Exploring WL500gP hardware expansion / interfacing possibilities

[Inertial]

Wouldn’t it be nice to have a thread dedicated to hardware hacks, hardware interfacing and expansion fantasies, and the stories of our quest to turn them in to reality? As discussed (http://wl500g.info/showthread.php?t=12962&page=3) in the “Upgrading WL-500g Premium, WL-500W and WL-700gE RAM to 128 MB (http://wl500g.info/showthread.php?t=12962)” thread there are many such possibilities, for wl500gP and other routers as well.

Inspired by the fact that a wl500gP with 128MB RAM can do quite some things on top of it’s base duties, and considering that the software – firmware – networking part of these is pretty well taken care of in the forum :), I take the honour to inaugurate a dedicated thread to hardware upgrade – expansion – interfacing.

Hopping to see postings on the subject of:

* Sensors interfacing
* Motor control
* Robotics
* wl500gp bus expansions
* Interfacing to microcontrollers and custom hardware through RS232 / USB / LAN / Wi-Fi / Bluetooth / (…)
* Interfacing to GPS modules, to smart phones, to PDA’s, to GPRS modules,to harddisks / Compact Flash's

and in general, on upgrades and hard-hacks of any kind , I welcome us all!

Inertial

[mitek]

EEPROM interface

1. VT6212L (usb) have eeprom interface:
EECS (O) - pin56
EECK (O) - pin55
EEDI (O) - pin50
EEDO (I) - pin49
VT6212 specification does not mention about register to control this interface - maybe someone have any drivers that can do this?

2. BCM5325 (ethernet) eeprom interface:
SCK - pin7
SS# - pin8
MOSI - pin6
MISO - pin5
Interesting could be to access this interface via MII interface (used by processor to configure switch). Need detailed registers description to do it.

[Inertial]

In order to remove the uncertainty around the current consumption levels of the various usb peripherals that may be connected on a wl500gP (modified with extra USB ports or just plain, straight out of the box), an experimental current measurement set up was used.


The router was supplied with power through a digital millimetre, set at 10 Amps range, then the current consumption of various configurations of hardware was measured. The peek current during power-on of each module was also recorded. The router was modified with 128MB RAM, MAX202 RS-232 dual transceiver, two extra USB ports (taken from VIA chip). Firmware: Oleg's ver. 1.9.2.7-9. Picures of the mods here (http://wl500g.info/showpost.php?p=92227&postcount=40)


Current Measurement During Boot Sequence:

Set up:
Two lan ports connected with PC's
Serial port 0 console connection to the unit
Wi-Fi initially off
No usb devices connected

Result:

Starts at 0.67 Amps for a couple of sec’s, then 0.89 Amps then ranges between 0.85 to 1.05 Amps and then after boot sequence and os-startup is complete stabilizes at 1.00 Amp.

Now we are just at the first prompt after the boot sequence.


Removing one of the two Lan cables dropped the current to 0.95 Amps
Connecting a 1GB flash USB rises at 1.04 (90mA more)
Connecting a 4GB flash USB rises at 1.13 (90mA more)
Connecting a 64MB flash USB rises at 1.18 (50mA more)


Connecting these results on the following messages on the Serial Console:

echo for PaN ::: &&&PaN
hub.c: new USB device 01:03.2-2, assigned address 2
usb.c: USB device 2 (vend/prod 0x19b6/0x1024) is not claimed by any active drive
r.
hub.c: new USB device 01:03.2-1, assigned address 3
usb.c: USB device 3 (vend/prod 0x90c/0x1000) is not claimed by any active driver
.
hub.c: new USB device 01:03.1-2, assigned address 2
usb.c: USB device 2 (vend/prod 0x1043/0x8006) is not claimed by any active drive
r.

/ #

Please note that the firmware was set up not to mount the USB mass strorage devices upon detection, in order to see if there is any difference in consumption pre-mount and post-mount. So let's mount them manually:



/ # insmod scsi_mod
SCSI subsystem driver Revision: 1.00
/ # insmod sd_mod
/ # insmod usb-storage

That's part of what we get at the Serial Console:


usb.c: registered new driver usb-storage
scsi0 : SCSI emulation for USB Mass Storage devices
Vendor: takeMS Model: USB Easy Rev: 1100
Type: Direct-Access ANSI SCSI revision: 02
Attached scsi removable disk sda at scsi0, channel 0, id 0, lun 0
SCSI device sda: 7864320 512-byte hdwr sectors (4027 MB)
sda: Write Protect is off
/dev/scsi/host0/bus0/target0/lun0: p1
scsi1 : SCSI emulation for USB Mass Storage devices
Vendor: S3+ Model: Rev: 8.07
Type: Direct-Access ANSI SCSI revision: 02
Attached scsi removable disk sdb at scsi1, channel 0, id 0, lun 0
SCSI device sdb: 1918976 512-byte hdwr sectors (983 MB)
sdb: Write Protect is off
/dev/scsi/host1/bus0/target0/lun0: p1
scsi2 : SCSI emulation for USB Mass Storage devices
Vendor: Generic Model: USB Flash Drive Rev: %z!Y
Type: Direct-Access ANSI SCSI revision: 02
Attached scsi removable disk sdc at scsi2, channel 0, id 0, lun 0
SCSI device sdc: 128512 512-byte hdwr sectors (66 MB)
sdc: Write Protect is off
/dev/scsi/host2/bus0/target0/lun0: p1
USB Mass Storage support registered.

Let's check the mounted devices:

/ # df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/root 3008 3008 0 100% /

Mounting the usb's:


/ # mkdir /tmp/hd1
/ # mkdir /tmp/hd2
/ # mkdir /tmp/hd3
/ # mount /dev/discs/disc0/part1 /tmp/hd1
/ # mount /dev/discs/disc1/part1 /tmp/hd2
/ # mount /dev/discs/disc2/part1 /tmp/hd3
/ # df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/root 3008 3008 0 100% /
/dev/discs/disc0/part1 3924460 1103812 2820648 28% /tmp/hd1
/dev/discs/disc1/part1 959200 703104 256096 73% /tmp/hd2
/dev/discs/disc2/part1 61596 4494 57102 7% /tmp/hd3
/ #

Everything remains at 1.18 Amps... So no difference when the Flash memory usb's are connected, whether mounted or not.

Let's turn on wi-fi:


/ # wl radio on
/ #

Now it's up to 1.43 Amps (250mA more)(TX Power settings are the default, mini-PCI card is the original WL120G R1.01)



Connecting a multi-card reader loaded with a 2GB CF:

That's 1.58 Amps after a peak of 1.60


/ # hub.c: new USB device 01:03.2-3, assigned address 6

/ # mkdir /tmp/hd4
/ # mount /dev/discs/disc4/part1 /tmp/hd5
/ # df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/root 3008 3008 0 100% /
/dev/discs/disc0/part1 3924460 1103812 2820648 28% /tmp/hd1
/dev/discs/disc1/part1 959200 703104 256096 73% /tmp/hd2
/dev/discs/disc2/part1 61596 4494 57102 7% /tmp/hd3
/dev/discs/disc4/part1 2000064 1706400 293664 85% /tmp/hd4
/ #

Connecting two more Lan's: 1.70 Amps (100mA more)


Initiating a large file transfer between two pc's connected over lan through the wl500gp doesn't affect current consumption which remains 1.70Amps

Disconnecting all usb flash memory devices, leaving only one lan connection, Wi-fi, and the RS-232 console too: 1.18Amps (520mA less)

Wi-fi turned off: 0.92Amps (260mA less) (It was 250mA up when turned on, but that's the reading i got)

Now to the interesting part:

60 GB, 2.5'' IDE HD connected through e-quip IDE to USB adaptor, power supplied from usb: 1.45Amps during several spin-up seconds then 1.25 Amps (530mA peek, 330 there after)

Disconnecting the usb-HD, connecting an external one:

250GB 3.5'' maxtor external HD, externally supplied: 1.02 Amps, no peek observed. (100 mA more)


I also checked the re-settable poly-fuses (on the mainboard) used to protect the router from USB overcurrent and they are rated 0.750 mA. I checked their specs from their manufacturer and it turns out they trip at 1.5 Amps(!), not that i would recommend connecting anything that heavy though.
So as thing are connected now on the modded router, three usb devices are supplied from the power initially intended for one of the two original usb ports while the other get's all the current by itself.


I had to stop experimenting at that time, but still want to take measurements during file transfers from/to the Flash memory devices and the usb-HD. These are sure to draw more current, how much exactly remains to be measured...



To sum it up, here are the same results, presented in a table:



Device/Action: Current Peek Current
Consumption: Consumption:

Asus WL500gP start-up (+2 Lan) 670 mA -
Asus WL500gP boot (+2 Lan) 850 - 1050 mA 1050 mA
Lan connected (each) 50 mA -
1GB iStar, usb Flash memory 90 mA 90 mA
4GB takeMS, usb Flash memory 90 mA 90 mA
64MB, usb Flash memory 50 mA 50 mA
usb multi-card reader with 2GB CF 150 mA 170 mA
Asus wl-121 mini-PCI power-on 250 mA -
2.5'' IDE HD - USB (internal) 330 mA 530 mA
3.5'' IDE HD - USB (external) 100 mA -

Also note that the usb ports will try to provide as much current as possible and the poly-fuses protecting them will only trip somewhere in the region 1Amp - 1.5Amps (guess not tested) (usb protecting Poly-fuses marked "P.075", WL500gP board version R1.14). There is also the Poly-fuse protecting the main power supply, (Main Poly-fuse marked "P.260", WL500gP board version R1.14). In general poly-fuses trip, when the current exceeds by some percentage their rating and then, once the overcurrent condition has been removed, conduct again when they have cool down.


I hope this info may be useful somehow

Greetings to all


Inertial


Attached: 1) The measurements set up. 2) Cable connections (little cables usb mod supply, larger cables router supply)

[Inertial]

Following some posts in the forum on the RS232 port subject, a dual RS232 line transceiver was implemented, based on a 5-Volt, max202, narrow-SOIC 16pin chip. Spec's say that anything below 0.8 Volts is perceived as Low-Level signal whereas anything above 2 volts is perceived as High-Level signal so the 3.3 volts from the board are definitively interpreted correctly as a High-Level. Supply-voltage-wise the requirements range between 4.5 to 5.5 volts, so the on-board regulated USB supply kindly donates the appropriate voltage (and a maximum current of 15mA), keeping everyone happy. MAX202 is oriented towards battery operated, handheld applications, and only needs five 100nF capacitors to operate. Using smd ceramic capacitors results in a very small sized pcb. The transceiver circuit was tested OK using a USB to RS-232 converter and a plain-old RS-232 port (still quite a few of those available around). :)

The default settings for connection to the WL500gP over RS-232 are 115200 Baud rate, 8 Data bits, No Parity, 1 Stop bits, No Flow Control.

Port 0 is console, port 1 is free to use, both are found on /dev/tts/

echo "Hello Network" >> /dev/tss/1

will sent a string to rs-232 port one.


Note: FTDI based USB to RS232 converters work fine with Oleg's firmware ver. 1.9.2.7-9. and provide connection for extra micro-controllers if need be.


I will update this post with schematics / more details / better pic's and hopefully in the later future with a small pcb design.

Visible in the photo is the unorthodox use of an old prototyping board with tracks split in two, and some smd capacitors mounted in equally unorthodox orientations. that wasn't rapid prototyping, but rather impulse prototyping :) . It also made me consider a small custom pcb in the future.


Greetings

Inertial

[Oyabun]

A bit of a different USB implementation.
The principle is the same - in a way, that goal was to enable the two unused USB ports on the router - with maximum tidyness and serviceability in focus. Clicking on picture brings up bigger image.
http://www.boday-bago.hu/500gP/wl500gP_USB_small.jpg (http://www.boday-bago.hu/500gP/wl500gP_USB.jpg)

[Inertial]

Hello again!

Following the post "Additional USB ports and Internal HD! (http://wl500g.info/showthread.php?t=11992)" by parper, I decided to add two more USB ports by soldering tiny wires on the pins of the VIA (VT6212L) chip. I used very thin veneer-insulated copper wire taken from the coil windings of a Cathode Ray Tube (CRT) of an old monitor. I had a bit of a trouble finding the correct circuit schematic and component values on the forum or the net (I failed to actually), so I examined the wiring of the existing USB ports and used a multimeter to figure these out. The findings are: Each one of the data pins (usb3D+,usb3D-,usb4D+,usb4D-) is tied to ground by an 15K ohm resistor and filtered in pairs using magnetically coupled inductors. Power supply and grounding are also filtered by inductors and capacitors. The configuration I finally went with is: four 15K ohm resistors tying the usb data pins to ground, and some simple LC (inductor capacitor) filter for the positive power supply. Having trouble to locate suitable smd resistors in the "junk pile", pairs of 10K ohm and 4k7 ohm resistors off an old ink-jet printer board were used in series. The 100nf ceramic disc capacitors and ferrite beads for the supply filter were kindly provided by the same old monitor as before.

A standard dual stacked type A female pcb connector was "slightly" modified and the end result is quite acceptable. The case is also modified, with a rectangular hole between the WAN and LAN1 connectors, to house the usb connector.

In details, the usb connector was fitted with an eight pin standard 2.54 cm pitch gold plated male connector, while the rest of the circuit (pull-ups and filters) was attached to it’s respective female connector. The usb connector is not attached to the wl500gp PCB, and it’s only held in place by the metallic springs on the top and bottom of it’s body, holding against the rectangular opening on the case.

I have later refined the USB mod. This was needed since I already had managed to remove most of the fine wires while accidentally pulling the resistor – filters pcb. Oyabun is right: the previous implementation of mine was a little mess! :) Electrical connections are now achieved using a very small piece of pcb, with a fine pitch 1mm, gold contact, female connector, attached to the asus mainboard with Devcon - high strength "plastic steel epoxy". I have to admit it looks really neater! This way things are a bit more modular too, which comes handy since I plan to design and etch a small pcb to house the pull-ups and the filters, all hopefully in smd sizes. When successful, all results schematics, pcb layouts and relative photos will be posted here :)


Happy modding!

Inertial


Bellow are some pictures, one during the fabrication of the small pcb (included for it's strange beauty and it's mild industrial after-taste), and two more of it as it looks on the board. The little wires were not soldered on it yet; since it took 24 hours waiting for the epoxy to fully cure. The last picture shows the final arrangment with the little (fragile) wires in place.

[Inertial]

EEPROM interface
Interesting could be to access this interface via MII interface (used by processor to configure switch). Need detailed registers description to do it.

@mitek:

Thanks for the info!

@all:

It seems that we need indeed registers info to proceed this way. Reverse engineering the drivers or firmware that mitek mentions (if any) in hope that they actually use the eeprom interface of these chips might provide a solution... I haven't spoted anything yet but haven't really looked for it that hard either. We would first need to spot some hardware which implements the eeprom connection with either VT6212L or BCM5325. A "Programmer's Guide" or at least some datasheets for the BCM4704 would be our heaven, but no such thing in sight anywhere... Does Broadcom only provides these info's under NDA's? Or even worst, to business partners only, under NDA's too? Do they actually make you swear to eat :p the hardcopy of the documents if you let any one else even have a glimpse on them?
Seriously now, has anyone tried to approach them directly?

Inertial

[Inertial]

Hello again!

Let me present some info on the mini-PCI bus and the mini-PCI cards Type III, as the ones found on routers.

The connector has 124 pins. A list of pins and signal names, adapted from PCI Local Bus Specifications Rev 2.3 and pinouts.ru (http://pinouts.ru/Slots/mini_pci_pinout.shtml) follows:

Mini PCI Card Type III System Connector Pinout

Pin Signal Pin Signal Pin Signal Pin Signal

1 TIP 2 RING 63 3.3V 64 FRAME#
Key Key 65 CLKRUN# 66 TRDY#
3 8PMJ-3 4 8PMJ-1 67 SERR# 68 STOP#
5 8PMJ-6 6 8PMJ-2 69 GROUND 70 3.3V
7 8PMJ-7 8 8PMJ-4 71 PERR# 72 DEVSEL#
9 8PMJ-8 10 8PMJ-5 73 C/BE[1]# 74 GROUND
11 LED1_GRNP 12 LED2_YELP 75 AD[14] 76 AD[15]
13 LED1_GRNN 14 LED2_YELN 77 GROUND 78 AD[13]
15 CHSGND 16 RESERVED 79 AD[12] 80 AD[11]
17 INTB# 18 5V 81 AD[10] 82 GROUND
19 3.3V 20 INTA# 83 GROUND 84 AD[09]
21 RESERVED 22 RESERVED 85 AD[08] 86 C/BE[0]#
23 GROUND 24 3.3VAUX 87 AD[07] 88 3.3V
25 CLK 26 RST# 89 3.3V 90 AD[06]
27 GROUND 28 3.3V 91 AD[05] 92 AD[04]
29 REQ# 30 GNT# 93 RESERVED 94 AD[02]
31 3.3V 32 GROUND 95 AD[03] 96 AD[00]
33 AD[31] 34 PME# 97 5V 98 RESERVED_WIP
35 AD[29] 36 RESERVED 99 AD[01] 100 RESERVED_WIP
37 GROUND 38 AD[30] 101 GROUND 102 GROUND
39 AD[27] 40 3.3V 103 AC_SYNC 104 M66EN
41 AD[25] 42 AD[28] 105 AC_SDATA_IN 106 AC_SDATA_OUT
43 RESERVED 44 AD[26] 107 AC_BIT_CLK 108 AC_CODEC_ID0#
45 C/BE[3]# 46 AD[24] 109 AC_CODEC_ID1# 110 AC_RESET#
47 AD[23] 48 IDSEL 111 MOD_AUDIO_MON 112 RESERVED
49 GROUND 50 GROUND 113 AUDIO_GND 114 GROUND
51 AD[21] 52 AD[22] 115 SYS_AUDIO_OUT 116 SYS_AUDIO_IN
53 AD[19] 54 AD[20] 117 SYS_AUDIO_OUT GND 118 SYS_AUDIO_IN GND
55 GROUND 56 PAR 119 AUDIO_GND 120 AUDIO_GND
57 AD[17] 58 AD[18] 121 RESERVED 122 MPCIACT#
59 C/BE[2]# 60 AD[16] 123 VCC5VA 124 3.3VAUX
61 IRDY# 62 GROUND

8PMJ = 8 position modular jack connector pin (RJ45)


To help things some more, an image of the actual wi-fi card used in the wl500gP, overlayed with pin numbers and signal names is attached bellow.

Some mechanical specs for type III connectors (adapted from the PCI Local Bus Specifications Rev 2.3) where found and are attached bellow too.

While having a look at the mainboards of wl700gE and wl500W, I noticed two interresting things:

The wl500W seems to have pads for a 68 pins pcb connector(!) on the underside of the mainboard (Bottom Layer). From a quick look i had, it seems that most of the interesting signals of the mini-PCI bus are present there :) . Initially i hopped they where EBI signals (Expansion Bus Interface) but no luck...

Wl700gE seems to have pads for a type III mini-PCI connector! :D


I am currently fighting my way through the PCI Local Bus Specs. Maybe an easier way (?) to approach things would be a PCI-to-PCI Bridge on a mini-PCI card (if such thing exists). This could be used in order to connect a multitude of Mini-PCI cards. I still dont understand all about how PCI's work, and reserve the right to return on the subject after completing my reading...


Inertial

[Inertial]

I managed to find a detailed enough picture of the underside of wl700gE mainboard, here (http://www.wl500g.info/showthread.php?t=6499) in the forum.

82 connected pads out of the 124 on the wl700gE mainboard as opposed to 86 connected pads on the wl120v2, but still it yields a match!
These are indeed pads for a mini-PCI type III connector:D
Actually, four Reserved pins are left Non Connected at wl700gE as opposed to the WL120V2 wifi card.

Things must be a bit crowded at the PCI bus of wl700gE, between IDE controllers, USB 2.0 Hosts and onboard wifi's. Maybe the IDE controller is on the EBI bus, I will get hold of a wl700gE for a while, that will give me the chance to have a closer look... The wl700gE will be on short loan though, no chances for hardware experimentations...:p Whether it's possible to connect a mini-PCI connector and a type III card and make it visible for the firmware, i know not. I had a quick read through the firmware's source code of pci.c and such, i can't really say...:o I could probably use some help on that one.

Here goes the picture overlayed with pin numbers and signal names.

Inertial

[wpte]

wow this is cool stuff:eek:
I never really attempted to open my box up... I dont like to break the warranty;)
verry nice pictures, but some Soldering might be done a bit more cleaner:p
and no, I'm not really good myself at soldering;)

[Inertial]

Well these wonderful pads of what seems to be an 8-pin ic, where there, next to the flash chip, on all wl500gP's, wl500w's and wl700gE's, waiting to be noticed...

What that IC might have been remains unclear...

If it was a real time clock, wouldn't it need a back-up battery? most probably yes.

An eeprom then...? but what it's use would be...?

Or do they give access to some internal pins of nearby chips...? Probably not since test points or connector awaiting pads would have been used in that case...

It seems (a wild guess) that there might be the signals of an I2C or an SPI presented there...

Having zero spare time now, it will take a while before I could have a chance to investigate this matter further...

The pads are know to belong to an IC nicknamed U12 ;)

If you can shed light on this case... we want to hear from you :)

Inertial

Bellow is a picture of the UUP's (Unidentified Unsoldered Pads) in question...

[wpte]

If it was a real time clock, wouldn't it need a back-up battery? most probably yes.


the routers don''t have any, they update the time from the internet remember:rolleyes:

anyway, about what are you talking? about those pieces of metal with a white box left top?:p

[MrWindred]

So U12 is on several wl-models??

Hmmm... I think they are JTAG pads.

Anybody with some knowledge / testing ability of JTAG, can have/borrow a bricked wl500gP from me.

Please email me at wl500gp@3iii.dk

[snarfer]

I have been looking with some interest through the threads on adding RS-232 support regarding the connection to built-in UART. What I'm looking for actually is not RS-232, but RS-485.

Why? For implementing DMX/RDM protocol for control of stage lighting units. Actually it has already been done by using USB-DMX controller such as Enttec OpenDMX. But to do it directly with built-in UART would be far simpler and cheaper.

I would like to connect RS-485 transciever, or ideally two RS-485 transceivers, if indeed both UARTs can be used simultaneously. Example would be SN75176B if unisolated, or actually I have some very nice fully isolated Maxim transceivers around too. This would make possible control of up to 1024 DMX channels.

Before I open up the case of the WL-500gP I wonder about the software aspects first though. Is it possible to set bit rate at 250kbps, 2 stop bits, no parity? How to control Tx/Rx mode for the transceiver?

Any ideas on this?

[snarfer]

I found this link to datasheet for VT6212L:

http://down.chinaeda.cn/upload/2007_10/07101218477472.pdf

Maybe some useful information in there.

[wpte]

I found this link to datasheet for VT6212L:

http://down.chinaeda.cn/upload/2007_10/07101218477472.pdf

Maybe some useful information in there.

nice
but doesnt that just add nothing to what we already know, the chip has 4 usb ports...:rolleyes: