Browsed by
Category: Computer Projects

Computer projects I’m working on

WiiMu A01 (Work in Progress)

WiiMu A01 (Work in Progress)

This is an information dump of the WiiMu A01 in hopes of instituting audio control with the OpenWRT firmware.

PCB Silkscreen:

MVSILICON& WiiMu A01 V2.0 2013.03

Default firmware:

Kernel:

Busybox Linux 2.6.21, built from the Ralink SDK

Modules:

printk, 8250, rt_rdm, rt2860v2_ap, block2mtd, ohci_hcd, snd_timer, snd_seq_oss, snd_soc_core, nf_nat_ftp, rcupdate, rd, ppp_async, scsi_mod, usbcore, usb_storage, snd_pcm, snd_seq, nf_conntrack, iptable_filter, n_hdlc, loop, pppopptp, sg, ehci_hcd, snd, snd_pcm_oss, snd_seq_dummy, nf_conntrack_ftp, tcp_cubic

Libs:

  • libintl.so
  • libresolv-0.9.28.so
  • libintl-0.9.28.so
  • libnsl-0.9.28.so
  • libuClibc-0.9.28.so
  • libpthread.so
  • libnsl.so
  • libcrypt.so
  • libm-0.9.28.so
  • libnvram.so.0
  • libintl.so.0
  • libupnp.so.1.3.1
  • libutil-0.9.28.so
  • libm.so
  • libntfs-3g.so.26
  • libutil.so.0
  • libresolv.so
  • libcrypt-0.9.28.so
  • libc.so
  • libdl-0.9.28.so
  • libutil.so
  • libiw.so.29
  • libixml.so.1.3.1
  • libcrypt.so.0
  • libm.so.0
  • libnvram-0.9.28.so
  • libc.so.0
  • libdl.so
  • libnvram.so
  • libnsl.so.0
  • libdl.so.0
  • libthreadutil.so.1.3.1
  • libpthread-0.9.28.so
  • ld-uClibc-0.9.28.so
  • libpthread.so.0
  • libresolv.so.0
  • ld-uClibc.so.0
  • 2.6.21/kernel/drivers/net/wireless/rt2860v2_sta/rt2860v2_sta.ko
  • 2.6.21/kernel/drivers/char/hw_random/rng-core.ko

Unpacking the root_uImage upgrade:

Using binwalk, specifically

binwalk -Me root_uImage

I was able to extract the root_uImage

Audio DAC

My unit had the DAC markings sanded off, but from /proc/asound/cards, DAC appears to be an Everest Semiconductor ES8155. According to their product sheet, it is a 2-channel DAC in QFN-28 package.

  • SNR: 96 dB
  • THD+N: -85 dB
  • Headphone Amp: Yes
  • Line Driver: Yes
  • PLL: Yes
  • Additional Function: 3-band PEQ
  • Supply Voltage: 1.5 to 3.6 V
  • Low Power: 7 mW
OpenWRT on the DIR-615 Rev. A1 (Marvell 88F5181L) [Work In Progress]

OpenWRT on the DIR-615 Rev. A1 (Marvell 88F5181L) [Work In Progress]

This article will document the process of making OpenWRT work on the DIR-615 rev. A1.

In its dmesg, the stock firmware reports this board as “Marvell Development Board (LSP Version 0.0.102)– RD-88F5181L-VOIP-FE”.

In the GPL’d source code available from D-Link [FTP], in DIR-615A1-GPL.tgz (inside the downloaded file), in Noahsark/platform/MVL5181/linux/arch/arm/mach-mv88fxx81/Board/boardEnv/DB_88FXX81/mvBoardEnvSpec.h, a search for “RD-88F5181L-VOIP-FE” reveals a list of constants that pertain to the board. (See attached .XLS file)

I created Board ID# 4262 at the ARM Linux website to describe this board.(This document from Nas-Central.org explains why this needs to be done, and goes into detail about how to get support for your particular Orion board type in the mainline Linux kernel. This only ever needs to be done once for each type of board defined on the ARM Linux site, so consider it “already done” for the D-Link DIR-615 and/or the Marvell RD-88F5181L-VOIP-FE reference board.)

Update (25-Jul-2012): I just received my Dangerous Prototypes Bus Blaster to allow me to use JTAG with either OpenOCD or urjtag, among others. It seems that the resistor and capacitor footprints beside the JTAG header need to be populated to allow JTAG access. Proper SMD resistors and caps are part of my next DigiKey order.

Unbricking a D-Link DIR-615 Rev A1

Unbricking a D-Link DIR-615 Rev A1

I have managed to unbrick a D-Link DIR-615 Rev A1 back to D-Link firmware (1.00) from firmware 1.10. Allow me to describe the situation:

  • Given a direct connection to my laptop, the router does not respond to HTTP requests on either WAN or LAN, does not assign DHCP IP addresses, cannot ping or respond to pings, but does show up on the laptop in the ARP tables (arp -an). (This same setup has worked for numerous non-bricked routers, so it seems that some busybox functionality is corrupt.)
  • Over serial, the uBoot bootloader cannot connect to a TFTP server (and does not have the ability to flash over serial).

Attached to this article is a log of one of these so-called “failboots”. It can be easily identified as it only one block of text following the BusyBox ash shell:

BusyBox v1.1.0 (2007.07.26-06:29+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
/ # pc : [<40146968>] lr : [<400ca0b8>] Not tainted
sp : befaf8a0 ip : 00000002 fp : 40079bf8
r10: 00000003 r9 : 40079bb8 r8 : 00050500
r7 : befb5c75 r6 : 00026740 r5 : befb5c74 r4 : 0002674a
r3 : 00000065 r2 : 0000000a r1 : 00026741 r0 : 400ca0b7
Flags: nzCv IRQs on FIQs on Mode USER_32 Segment user
Control: A005317F Table: 01DF0000 DAC: 00000015

A successful bootup (log also attached) is followed by much more serial chatter, such as bringing up interfaces, mounting flash, etc.

BusyBox v1.1.0 (2007.01.24-07:26+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
/ # cp -f /etc/nvram.default /var/etc
mount -t jffs2 /dev/mtdblock2 /flash
cp -f /flash/nvram.conf /var/etc
brctl addbr br0
brctl stp br0 off
brctl setfd br0 0
brctl addif br0 eth1
device eth1 entered promiscuous mode
[... etc ...]

To recover your device:
(Warning: This might damage your device; however, if you are in need of these instructions, I don’t think it’s possible to damage it any more.)

1) Solder on serial headers to CON5 (on the side opposite of the mini-PCI slot)

2) With an Ethernet cable, connect the DIR-615’s WAN port to one of the LAN ports of another router, as it doesn’t play well otherwise. (It seems to need an intermediary to handle ARP tables for it while bricked like this)

3) Power it on, let it boot up, and over the serial connection to the router, run “ipconfig eth0 192.168.1.25” or some other memorable IP address that’s in the same subnet as your computer

4) Again, over serial connection to the router, run “tftpd”

5) On your computer, download the firmware from DLink: ftp://ftp.dlink.com/Gateway/dir615/Firmware/dir615_firmware_100.bin

6) And with a tftp client (See Installing OpenWRT via TFTP (Bootloader contains TFTP Server)), upload the .bin file to the router.

The router will flash itself, then reboot, and erase the (dirty) NVRAM. It will set itself to the default 192.168.0.1.

The key, I believe, lies in installing a version of firmware that is not currently installed, so as to erase all NVRAM settings. If you try to reinstall the same firmware, it will not clear the device’s (faulty) settings. In other words, there may be a much easier way to debrick the device, however with the limited (and possibly corrupt) BusyBox commands, I took the first viable option I could get.

I hope this works for you as it did for me, but as usual, ‘no promises’.

How to convert .RMT to .BIN for OpenRG Bootloader (RGLoader)

How to convert .RMT to .BIN for OpenRG Bootloader (RGLoader)

I recently encountered a situation while loading firmware into an Actiontec MI424-WR router, when I found myself without a bootable firmware, and the OpenRG bootloader would vehemently refuse to load .rmt files.

The MI424-WR has two sections in its Flash for firmware. The stock firmware available from Actiontec is, of course, a RMT. (I did in fact have the .bin dump of the entire flash chip, but I wasn’t about to attempt to make the bootloader overwrite itself.)

After comparing hex dumps, I came to the conclusion that .rmt files are .bin files with a 148-byte header. All you have to do to create a .bin that is ready to be downloaded by the router is to use the following command:

dd if=firmware.rmt of=firmware.bin bs=1 skip=147

Such that the resulting “firmware.bin” file begins with 0xE2 0x8F 0xA0 like other .img files built for this router. I’m not sure if the “magic” will be the same for other machines, but that’s what it seems to be for the MI424-WR running on the stock bootloader (OpenRG).

I hope this saves someone some hassle. As usual, no guarantees of accuracy or completeness 😉

WIP: DIR-615 rev C1 Hacking

WIP: DIR-615 rev C1 Hacking

In my most recent thrift store trips, I found (among other things) a large quantity of D-Link DIR-615 Rev C1.

Some relevant linkage:

Things on my TODO List:

  • Add a USB port and/or hub, and supporting components
  • Add a third antenna (requires a lot of supporting components)
  • Install Kismet and gpsd for a mobile wardriving box?
  • Add I2C Bus over GPIO
  • Add SD Card Support over GPIO?
USB Host on HP Touchpad: Progress…

USB Host on HP Touchpad: Progress…

To access USB Host mode on the Touchpad (to plug in a Keyboard/USB Drive/etc), you need:

  1. A microUSB to USB Female cable (USB-OTG cable), available on ebay for ~$3, shipped [search ‘USB-OTG cable’]
  2. A powered USB Hub (a USB Hub with a spot to plug in an external power supply), available on ebay for under $10, shipped, with power supply  [Search ‘powered usb hub’]

All you need to do is plug the USB Hub into the OTG adapter, and the OTG Adapter into the Touchpad. Power it with a wall adapter, and you’ll have USB devices showing up in dmesg in no time!

For example:

[16075.755719] usb 1-1.1: new high speed USB device using msm_hsusb_host and address 3
[16075.775744] get_port_status port=1,portstatus=1503, portchange=10
[16075.868006] usb 1-1.1: New USB device found, idVendor=13fe, idProduct=3323
[16075.868111] usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[16075.883769] usb 1-1.1: Product: STORE N GO
[16075.883821] usb 1-1.1: Manufacturer: Verbatim
[16075.894000] usb 1-1.1: SerialNumber: 070007A315074099E8C5
[16075.922270] scsi1 : usb-storage 1-1.1:1.0
[16075.944010] get_port_status port=1,portstatus=1503, portchange=0
[16076.953338] scsi 1:0:0:0: Direct-Access     Verbatim STORE N GO       5.00 PQ: 0 ANSI: 0 CCS
[16076.993863] sd 1:0:0:0: Attached scsi generic sg0 type 0
[16077.204050] sd 1:0:0:0: [sda] 7802880 512-byte logical blocks: (3.99 GB/3.72 GiB)
[16077.204665] sd 1:0:0:0: [sda] Write Protect is off
[16077.216317] sd 1:0:0:0: [sda] Mode Sense: 23 00 00 00
[16077.216329] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.219671] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.227274]  sda: sda1
[16077.237134] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.237234] sd 1:0:0:0: [sda] Attached SCSI removable disk

To be fair, there is most likely a way to enable the Touchpad to power USB OTG devices itself, which would remove the need for the powered hub.

See also: http://forums.precentral.net/hp-touchpad/296505-functional-usb-host-touchpad.html and http://www.youtube.com/watch?NR=1&v=rXRcvN50-nU, which suggest using a USB Y-cable to inject power, and from which I blatantly stole the idea of using a powered USB hub 😉

So far I have tried a USB thumbdrive and a wireless mouse dongle; the thumbdrive was detected flawlessly, while the mouse’s dongle was not.

HP Touchpad Hardware [Preliminary]

HP Touchpad Hardware [Preliminary]

Although this is an article on hardware, I’m going to be using software to probe it. This is from a 32GB HP Touchpad, though the 16GB should be the same, barring the difference in storage.

/proc/cpuinfo:

Processor       : ARMv7 Processor rev 2 (v7l)
processor       : 0
BogoMIPS        : 13.52

Features        : swp half thumb fastmult vfp edsp neon vfpv3
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0x02d
CPU revision    : 2

Hardware        : TENDERLOIN
Revision        : 0000
Serial          : 0000000000000000

The touchpad runs on a Qualcomm Snapdragon dual-core CPU, so I would take this output with a grain of salt: It’s only showing one core, and my touchpad is in powersave mode, so the bogomips, as usual, is way off.

Now for the more interesting stuff, like i2c devices.

cat /sys/bus/i2c/devices/*/name: (with annotations)

mt9m113– Aptina Webcam SoC

  • /sys/devices/i2c-1/1-0078

a6_0 – Battery monitor – Battery?

  • /sys/devices/i2c-3/3-0031
  • This one seems to have information on voltage, charge percentage, etc.
  • Seems to be the battery monitor
  • Here are the values/categories for the Veer (for comparison and info)
  • A6 Version: HW: 255, FW (M.m.B): 2.13.25, ManID: 28769, ProdTyp: 1281

a6_1 – Battery monitor – Charger?

  • /sys/devices/i2c-3/3-0032
  • This one has info in acc_data_*, but not voltage
  • Seems to be the battery charging circuit
  • A6 Version: HW: 255, FW (M.m.B): 2.7.23, ManID: 28769, ProdTyp: 1793

LM8502– National Semiconductor “Smart Lighting” IC

  • /sys/devices/i2c-3/3-0033
  • Fun: The LM8502 driver brings out the vibrator, LEDs (home button LEDs?), flash (for camera? I dont’ think the TP has one),

wm8958– Wolfson Microelectronics Audio Hub w/ 3 Digital Audio interfaces & DSP

  • /sys/devices/i2c-4/4-001a
  • Fun: Driver brings out some GPIO pins

maXTouch– Atmel’s family of “Unlimited-Touch” Touchscreen controllers

pm8058-core – Qualcomm Power Management IC

  • /sys/devices/i2c-6/6-0055
  • The datasheet for this one is kept under wraps?
  • From what the driver brings out, we can see that it controls power to the charger, GPIO, MPP (Multi-Purpose Pins), PWM, Power button, RTC, TM (IC Temperature Monitor), UPL(?), and the vibrator

pm8901-core – Qualcomm Power Management IC (No datasheet?)

  • /sys/devices/i2c-7/7-0055
  • The datasheet for this one is kept under wraps?
  • The driver brings out MPP (Multi-Purpose Pins), regulators, and a Temperature Monitor.
  • (Maybe this one is used for large loads, whereas the pm8058 is for smaller loads?)

QUP I2C adapter – (Six) – Qualcomm Universal Peripheral [cite]

  • /sys/devices/i2c-0 all the way through i2c-5

MSM SSBI adapter – (Three) – Qualcomm MSM-series “Single-Wire Serial Bus Interface” [cite]

  • /sys/devices/i2c-6 through i2c-8

cat /etc/fstab:

  • # <filesystem>  <mount point>   <type>  <options>       <dump>  <pass>
  • rootfs  /       ext3    ro,suid,dev,exec,auto,nouser,async,noatime      1       1
  • /dev/mapper/store-var   /var    ext3    noatime,data=writeback  0       0
  • /dev/mapper/store-cryptodb      /var/db ext3    noauto,noatime,data=ordered     0       0
  • /dev/mapper/store-cryptofilecache       /var/file-cache ext3    noauto,noatime,user_xattr       0       0
  • /dev/mapper/store-log   /var/log        ext3    noatime 0       0
  • /dev/mapper/store-update        /var/lib/update ext3    noauto,noatime  0       0
  • proc    /proc   proc    defaults        0       0
  • devpts  /dev/pts        devpts  mode=0620,gid=5 0       0
  • tmpfs   /tmp    tmpfs   size=40M,mode=1777      0       0
  • tmpfs   /var/run        tmpfs   size=16M,mode=1777      0       0
  • tmpfs   /var/tmp        tmpfs   size=32M,mode=1777      0       0
  • tmpfs   /media/ram      tmpfs   defaults        0       0
  • /dev/mapper/store-media /media/internal vfat    utf8,shortname=mixed,umask=0000 0       0

/dev/input/event0 is the home button and volume button device
/dev/input/event1 is the power button device
/dev/bt_uart is the Bluetooth serial stream

/proc/tty/drivers: (showing some promising signs of USB-Host ability)

/dev/tty             /dev/tty        5       0 system:/dev/tty
/dev/console         /dev/console    5       1 system:console
/dev/ptmx            /dev/ptmx       5       2 system
/dev/vc/0            /dev/vc/0       4       0 system:vtmaster
usbserial            /dev/ttyUSB   188 0-253 serial
acm                  /dev/ttyACM   166 0-31 serial
msm_serial_hsl       /dev/ttyS     243 0-3 serial
pty_slave            /dev/pts      136 0-1048575 pty:slave
pty_master           /dev/ptm      128 0-1048575 pty:master
pty_slave            /dev/ttyp       3 0-255 pty:slave
pty_master           /dev/pty        2 0-255 pty:master
smd_tty_driver       /dev/smd      253 0-36 serial
unknown              /dev/tty        4 1-63 console

More to come.

How to make a 5-Bay NAS Box for under $400

How to make a 5-Bay NAS Box for under $400

What you will need:

Reasoning:

  • Case: If space and/or looks are an issue, get a Lian Li PC-Q08, otherwise just get any generic case that will accept a Mini-ITX board and 5 (or 6, like the PC-Q08) hard drives. I chose the PC-Q08 because it was the only reasonably small, well-ventilated case for Mini-ITX and six 3.5″ drives. (It can also hold a 2.5″ hard drive in a space underneath the 5.25″ bay, as I’ll discuss later)
  • Power Supply: I went with the SeaSonic 350W SS-350ET as it was one of the lowest-powered models available (except for the 300W version, which seems to be hard to find), and was from a reputable power supply manufacturer. It supports ATX2.31 and has received the 80 Plus Bronze rating for efficiency. Although it is still overkill for what will be going into this machine, it will allow for adding a graphics card for HTPC use if you decide to go that route either now or in the future.
  • Motherboard/CPU: ASUS E35M1-I — If you are going to use your NAS as an HTPC as well, get the Deluxe version. If you’re going all-out for storage capacity, get the regular, non-deluxe one (The regular has 6 SATA ports, Deluxe only has 5)
  • RAM: This is a bit of a tricky one, as the motherboard tops out at PC3-8500 (DDR3-1066), single channel. That speed of memory is pretty scarce compared to its faster sibling, PC3-10666, and if nothing else, the PC3-10666 will give you more stability. I’d recommend the Mushkin 996992 Silverline PC3-10666 8GB (2x4GB Kit) as it fills the motherboard up to its maximum for memory without breaking the bank.

    I couldn’t get my hands on the Mushkin 996992 memory, and the Mushkin 997667
    Blackline PC3-12800 8GB (2x4GB Kit)
    was actually cheaper than buying two no-name, bottom-of-the-barrel 4GB sticks of PC3-10666 memory.

    My reasoning for maxing out the memory is that we can use this later on to set up RAM drives (tmpfs) to speed up generic tasks and keep our drives spun down longer to save power. If this isn’t your cup of tea, feel free to grab whatever memory best suits your needs.

  • Hard Disk (OS): For power savings, I opted to use a 2.5″ drive for my system disk as it takes substantially less power to operate. I considered a Seagate Momentus XT for the added benefit of having a small amount of SSD storage, but the benchmarks for a server-type machine don’t support spending the extra money. I settled on a WD Scorpio Black 500GB drive (WD5000BEKT)

    As an added bonus, the Lian Li case that I discussed earlier has a special hiding spot for a 2.5″ drive so that it won’t take up any of the 3.5″ bays (leaving a whopping 6 3.5″ bays for possible RAID storage! Unfortunately, the motherboard only has 6 SATA ports, though if you really wanted to have a 6-bay RAID, you could always add a SATA board in the PCIe slot.)

  • Hard Disks (RAID): For this build, I will be making a RAID out of Western Digital Green 2TB SATA-II drives (WD20EARS).

    As of this writing, 2TB drives have the lowest Cost/GB of any 3.5″ drive. 3TB drives, while available, are disproportionately expensive as they are still solely in the realm of the early adopter.

    A RAID 5 setup requires (as a bare minimum) 3 drives. You can always add more in later; the RAID array will just expand to accommodate the extra space.

    Unfortunately, whereas most Western Digital drives used to have a feature known as TLER (Time-Limited Error Recovery) [Wikipedia] hidden in the firmware, this feature now seems to be only available on Enterprise-level drives. This isn’t a problem for Linux software RAID (mdadm) as it just waits for the drive to complete its recovery, but may be a problem if you plan on using a RAID controller card.

WIP: Cantenna

WIP: Cantenna

This shows step by step how I made a Cantenna. This is a simplified tl;dr version of “How to build a tin can waveguide antenna” by Gregory Rehm.

Materials:

  • 1x Can, washed (hapi HOT Wasabi Peas [450g])
  • 1x N-type, Female Chassis-mount connector (Digikey# 367-1081-ND)
  • 1x Piece of copper wire
  • 4x Nuts & bolts

Prep:

  1. Measure diameter of the can -> 3.9″
  2. Calculate wavelength using waveguide calculator found here.
  3. Mark a point 1/4 Wavelength up from the bottom (closed) side of the can.
  4. Measure the hole to be cut (diameter of part of the connector that will be going inside the can) -> 0.43″
  5. Drill marked point to measured diameter (0.43″)
  6. Dry-fit the connector, and mark holes for the screws or nuts/bolts (if any)
  7. Drill marked points to the diameter of your connector’s holes (if any)
  8. Cut a piece of copper wire so that when it is in the copper sleeve on the connector, the total length of the copper sleeve and piece of copper is exactly 1.21″ (or as close as you can humanly get to it), and solder it in place.
  9. Mount the connector in the hole in the can and secure it with screws or nuts/bolts (if any). Make sure to mount the heads of the screws or bolts inside the can to reduce antenna obstruction.