UPDATE:
http://rtl8186.sourceforge.net is where anyone wanting to modify their device should go!
Thanks!
Howdy all-
Ended up here since no one else seems to be talking about these cool little devices anywhere else. Anyhow, I just picked up a C-media CMWS01, which appears to be what Sondigo is OEM'ing (or is that OEM'ed?) for their Sirocco product and I'm interested in hacking the device so that I can install a streaming audio player directly on the device and use it as a standalone digital head for a stereo system. I don't run windows and it certainly has enough horsepower to play the mp3s directly off my fileserver.
The Sirocco is the same as the Linksys WMB54G, the toolchains and kernels are the same, in fact, if you look in the source code provided by Sondigo, and grep for linksys you'll find it all over the place. Point of interest for all the other hackers out there.
I've not yet started my device up, but from a quick perusal of the source code, here's what I interpret happening, and I hope others can help me suss out the rest of the details:
1) I assume the boot sequence is similar to: bootloader is started, initializes system, checks NVRAM, if not good, waits for TFTP'ed firmware. If firmware passes CRC check, it loads the firmware. The question here is what format the firmware is in CFE, PMON, ADAM2...? (just the ones I'm familiar with from OpenWRT work). And does it have TFTP capability? (that helped me unbrick a couple of WRT54G's)
2) The main firmware build script is rtl8186-linux-1.2a/MakeFW, for the Sirocco, it looks like it simply copies Scirocco specific webpages over the existing Linksys pages.
3) The toolchain is provided with source (thanks guys!).
4) All the fun stuff is the rootfs.tar.gz in the rtl8186-linux-1.2a/AP/ directory. Extract this to get some idea of how the device starts. I looks to me like everything is initialized by rootfs/bin/init.sh. Basically:
- init nvram, (fix/restore it if necessary)
- init wlan and find number of wlan interfaces?
- load default config if flash data is invalid (how different than nvram?)
- run through setting it up as an ap, gw, and figure out which interfaces to start, some random AP functionality here? (IAPP?)
- set the MAC addresses from NVRAM
- random stuff for the individual modes start (ap,gw)
- start raspplay.sh (starts remote audio daemon ezwave?)
- load easyconf module (no idea what this is)
5) rasplay looks like it starts ezwave (remote audio daemon?)
All for now, if anyone can help me figure out how to cross compile something like madplay, I'd be grateful...
IrvingWashington