OpenWrt Forum Archive

Topic: Openwrt on edimax PS-1208mfg

The content of this topic has been archived between 6 Apr 2018 and 26 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hello everyone i'm new to open wrt
i'm trying to put openwrt to an edimax PS-1208mfg which is a print server

http://clemworkbench.fr/ps1208mfg/images/taille.jpg

http://clemworkbench.fr/ps1208mfg/images/connection.png


specifications :
CPU: Broadcom BCM5354 KFBG rev3 at 240MHz (0x29029)
FLASH: MX29LV160CBTC (2MB BotB nor flash)
RAM: 32MB
Serial port
Jtag port
Lan: Broadcom BCM47xx 100/100 Mbps Ethernet Controller 4.130.25.0
1 lan port
Wlan: eth1: Broadcom BCM4318 802.11 Wireless Controller 4.130.28.0
1 USB 2.0 Host port (PCI ID: 14e4:471a)
Reset button, Lan, Wlan, Status LEDs

Actually edimax hasn't released the firmware but it runs a modified linux by default. We have been able to dump the firmware from the device
http://clemworkbench.fr/images/firmware.bin

The original compressed CFE is also modified to boot only firmware with edimax header.

After some research it seems to be a kind of CSYS header which is used by edimax :
edimax ps-1208mfg firmware header :
50 53 31 36 02 B0 1A 00 00 00 50 80 48 44 52 30 | PS16......P.HDR0

edimax ps-1210mfp firmware header :
50 53 30 42 02 C0 0A 00 00 00 50 80 73 68 73 71 | PS0B......P.shsq

50 53 31 36 | 02 B0 1A 00 | 00 00 50 80 
      |             |            | 
Signature           |       start adress 
                    | 
        length in little endian

the signature for this device is PS16
then the start adress doesn't seems to be used as it can be modified without crashing the boot of the original firmware.

I have compile open-wrt backfire from the svn to make a 1,6Mb version (using brcm2.4 and removing all the useless function) and i have added the header with the right size for it but it doesn't seems to boot properly as i haven't any serial output :/ (maybe the serial is misconfigured in the kernel)
here is the output :

CFE version 1.0.37 for BCM947XX (32bit,SP,LE) 
Build Date: ?? 11?? 30 21:57:42 CST 2007 (root@Hinet) 
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation. 

Initializing Arena 
Initializing Devices. 
Boot partition size = 131072(0x20000) 
et0: Broadcom BCM47xx 100/100 Mbps Ethernet Controller 4.130.25.0 
CPU type 0x29029: 240MHz 
Total memory: 32768 KBytes 

Total memory used by CFE:  0x80300000 - 0x8039A300 (631552) 
Initialized Data:          0x803302C0 - 0x80332890 (9680) 
BSS Area:                  0x80332890 - 0x80334300 (6768) 
Local Heap:                0x80334300 - 0x80398300 (409600) 
Stack Area:                0x80398300 - 0x8039A300 (8192) 
Text (code) segment:       0x80300000 - 0x803302C0 (197312) 
Boot area (physical):      0x0039B000 - 0x003DB000 
Relocation Factor:         I:00000000 - D:00000000 

Device eth0:  hwaddr 00-1F-1F-49-5A-6B, ipaddr 192.168.1.1, mask 255.255.255.0 
        gateway not set, nameserver not set 
get id=650 
Open device flash0.setting success 
upgrade flag=0 
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null) 
Loading: Failed. 
Could not load :: Timeout occured************* 
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null) 
Loading: .. 3856 bytes read 
Entry at 0x80001000 
Closing network. 
Starting program at 0x80001000

in fact when i try to ping the device, the network led is blinking but it doesn't answer...is this led driven by hardware ?

it seems the problem is like this one : http://open-wrt.ru/forum/viewtopic.php?id=14856

anyway any help would be appreciated.

thanks

(Last edited by clem-vangelis on 6 Aug 2011, 17:41)

It seems that only the signature is needed, whatever are the changes to the 8 next bytes it doesn't matter.

this let me think it's another problem.
here is my cfe env :

BOOT_CONSOLE         uart0
CFE_VERSION          1.0.37
CFE_BOARDNAME        BCM947XX
CFE_MEMORYSIZE       32768
NET_DEVICE           eth0
NET_IPADDR           192.168.1.1
NET_NETMASK          255.255.255.0
NET_GATEWAY          0.0.0.0
NET_NAMESERVER       0.0.0.0
STARTUP              go;

and here is my nvram :

opo=12
il0macaddr=00:11:22:33:44:55
boardrev=0x11
et0macaddr=00:1f:1f:49:5a:6b
reg_domain=3
watchdog=3000
boot_wait=on
et0mdcport=0
bxa2g=1
reset_gpio=4
pmon_ver=CFE 4.131.25.0
lan_gateway=192.168.1.254
sromrev=3
boardtype=0x048e
lan_netmask=255.255.255.0
wl0id=0x4318
ag0=0
xtalfreq=25000
wl0gpio0=11
wl0gpio1=11
wl0gpio2=11
wl0gpio3=11
status_gpio=1
pa0itssit=62
rxpo2g=0xfff8
rssisav2g=2
wlan_gpio=0
cctl=0
pa0maxpwr=83
lan_ipaddr=192.168.1.1
clkfreq=240
aa0=3
sdram_config=0x0062
ccode=0
rssismf2g=0
boardflags=0x650
sdram_refresh=0
sdram_ncdl=0x10ff09
et0phyaddr=30
landevs=et0 wl0
pa0b0=0x15ed
pa0b1=0xfac2
pa0b2=0xfea0
sdram_init=0x054B
parefldovoltage=0x28
tri2g=78
et1phyaddr=0x1f
language=0
boardnum=01
size: 733 bytes (64803 left)

It boots ! the problem was due to the lzma loader. now there is a problem while detecting bootloader size, this seems due to the fact i'madding a header and then it can detect HDR0 (trx magic) hence it crash hmm if somebody could help

(Last edited by clem-vangelis on 30 Jun 2010, 10:53)

it boot completely smile

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: ?? 11?? 30 21:57:42 CST 2007 (root@Hinet)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena
Initializing Devices.
Boot partition size = 131072(0x20000)
et0: Broadcom BCM47xx 100/100 Mbps Ethernet Controller 4.130.25.0
CPU type 0x29029: 240MHz
Total memory: 32768 KBytes

Total memory used by CFE:  0x80300000 - 0x8039A300 (631552)
Initialized Data:          0x803302C0 - 0x80332890 (9680)
BSS Area:                  0x80332890 - 0x80334300 (6768)
Local Heap:                0x80334300 - 0x80398300 (409600)
Stack Area:                0x80398300 - 0x8039A300 (8192)
Text (code) segment:       0x80300000 - 0x803302C0 (197312)
Boot area (physical):      0x0039B000 - 0x003DB000
Relocation Factor:         I:00000000 - D:00000000

Device eth0:  hwaddr 00-1F-1F-49-5A-6B, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
get id=650
Open device flash0.setting success
upgrade flag=0
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured*************
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3776 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
Linux version 2.6.25.20 (vangelis@vangelis-xps) (gcc version 4.1.2) #1 Thu Jul 1 14:05:36 CEST 2010
CPU revision is: 00029029 (Broadcom BCM3302)
ssb: Core 0 found: ChipCommon (cc 0x800, rev 0x14, vendor 0x4243)
ssb: Core 1 found: Fast Ethernet (cc 0x806, rev 0x09, vendor 0x4243)
ssb: Core 2 found: MIPS 3302 (cc 0x816, rev 0x08, vendor 0x4243)
ssb: Core 3 found: USB 2.0 Host (cc 0x819, rev 0x02, vendor 0x4243)
ssb: Core 4 found: MEMC SDRAM (cc 0x80F, rev 0x04, vendor 0x4243)
ssb: Core 5 found: IEEE 802.11 (cc 0x812, rev 0x0D, vendor 0x4243)
ssb: Core 6 found: Roboswitch (cc 0x81C, rev 0x02, vendor 0x4243)
ssb: Initializing MIPS core...
ssb: set_irq: core 0x0806, irq 2 => 2
ssb: set_irq: core 0x0819, irq 4 => 3
ssb: set_irq: core 0x0812, irq 0 => 4
ssb: Sonics Silicon Backplane found at address 0x18000000
Serial init done.
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal          0 ->     8192
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0:        0 ->     8192
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200
Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Synthesized clear page handler (26 instructions).
Synthesized copy page handler (46 instructions).
PID hash table entries: 128 (order: 7, 512 bytes)
console [ttyS0] enabled
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29216k/32768k available (1986k kernel code, 3552k reserved, 303k data, 828k init, 0k highmem)
Mount-cache hash table entries: 512
net_namespace: 444 bytes
NET: Registered protocol family 16
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
detected lzma initramfs
initramfs: LZMA lc=1,lp=2,pb=2,origSize=2445312
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0xb8000300 (irq = 3) is a 16550A
serial8250: ttyS1 at MMIO 0xb8000400 (irq = 3) is a 16550A
serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 3) is a 16550A
serial8250.0: ttyS1 at MMIO 0xb8000400 (irq = 3) is a 16550A
b44.c:v2.0
eth0: Broadcom 44xx/47xx 10/100BaseT Ethernet 00:1f:c6:42:40:79
flash init: 0x1c000000 0x02000000
Physically mapped flash: Found 2 x8 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Flash device: 0x400000 at 0x1fc00000
Found edimax header 
bootloader size: 131072
Found an edimax ps header
Updating TRX offsets and length:
old trx = [0x00169000, 0xe834a13c, 0x00010000], len=0x00169000 crc32=0x80500000
new trx = [0x0000001c, 0x00000914, 0x00000000], len=0x00000908 crc32=0x12e332d9
erase of region [0x20000, 0x20000] on "Physically mapped flash" failed
Done
Creating 4 MTD partitions on "Physically mapped flash":
0x00000000-0x00020000 : "cfe"
0x00020000-0x003e0000 : "linux"
0x00020914-0x003e0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "Physically mapped flash"
0x003e0000-0x00400000 : "nvram"
TCP vegas registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Freeing unused kernel memory: 828k freed
Algorithmics/MIPS FPU Emulator v1.5
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
- preinit -
Press CTRL-C for failsafe
diag: Detected 'ASUS WL-500g Premium V2'
b44: eth0: Link is up at 100 Mbps, full duplex.
b44: eth0: Flow control is off for TX and off for RX.
roboswitch: Probing device eth0: found!
b44: eth0: powering down PHY

Please press Enter to activate this console. mtdblock: erase of region [0x0, 0x20000] on "nvram" failed



BusyBox v1.11.2 (2010-07-01 13:57:53 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (8.09.2, r18801) -------------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@(none):/# b44: eth0: Link is up at 100 Mbps, full duplex.
b44: eth0: Flow control is off for TX and off for RX.
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
br-lan: Dropping NETIF_F_UFO since no NETIF_F_HW_CSUM feature.
device eth0.0 entered promiscuous mode
device eth0 entered promiscuous mode
br-lan: port 1(eth0.0) entering learning state
br-lan: topology change detected, propagating
br-lan: port 1(eth0.0) entering forwarding state
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)

but there is still a problem with flashwriting...

my PS-1208mfg hang same place
"starting program 0x80001000"

what's lzma-loader probrem ?
what sould i do ?

hey nice to see some one with the same device smile

the problem is that lzma loader expects to find trx header at start of an erase block. but due to the edimax header it can't find it.

I will release the patch so you will be able to test it.

if you want the modification it's the following :
open the file target/linux/brcm47xx/image/lzma-loader/src/decompress.c

add that :
#define EDIMAX_PS_HEADER_MAGIC    0x36315350 /*  "PS16"  */
#define EDIMAX_PS_HEADER_LEN    0xc /* 12 bytes long for edimax header */


and modify that near line 140 :

    /* look for trx header, 32-bit data access */
    for (data = ((unsigned char *) KSEG1ADDR(BCM4710_FLASH));
        ((struct trx_header *)data)->magic != EDIMAX_PS_HEADER_MAGIC; data += 65536);
    data+=EDIMAX_PS_HEADER_LEN;

here is the patch :

Index: decompress.c
===================================================================
--- decompress.c    (révision 22048)
+++ decompress.c    (copie de travail)
@@ -87,6 +87,9 @@
     unsigned int offsets[3];    /* Offsets of partitions from start of header */
 };
 
+#define EDIMAX_PS_HEADER_MAGIC    0x36315350 /*  "PS16"  */
+#define EDIMAX_PS_HEADER_LEN    0xc /* 12 bytes long for edimax header */
+
 /* beyound the image end, size not known in advance */
 extern unsigned char workspace[];
 
@@ -135,8 +138,8 @@
 
     /* look for trx header, 32-bit data access */
     for (data = ((unsigned char *) KSEG1ADDR(BCM4710_FLASH));
-        ((struct trx_header *)data)->magic != TRX_MAGIC; data += 65536);
-
+        ((struct trx_header *)data)->magic != EDIMAX_PS_HEADER_MAGIC; data += 65536);
+    data+=EDIMAX_PS_HEADER_LEN;
     /* compressed kernel is in the partition 0 or 1 */
     if (((struct trx_header *)data)->offsets[1] > 65536) 
         data += ((struct trx_header *)data)->offsets[0];

(Last edited by clem-vangelis on 4 Jul 2010, 08:49)

Forget about OpenWrt on routers with 2MB flash/8MB RAM. Minimum for OpenWrt is 4MB flash/16MB RAM....

i have been able to make an openwrt version for this device, by the way it has a usb port which can be used to put an usb key and use it as a root device

clem-vangelis wrote:

by the way it has a usb port which can be used to put an usb key and use it as a root device

Well, if you manage to put the USB and filesystem support in the 2MB flash.......

by stripping it down to the strict neccessary maybe it could be possible... plus it's possible with dd-wrt (someone as already done it) so as openwrt is highly configurable...

Thanks for your advice but i will give it a try smile

Ok. Try it and report your solution....

Hey Dogge i got a working openwrt version with ext2 and usb support, so here is my solution : build openwrt with minimum packages and install them later smile thanks for your encouragements wink

Hello smile

This is a very good work. You can try to boot OpenWrt from usb key, or try to boot directly debian mipsel rootfs.

I'll try to reflash original edimax CFE and boot your kernel to see if it works.

@sebtx : everything is almost working smile root is on usb key, wireless and lan is working, there is just a last problem with nvram which is as the rest not standard... xMff has make a patch and reading is working but not writing.

more news quickly

@clem: great work, im' looking forward to reading more news smile

OK this is a good new. you can look into kernel logs of edimax's firmware to see how kernel handles nvram.

DD-WRT is quite stable, and used principally as ssh tunnel and public web server. I have the following processes running permanently :

- Screen
- irssi
- sshd
- srelay
- polipo
- thttpd (with php support).

root@DD-WRT:~# free
    total         used         free       shared      buffers
  Mem:        30004        28928         1076            0          932
 Swap:        53240         5132        48108
Total:        83244        34060        49184
Linux DD-WRT 2.4.36 #2878 Wed Dec 17 08:57:45 CET 2008 mips unknown
root@DD-WRT:~# dmesg
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
usb-ohci.c: USB OHCI at membase 0xb8003000, IRQ 6
usb-ohci.c: usb-00:03.0, PCI device 14e4:471a
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
SCSI subsystem driver Revision: 1.00
Initializing USB Mass Storage driver...
usb.c: registered new driver usb-storage
USB Mass Storage support registered.
hub.c: new USB device 00:03.0-1, assigned address 2
scsi0 : SCSI emulation for USB Mass Storage devices
  Vendor: SanDisk   Model: Cruzer Micro      Rev: 8.02
  Type:   Direct-Access                      ANSI SCSI revision: 02
Attached scsi removable disk sda at scsi0, channel 0, id 0, lun 0
SCSI device sda: 7856127 512-byte hdwr sectors (4022 MB)
sda: Write Protect is off
WARNING: USB Mass Storage data integrity not assured
USB Mass Storage device found at 2
EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
root@DD-WRT:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 1.1M      1.1M         0 100% /mnt
/dev/scsi/host0/bus0/target0/lun0/part1
                          3.7G      2.7G    796.0M  78% /
/dev/scsi/host0/bus0/target0/lun0/part1
                          3.7G      2.7G    796.0M  78% /opt
root@DD-WRT:~# uptime
 08:17:20 up 30 days,  2:42, load average: 0.02, 0.02, 0.00
root@DD-WRT:~# cat /proc/cpuinfo
system type             : Broadcom BCM5354 chip rev 3
processor               : 0
cpu model               : BCM3302 V2.9
BogoMIPS                : 239.20
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available
root@DD-WRT:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00010000 "cfe"
mtd1: 001d0000 00010000 "linux"
mtd2: 00127000 00010000 "rootfs"
mtd3: 00010000 00010000 "nvram"

Openwrt seems much more extendable than DD-wrt with the packages. and building is really easy compared to dd-wrt which required a tons of librairy and data.

Hello everybody, I have exactly the same device and I've rather disappointed with the original software/firmware. This was provided to me when I purceased an Epson GT-S50N scanner (great scanner btw) to make it "network ready". It does work, but if I happen to reboot either edimax or scanner the windows edimax software, by design according to the tech support, doesn't reconnect the remote USB port automatically and I need to manually click "connect". Please don't ask...

2 questions for you clem-vangelis if you don't mind:

1) Is your firmware compatible with USB scanner?

2) How would I mount the USB scanner via the network without having to use the Edimax software provided (MFP Server or something)?

Thanks! I thought I was the only one with such device, nice to see some interest around it :-)

rs232

@rs232

1) Is your firmware compatible with USB scanner?

At the moment no

2) How would I mount the USB scanner via the network without having to use the Edimax software provided (MFP Server or something)?

When it will be supported, you will need to install sane to share your scanner and then use something like xsane to scan from your windows computer. but i wouldn't recomment you using another firmware if your purpose is only to use the scanner remotely. Moreover it will not be ready to use, i mean you will have to modify some config files and maybe experience a lot of problems wink

(Last edited by clem-vangelis on 15 Aug 2010, 23:05)

Hi all,

I have build a working firmware with some packages for ps-1208mfg.
The firmware has USB 2.0 integrated, with block-extroot to put the root on an usb key.
You can find them at http://clemworkbench.fr/ps1208mfg/old/upgrade.bin for the firmware and  http://clemworkbench.fr/ps1208mfg/old/packages for the packages. They can be used with opkg of course you will just have to modify the opkg repository to use this one (/etc/opkg.conf) .

I'm not responsible of any damage you will do to your material

Do not try to flash the firmware using edimax firmware upgrade web pages. It will put the cfe upgrade flag to 1 or something like that and you will not be able to boot without a serial cable

To use it and have some extra space you will have to put an usb key in the print server formatted as the following :

/dev/sda1 = root in ext2fs
/dev/sda2 = swap

Now to flash it you will need to setup a tftp (not ftp) server on your computer (i let you find a tutorial for that).
Once it will be setup properly put the firmware in the main tftp directory and rename it upgrade.bin.
Now connect your computer to the print server using ethernet cable. set your computer ip to 192.168.2.254.
Then press the reset button of the print server and boot it while keeping the reset button pressed. If everything is ok you should see the lan led blinking fast for approximately 2 seconds (transfer of the firmware).

Then wait for 30 seconds while the server is booting and after that  log in using telnet.
Install dropbear ssh server elsewhere you will not be able to login again to the print server after quitting the telnet session. Then do

/etc/init.d/dropbear enable

to enable dropbear at the next boot.

Once everything is done ( dropbear installed) you will be able to change your password, reboot and login using ssh.

After that to flash the firmware you will be able to use mtd.

(Last edited by clem-vangelis on 6 Aug 2011, 17:45)

Clem, thanks for work you are doing. I will be glad to try change the firmware of my print server, but the links you posted do not seem to work... At least, they do not work for me...

Hi Clem.
Thank you for your firmware and firmware patch.
I installed your firmware.
But, I could not use wifi.
If I want to use PS-1208mfg with wifi., which package should I install ?

hey you should install kmod-b43, hostapd, wpa-supplicant and it should work smile install dnsmasq to have a dhcp server and luci to have a web adminsitration. Then do /etc/init.d/uhttpd enable and reboot the board