box.