Während der rechern zu meinem WRT-Flash mod stieß ich auf die Erkenntniss, das auf dem BCM4712 CPU immer ein USB host controller drauf ist. Warum diesen also nicht nutzbar machen? Wenn man die ervorderlichen kontakte heraus bekommt braucht man nur einen externen pull up für die Datenleitungen, zwei kondensatoren und ein bisschen 5Volt. Zur not muss man sich eben ein platinchen löten mit spannungregler. Auf alle Fälle würde es wehsentlich mehr bedeuten als der flash mod da es wohl mit weniger Aufwand die Möglickeiten des WRT imens erhöht.
Ich beginne einmal mit der Informations sammlung
Boud Rate : 11,5200 8N1 no Parity, no flow control.
(12:53:29) blux: one with broadcom BC4712 and USB? spect sheet say that se chip supports is (12:53:31) blux: it (12:55:20) groz: every wrt54 has it, but, its just not populated (12:55:55) blux: I knop (12:55:58) blux: sry know (12:57:06) blux: but if someone had en dev with USB and that chip hell could take a foto so I culd trace the lines (12:57:34) groz: think it's populated on a couple of asus boards (12:57:40) groz: but, i've never actually had one (12:57:49) blux: I found out that the two outer pin lines are acessible from the TOP of the chip body, so the wwill be acessable (12:57:56) blux: hm (13:01:06) blux: do you know somebody wwith such an dev? (13:01:47) groz: not offhand no (13:01:51) blux: oh, i cold goggle. . . but i don't think I will hig resulution pictures (13:02:01) groz: i bet you will find photos (13:02:10) blux: I'll see (13:02:39) blux: another thing: if someone is interestet in X-Ray photos of an Linksys PCB I have some (13:07:53) Hooligan0 hat den Raum verlassen (quit: Read error: 104 (Connection reset by peer)). (13:15:48) jr--: blux. there's photos of belkin with usb1+4712 on fcc site. fcc id K7SF5D7231P (13:29:46) blux: what is fcc? (13:30:42) jr--: blux: https://gullfoss2.fcc.gov/prod/oet/cf/eas/reports/GenericSearch.cfm (13:44:44) blux: thx (13:54:14) jr--: blux. also check K7SF5D72354 and K7SF5D72304. those have better photos of pcb
(13:12:03) jr--: toh lists Belkin F5D7231-4P and Siemens SE505 v2 as devices with 4712 and usb1 (13:12:06) jr--: asus models with usb1 are with 4710 (again based on toh) (13:12:26) jr--: accidentall wrote that to #openwrt instead of #openwrt-devel.. that's why msgd (13:12:49) blux: I,d see on WRT HW page (13:13:01) blux: ok, I'll do (13:13:23) blux: but the experts are most on wrt-devel :-) (13:13:55) blux: thx anyway (13:47:51) blux: im not able to find it with this ID (13:54:34) jr--: put k7s to first field (grantee code) and rest to product code (13:55:01) blux: I did, but no results apear (13:56:36) jr--: works for me.. (14:06:16) jr--: try contacting Rick Bronson? he has added usb to belkin that has traces onboard. probably could measure / follow traces to find bga "pins" on 4712? http://www.efn.org/~rick/work/f5d7230/ (14:13:12) blux: ok, cool (14:13:18) blux: I'll try (14:13:35) blux: tu add USb to all WRT would be very cool . . . (14:13:38) blux: to (14:25:12) jr--: found hires front and back photos of siemens se505v2. link was on openwrt forum :) (14:25:14) jr--: http://kordewiner.com/siemens-se505-v2/
So der SE505 is eingetroffen, nach einem kurzen Test geöffnet und mit ein paar Teilen aus der Krabbelkiste, von alten Mainboards und einer Soundcarte (der Spannungregler und ein cap) gleich mit USB ausgestatet. Aktuell versuche ich gerade openwrt zu installieren, aber leider funktioniert dies nicht besonders gut.
tftp> put openwrt-wrt54g-squashfs.bin tftp> put openwrt-brcm-2.4-squashfs.trx tftp> put openwrt-se505-freifunk-1.2.5-de.bin
CFE> tftpupg
Reading :: Done. 1545216 bytes read
Magic ID: 47343557, Abort.
Expected linux(30524448), bootloader(4E4F4D50), nvram(5241564E)
boardcase upgrade status to client: upgrade failure
*** command status = -31
CFE> tftpupg
Reading :: Done. 1147844 bytes read
Boot program checksum is invalid
[flash1.trx] : Programming...done. 1544192 bytes written
boardcase upgrade status to client: upgrade success
*** command status = 0
CFE>
CFE>
CFE>
CFE> tftpupg
Reading :: Done. 1437724 bytes read
This is a Multi-File (44414F4C).
[flash1.trx] : Programming...done. 1437696 bytes written
boardcase upgrade status to client: upgrade success
*** command status = 0
Also dann soll es zum ersten Test die ff firmware sein . . .
CFE>
CFE> reboot
Decompressing..........done
Here we try to capture the default reset button: None.
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Fri May 14 09:44:24 CST 2004 (denny@dnylinux)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena.
Initializing Devices.
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.9.0
CPU type 0x29007: 200MHz
Total memory: 0x800000 bytes (8MB)
Total memory used by CFE: 0x80300000 - 0x80434F90 (1265552)
Initialized Data: 0x8032F0A0 - 0x803313D0 (9008)
BSS Area: 0x803313D0 - 0x80332F90 (7104)
Local Heap: 0x80332F90 - 0x80432F90 (1048576)
Stack Area: 0x80432F90 - 0x80434F90 (8192)
Text (code) segment: 0x80300000 - 0x8032F0A0 (192672)
Boot area (physical): 0x00435000 - 0x00475000
Relocation Factor: I:00000000 - D:00000000
Device eth0: hwaddr 00-01-E3-0F-2F-12, ipaddr 192.168.2.1, mask 255.255.255.0
gateway not set, nameserver not set
Reading :: Failed.: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3704 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007
Primary instruction cache 8kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 4kB, 2-way, linesize 16 bytes.
Linux version 2.4.30 (root@pcacer) (gcc version 3.4.4 (OpenWrt-1.0)) #1 So Mär 6
Setting the PFC value as 0x15
Determined physical RAM map:
memory: 00800000 @ 00000000 (usable)
On node 0 totalpages: 2048
zone(0): 2048 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/pr0
CPU: BCM4712 rev 1 at 200 MHz
Using 100.000 MHz high precision timer.
Calibrating delay loop... 199.47 BogoMIPS
Memory: 6196k/8192k available (1399k kernel code, 1996k reserved, 96k data, 80k)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
PCI: Fixing up bus 0
PCI: Fixing up bridge
PCI: Fixing up bus 1
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
Squashfs 2.1-r2 (released 2004/12/15) (C) 2002-2004 Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI ed
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
b44.c:v0.93 (Mar, 2004)
eth0: Broadcom 47xx 10/100BaseT Ethernet 00:01:e3:0f:2f:12
Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Flash device: 0x400000 at 0x1c000000
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003f0000 : "linux"
0x000ba890-0x0019f000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-y
0x003f0000-0x00400000 : "nvram"
0x001a0000-0x003f0000 : "OpenWrt"
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (5953 buckets, 5953 max) - 328 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (5953 buckets, 5953 max) - 328 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 80k freed
Algorithmics/MIPS FPU Emulator v1.5
Using /lib/modules/2.4.30/diag.o
diag boardtype: 00000101
diag se505-v2 detected
Using /lib/modules/2.4.30/switch-core.o
Using /lib/modules/2.4.30/switch-robo.o
Probing device eth0: No Robo switch in managed mode found
Probing device eth1: No such device
Probing device eth2: No such device
Probing device eth3: No such device
insmod: init_module: switch-robo: No such device
Using /lib/modules/2.4.30/switch-adm.o
b44: eth0: Link is up at 100 Mbps, full duplex.
b44: eth0: Flow control is off for TX and off for RX.
nvram_commit(): start
nvram_commit(): end
Creating jffs2 partition... done
creating directories... mkdir: Cannot create directory `.': File exists
mkdir: Cannot create directory `/jffs': File exists
done
setting up symlinks... done
setting up dropbear (takes a while)...Will output 1024 bit dss secret key to 'e'
Generating key, this may take a while...
Public key portion is:
ssh-dss AAAAB3NzaC1kc3MAAACBANCiGlwYhV6DFCU8LeO3J+qoxczurlWJJwivxsZvRT6xeXhIyX2=
Fingerprint: sha1 c4:fb:41:df:c7:9f:9d:be:a3:af:25:a0:59:9e:73:69:5b:56:7c:c7
Changing password for root
Enter the new password (minimum of 5, maximum of 8 characters)
Please use a combination of upper and lower case letters and numbers.
Enter new password:
Bad password: too simple.
Warning: weak password (continuing).
Re-enter new password:
Password changed.
done
umount: /rom/dev: Device or resource busy
init started: BusyBox v1.01 (2006.04.12-12:05+0000) multi-call binary
nvram_commit(): start
nvram_commit(): end
The system is going down NOW !!
Sending SIGTERM to all processes.
Sending SIGKILL to all processes.
Please stand by while rebooting the system.
Restarting system.
Please stand by while rebooting the system...
Decompressing..........done
Here we try to capture the default reset button: None.
Warning! invalid default profile, please update it first.
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Fri May 14 09:44:24 CST 2004 (denny@dnylinux)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena.
Initializing Devices.
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.9.0
CPU type 0x29007: 200MHz
Total memory: 0x800000 bytes (8MB)
Total memory used by CFE: 0x80300000 - 0x80434F90 (1265552)
Initialized Data: 0x8032F0A0 - 0x803313D0 (9008)
BSS Area: 0x803313D0 - 0x80332F90 (7104)
Local Heap: 0x80332F90 - 0x80432F90 (1048576)
Stack Area: 0x80432F90 - 0x80434F90 (8192)
Text (code) segment: 0x80300000 - 0x8032F0A0 (192672)
Boot area (physical): 0x00435000 - 0x00475000
Relocation Factor: I:00000000 - D:00000000
Device eth0: hwaddr 00-01-E3-0F-2F-12, ipaddr 192.168.2.1, mask 255.255.255.0
gateway not set, nameserver not set
Reading :: Failed.: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3704 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007
Primary instruction cache 8kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 4kB, 2-way, linesize 16 bytes.
Linux version 2.4.30 (root@pcacer) (gcc version 3.4.4 (OpenWrt-1.0)) #1 So Mär 6
Setting the PFC value as 0x15
Determined physical RAM map:
memory: 00800000 @ 00000000 (usable)
On node 0 totalpages: 2048
zone(0): 2048 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/pr0
CPU: BCM4712 rev 1 at 200 MHz
Using 100.000 MHz high precision timer.
Calibrating delay loop... 199.47 BogoMIPS
Memory: 6196k/8192k available (1399k kernel code, 1996k reserved, 96k data, 80k)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
PCI: Fixing up bus 0
PCI: Fixing up bridge
PCI: Fixing up bus 1
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
Squashfs 2.1-r2 (released 2004/12/15) (C) 2002-2004 Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI ed
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
b44.c:v0.93 (Mar, 2004)
eth0: Broadcom 47xx 10/100BaseT Ethernet 00:01:e3:0f:2f:12
Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Flash device: 0x400000 at 0x1c000000
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
.......
......
BusyBox v1.01 (2006.04.12-12:05+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
_______ ________ __
( ).-----.-----.-----.) ) ) ).----.) )
( - )) _ ) -__) )) ) ) )) _)) _)
(_______)) __)_____)__)__))________))__) )____)
)__) F R E I F U N K F I R M W A R E
root@OpenWrt:/#
So it did, it run’s!
Ausgehend von der ff-Firmware Version kann man nun bequem via webfrondend ein openwrt-wrt54g-squashfs.bin installieren. Das bootet danach auch ohne probleme
Als nächstes installiert man die USB kernal module und scripte.
ipkg install kmod-usb-core kmod-usb-ohci kmod-usb-storage kmod-vfat kmod-nfs kmod-ext2
Installing kmod-usb-storage (2.4.30-brcm-3) to root... Downloading http://downloads.openwrt.org/whiterussian/packages/kmod-usb-storage_2.4.30-brcm-3_mipsel.ipk Installing kmod-usb-core (2.4.30-brcm-3) to root... Downloading http://downloads.openwrt.org/whiterussian/packages/kmod-usb-core_2.4.30-brcm-3_mipsel.ipk Installing lsusb (0.71-1) to root... Downloading http://downloads.openwrt.org/whiterussian/packages/lsusb_0.71-1_mipsel.ipk Installing libusb (0.1.10a-1) to root... Downloading http://downloads.openwrt.org/whiterussian/packages/libusb_0.1.10a-1_mipsel.ipk undsoweiter alles was man für USB eben so braucht. . .
Läuft soweit alles wunderbar.
Nur hat der USb treiber ein problem. Steckt man einen USB-stick ein, so wird dieser erkannt. Leider scheitert der Treiber dann daran dem USB geräte einen Interrupt zuzuweisen.
Und ohne diese Zuweisung geht nichts.
— Bernd 2006/09/02 15:04