ASCII Smiley Face Daniel Dickinson Mini Headshot
The C Shore
Daniel Dickinson's Website - Experimental

NB: The main page content is close to the 2007-2011 version (you can view it with no styles or graphics). There are major technical updates for future work, however.

Comtrend CT-5621


General Information

This is an ADSL2+ Modem + 4-port Switch with USB (it can act as a USB network device). It is manufactured by Comtrend who, as best I can determine from their voice prompts for assistance, only sell their equipment to ISP’s and Telcos, thus bypassing regular users as customers and therefore recipients of source code.

Specifications

Chipset

This is based on the Broadcom BCM96348 SoC, BCM5325EQKM switch, Fujitsu MPM29DL32B-70PFTN Flash, Hynix 409A HY57 283220I-7 SDRAM, and ADM202EARN RS-232c Line Driver

System (Board) Type

96348GW-11

CPU

CPU is BigEndian

BCM6348 V0.7
256 MHz
Bus: 128 MHz
Ref: 32 MHz

Stock firmware (2.4.17 kernel)

cat /proc/cpuinfo
system type                : 96348GW-11
processor                : 0
cpu model                : BCM6348 V0.7
BogoMIPS                : 255.59
wait instruction        : no
microsecond timers        : yes
tlb_entries                : 32
extra interrupt vector        : no
hardware watchpoint        : no
VCED exceptions                : not available
VCEI exceptions                : not available

From kamikaze (kernel 2.6.27)

 /proc/cpuinfo
 system type                : bcm63xx/96348GW-11 (0x6348/0x00A2)
 processor                : 0
 cpu model                : Broadcom BCM6348 V0.7
 BogoMIPS                : 255.48
 wait instruction        : yes
 microsecond timers        : yes
 tlb_entries                : 32
 extra interrupt vector        : yes
 hardware watchpoint        : no
 ASEs implemented        :
 shadow register sets        : 1
 core                        : 0
 VCED exceptions                : not available
 VCEI exceptions                : not available

RAM

16 MiB RAM

Flash

4 MiB Fujitsu MPM29DL32B-70PFTN

Messages

Boot Log

Stock firmware (2.4.17 kernel)

 CFE version 1.0.37-5.17 for BCM96348 (32bit,SP,BE)
 Build Date: Tue, 19 Oct 2004 12:02:54 +0800 (root@junhon_linux)
 Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

 Initializing Arena.
 Initializing Devices.
 init 5325E: init mii=0
 init 5325E: init success, mii=9f
 CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz

 Total memory used by CFE:  0x80401000 - 0x80521DF0 (1183216)
 Initialized Data:          0x8041C740 - 0x8041E1B0 (6768)
 BSS Area:                  0x8041E1B0 - 0x8041FDF0 (7232)
 Local Heap:                0x8041FDF0 - 0x8051FDF0 (1048576)
 Stack Area:                0x8051FDF0 - 0x80521DF0 (8192)
 Text (code) segment:       0x80401000 - 0x8041C73C (112444)
 Boot area (physical):      0x00522000 - 0x00562000
 Relocation Factor:         I:00000000 - D:00000000

 Board IP address                : 192.168.1.1  
 Host IP address                 : 192.168.1.3  
 Gateway IP address              :   
 Run from flash/host (f/h)       : f  
 Default host run file name      : openwrt-brcm63xx-vmlinux.elf  
 Default host flash file name    : bcm963xx_fs_kernel  
 Boot delay (0-9 seconds)        : 5  
 Board Id Name                   : 96348GW-11  
 Psi size in KB                  : 24
 Number of MAC Addresses (1-32)  : 11  
 Base MAC Address                : 00:30:da:47:bd:b4  
 Ethernet PHY Type               : External Using Reverse MII with SPI
 Memory size in MB               : 16

 *** Press any key to stop auto run (5 seconds) ***
 Auto run second count down: 5 5 4 3 2 1 0
 Code Address: 0x80010000, Entry Address: 0x8001046c
 Decompression OK!
 Entry at 0x8001046c
 Closing network.
 Starting program at 0x8001046c
 Total Flash size: 4096K with 71 sectors
 Scratch pad is not used for this flash part.
 96348GW-11 prom init
 CPU revision is: 00029107
 Primary instruction cache 16kb, linesize 16 bytes (2 ways)
 Primary data cache 8kb, linesize 16 bytes (2 ways)
 Linux version 2.4.17 (root@max-redhat) (gcc version 3.1) #1 [bad encoding] 2 04:34:28 CST 2004
 Determined physical RAM map:
  memory: 00fa0000 @ 00000000 (usable)
 On node 0 totalpages: 4000
 zone(0): 4000 pages.
 zone(1): 0 pages.
 zone(2): 0 pages.
 Kernel command line: root=/dev/mtdblock0 ro
 bcm_console_setup
 Calibrating delay loop... 255.59 BogoMIPS
 Memory: 14236k/16000k available (1144k kernel code, 1764k reserved, 80k data, 48k init, 0k highmem)
 Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes)
 Inode-cache hash table entries: 1024 (order: 1, 8192 bytes)
 Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
 Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
 Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
 Checking for 'wait' instruction...  unavailable.
 POSIX conformance testing by UNIFIX
 mpi: No Card is in the PCMCIA slot
 PCI: Fixing up bus 0
 Linux NET4.0 for Linux 2.4
 Based upon Swansea University Computer Society NET3.039
 Initializing RT netlink socket
 Starting kswapd
 brcmboard: brcm_board_init entry
 Module bcm63xx_cons.c v1.1 Dec  2 2004 04:34:57
 block: 64 slots per queue, batch=16
 PPP generic driver version 2.4.1
 NET4: Linux TCP/IP 1.0 for NET4.0
 IP Protocols: ICMP, UDP, TCP, IGMP
 IP: routing cache hash table of 512 buckets, 4Kbytes
 TCP: Hash tables configured (established 512 bind 1024)
 Linux IP multicast router 0.06 plus PIM-SM
 NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
 Ebtables v2.0 registered<6>NET4: Ethernet Bridge 008 for NET4.0
 802.1Q VLAN Support v1.6  Ben Greear <greearb@candelatech.com>
 vlan Initialization complete.
 VFS: Mounted root (cramfs filesystem) readonly.
 Freeing unused kernel memory: 48k freed
 init started:  BusyBox v0.60.4 (2004.12.01-20:44+0000) multi-call binary
 Algorithmics/MIPS FPU Emulator v1.5


 BusyBox v0.60.4 (2004.12.01-20:44+0000) Built-in shell (msh)
 Enter 'help' for a list of built-in commands.


 Loading drivers and kernel modules... 

 atmapi: init_module entry 0xc0006060
 blaadd: blaa_detect entry
 adsl: adsl_init entry
 var 1.0 initialised
 Broadcom BCM6348A2 Ethernet Network Device v0.1 Dec  2 2004 04:40:06 External Switch Reverse MII (SPI Device 1)
 eth0: MAC Address: 00:30:DA:47:BD:B4
 Broadcom BCM6348A2 USB Network Device v0.3 Dec  2 2004 04:40:08
 usb0: MAC Address: 00 30 DA 47 BD B5
 usb0: Host MAC Address: 00 30 DA 47 BD B6
 insmod: init_module: wl: No such device
 BcmAdsl_Initialize=0xC0018418, g_pFnNotifyCallback=0xC002CCB0
 AdslCoreHwReset: AdslOemDataAddr = 0xA0FE4D5C

 ==>   Bcm963xx Software Version: A101-221CTL-C01_R04.A2pB017f.d15   <==

 device usb0 entered promiscuous mode
 br0: port 1(usb0) entering listening state
 br0: port 1(usb0) entering learning state
 br0: port 1(usb0) entering forwarding state
 br0: topology change detected, propagating
 device eth0 entered promiscuous mode
 br0: port 2(eth0) entering listening state
 br0: port 2(eth0) entering learning state
 br0: port 2(eth0) entering forwarding state
 br0: topology change detected, propagating
 pvc2684d: Interface "nas_0_35" created sucessfully

 atm_connect (TX: cl 1,bw 0-0,sdu 1524; RX: cl 1,bw 0-0,sdu 1524,AAL 5)
 pvc2684d: Communicating over ATM 0.0.35, encapsulation: LLC

 device nas_0_35 entered promiscuous mode
 br0: port 3(nas_0_35) entering listening state
 br0: port 3(nas_0_35) entering learning state
 br0: port 3(nas_0_35) entering forwarding state
 br0: topology change detected, propagating
 eth0 Link UP.

 Message from syslogd@router at Jan 23 16:34:40 ...
  BCM96345 started: BusyBox v0.60.4 (2004.12.01-20:44+0000)
 sntp: host not found

 Message from syslogd@router at Jan 23 16:34:41 ...
  klogd: 802.1Q VLAN Support v1.6  Ben Greear reearb@candelatech.com>
 br0: port 1(usb0) entering disabled state
 ADSL G.994 training
 ADSL G.992 started
 ADSL G.992 channel analysis
 ADSL G.992 message exchange
 ADSL link up, interleaved, us=800, ds=6016
 PPP: PPP0_35_1 Start to connect ...
 PPP: PPP0_35_1 Connection Up.
 Primary DNS server = 216.183.128.10
 Secondary DNS server = 216.183.128.4

kamikaze (2.6.27 kernel)

 0x80010000/3644617 0x80389cc9/141127 Entry at 0x80014450
 Closing network.
 Starting program at 0x80014450
 Linux version 2.6.27.11 (daniel@brennin) (gcc version 4.1.2) #3 Fri Jan 23 07:01:13 EST 2009
 Detected Broadcom 0x6348 CPU revision a2
 CPU frequency is 256000000 Hz
 16MB of RAM installed
 board_bcm963xx: CFE version: 1.0.37-5.17
 console [early0] enabled
 CPU revision is: 00029107 (Broadcom BCM6348)
 board_bcm963xx: board name: 96348GW-11
 Determined physical RAM map:
  memory: 01000000 @ 00000000 (usable)
 Initrd not found or empty - disabling initrd
 Zone PFN ranges:
   Normal   0x00000000 -> 0x00001000
 Movable zone start PFN for each node
 early_node_map[1] active PFN ranges
     0: 0x00000000 -> 0x00001000
 Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
 Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200
 Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
 Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes
 PID hash table entries: 64 (order: 6, 256 bytes)
 Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
 Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
 Memory: 12472k/16384k available (1930k kernel code, 3912k reserved, 410k data, 1216k init, 0k highmem)
 Calibrating delay loop... 255.48 BogoMIPS (lpj=510976)
 Mount-cache hash table entries: 512
 net_namespace: 776 bytes
 NET: Registered protocol family 16
 registering 37 GPIOs
 registering PCI controller with io_map_base unset
 bus: 00 index 0 io port: [8000000, 800ffff]
 bus: 00 index 1 mmio: [30000000, 37ffffff]
 NET: Registered protocol family 2
 IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
 TCP established hash table entries: 512 (order: 0, 4096 bytes)
 TCP bind hash table entries: 512 (order: -1, 2048 bytes)
 TCP: Hash tables configured (established 512 bind 512)
 TCP reno registered
 NET: Registered protocol family 1
 audit: initializing netlink socket (disabled)
 type=2000 audit(1.220:1): initialized
 squashfs: version 3.0 (2006/03/15) Phillip Lougher
 Registering mini_fo version $Id$
 JFFS2 version 2.2. (NAND) (SUMMARY)  ├é┬® 2001-2006 Red Hat, Inc.
 msgmni has been set to 24
 io scheduler noop registered
 io scheduler cfq registered (default)
 bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart
 console handover: boot [early0] -> real [ttyS0]
 bcm63xx_enet MII bus: probed
 bcm963xx_flash: 0x00400000 at 0x1fc00000
 bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank
  Amd/Fujitsu Extended Query Table at 0x0040
 number of CFI chips: 1
 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
 bcm963xx_flash: Read Signature value of CFE1CFE1
 bcm963xx_flash: CFE bootloader detected
 bcm963xx_flash: CFE boot tag found with version 6 and board type 96348GW-11.
 bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000
 bcm963xx_flash: Partition 1 is kernel offset 22f100 and length 656d3
 bcm963xx_flash: Partition 2 is rootfs offset 10100 and length 35f000
 bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000
 Creating 4 MTD partitions on "bcm963xx":
 0x00000000-0x00010000 : "CFE"
 0x0022f100-0x002947d3 : "kernel"
 mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only
 0x00010100-0x0036f100 : "rootfs"
 mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
 mtd: partition "rootfs" set to be root filesystem
 split_squashfs: no squashfs found in "bcm963xx"
 0x003f0000-0x00400000 : "nvram"
 TCP bic registered
 NET: Registered protocol family 17
 Bridge firewalling registered
 Freeing unused kernel memory: 1216k freed
 Algorithmics/MIPS FPU Emulator v1.5
 [sighandler]: No more events to be processed, quitting.
 [cleanup]: Waiting for children.
 [cleanup]: All children terminated.
 - preinit -
 Press CTRL-C for failsafe

 Please press Enter to activate this console. bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)]
 bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)]
 eth1: link forced UP - 100/full - flow control off/off
 device eth1 entered promiscuous mode
 br-lan: topology change detected, propagating
 br-lan: port 1(eth1) entering forwarding state
 PPP generic driver version 2.4.2
 ip_tables: (C) 2000-2006 Netfilter Core Team
 nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
 CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use
 nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or
 sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
 br-lan: port 1(eth1) entering disabled state
 br-lan: topology change detected, propagating
 br-lan: port 1(eth1) entering forwarding state

dmesg output (kamikaze 2.6.27 kernel)

 Linux version 2.6.27.11 (daniel@brennin) (gcc version 4.1.2) #3 Fri Jan 23 07:01:13 EST 2009
 Detected Broadcom 0x6348 CPU revision a2
 CPU frequency is 256000000 Hz
 16MB of RAM installed
 board_bcm963xx: CFE version: 1.0.37-5.17
 console [early0] enabled
 CPU revision is: 00029107 (Broadcom BCM6348)
 board_bcm963xx: board name: 96348GW-11
 Determined physical RAM map:
  memory: 01000000 @ 00000000 (usable)
 Initrd not found or empty - disabling initrd
 Zone PFN ranges:
   Normal   0x00000000 -> 0x00001000
 Movable zone start PFN for each node
 early_node_map[1] active PFN ranges
     0: 0x00000000 -> 0x00001000
 On node 0 totalpages: 4096
 free_area_init_node: node 0, pgdat 802586d0, node_mem_map 803ae000
   Normal zone: 4064 pages, LIFO batch:0
 Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
 Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200
 Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
 Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes
 PID hash table entries: 64 (order: 6, 256 bytes)
 Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
 Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
 Memory: 12472k/16384k available (1930k kernel code, 3912k reserved, 410k data, 1216k init, 0k highmem)
 Calibrating delay loop... 255.48 BogoMIPS (lpj=510976)
 Mount-cache hash table entries: 512
 net_namespace: 776 bytes
 NET: Registered protocol family 16
 registering 37 GPIOs
 registering PCI controller with io_map_base unset
 bus: 00 index 0 io port: [8000000, 800ffff]
 bus: 00 index 1 mmio: [30000000, 37ffffff]
 Switched to high resolution mode on CPU 0
 NET: Registered protocol family 2
 IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
 TCP established hash table entries: 512 (order: 0, 4096 bytes)
 TCP bind hash table entries: 512 (order: -1, 2048 bytes)
 TCP: Hash tables configured (established 512 bind 512)
 TCP reno registered
 NET: Registered protocol family 1
 audit: initializing netlink socket (disabled)
 type=2000 audit(1.220:1): initialized
 squashfs: version 3.0 (2006/03/15) Phillip Lougher
 Registering mini_fo version $Id$
 JFFS2 version 2.2. (NAND) (SUMMARY)  ┬® 2001-2006 Red Hat, Inc.
 msgmni has been set to 24
 io scheduler noop registered
 io scheduler cfq registered (default)
 bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart
 console handover: boot [early0] -> real [ttyS0]
 bcm63xx_enet MII bus: probed
 bcm963xx_flash: 0x00400000 at 0x1fc00000
 bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank
  Amd/Fujitsu Extended Query Table at 0x0040
 number of CFI chips: 1
 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
 bcm963xx_flash: Read Signature value of CFE1CFE1
 bcm963xx_flash: CFE bootloader detected
 bcm963xx_flash: CFE boot tag found with version 6 and board type 96348GW-11.
 bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000
 bcm963xx_flash: Partition 1 is kernel offset 22f100 and length 656d3
 bcm963xx_flash: Partition 2 is rootfs offset 10100 and length 35f000
 bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000
 Creating 4 MTD partitions on "bcm963xx":
 0x00000000-0x00010000 : "CFE"
 0x0022f100-0x002947d3 : "kernel"
 mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only
 0x00010100-0x0036f100 : "rootfs"
 mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
 mtd: partition "rootfs" set to be root filesystem
 split_squashfs: no squashfs found in "bcm963xx"
 0x003f0000-0x00400000 : "nvram"
 TCP bic registered
 NET: Registered protocol family 17
 Bridge firewalling registered
 Freeing unused kernel memory: 1216k freed
 Algorithmics/MIPS FPU Emulator v1.5
 bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)]
 bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)]
 eth1: link forced UP - 100/full - flow control off/off
 device eth1 entered promiscuous mode
 br-lan: topology change detected, propagating
 br-lan: port 1(eth1) entering forwarding state
 PPP generic driver version 2.4.2
 ip_tables: (C) 2000-2006 Netfilter Core Team
 nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
 CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use
 nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or
 sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
 br-lan: port 1(eth1) entering disabled state
 br-lan: topology change detected, propagating
 br-lan: port 1(eth1) entering forwarding state

flash (mtd) partitions

 root@OpenWrt:/proc# 

 cat partitions
 major minor  #blocks  name

   31     0         64 mtdblock0
   31     1        405 mtdblock1
   31     2       3452 mtdblock2
   31     3         64 mtdblock3
 root@OpenWrt:/proc# 

 cat mtd
 dev:    size   erasesize  name
 mtd0: 00010000 00002000 "CFE"
 mtd1: 000656d3 00010000 "kernel"
 mtd2: 0035f000 00010000 "rootfs"
 mtd3: 00010000 00010000 "nvram"
 root@OpenWrt:/proc# df
 Filesystem           1k-blocks      Used Available Use% Mounted on
 tmpfs                     6844        44      6800   1% /tmp
 tmpfs                      512         0       512   0% /dev
 root@OpenWrt:/proc# 

CFE (Bootloader) Information

 CFE> web info: Waiting for connection on socket 0.
 CFE> 
 CFE> c
 Press:  <enter> to use current value
         '-' to go previous parameter
         '.' to clear the current value
         'x' to exit this command
 Board IP address                :  192.168.1.1:ffffff00  
 Host IP address                 :  192.168.1.100
 Gateway IP address              :  
 Run from flash/host (f/h)       :  f  
 Default host run file name      :  vmlinux  
 Default host flash file name    :  bcm963xx_fs_kernel  
 Boot delay (0-9 seconds)        :  5
 *** command status = 0
 CFE> b
 Press:  <enter> to use current value
         '-' to go previous parameter
         '.' to clear the current value
         'x' to exit this command
 Board Id Name (0-5)
 96348R           -------- 0
 96348LV          -------- 1
 96348GW          -------- 2
 96348GW-10       -------- 3
 96348GW-11       -------- 4
 96348SV          -------- 5     :  4
 Number of MAC Addresses (1-32)  :  11  
 Base MAC Address                :  00:40:dd:37:ad:e4  

Accessing the Stock Device

-

Serial Console Pinout

RJ45 connector

3: Receive Data
4: Transmit Data
7: Ground
1,2,5,6,8: Not Connected

JTAG

Located near the front left, beside the CPU. Pin 1 has white box surrounding it and the whole connection area is surrounded by a white border (thin). There is no existing header, if you want one you have to add it (there are only solder pads in the stock configuration).

Pinout:

|----|-----|----|-----|-----|----|
| 6  |  5  | 4  |  3  |  2  |  1 |
|----|-----|----|-----|-----|----|
| 12 | 11  | 10 |  9  |  8  |  7 |
|----|-----|----|-----|-----|----|

Meaning and mapping to LPT for an unbuffered cable (see http://wiki.openwrt.org/OpenWrtDocs/Customizing/Hardware/JTAG_Cable )

Pin 3 - TDI - DATA0  - Pin 2
Pin 5 - TD0 - SELECT - Pin 13
Pin 7 - TMS - DATA2  - Pin 4
Pin 9 - TCK - DATA1  - Pin 3

Status

This router is partially supported.

Tools

If you want to play with the stock firmware and know the required offsets and size, you can use an modified imagetag, which will generate a correct image header so you can flash the modified firmware to the router (using the CFE). The instruction for use, such as they, can be found on The C Shore; OpenWRT Contributions and on the OpenWRT Forum

The modified imagetag does a minimal amount of work; you already need to know the entry point of the kernel, the size and offset of the kernel in the flash (once flashed), and size of the mtd partition that is used around the rootfs+kernel.

This information can be obtained from the boot logs of the original (manufacturer’s) firmware plus a ramdisk-based boot of openwrt with the stock kernel in the flash.

Pictures

photo of boardphoto of frontphoto of back

USB

This board only needs 3 x 15 kiloOhm resistors and one 470 microFarad capacitor, and the USB host (USB A Female) connector, to have a USB host port on the board (i.e. to drive USB mass storage, wireless, etc)

Two of the resistors and the capacitor get voltages right, while the third resistor is used to tie the USB host enabled pin on the BCM63xx to Vcc, so that it is seen as enabled.

There is a schematic from a NetGear that might be helpful. The only components that matter to our board are the 15k resistors.

usb schematic

Now we look at the space on the board that is for the USB host.

space for usb host

The following image shows what needs to be done in order to enable host usb.

usb host space with icons for need additions/removals

And here’s what a badly done mod looks like (I had a terrible time soldering)

results of my mod


Author: Daniel F. Dickinson Address: openwrt@thecshore.com Version: 2.0 Date: Saturday, March 28, 2009 Language: en


CategoryBCM63xx