MLW221 technical information

MLW221 Hardware

Here is the hardware information I have extracted from the original image + a little bit of information from my first try at booting OpenWrt on the device.
I haven't bothered to verify information or clean out private information from the logs, so if you see anything that should be private please just pretend it's not there. I just thought I should share it, in case anyone else could have some use for it.

Main SoC:
Mediatec
MT7620N

RAM:
SK Hynix
M5PS5182GFR-S6C

Flash:
Spansio
S25FL128S?

GPIO:
Output 7 Power
Output 11 WIFI
Output 43 Status
Input 1 Reset


MT7620 # printenv
bootcmd=tftp
bootdelay=1
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=10.10.10.123
serverip=10.10.10.3
stdin=serial
stdout=serial
stderr=serial

Environment size: 149/4092 bytes


# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "Bootloader"
mtd1: 00010000 00010000 "Config"
mtd2: 00010000 00010000 "Factory"
mtd3: 00f60000 00010000 "Kernel"
mtd4: 00050000 00010000 "User_CFG"

# cat /proc/partitions
major minor  #blocks  name

  31        0        192 mtdblock0
  31        1         64 mtdblock1
  31        2         64 mtdblock2
  31        3      15744 mtdblock3
  31        4        320 mtdblock4

# cat cpuinfo
system type        : Ralink SoC
processor        : 0
cpu model        : MIPS 24Kc V5.0
BogoMIPS        : 386.04
wait instruction    : yes
microsecond timers    : yes
tlb_entries        : 32
extra interrupt vector    : yes
hardware watchpoint    : yes, count: 4, address/irw mask: [0x0ff8, 0x0ff8, 0x06d3, 0x0ff8]
ASEs implemented    : mips16 dsp
shadow register sets    : 1
core            : 0
VCED exceptions        : not available
VCEI exceptions        : not available

# cat cmdline
console=ttyS1,57600n8 root=/dev/ram0 console=ttyS0

# cat mounts
rootfs / rootfs rw 0 0
proc /proc proc rw,relatime 0 0
none /var ramfs rw,relatime 0 0
none /tmp ramfs rw,relatime 0 0
none /media ramfs rw,relatime 0 0
none /sys sysfs rw,relatime 0 0
none /dev/pts devpts rw,relatime,mode=600 0 0
none /proc/bus/usb usbfs rw,relatime 0 0
none /etc ramfs rw,relatime 0 0
mdev /dev ramfs rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
/dev/mtdblock4 /etc/config jffs2 rw,relatime 0 0

# cat modules
tntfs 490768 0 - Live 0xc0388000 (P)
texfat 151536 0 - Live 0xc02ab000 (P)

# cat version
Linux version 2.6.36+ (root@CVS2) (gcc version 3.4.2) #15 Tue Sep 3 11:17:59 CST 2013

// Stock image
Creating 5 MTD partitions on "raspi":
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x000000fb0000 : "Kernel"
0x000000fb0000-0x000001000000 : "User_CFG" // jffs2

// OpenWRT
[    2.280000] m25p80 spi32766.0: found s25fl129p1, expected mx25l6405d
[    2.290000] m25p80 spi32766.0: s25fl129p1 (16384 Kbytes)
[    2.310000] 4 ofpart partitions found on MTD device spi32766.0
[    2.320000] Creating 4 MTD partitions on "spi32766.0":
[    2.330000] 0x000000000000-0x000000030000 : "u-boot"
[    2.340000] 0x000000030000-0x000000040000 : "u-boot-env"
[    2.350000] 0x000000040000-0x000000050000 : "factory"
[    2.360000] 0x000000050000-0x000000800000 : "firmware"
[    2.380000] 0x0000004a6074-0x000000800000 : "rootfs"

Boot messages from original firmware

U-Boot 1.1.3 (Apr 10 2013 - 15:50:37)

Board: Ralink APSoC DRAM:  64 MB

relocate_code Pointer at: 83fb4000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
spi_wait_nsec: 29
spi device id: 1 20 18 4d 1 (20184d01)
find flash: S25FL129P
raspi_read: from:30000 len:1000
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 4.1.1.0
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 10 2013  Time:15:50:37
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
 0
  
3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    4546612 Bytes =  4.3 MB
   Load Address: 80000000
   Entry Point:  8000c310
raspi_read: from:50040 len:456034
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8000c310) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.36+ (root@CVS2) (gcc version 3.4.2) #15 Tue Sep 3 11:17:59 CST 2013

 The CPU feqenuce set to 580 MHz
 PCIE: bypass PCIe DLL.
 PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
 disable all power about PCIe
 PCIE: PLL power down for MT7620N
CPU revision is: 00019650 (MIPS 24Kc)
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 console=ttyS0
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=0007d577
Readback ErrCtl register=0007d577
Memory: 56328k/65536k available (4731k kernel code, 9208k reserved, 852k data, 2808k init, 0k highmem)
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RT3xxx EHCI/OHCI init.
JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
fuse init (API version 7.15)
msgmni has been set to 110
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered (default)
Ralink gpio driver initialized
led=43, on=5, off=5, blinks,=4000, reset=1, time=4000
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
brd: module loaded
flash0: started
deice id : 1 20 18 4d 1 (20184d01)
S25FL129P(01 20184d01) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (0M) .erasesize = 0x00000010 (0K) .numeraseregions = 65536
Creating 5 MTD partitions on "raspi":
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x000000fb0000 : "Kernel"
0x000000fb0000-0x000001000000 : "User_CFG"
rdm_major = 253
SMACCR1 -- : 0x0000000c
SMACCR0 -- : 0x43762077
Ralink APSoC Ethernet Driver Initilization. v3.0  256 rx/tx descriptors allocated, mtu = 1500!
SMACCR1 -- : 0x0000000c
SMACCR0 -- : 0x43762077
PROC INIT OK!
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5


=== pAd = c0198000, size = 807960 ===

<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
AP Driver version-2.7.1.2
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
MTK MSDC device init.
mtk-sd: MediaTek MT6575 MSDC Driver
nf_conntrack version 0.5.0 (880 buckets, 3520 max)
IPVS: Registered protocols ()
IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
IPVS: ipvs loaded.
GRE over IPv4 demultiplexor driver
gre: can't add protocol
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
TCP cubic registered
NET: Registered protocol family 10
NET: Registered protocol family 17
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
msdc0 -> ops_get_cd return<0> <- msdc_ops_get_cd() : L<2273> PID<kworker/u:1><0x16>
Freeing unused kernel memory: 2808k freed
init started: BusyBox v1.12.1 (2013Algorithmics/MIPS FPU Emulator v1.5
-09-03 11:14:23 CST)
starting pid 31, tty '': '/etc_ro/rcS'texfat: module license 'Commercial. For support email exfat-support@tuxera.com' taints kernel.

Disabling lock debugging due to kernel taint
Tuxera exFAT driver 3013.2.7.2 [Flags: R/W MODULE].
Tuxera NTFS driver 3013.2.5 [Flags: R/W MODULE].
usb 1-1: new high speed USB device using rt3xxx-ehci and address 2
devpts: called with bogus options
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 3 ports detected
Welcome to
    _______  _______  ___     __  ____   _  _   ___
    |  ___  \|   __  ||   |   |__||    \ | || | /  /
    | |___| ||  |__| ||   |__  __ |     \| || |/  /
    |   _   /|   _   ||      ||  || |\     ||     \
    |__| \__\|__| |__||______||__||_| \____||_|\___\

                    =System Architecture Department=

[check_jffs]80 : JFFS_OK
led=11, on=1, off=4000, blinks,=1, reset=1, time=4000
semget err:: No such led=7, on=1, off=4000, blinks,=1, reset=1, time=4000
file or directory
Set: phy[0].reg[0] = 3100
Set: phy[1].reg[0] = 3100
Set: phy[2].reg[0] = 3100
Set: phy[3].reg[0] = 3100
Set: phy[4].reg[0] = 3100
nvram_init: INFO=>nvram MAC initialized successfully!
==>shm_init()!!
check_shm_hash: Check shm hash value
nvram_init: INFO=>nvram conf initialized successfully!
nvram_init: INFO=> RAM CONF successful created!
nvram_init: INFO=> RC.CONF successful created!
---------------- Get WLAN MAC 00:26:b7:05:ff:fe---------------
switch reg write offset=94, value=1000
switch reg write offset=2004, value=ff0003
switch reg write offset=2104, value=ff0003
switch reg write offset=2204, value=ff0003
switch reg write offset=2304, value=ff0003
switch reg write offset=2404, value=ff0003
switch reg write offset=2504, value=ff0003
switch reg write offset=2010, value=810000c0
switch reg write offset=2110, value=810000c0
switch reg write offset=2210, value=810000c0
switch reg write offset=2310, value=810000c0
switch reg write offset=2410, value=810000c0
switch reg write offset=2510, value=810000c0
switch reg write offset=2610, value=81000000
switch reg write offset=2710, value=81000000
switch reg write offset=2604, value=20ff0003
switch reg write offset=2704, value=20ff0003
Special Tag Disabled
switch reg write offset=2610, value=81000000
switch reg wRaeth v3.0 (riTasklette,SkbRecycle o)
ffset
phy_tx_ring = 0x028f7000, tx_ring = 0xa28f7000

phy_rx_ring0 = 0x028f8000, rx_ring0 = 0xa28f8000
SMACCR1 -- : 0x00000026
SMACCR0 -- : 0xb705fffe
=2CDMA_CSG_CFG = 81000000
01GDMA1_FWD_CFG = 20710000
4, value=10001
switch reg write offset=2114, value=10001
switch reg write offset=2214, value=10001
switch reg write offset=2314, value=10001
switch reg write offset=2414, value=10002
switch reg write offset=2514, value=10001
REG_ESW_WT_MAC_ATC is 0x7ff0002
done.
ifconfig: SIOCSIFHWADDR: No such device
ifconfig: ioctl 0x8913 failed: No such device
device vlan0001 entered promiscuous mode
device eth2 entered promiscuous mode
input_access=[3]
echo 3 > /proc/lan_wlan_access_controller
sh: can't create /proc/lan_wlan_access_controllebr0: port 1(vlan0001) entering learning state
r:br0: port 1(vlan0001) entering learning state
 nonexistent directory
Fri Jan  1 00:00:00 GMT 2010
/etc_ro/rcS: line 138: wd_keepalive: not found
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).
Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).
iptables v1.4.10:
The "nat" table is not intended for filtering, the use of DROP is therefore inhibited.


Try `iptables -h' or 'iptables --help' for more information.
ifconfig: ioctl 0x8913 failed: No such device
interface ra2 does not exist!
ifconfig: ioctl 0x8913 failed: No such device
interface ra2 does not exist!
[Enter Test] in wlan_led_ctrl.c main()
.killall: ap_client_run: no process killed
insmod: ipv6passthru.ko: module not found
/usr/shell/dnsmasq.sh stop ok
dnsmasq: read /etc/hosts - 2 addresses
dnsmasq: read /etc/hosts - 2 addresses
dnsmasq: [truncated] m
/usr/shell/dnsmasq.sh start ok
sh: /usr/sbin/miniupnpd: not found
/usr/shell/udhcpd.sh config ok
/usr/shell/udhcpd.sh start ok

***** g_wl_interface = ra0 ******

MAX_NUM_SESSIONS : 5; NUM_SEES: 64
ls: /dev/sd*: No such file or directory
aa
killall: wifidetect: no process killed


===wifidetect start===

killall: udhcpc.sh: no process killed
/etc_ro/rcS: line 242: /usr/local/apache2/bin/htpasswd: not found
killall: udhcpc: no process killed
ls: /media/*/mlwfw_v*.*.*.bin: No such file or directory
killall: DMS: no process killed
killall: smbd: no process killed
killall: nmbd: no process killed
kill samba server firsthello, samba!
startsmbfilepwent_internal: file /tmp/samba/private/smbpasswd did not exist. File successfully created.
User guest password set to none.
new GPIO mode
ls: /media/*/gemtek_easytest.txt: No such file or directory
main(205) ::
DMS_Create()
DLNA DMS: UUID=[aaab4c54-ea1b-1885-b390-0026b705fffe]
starting pid 8225, tty '/dev/ttyS1': '/bin/sh'
IP Address List: 192.168.200.254


BusyBox v1.12.1 (2013-09-03 11:14:23 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

#

Time to start working on the port again

I have been out traveling, and therefore unable work on this little project for some time now. The last status before I left was that I booted OpenWrt and wrote a quick draft with all the hardware specifications. I will try to clean things up a little bit and publish things.

While I were away, a "reader" called Larry has picked the project up and ported it as well. The last status update from him were that things were booting, but WiFi were missing. So I guess I will merge the changes, and see where we are at. I will also find out how to share the code, if it should be pushed to OpenWrt, or branched somewhere first.

Stay tuned, and there should be a bootable image in not to long.

Building OpenWRT for MobileLite Wireless

I have always had a fondness for OpenWRT, and I know it suports our MT7620 as a target, so why not give it a shot. I have already cheated a little bit and built a test image with root fs on ramdisk that I loaded directly from the uBoot menu.

Seems that I forgot to write while playing today, so here we have a short summary. After playing with OpenWRT, and making a port for the MLW221, I decided to get ethernet up and running. So after reading a bit of documentation I found the pinout for ethernet.

P5 = Tx-
P6 = Tx+
P7 = Rx-
P8 = Rx+

I found an old router and lifted the pins on the filter, and after a little bit of soldering we have ethernet on our device. This is not a permanent solution, since there is no room for the ethernet connector inside the device. If I have to bring a dongle with me, it might just as well be en USB-ethernet dongle.

But the end result is that we can select to boot from tftp in the uBoot menu, so now it will take a few seconds to transfer the test image, instead of 10 minutes. We are moving forward here.

My alternative ethernet port setup.

Fixing the dead device

Time to fix our device again.
We now have a serial terminal and access to uBoot, so this should be doable.

The first thing we want to do is to transfer the stock image to our device. To do this we first need to install ckermit (since we already know that uBoot requires it for file transfer).

First thing we wont to try is booting from memory.
So with our serial cable connected, we press 4 during the uBoot sequence. This puts us in the uBoot bootloader console. We want to load the image from serial, and then boot into the image. Afterwards we want to do a firmware upgrade the normal way, to make sure all settings are correct. So we will have to make sure we have our firmware upgrade memory stick or memory card plugged in.

The procedure for upgrading is roughly something like this, and it might be a good idea to have the power plugged in, I didn't:

In console:
kermit

In kermit:
set line /dev/ttyUSB0 (or whatever your serial port is)
set speed 57600
set serial 8n1
set flow-control none
set file type bin
set carrier-watch off
set prefixing all
set modem none
c (to connect)

Power on the device
Press4
loadb 0x800000
(system waiting for file send)
Press ctrl+\ to
This is going to take a while (roughly 15 min)
bootm 0x800034 (this is our offset to the actual image)

The system boots, and starts the firmware upgrade to the official firmware. After the upgrade the device automatically reboots, and we are back to the standard firmware again.

So now we are back to the development part again. After looking at the kernel booting, I'm not even sure if I want to use this as base. We might be better of just basing it on OpenWRT or something similar. But then again, its fun to learn a bit more about uClinux.

If we really want to play with the device, I guess we will have to get ethernet connection and boot from tftp. The 15min of waiting every time I have to do a recovery starts to annoy me.

Device dead after firmware upgrade

In the last post I build a firmware for our cute little device. And as always, I try my luck first, and then fix the errors afterwards. Not totally unexpected, after flashing my new firmware there were little response from the device afterwards. So I guess this is what we call a bricked device. This wasn't totally unexpected since we can see from the source that the firmware update is a part of the uClinux image.

So finally its time for me to actually own the device, and void the warranty. 3 plastic hooks on each side of the case, and a little bit of work and it opens. Inside we find 3 sets of test pads. So this should be possible to fix somehow.

A quick look at the chips inside. We see that the SoC is a MT7620, and its connected to a H5PS5162GFR 512Mb DDR2 SDRAM, and we can also see some other chips, but those should be unimportant to us.

From the MT7620 datasheet we can find that we have two interesting sets of ports.


UART:

TP15 - I don't know where this goes, and it doesn't really matter for us
TP16 - TX
TP17 - RX
TX18 - GNX

Ethernet:
TP5-8
Uncertain on whats needed for a breakout cable here.

I'm uncertain if the JTAG pins are connected or not, and I don't even know if the chip even have the ports in JTAG mode since they share port with the ethernet leds. But then again, I'm pretty certain we won't need JTAG for this.

I pull out a USB to TTL adapter and try my luck. A few guesses, and I get a serial console with the settings 57600-8-N-1.

And this is the output:
============================================
Ralink UBoot Version: 4.1.1.0
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 10 2013  Time:15:50:37
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
 0
  
3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    6274935 Bytes =  6 MB
   Load Address: 80000000
   Entry Point:  8000c310
raspi_read: from:50040 len:5fbf77
   Verifying Checksum ... Bad Data CRC

I guess the firmware image wasn't that good after all. First step is create a semi permanent way to recover when our firmware fails, and afterwards we can start to make our own firmware again. I'm pretty comfortable pressing the pins against the pads while using a serial terminal, but when transferring the firmware I think I'm better of soldering on some pins to the device. Or maybe some short breadboard cables and a little dash of hot glue gun would do the trick. Who knows, maybe i can fit some external connector later on.

Next post will hopefully be on how to fix up the rest, and get back to stock firmware.

If anyone request it I can provide pictures of the components, but its well marked and should be easy to find.

Building MobileLite Wireless MLW221 from source

If we are going to build the firmware from MobileLite from source, the first requirement is getting the source from the Kingston support pages. This is an self-extracting archive, and can be extracted using RAR, or similar compatible extractions tools. Once we are finished extracting the code, we can have a look at it and try to find out how to attack this project.

The first thing we notice is that it running on a version of uClinux, a simple and well documented embedded Linux version. We know we are going to need a toolchain to be able to cross-compile this, so we have two options. We could do it the hard way, and look at specifications, FCC images etc. to find out the hardware architecture. But instead we will cheat a little bit and just look around in the source. Specifically we look for the definition of CC, the compiler. This tells that they were using the compiler "/opt/buildroot-gcc342/bin/mipsel-linux-uclibc-gcc", which is pretty much all we need to know. Now we know for sure that we are dealing with a MIPS little endian of some sort. And thats all we really need to know. We can also see that the toolchain is quite old buildroot toolchain, since the naming has now changed in buildroot.

Again we are left with two options. We could build a shining new toolchain to use for our mipsel. We also know that gcc342 is a very old version of GCC, and we might bump into quite a lot of annoyances if we try with a toolchain with a 10 year newer GCC version. But mostly because we are lazy, we can be pretty sure this toolchain is available somewhere online. So we do a few quick searches. And quite fast we find a BBS where someone have some issues compiling from source for another kind of device thats using the same toolchain. And a few quick later we have downloaded the source code for that device, and they have been kind enough to include the toolchain together with the source code. All honors to Medion AG.

So now we have everything we need to start working on this. I put the toolchain in the same folder we found earlier, so we don't have to manually change all the Makefiles. You will also need a few build tools, but that should be easy for you to sort out. If we do a quick grep for "/home/" we can see that it refers to quite a lot of absolute paths. It seems like the most of the work is done by a guy named Steven, but it also refers to the homedir of a Winfred. I guess this means we will have to work a little bit to get this up and running. I'm not going to write it all down here, but basically its just fixing include paths.

If you are using dash as default shell for sh (/bin/sh -> /bin/dash) you will got syntax errors when its building some of the packages. I choose to fix this in the makefile of the affected packages, and refer to /bin/bash instead of /bin/sh.

It also complained about missing includes when compiling SSL for the webserver. For now I just changed the Makefile to compile it without SSL. Since we don't really need it right now.

So now we stop at a issue with iconv.

/opt/buildroot-gcc342/bin/mipsel-linux-gcc -c -I. -I. -I.. -I../include -I./../include -I../srclib -I./../srclib -I../lib -g -O2  -DINSTALLDIR=\"/usr/local/bin\" -DLOCALEDIR=\"/usr/local/share/locale\" ./iconv.c
In file included from ./iconv.c:77:
../srclib/gettext.h:26:22: libintl.h: No such file or directory
In file included from ./iconv.c:77:

I guess we have to fix this as well. A quick find shows that missing file is located at "./lib/include/libintl.h", relative to the root dir of the firmware. So I guess we will have to change the Makefiles here. So we just go to the folder "user/libiconv-1.11/src" and edit the Makefile manually, and add " -I$(srcdir)/../../../lib/include" to the include directive.

Next stop:
make[2]: execvp: ./makedevlinks: Permission denied
Strange, lets look a little bit at this one.
If we check the permissions on the file we can see this:
-rw-r-xr-x 1 erik erik 3999 nov.   7  2012 makedevlinks
For some reason the owner (me) doesn't have execute rights on the file, and the same goes for the rcS script. This must be a mistake, so I just add the missing bit. And then it fails again, and the execute bit is unset again. Time to look at the main Makefile. We can see here that it sets the mode to 655 and 675 on all the executable scripts. I really can't understand why, they are not suid or anything. So I just change all of them to be 744. My system, my rules.

Next issue:
cp /home/erik/hack/mobilelite/MLW_SDK_4100/images/erik_uImage /tftpboot
cp: cannot stat ‘/home/erik/hack/mobilelite/MLW_SDK_4100/images/erik_uImage’: No such file or directory
But there is a file called root_uImage, this leads me to think that there is some issue with environment variables. And quite correct, the Makefile at "vendors/Ralink/MT7620" has been changed from "IMAGE = $(IMAGEDIR)/$(USER)_uImage to "IMAGE = $(IMAGEDIR)/root_uImage". I just changed this.

We know its almost finished compiling the firmware and it stops at the image part, so we just issue a "make image". And now it complains that my user doesn't have right to write to the "/tftpboot" folder, and quite correctly so. But then again I don't need the makefile to put the image there anyways, so we just comment this away from the makefile. But I guess this means they have been using some dev kit with ethernet support.

And again, it fails on the root_uImage, I guess this is the reason why they changed the Makefile earler. We just add another line where we copy our $(USER)_uImage to root_uImage. So now the file is like this:
#!/bin/sh
cd CRC_tool
cp '../images/'$USER'_uImage' ../images/root_uImage
cp ../images/root_uImage ./
./CRC_tool root_uImage WMTM-169N
mv ./CRC_root_uImage ../images/
rm -f root_uImage
ver=`grep " VER" ../user/gt_utilities/version.h | cut -d '"' -f 2`
mv ../images/CRC_root_uImage ../images/Kingston_widrive_v$ver.bin
chmod 777 ../images/Kingston_widrive_v$ver.bin
cp ../images/Kingston_widrive_v$ver.bin ../images/mlwfw_v$ver.bin

And finally we have a "working" image. This is where the fun starts. In the next post.

A quick look at MobileLite Wireless

I happened to bump into this funny device from Kingston on sale. A MobileLite Wireless MLW221. It's called a wireless card reader, but I also saw some other functions that interested me.

When traveling I every once in a while take a few pictures, and it wouldn't hurt to be able to take a look at them without bringing a laptop. USB OTG could be an option, but it just seemed a bit to boring so the wireless card reader was the way to go. And I would be able to copy the files from the USB CF card reader to an SD card, as backup.

But the functionality that interested me the most was the hackabillity of the device. On the Kingston webpage I could see that they provides the source for the OS of the device. An uClinux build, and its all there for me to play with. Of course I would have too find the right toolchain, and I expected there to be some binary parts as well. But that wouldn't stop me from adding some functionality.

The WiFi on the device is supposed to be able to act as a bridge, so that gives me quite a lot of possibilities on what I can do with the device network wise.

So now I some different things I want to accomplish with this:

1. Build the image and flash it to the device
2. Route all my wireless traffic trough it when traveling (in hotels where you only get access for one device etc.)
3. Route all traffic over an tunnel (OpenVPN)
4. Use an USB ethernet dongle, for hotels that only have wired internet access.
5. Make the device automatically upload the pictures to an online service when I plug inn an special memory card.

 So now I just start on top of the list, and see how far I will get before I loose interest and start another project.

The next post will have some instructions on how to build the source, and requirements.