This is not a difficult project, I already added SD/MMC card to my WRT54GL about 2,5 years ago. The difference is that there isn’t much guide about the hardware part (which GPIO pins to solder), and the software part (how to activate the drivers). So here is a short guide to anyone who needs it. Note that I already installed OpenWRT Kamikaze using the guide from: OpenWRT site.

This is what the front side of PCB looks like:

On the bottom right, you can connect a serial port (note: 3.3V, you will need MAX3232 or use a data cable from phone, don’t connect directly). Many guides are already available for connecting serial port (for example: here, here, here, and here), so I wont write about it. Just note that you will use the 3.3V and GND for the SD card mod.

This is what the PCB looks like from the back:

I found the GPIO pins from this posting by guidoa:


1: SES Button Blue led (Enable=ON)
2: WiFi led
3: SES Button Red led (Enable=ON)
4: SES Button (Pressed=01)
6: Reset Button (Pressed=01)
7: Status led (Enable=ON)

I have confirmed it using voltmeter and gpioctl command line tool. The SES button is the button on the right side of the unit. As far as I know, SES button, and the LEDS (red and blue) are not used by default, the Wifi LED is used to indicate Wifi ON/OFF. So we can use GPIO 1,3,4. We need another one: we can use GPIO 6 or 7. Since The status led is not used, I prefer GPIO 7. You can see the location of the GPIO pins that I used from the above picture.

Now, look at the SD Card Pinout (you can search it in Google, or just look here).
You need to connect SD Pin 4 to to 3.3V (see the serial port above), Pin 3 and 6 to GND. The rest is up to you (we will configure this later in software). This is what I use:

• Pin 2 (Data In/MOSI) to GPIO 4 (SES Button)
• Pin 7 (Data Out/MISO) to GPIO 7 (Status LED)
• Pin 5 in SD Card (CLK) to GPIO 1 (blue LED)
• Pin 1 in SD Card (Chip Select) to GPIO 3 (red LED)

After you solder them, you need to install these packages using opkg: kmod-mmc, kmod-mmc-over-gpio, kmod-mmc-spi, kmod-spi-bitbang, and kmod-spi-gpio. We need to edit /etc/init.d/mmc_over_gpio. The line that you are looking for is the add_device "default". There are some numbers in the following order DI, DO, CLK, CS and SPI_MODE. You need to fill in the GPIO that you use for each of that pins and just fill in 0 for SPI_MODE. In my case I edit the line to become: add_device "default" 4 7 1 3 0.

Now I can start the SD card using: /etc/init.d/mmc_over_gpio start. You can now mount the card. To remove the card, umount the card and /etc/init.d/mmc_over_gpio stop. The SD card speed is to slow, I will look on to this later, but for now the speed is enough for me.

This is my final result (I am really lousy at soldering):

Doesn’t look too bad from the outside for the SD Card:

But I made a stupid mistake for the RS232 port. I put the port on the wrong place, and I can not drill for the screw on the right side of the port. Fortunately this is not fatal, I just glued the port to the casing.

Update This is the dmesg log after /etc/init.d/mmc_over_gpio start

gpio-mmc: Failed to request mmc_spi module.
mmc_spi spi32765.0: SD/MMC host mmc0, no DMA, no WP, no poweroff
gpio-mmc: MMC-Card "default" attached to GPIO pins di=4, do=7, clk=1, cs=3
mmc_spi spi32765.0: can't change chip-select polarity
mmc0: new SD card on SPI
mmcblk0: mmc0:0000 SD512 495488KiB
 mmcblk0: p1

Update 9 April 2010 to make it clear, this is the picture of the back side of the pcb after soldering:

http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/arm/econa/

I asked in the freebsd-arm mailing list if anyone would like to donate me a CNS21XX device, and Stefan Bethke immediately offered me to buy one for me. I bought the device from dealextreme with the money donated to me. It took 9 days until it arrived.

Meanwhile John Nicolls from ThinkLinx sent me a Hot-e, a device based on AT91SAM9G20. I told him that I have received mr Stefan offer, but he said I can work on it anytime I want it. Since the Hot-e arrived earlier, I have managed to get it to boot. At first i was going to use the work from Sylvestre Gallon on at91sam9621(mailing list archive), but it turns out that it is not usable yet.

I have fixed the clock computation in at91_pmc.c, and currently writing a new timer driver (at91_pit.c), because the system timer device (at91_st.c) no longer exists in AT91SAM9G20. Currently the timer device is still not working properly, but I think I will be able to get it work this week.

When the CNS211XX LAN device finally arrived, I stopped the work for Hot-e for a while to test the new device. I bought a CA-42 cable to connect to it, but I can’t send anything to the device. I thought that the device was faulty, but turns out that the cable is faulty. I was disappointed because usually I used that type of cable (it is cheap only 132 baht or 4 usd). Fortunately I still have one MAX3232, and I can make my own cable.

I think porting CNS21XX will not be so difficult. I made some small adjustment for the serial port driver to make it show something. Memory mapping is different compared to CNS11XX, but that can easily be adjusted. The Interrupt controller is different, so I need to rewrite some parts. After it works, EHCI/OHCI was working fine. The network driver will need major adjustment (may be I will just write a new driver for this one), and the device doesn’t use CFI for Flash, it uses SPI, so I will need to write a driver for SPI bus.

For CNS11XX and CNS21XX You can see my progress in this wiki page:
http://wiki.freebsd.org/FreeBSDcns11xx

The remaining drivers that needs to be written are the OHCI and network. The OHCI shouldn’t take too much time, but I think the network will take quite a long time.

I was planning to clean up, and release the code today, but I was busy with something else, so may be I will release the code in the next few days. For those of you who are curious about the boot log, here it is:

KDB: debugger backends: ddb
KDB: current backend: ddb
Copyright (c) 1992-2009 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 8.0-CURRENT #169: Sun May 10 01:25:55 WIT 2009
    yohanes@cameron:/usr/home/yohanes/freebsd/freebsd/src/sys/arm/compile/CNS11XXNAS
WARNING: DIAGNOSTIC option enabled, expect reduced performance.
Preloaded elf kernel "elf kernel" at 0xc12d30b8.
unknown CPU (ID = 0x66015261)
  WB enabled LABT
  16KB/16B 2-way Instruction cache
  16KB/16B 2-way write-back-locking-B Data cache
real memory  = 67108864 (64 MB)
Physical memory chunk(s):
00000000 - 0xffffff, 16777216 bytes (4096 pages)
0x1337000 - 0x3eaefff, 45580288 bytes (11128 pages)
avail memory = 61718528 (58 MB)
ULE: setup cpu 0
nfslock: pseudo-device
null: <null device, zero device>
random: <entropy source, Software, Yarrow>
mem: <memory>
econaarm0: <ECONA device bus> on motherboard
econa add children
econa add child econa_ic addr 7d000000
econa add child uart addr 78000000
econa add child timer addr 79000000
econa add child ehci addr f8000000
econa_alloc_resource start 00000000 end ffffffff, count = 00000008
econa_alloc_resource start 00000000 end ffffffff, count = 00000008
econa_alloc_resource start 78000000 end 78ffffff, count = 01000000
sys_res_memory
Alloc OK
econa_alloc_resource start 00000000 end ffffffff, count = 00000008
econa_alloc_resource start 00000000 end ffffffff, count = 00000008
econa_alloc_resource start 78000000 end 78ffffff, count = 01000000
sys_res_memory
Alloc OK
uart0: <Non-standard ns8250 class UART with FIFOs> mem 0x78000000-0x78ffffff irq 10 on econaarm0
econa_alloc_resource start 00000000 end ffffffff, count = 00000008
econa_alloc_resource start 78000000 end 78ffffff, count = 01000000
sys_res_memory
Alloc OK
econa_alloc_resource start 00000000 end ffffffff, count = 00000001
econa_alloc_resource start 0000000a end 0000000a, count = 00000001
sys_res_irq
Alloc OK
uart0: [FILTER]
uart0: fast interrupt
uart0: console (38461,n,8,1)
timer0: <Econa CPU Timer> mem 0x79000000-0x79ffffff irq 0,1 on econaarm0
econa_alloc_resource start 00000000 end ffffffff, count = 00000001
econa_alloc_resource start 79000000 end 79ffffff, count = 01000000
sys_res_memory
Alloc OK
econa_alloc_resource start 00000000 end ffffffff, count = 00000001
econa_alloc_resource start 00000000 end 00000000, count = 00000001
sys_res_irq
Alloc OK
STR9100 CPU Clock: 200 MHz
HZ = 100
reload value = 500000
IRQ Timer1 at int #0x0 clock 100000000(Hz)
timer0: [FILTER]
DONE timer
done00000000
ehci probe
ehci probe
ehci0: <CNS11XX USB EHCI> mem 0xf8000000-0xffffffff irq 24 on econaarm0
econa_alloc_resource start 00000000 end ffffffff, count = 00000001
econa_alloc_resource start f8000000 end ffffffff, count = 08000000
sys_res_memory
Alloc OK
econa_alloc_resource start 00000000 end ffffffff, count = 00000001
econa_alloc_resource start 00000018 end 00000018, count = 00000001
sys_res_irq
Alloc OK
add USB device
setup intr
ehci0: [MPSAFE]
ehci0: [ITHREAD]
init ehci
usbus0: EHCI version 1.0
probe and attach
usbus0: <CNS11XX USB EHCI> on ehci0
done
initcloks
enabling timer
Timecounter "CPU Timer" frequency 50000000 Hz quality 1000
Timecounters tick every 10.000 msec
usbus0: 480Mbps High Speed USB v2.0
WARNING: DIAGNOSTIC option enabled, expect reduced performance.
ugen0.1: <Cavium> at usbus0
uhub0: <Cavium EHCI root HUB, class 9/0, rev 2.00/1.00, addr 1> on usbus0
uhub0: 2 ports with 2 removable, self powered
ugen0.2: <Kingston> at usbus0
umass0: <Kingston DataTraveler 2.0, class 0/0, rev 2.00/1.00, addr 2> on usbus0
umass0:  SCSI over Bulk-Only; quirks = 0x0000
register sim 0
scanning the sim
umass0:0:0:-1: Attached to scbus0
(probe0:umass-sim0:0:0:0): TEST UNIT READY. CDB: 0 0 0 0 0 0
(probe0:umass-sim0:0:0:0): CAM Status: SCSI Status Error
(probe0:umass-sim0:0:0:0): SCSI Status: Check Condition
(probe0:umass-sim0:0:0:0): UNIT ATTENTION asc:28,0
(probe0:umass-sim0:0:0:0): Not ready to ready change, medium may have changed
(probe0:umass-sim0:0:0:0): (probe0:umass-sim0:0:0:0): TEST UNIT READY. CDB: 0 0 0 0 0 0
(probe0:umass-sim0:0:0:0): UNIT ATTENTION asc:28,0
(probe0:umass-sim0:0:0:0): Not ready to ready change, medium may have changed
Retrying Command (per Sense Data)
(probe0:umass-sim0:0:0:0): Retrying Command
pass0 at umass-sim0 bus 0 target 0 lun 0
pass0: <Kingston DataTraveler 2.0 1.00> Removable Direct Access SCSI-2 device
pass0: 40.000MB/s transfers
da0 at umass-sim0 bus 0 target 0 lun 0
da0: <Kingston DataTraveler 2.0 1.00> Removable Direct Access SCSI-2 device
da0: 40.000MB/s transfers
da0: 1906MB (3903578 512 byte sectors: 255H 63S/T 242C)
GEOM: new disk da0
GEOM_LABEL: Label for provider da0s1a is ufsid/4a01b053676144f3.
GEOM_LABEL: Label for provider da0s1a is ufs/FreeBSDonUSB.
root_mount_prepare 100

Manual root filesystem specification:
  <fstype>:<device>  Mount <device> using filesystem <fstype>
                       eg. ufs:/dev/da0a
  ?                  List valid disk boot devices
  <empty line>       Abort manual input

mountroot> ufs:da0s1a
Trying to mount root from ufs:da0s1a
warning: no time-of-day clock registered, system time will not be set accurately
start_init: trying /sbin/init
Enter full pathname of shell or RETURN for /bin/sh:
# ls /
.snap		dev		media		root		usr
COPYRIGHT	etc		mnt		sbin		var
bin		lib		proc		sys
boot		libexec		rescue		tmp

My wife was happy with her Asus EEE 701, but she would like something better with the same size. We sold the old Asus 701 to my brother, and she bought Asus EEE 900A. Compared to EE PC 701, the EEE PC 900A has a faster processor (Intel Atom 1.6 ghz vs the 900 Mhz EEE), more memory (1 gb vs 512 mb), bigger disk space (16 gb vs 4 gb), higher resolution (1024 x 600 vs 840×400), and better graphic processors (Intel GMA 950 vs Intel GMA 900). The only problem is the 16 GB SSD is much slower than the EEE 701 4 GB SSD. You can really feel it when running almost any applications, especially the firefox browser.

My wife uses Windows XP on the new Asus. After reading several blog posts and many forums, the conclusion is: to make everything faster, try to reduce the number of disk access. Here is how to reduce the disk access in Windows XP:

1. Buy more memory, we bought 2 GB memory  (quite cheap, around 690 baht/20 usd) to replace the 1 GB default
2. Allocate some of the memory (384 Mb for RAM disk). I set the environment variables TEMP and TMP to point to the RAM Disk. I also point firefox cache to the RAM disk.
3. Turn off page file
4. Disable indexing on all drives
5. Disable System restore
6. Don’t install firefox on the SSD. Firefox 3 will try to write its history every few seconds. I use Firefox portable on SD Card, and it is much faster now.

Someone already made an early SDL port to Wii, but it is missing threading support (which is needed by the emulator). After reading things at wiibrew.org and devkitpro.org, I decided to complete the threading part. The next problem is the input. I want to be able to write BASIC applications, so I decided that the SDL port must support keyboard input, someone already made LibWiikeyboard, so I can just plug it in SDL (actually this is a hack, to correctly handle SDL requirements, there are some things that needs to be changed, in LibWiikeyboard and in the SDL gamecube implementation).

Next part is the porting process itself. The difficult part is making sure all the endiannes conversion of 6502 (Apple II CPU) to Wii’s PowerPC is done correctly, because I don’t have a USB gecko to debug it. Currently the port works, but don’t expect too much from this first release. I can already play some games, but I haven’t tested many other things. Sound is not yet now supported.

Here are some screenshots (made using tvtime, captured through my USB TV Box)

This is the application that you can extract to your SD Card

http://tinyhack.com/wii/wiiapple/wiiapple.zip

Note: Latest version is available at: http://code.google.com/p/wiiapple

The plan is: Everytime I update the application, I will still use the same file name, you can look at http://tinyhack.com/wii/wiiapple/ to look for older releases.
You will need to install Homebrew Channel to use it.

And the source codes are available at:

http://tinyhack.com/wii/wiiapple/

Note: Latest source code is available at: http://code.google.com/p/wiiapple

Update:

version 0.0.2:

- Fixed text overlay
- Disable saving options (dangerous for now, because you might overwrite your files)

version 0.0.3:

- Sound support
- Fix joypad problem
- Invalid disk image will not freeze the emulator (in case of invalid disk, Master.dsk will be reloaded)

January 6, 2009 (0.0.4)
- new keyboard driver, now work with most USB keyboards
Note: I am still working on the keyboard issue (some USB keyboard still  doesn’t work). I think this is because the limitation of Libwiikeyboard that can only do control transfer instead of interrupt transfer. Now I have rewritten the SDL keyboard part with my own code (part was based on the code from Guitar Fun).

January 6, 2009 (0.0.5)
- Support Gamecube controller (Wiimote support is planned for next version)
- updated some bug in keyboard handling

January 7, 2009 (0.0.6)
- Increased gamecube joystick sensitivity
- Fixed (most) crashing issue

January 8, 2009 (0.0.7)
- Support Wiimote as Joystick (Press A button in Gamecube controller to switch to gamecube joypad)

note: Mac USB keyboard works.

Kari Ahtiala who owned several NAS devices (SLUG, NCB3AST, NCH3AHT), said that you can just move your disk from NSLU (SLUG) to Agestar just fine:

after upgrading the firmware, boot the Agestar without the disk, ssh to it, plug in the disk, mount it and chroot to it, and then mount -t proc /proc proc, and everything works as if the Agestar had been booted off the hard drive.

This is fine if you want to just borrow the disk for testing or cloning purposes. To convert it to be used on the Agestar exclusively, I copied /etc to /etc-slug (so I can revert by "mv etc etc-agestar" and "mv  etc-slug etc" and enited fstab, network/interfaces and modules and issued the command "e2label /dev/sdb1 /" as you instructed.

And here are some tips from him:

I pretty much cloned my SLUG so the Agestar is now a NFS and Samba server, Web server and X server. The Xfce4 applications are usable on the Agestar – Mousepad is an OK editor and Thunar is OK for a file manager (these have a habit of Segfaulting, though, but at least X works: xterm, kpat, xpat2 and spider!). Using "ssh -CY" instead of "ssh -X" doesn’t seem to make much difference.

Usbmount is very useful: plug in a USB drive and it is accessible on your local network if you share /media via samba. Just edit /etc/usbmount/usbmount.conf: the default filesystems are ext2 and ext3 but you can add vfat and ntfs but you need to add some options:
FS_MOUNTOPTIONS="-fstype=ntfs,rw,errors=remount-ro,dmask=0000,fmask=0000 -fstype=vfat,dmask=0000,fmask=0000"

To get read-write on an NTFS drive, you need to cheat a bit: first install ntfs-3g and then
ln -s /usr/bin/ntfs-3g /sbin/mount.ntfs (this is because ntfs-3g is a program and the old ntfs is a module).

A tip from me is that if you have a problem with your Agestar, just search google for your problem, and add "NSLU" "debian" (or NSLU2 debian). The solution for debian NSLU2 should apply to Agestar with Debian.

NOTE: the web update method only works on agestar ncb3ast, other models can work by using serial port and latest patch for kernel source (2.6.29 or later).

zImage and bootpImage are compressed kernel image, this is compressed by using GZip method 8. The easiest way to decompress it is to give it to gunzip. I just searched the kernel image for the sequence 1f 8b 08, and cut it using khexedit. You don’t have to find where the compressed data ends, gunzip will ignore trailing garbage.

The kernel contains some symbols for linking on dynamic module loading. You can see these symbols and their address by reading /proc/kallsyms. Some other information from /proc can be useful in reverse engineering for example you can read /proc/irq to get the irq number for devices. Some other device drivers creates a proc entries that contain their state.

Reverse engineering dynamic/loadable modules (.o/.ko) are a bit easier than built in modules. The code is more isolated, and it has clear names (init_module, exit_module, etc). The interface for different kind of modules is usually clear (for example an rtc driver must provide rtc_open, etc), so reverse engineering simple modules is quite easy.

And of course the source code of the kernel is very helpful to understand the code flow. Human can easily follow the assembly code by comparing it to the kernel source. Unfortunately this process can not yet be done automatically. If it can, I think many people can quickly reverse engineer Linux kernels on devices where the source code is not given by the vendor.

Coolmax CN-570 http://www.smallnetbuilder.com/content/view/29899/75/1/3/
NS-348S http://www.multicase.de/en/products/76/ns348s.html http://www.enclosureservice.com/
Emprex NSD-100 http://www.emprex.com/02_products_02.php?id=205
Agestar NCB3AHT http://www.agestar.com/english/products/ncb3aht.asp
http://shenztech.com/code/ui/product/product.aspx?prdid=NAS2&subcatid=9
revoltec rs049

We can see from the boot log that says the machine is STAR_STR9100. Lately I have worked less and less on this device, because it has been running smoothly enough for me (I have run it continuously for a week). The last few parts is not so important for me. These four parts are RTC (turns out to be a very limited RTC), LED (only one LED inside the box, which is not very useful), and button (I have never used the button anyway), and Watch dog (this one might be useful, but I don’t have any documentation about this).

I am planning to stop further development. I was planning to build a custom firmware, but I think a full Debian distro is much better for me. But, if there are quite many people that uses this devices and are expecting something like NSLU2 (easy installer, etc), then I might continue the development. So, If you are using Agestar or agestar like devices, please leave a comment, and let me know what you expect.

If I am going to continue the development, I will need to buy another box, because I am currently using this one extensively for my daily activities. Irina (that is the name I gave to my NAS box) is now serving MP3, serving web page, and act as a download station.

There is one feature that is supposed to be useful if I can make it work: the alarm capability. With alarm some cron-like applications can set to be notified when a particular time comes (it will ease the CPU burden). As far as I know the cron daemon doesn’t use this feature, so it is not a great loss.

There is one thing that still puzzles me. The original firmware uses X1205 through I2C bus. From my understanding the X1205 have different abilities compared to the STR9100 RTC. So I don’t know whether there is actually another RTC on the board.

Since the RTC is not very useful. I will let go hacking this part, until I find other clues.

Here is the output of the original firmware.

X1205: I2C based RTC driver.
i2c-core.o: driver X1205 registered.
X1205: found X1205 on STR9100 I2C Adapter
ccr_write_enable: verify SR failed
i2c-core.o: client [X1205] registered to adapter [STR9100 I2C Adapter](pos. 0).
X1205: i2c_add_driver RTC driver.
X1205: misc_register RTC driver.