Linux on Proxim 802.11a AP
 


NEWS

Software development suspended,( because everything is working already). Now I am working on antennas and packaging.

AP linux firmware is quite ready, all interface is similar to LinuxAP, but more powerfull and flexible.
Gpio outputs can be easily controlled and used for leds only or you can connect something external to control.
Bridging in client mode dont work because of wlan driver limitations, but that can be emulated with arp bridge (parprouted ) (only ip nonmulticast traffic will pass).
Very directional antenna for 5.3ghz is required now, to allow full speed over long distances.

theoreticaly it is possible to reflash ap even without jtag, because I know password, but then some bootloader which takes less than 64kb is required.
.......
I decided to find password to access proxim telnet without jtag crack,
Engineer who created that firmware was total joker, everybody thinks that password must be brando
(since that string can be found in firmware near password prompt and was used on older devices) but password is notbrando
btw, you must NOT use putty telnet, or it wont work, it is best to use windows telnet. or putty in raw mode
......
Implemented basic gpio control, but it need to be made more led oriented, or now it is impossible to control separate leds.
......
gpio led control appears to me nesecary function, or now it is imposible to know when ap is on.
unfortunately there is no example of userspace program available anywhere.
........
web control panel improved a lot, now it allows total control over boot process.
added  parprouted, ( but untested now) which should allow to emulate bridge.
now it is only possible to use AP as router
..........
Instructions how to reflash AP
...........
seems madwifi driver is not good, it woks only in ap or client mode.
ap cant connect to ap , client cant work as bridge.

2004.10.11: first boot as independent device
By now it probably contains all required software to work as bridge or router
...........
First try to boot as standalone device, was not successful,
ethernet driver hangs linux during boot time  --- Fixed,( interrupt registers were uninitialized)

web control panel   (because I hate vi  :) ---  mostly completed
Some way to store configuration   --  OK
initramdisk -- OK
bootloader --- finished
flash-mtd driver -- finished
basic root system -- OK
wlan driver -- Usable
linux kernel -- OK
 


released files are here

 

This device is small computer with ppc processor

cpu:   IBM PPC405GP 200Mhz RISC, MMU
integrated: uart, ethernet, pci
 
flash: SST 1MB 16bit
very fast programming
Ram:  hynix 8MB ddram
 
Phy:   LSI   L80225 100Mbit
Just some cheap one and uses half of all AP electric power
pci interface: usualy cardbus = pci and I don't know which one is used on this ap
wlan: proxim 802.11a atheros with amplifier 6-108mbit speed, 5ghz

Potentialy can be quite high power, because other similar cards do not have amplifier
also contains saw filters that are not used on cheap cardbus cards
 
Antena system If somebody understand how that works, tell me.
Antena cables are so thin, that they insert probably more than 3db loss.
also they used 1/2 wavelength dipole intead of usual 1/4
what means it is same antenna on 802.11a as 802.11b
 

New firmware will (probably) contain these functions
Client mode
Traffic shapping
iptables
Monitor mode
Custom scripts
Mini webserver
GPIO-led outputs/inputs for external hardware control
 

NOTES

The big surprise, that ppc files are bigger than i386,
but they compress much better
Example:
busybox
i386 243kb  ->  125kb 7zip  or 141kb gzip
ppc  271kb ->   110kb 7zip  or 136kb gzip

So 1mb flash is going to fit quite lot of stuff

...

depending on how much people will be interested in this project I will post more news.

If you want to have such super access point,  but are unable to modify it yourself, then I can do this for you,
I do not want money for this job, I prefer to get another wireless AP.
 


Reflashing ap with linux:

Required stuff:

1. wiggler JTAG adapter (for instructions how to make it go here) TRST must NOT be open collector output. ( modified schematic is here )
2. TTL to Uart adapter (I will post schematic later, if there will be such request) or use data cable from your mobile phone ;) or build this one
3. OCD commander (get it from www.macraigor.com. All bugs, it contains, are free : )
4. if you want to recompile source code  you need computer with linux (or BSD probably)  capable to run ppc crosscompiler
5. Some knowledge about electronic, if you dont have it then  get it, it is free afterall. ;)

 

Possible UART - TTL converter schematic. It have advantage over max232,
 because does not need additional supply

DO NOT connect GND  to e1 it is 2.5v not gnd on board.
Use e7 instead.


................................



 

 

Connect  jtag and uart (you need only UTX and URX lines)  resolder that jumper, check if you can control cpu.
Uart uses standard settings (9600bps, no control.)

 

Download required files here  you will need .s19 and .mac files
because OCD commander cant  reset cpu  ( did they at least test their software?) and 405GP damages itself(until next reset) if it runs bad instructions
you will need to use this trick to avoid that problem.

WARNING: as I know new OCD commander is somehow broken, to avoid problems use older one from my page.
it is already configured, as required. But you must also install new ocd commander anyway, or nothing will work.

1. initialize cpu:  (run init.mac)
2 write assembler instruction b 0 to 'reset vector' location. ( run wrb.mac)
3 reset board use reset switch or unplug power cable.
4 initialize again.  (run init.mac)
 now you can erase and reflash

5 download (with ocd commander to ram ) umon.s19 file
6 download  flash.s19

7 erase chip (run erase.mac)
8 program it  ( type  'pc 0'  and press go )
I had no much motivation to make full featured flash program so it will not tell when it finishes
just wait 15-20 sec and press stop  then type 'dasm' if cpu is stuck on 'b 0' instruction then all is done

Flash contains micromonitor now,  it can be used to load linux or anything  else, 
my binary have default ip address 192.168.10.90 and you can use tftp to download files from some sever
I was not able to finish flash driver for micromonitor and don't need it that much anymore.
Source code is available for all software

Linux can be flashed in same way.

 download all files from here to c:\images

1. initialize cpu:  (run init.mac)
2 write assembler instruction b 0 to 'reset vector' location. ( run wrb.mac)
3 reset board use reset switch or unplug power cable.

4. run script.mac
5. write to flash  ( type  'pc 0'  and press go )

you need to wait about 30sec until everything is done,
then reset board and enjoy new linux firmware.

For questions, and comments email is tpt#pupa.da.ru

example output from AP with

Unpacking linux
FFF00000
00000000
Linux unpacked
0031A400
board init
mmu init
Linux version 2.4.18_mvl30-cpci405 (root@pupa.da.ru) (gcc version 3.2.2 20030217 (Yellow Dog Linux 3.0 3.2.2-2a_1)) #198 Mon Oct 11 21:39:01 GMT+3 2004
f1nd pci bridges
cfg addr = e7fff000, data = e7ffe004size e0000001 addr 80000000 size 0 size e0000003 addr c0000000 newmin = 80000000 , newmax = dfffffff
PCI Autoconfig: Found Bus 0, Device 10, Function 0
Setting board info
On node 0 totalpages: 2048
zone(0): 2048 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,9600 root=/dev/ram0
Calibrating delay loop... 199.88 BogoMIPS
Memory: 5552k available (992k kernel code, 304k data, 60k init, 0k highmem)
Dentry-cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode-cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
POSIX conformance testing by UNIFIX
PCI: Probing PCI hardware
PCI fixup irq: (PCI device 168c:0007) got 31 slot 10
PCI:00:0a.0: Resource 0: 80000000-8000ffff (f=200)
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
OCP uart ver 1.2 init complete
Starting kswapd
Disabling the Out Of Memory Killer
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xef600400 (irq = 1) is a 16550A
ttyS01 at 0xef600300 (irq = 0) is a 16550A
IBM gpio driver version 02.01.21.d
GPIO #0 at 0xef600700
PPC 405 watchdog driver v0.5
block: 64 slots per queue, batch=16
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
loop: loaded (max 8 devices)
eth0: Got bad Phy Read, missing MDIO pullup?
eth0: Phy @ 0x4, type L80225 (0x0016f880)
Reset ethernet interfaces
physmap flash device: 100000 at fff00000
proce qry
qry present
Number of erase regions: 2
Primary Vendor Command Set: 0701 (Unknown)
No Primary Algorithm Table
Alternative Vendor Command Set: 0000 (None)
No Alternate Algorithm Table
Vcc Minimum: 2.7 V
Vcc Maximum: 3.6 V
No Vpp line
Typical byte/word write timeout: 16 µs
Maximum byte/word write timeout: 32 µs
Full buffer write not supported
Typical block erase timeout: 16 ms
Maximum block erase timeout: 32 ms
Typical chip erase timeout: 64 ms
Maximum chip erase timeout: 128 ms
Device size: 0x100000 bytes (1 MiB)
Flash Device Interface description: 0x0001
- x16-only asynchronous interface
Max. bytes in buffer write: 0x1
Number of Erase Block Regions: 2
Erase Region #0: BlockSize 0x1000 bytes, 256 blocks
Erase Region #1: BlockSize 0x10000 bytes, 16 blocks
Amd/Fujitsu Extended Query Table v1.<4>Physically mapped flash: JEDEC Device ID is 0x81. Assuming broken CFI table.
number of CFI chips: 1
Sum of regions (200000) != total size of set of interleaved chips (100000)
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET4: Ethernet Bridge 008 for NET4.0
RAMDISK: romfs filesystem found at block 0
RAMDISK: Loading 1129 blocks [1 disk] into ram disk... done.
Freeing initrd memory: 1129k freed
VFS: Mounted root (romfs filesystem) readonly.
Freeing unused kernel memory: 60k init
init started: BusyBox v1.00-pre7 (2004.10.05-03:54+0000) multi-call binary
init started: Buopening eth0 on emac 0
syBox v1.00-pre7eth0: IBM EMAC: (2004.10.05-03:link up54+0000) multi-c, 100 Mbps Full Duplexall binary
Sta, auto-negotiation completerting pid 9, console /dev/consoleth0: IBM EMAC: e: '/etc/rc'

MAC 00:33:44:55:66:00
proxima-linuxAP Access Point / Router




* Mounting filesystems
Loading configuratwlan: 0.8.4.3 (EXPERIMENTAL)
ion
5+0 records in
5+0 records out
loaded.
wath_hal: 0.9.12.5
lan
telnetd.hosath_rate_onoe: 1.0
ts
netcfg
httpd.conf
custom
ath_pci: 0.9.4.6 (EXPERIMENTAL)
loaded saved config.
Done.
* Starting telnetd
* Starting httpath0: 11a rates: d
* Running cus6Mbpstom config scrip 9Mbpst
12Mbpslan.o
Using ath_hal.o 18Mbps
Using onoe.o
36MbpsUsing ath_pci.o
48Mbps 54Mbps
ath0: mac 1.7 phy 0.3 5ghz radio 0.10
ath0: 802.11 address: 00:20:a6:47:89:a5
ath0: Use hw queue 0 for WME_AC_BE traffic
ath0: Use hw queue 0 for WME_AC_BK traffic
ath0: Use hw queue 0 for WME_AC_VI traffic
ath0: Use hw queue 0 for WME_AC_VO traffic
ath0: Atheros 5210: mem=0x80000000, irq=31
opening eth0 on emac 0
eth0: IBM EMAC: link up, 100 Mbps Full Duplex, auto-negotiation complete.
eth0: IBM EMAC: MAC 00:20:a6:47:89:a5.
eth0: IBM EMAC: open completed
Mac Adderss 00:20:A6:47:89:A5

Error for wireless request "Set Frequency" (8B04) :
too few arguments.

Please press Enter to activate this console.
Starting pid 57, console /dev/ttyS0: '/bin/ash'


BusyBox v1.00-pre7 (2004.10.05-03:54+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

# ifconfig
eth0 Link encap:Ethernet HWaddr 00:20:A6:47:89:A5
inet addr:192.168.10.112 Bcast:192.168.10.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:106 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:6360 (6.2 KiB) TX bytes:0 (0.0 B)
Interrupt:9

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

# iwconfig
lo no wireless extensions.

eth0 no wireless extensions.

ath0 IEEE 802.11a ESSID:"Proxima"
Mode:Master Frequency:5.18GHz Access Point: 00:00:00:00:00:00
Bit Rate:0kb/s Tx-Power:50 dBm Sensitivity=0/3
Retry:off RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality:0/94 Signal level:-95 dBm Noise level:-95 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

#