Samsung4510 Wireless Hacking Session

[Henrion Benjamin]

Hello,

We were at a meeting this weekend to port linux on several APs:

There's very high probability that we will succeed in porting linux for
those boards (listed on the pages above) because we have access to JTAG:

Pictures:

http://bh.udev.org/filez/projects/uClinux-samsung4510/hackparty031019/

More infos:

http://reseaucitoyen.be/index.php?samsung4510
http://seattlewireless.net/index.cgi/SamSung4510

We are currently trying to modify the bios of dailzh.com for our board
(DI-614+revA).

If you detect another board AP that supports samsung4510, please add it
to the list... This CPU is used often with 22mbps products...

[Bruno Lopes F. Cabral]

Hello there
very good! nice to hear that!

Post by Henrion Benjamin
There's very high probability that we will succeed in porting linux for

if I recall correctly the dell true mobile 1184 doesn't have a JTAG
connector. if so, buying/making a JTAG cable could help to "revive"
them

Post by Henrion Benjamin
We are currently trying to modify the bios of dailzh.com for our board
(DI-614+revA).

did you try to get the boot loader from www.ucrouter.org/english ??
it is also samsung4510 based and there are reports of their original
boot code (ROM) working on various soho-routers out there

my only doubt on this uClinux-thing is how to boot the code.
I have a pretty good idea on the rest (kernel/romfs image)
but no clue on bios-less boot code

after that, porting linuxap should be a walk on the park ;-)

Cheers
!3runo
from Brazil

[Henrion Benjamin]

Post by Bruno Lopes F. Cabral
Hello there
very good! nice to hear that!

Post by Henrion Benjamin
There's very high probability that we will succeed in porting linux for

if I recall correctly the dell true mobile 1184 doesn't have a JTAG
connector. if so, buying/making a JTAG cable could help to "revive"
them

Post by Henrion Benjamin
We are currently trying to modify the bios of dailzh.com for our board
(DI-614+revA).

did you try to get the boot loader from www.ucrouter.org/english ??
it is also samsung4510 based and there are reports of their original
boot code (ROM) working on various soho-routers out there

I will have a look. Another guy has posted a link on the ucrouter.ru
forum:

BIOS for Samsung S3C4510B

http://sourceforge.net/projects/bios-lt/

Seems that we've some luck...We were just saying yesterday during the
hacking party that we wanted to rewrite a bootloader for this cpu. Don't
know if it's supports tftp, but we'll try...

Post by Bruno Lopes F. Cabral
my only doubt on this uClinux-thing is how to boot the code.
I have a pretty good idea on the rest (kernel/romfs image)
but no clue on bios-less boot code
after that, porting linuxap should be a walk on the park ;-)
Cheers
!3runo
from Brazil
_______________________________________________
LinuxAP-dev mailing list
http://linuxAP.ksmith.com/mailman/listinfo/linuxap-dev

[Christopher R. Hertel]

I was wondering... Would the eCos RedBoot work on this?

Post by Henrion Benjamin

Post by Bruno Lopes F. Cabral
Hello there
very good! nice to hear that!

Post by Henrion Benjamin
There's very high probability that we will succeed in porting linux for

if I recall correctly the dell true mobile 1184 doesn't have a JTAG
connector. if so, buying/making a JTAG cable could help to "revive"
them

Post by Henrion Benjamin
We are currently trying to modify the bios of dailzh.com for our board
(DI-614+revA).

did you try to get the boot loader from www.ucrouter.org/english ??
it is also samsung4510 based and there are reports of their original
boot code (ROM) working on various soho-routers out there

I will have a look. Another guy has posted a link on the ucrouter.ru
BIOS for Samsung S3C4510B
http://sourceforge.net/projects/bios-lt/
Seems that we've some luck...We were just saying yesterday during the
hacking party that we wanted to rewrite a bootloader for this cpu. Don't
know if it's supports tftp, but we'll try...

Post by Bruno Lopes F. Cabral
my only doubt on this uClinux-thing is how to boot the code.
I have a pretty good idea on the rest (kernel/romfs image)
but no clue on bios-less boot code
after that, porting linuxap should be a walk on the park ;-)
Cheers
!3runo
from Brazil
_______________________________________________
LinuxAP-dev mailing list
http://linuxAP.ksmith.com/mailman/listinfo/linuxap-dev

--
http://bh.udev.org
_______________________________________________
LinuxAP-dev mailing list
http://linuxAP.ksmith.com/mailman/listinfo/linuxap-dev

[Henrion Benjamin]

Post by Christopher R. Hertel
I was wondering... Would the eCos RedBoot work on this?

Yes, Peter (***@mind.be) says redboot should runs on samsung4510, but
could be larger than the current bios-lt.

It seems that the code of bios-lt has been cleaned, I need to compare
what has been don to see. More flash chips have been added.

Peter, can you try the bios-lt? and tftp booting?

Post by Christopher R. Hertel

Post by Henrion Benjamin

Post by Bruno Lopes F. Cabral
Hello there
very good! nice to hear that!

Post by Henrion Benjamin
There's very high probability that we will succeed in porting linux for

if I recall correctly the dell true mobile 1184 doesn't have a JTAG
connector. if so, buying/making a JTAG cable could help to "revive"
them

Post by Henrion Benjamin
We are currently trying to modify the bios of dailzh.com for our board
(DI-614+revA).

did you try to get the boot loader from www.ucrouter.org/english ??
it is also samsung4510 based and there are reports of their original
boot code (ROM) working on various soho-routers out there

I will have a look. Another guy has posted a link on the ucrouter.ru
BIOS for Samsung S3C4510B
http://sourceforge.net/projects/bios-lt/
Seems that we've some luck...We were just saying yesterday during the
hacking party that we wanted to rewrite a bootloader for this cpu. Don't
know if it's supports tftp, but we'll try...

Post by Bruno Lopes F. Cabral
my only doubt on this uClinux-thing is how to boot the code.
I have a pretty good idea on the rest (kernel/romfs image)
but no clue on bios-less boot code
after that, porting linuxap should be a walk on the park ;-)
Cheers
!3runo
from Brazil
_______________________________________________
LinuxAP-dev mailing list
http://linuxAP.ksmith.com/mailman/listinfo/linuxap-dev

--
http://bh.udev.org
_______________________________________________
LinuxAP-dev mailing list
http://linuxAP.ksmith.com/mailman/listinfo/linuxap-dev

--
"Implementing CIFS - the Common Internet FileSystem" ISBN: 013047116X
Samba Team -- http://www.samba.org/ -)----- Christopher R. Hertel
jCIFS Team -- http://jcifs.samba.org/ -)----- ubiqx development, uninq.
_______________________________________________
LinuxAP-dev mailing list
http://linuxAP.ksmith.com/mailman/listinfo/linuxap-dev

[Bruno Lopes F. Cabral]

Hello

Post by Henrion Benjamin
We are currently trying to modify the bios of dailzh.com
for our board (DI-614+revA).

just realized the release of a boot code for samsung 4510B
it's at http://sourceforge.net/projects/bios-lt/

I think the idea of partitioning the flash on three (or 4?)
areas could cause more trouble than benefit. i.e.

BOOT + CONFIG + KERNEL + ROMFS (4 areas)
should be worst than
BOOT + CONFIG + (KERNEL + ROMFS as one) (3 areas),

which is similar to openap/linuxap flash usage

hope this helps

Cheers
!3runo
from Brazil

[Bruno Lopes F. Cabral]

Hello there

Post by Henrion Benjamin
There's very high probability that we will succeed in porting linux for
those boards (listed on the pages above) because we have access to JTAG

Just found this similar project on conexant-based gear
http://home.comcast.net/~staskh/projects/

do you know if the conexant based dlink routers/APs are reflasheable
like the samsung ones? better yet, did you try any?

Cheers
!3runo
from Brazil

[Henrion Benjamin]

Post by Bruno Lopes F. Cabral
Hello there

Post by Henrion Benjamin
There's very high probability that we will succeed in porting linux for
those boards (listed on the pages above) because we have access to JTAG

Just found this similar project on conexant-based gear
http://home.comcast.net/~staskh/projects/
do you know if the conexant based dlink routers/APs are reflasheable
like the samsung ones? better yet, did you try any?

Yes, on the pictures of the hacking party, you can see one
dlinkDI614+-revB:

http://reseaucitoyen.be/index.php?DI-614%2BrevB2

We have soldered a 14 pins connector on it, but we have not taken the
time to try the jtag access on it.

But uclinux runs on the arm9, and it's still the same acx100 wireless
chipset. So hacking in prevision...

[Bruno Lopes F. Cabral]

Hello

Post by Henrion Benjamin

Post by Bruno Lopes F. Cabral
do you know if the conexant based dlink routers/APs are reflasheable
like the samsung ones? better yet, did you try any?

Yes, on the pictures of the hacking party, you can see one

I mean, DI-614+ is samsung based. I'm wondering on conexant based
like DI-604 and DWL-900AP+ rev.C1 (revisions before this are
samsung based like DI-614)

or I'm worried for nothing?

Post by Henrion Benjamin
http://reseaucitoyen.be/index.php?DI-614%2BrevB2
We have soldered a 14 pins connector on it, but we have not taken the
time to try the jtag access on it.
But uclinux runs on the arm9, and it's still the same acx100 wireless
chipset. So hacking in prevision...

I have a DI-604 lying around that I'd like to mess with (i.e. try linux),
but it is conexant based and I couldn't find any info about how to
install/boot linux on it, yet, except a cx84200-patched 2.4.19 kernel

how is the boot-loader thing you ppl were working on?

unfortunately DI-604 doesn't have an easy going console available,
and I have no JTAG cable yet (plan to make one or buy the one
recommended on seattlewireless page). until then, I'm just collecting
info about what I'd face ;~)

thanks for feedback, though

!3runo
from Brazil

[Henrion Benjamin]

Post by Bruno Lopes F. Cabral
Hello

Post by Henrion Benjamin

Post by Bruno Lopes F. Cabral
do you know if the conexant based dlink routers/APs are reflasheable
like the samsung ones? better yet, did you try any?

Yes, on the pictures of the hacking party, you can see one

I mean, DI-614+ is samsung based. I'm wondering on conexant based

For the DI-614+:

revA = samsung4510
revB = conexant arm9

Post by Bruno Lopes F. Cabral
like DI-604 and DWL-900AP+ rev.C1 (revisions before this are
samsung based like DI-614)

For the DWL900AP+:

revA, B = samsung4510
revC = conexant arm9

Post by Bruno Lopes F. Cabral
or I'm worried for nothing?

Post by Henrion Benjamin
http://reseaucitoyen.be/index.php?DI-614%2BrevB2
We have soldered a 14 pins connector on it, but we have not taken the
time to try the jtag access on it.
But uclinux runs on the arm9, and it's still the same acx100 wireless
chipset. So hacking in prevision...

I have a DI-604 lying around that I'd like to mess with (i.e. try linux),
but it is conexant based and I couldn't find any info about how to
install/boot linux on it, yet, except a cx84200-patched 2.4.19 kernel

I'm 95% sure that we can put linux also on the conexant arm9 machines
because:

o there's a jtag
o there's already a running uclinux distrib for this
o linux is already running on the same kind of hardware (see hactiontec)

Post by Bruno Lopes F. Cabral
how is the boot-loader thing you ppl were working on?

For the arm9, I don't know, but I think Peter knows more about...

Post by Bruno Lopes F. Cabral
unfortunately DI-604 doesn't have an easy going console available,

The 604 is not the same CPU as the conexant arm9
(Loading Image...)

Post by Bruno Lopes F. Cabral
and I have no JTAG cable yet (plan to make one or buy the one
recommended on seattlewireless page). until then, I'm just collecting
info about what I'd face ;~)

I've updated the seattlewireless page with:

http://home.comcast.net/~staskh/projects/tools/index.html#jtag

It's not so complicated to do, but I've missed my first attempt to do it
because I'm not good in soldering...

[Henrion Benjamin]

Post by Henrion Benjamin

Post by Bruno Lopes F. Cabral
Hello

Post by Henrion Benjamin

Post by Bruno Lopes F. Cabral
do you know if the conexant based dlink routers/APs are reflasheable
like the samsung ones? better yet, did you try any?

Yes, on the pictures of the hacking party, you can see one

I mean, DI-614+ is samsung based. I'm wondering on conexant based

revA = samsung4510
revB = conexant arm9

Post by Bruno Lopes F. Cabral
like DI-604 and DWL-900AP+ rev.C1 (revisions before this are
samsung based like DI-614)

revA, B = samsung4510
revC = conexant arm9

Post by Bruno Lopes F. Cabral
or I'm worried for nothing?

Post by Henrion Benjamin
http://reseaucitoyen.be/index.php?DI-614%2BrevB2
We have soldered a 14 pins connector on it, but we have not taken the
time to try the jtag access on it.
But uclinux runs on the arm9, and it's still the same acx100 wireless
chipset. So hacking in prevision...

I have a DI-604 lying around that I'd like to mess with (i.e. try linux),
but it is conexant based and I couldn't find any info about how to
install/boot linux on it, yet, except a cx84200-patched 2.4.19 kernel

I'm 95% sure that we can put linux also on the conexant arm9 machines
o there's a jtag
o there's already a running uclinux distrib for this
o linux is already running on the same kind of hardware (see hactiontec)

Post by Bruno Lopes F. Cabral
how is the boot-loader thing you ppl were working on?

For the arm9, I don't know, but I think Peter knows more about...

Which bootloader ?

I'm downloading the sources here:

http://opensource.actiontec.com/dualpcmodem/actiontec_release_031017.tar.gz

More infos on the bootloader and so on:

http://www.embeddedlinuxinterfacing.com/wiki.php/ActiontecDualModem

Post by Henrion Benjamin

Post by Bruno Lopes F. Cabral
unfortunately DI-604 doesn't have an easy going console available,

The 604 is not the same CPU as the conexant arm9
(http://damin.umlcoop.net/~delink/actiontec-arm.png)

What CPU is the 604 ? We could do a console on the DCC.

ADMtek 5106
(Loading Image...)

The 604 is a non-wireless router, but with JTAG connector.

I should check the 604+, which has wireless and dsl, but I'm pretty sure
it's not a samsung4510 inside. Who dig into the FCC site?

[Bruno Lopes F. Cabral]

Hello there

I got my hands on a Samsung Magiclan SWL 3300 AP.
inside, I have a Samsung S3C4510B processor, and
a 14 pin header that I suppose is JTAG

my question is... can I hook a jtag cable on it
without fear? here is the 14-pin ARM JTAG pinout
that I've found on

http://home.comcast.net/~staskh/projects/SMC7004/

1 vddh ( positive 3.3) 2 vss (ground)
3 nTRST 4 vss (ground)
5 TDI (pin 161) 6 vss (ground)
7 TMS (pin 164) 8 vss (ground)
9 TCK (pin 165) 10 vss (ground)
11 TDO (pin 162) 12 nRESET
13 vddh (positive 3.3) 14 vss (ground)

I plan to build my adapter cable based on this one

http://home.comcast.net/~staskh/projects/tools/index.html#jtag

the firmware I'll try is from http://www.ucrouter.ru/english/
just to see if it boots (the samsung magiclan SWL3300 has a
serial RS232C ready on it).

sorry folks, no pics at this time but I'll borrow a mavica
and will take some

Cheers
!3runo
from Brazil

[Bruno Lopes F. Cabral]

Hello there

Post by Henrion Benjamin
revA = samsung4510
revB = conexant arm9
revA, B = samsung4510
revC = conexant arm9

thanks for the clarification!! I won't ever understand
why these industry guys modify the hardware and mantain
the same model name for their products :~(

Post by Henrion Benjamin
I'm 95% sure that we can put linux also on the conexant
o there's a jtag
o there's already a running uclinux distrib for this

which would be... ?

Post by Henrion Benjamin
o linux is already running on the same kind of hardware (see actiontec)

their source code is a good start but it's far of complete,
unfortunately. I mean, the pieces are there, but a lot
desorganized for one to follow without more documentation
or lots of work

also, they still don't have the daughterboards available
(this may change in the near future)

Post by Henrion Benjamin

Post by Bruno Lopes F. Cabral
how is the boot-loader thing you ppl were working on?

For the arm9, I don't know, but I think Peter knows more about...

peter ... who? (sorry)

Post by Henrion Benjamin

Post by Bruno Lopes F. Cabral
unfortunately DI-604 doesn't have an easy going console available,

The 604 is not the same CPU as the conexant arm9
(http://damin.umlcoop.net/~delink/actiontec-arm.png)

it is ADMTEK ADM5106, which is a SoC of conexant CX84200 (ARM7TDI)
(the ARM7 part was the reason I asked to you at first place)

there is a pic of the board at
http://home.comcast.net/~staskh/projects/di_604/

Post by Henrion Benjamin

Post by Bruno Lopes F. Cabral
and I have no JTAG cable yet (plan to make one or buy the one
recommended on seattlewireless page).

It's not so complicated to do, but I've missed my first attempt
to do it because I'm not good in soldering...

I like this one http://az-electronics.com/item9.htm (US$35
but ready to go). is it "wriggler compatible" too?

Cheers
!3runo
from Brazil