Hacking Roomba - Tod E.Kurt Part 12 potx

Even writing little shell scripts on the command line is possible: root@OpenWrt:~# while [ 1 ] ; do > echo “OpenWrt is the best!” > sleep 1 > done OpenWrt is the best!. That’s okay, beca

F IGURE 14-7: Disabling the WAN port in OpenWrt

5 Enable Wireless client mode.

■Select the Wireless sub-category Second to the IP address, this is the most tant configuration page Normally you configure OpenWrt to act as an accesspoint Instead it will be a client on your existing wireless network like any otherclient

impor-■In the ESSID text box, type the name of your wireless network

■In the Mode pop-up menu, change Access Point to Client (Bridge)

■Leave Channel at Auto and leave ESSID Broadcast at Hide

■If you use encryption on your network, adjust the encryption settings ately Figure 14-8 shows the settings for connecting to an unencrypted Wi-Fi network named todbot

appropri-■Press Save Changes when done

F IGURE 14-8: Configuring OpenWrt as a wireless client

6 Apply changes.

■At this point you have all the changes queued up and you can review them with

Review Changes

■Or, just press Apply Changes and you’ll see OpenWrt reconfiguring itself

Then, because you changed its IP address, you won’t be able to contact it It will have

joined your wireless network, so you can connect to it wirelessly now

7 Change your PC’s network configuration to be back on your wireless net Use your

browser to go to the new IP address of the WL-HDD You should again see your

router’s home status page like in Figure 14-4

The WL-HDD is now fully configured network-wise and it’s time for some fun

Playing Around on Your Embedded Linux System

Just like any good Linux system, OpenWrt has an SSH server You can log into it like anyother Linux box:

* 2 oz Vodka Mix the Vodka and Kahlua together

* 1 oz Kahlua over ice, then float the cream or

* 1/2oz cream milk on the top

— — — — — — — — — — — — — — — — — — — — — — — — — root@OpenWrt:~#

-Of course, unlike a normal Linux system, the disk space situation is very different:

root@OpenWrt:~# df -h

Filesystem Size Used Available Use% Mounted on/dev/root 3.2M 1.8M 1.4M 57% /

none 7.0M 20.0k 7.0M 0% /tmpNotice you only have 3.2 MB of disk total, and over half of it is already in use But otherwise,it’s very much like any other command line Linux system You can ping Google:

root@OpenWrt:~# ping google.com

PING google.com (64.233.167.99): 56 data bytes

64 bytes from 64.233.167.99: icmp_seq=0 ttl=246 time=82.1 ms

64 bytes from 64.233.167.99: icmp_seq=1 ttl=246 time=84.7 ms

64 bytes from 64.233.167.99: icmp_seq=2 ttl=246 time=83.5 ms

Inspecting the Running System

As with any Linux system, you have access to a variety of command line tools to inspect therunning system You can run topto see what processes are running

Mem: 8116K used, 6232K free, 0K shrd, 0K buff, 3140K cachedLoad average: 0.00, 0.00, 0.00 (State: S=sleeping R=running,iW=waiting)

PID USER STATUS RSS PPID %CPU %MEM COMMAND

309 root S 344 1 0.0 2.3 crond

2149 root S 332 1 0.0 2.3 wifi

64 root S 304 1 0.0 2.1 klogd

301 root S 260 1 0.0 1.8 telnetd

And you can run other common Linux programs like netstat,ifconfig, and ps If you’re

familiar with Linux, you’ll find most of the low-level administration and inspection tasks

available to you For example, the entire /proc virtual file system exists to give you visibility into

the running Linux kernel

Even writing little shell scripts on the command line is possible:

root@OpenWrt:~# while [ 1 ] ; do

> echo “OpenWrt is the best!”

> sleep 1

> done

OpenWrt is the best!

OpenWrt is the best!

OpenWrt is the best!

The ipkg Packaging System

You’ve no doubt noticed the clock is wrong The easiest way to fix that is to get an NTP client

from the ipkgrepository Ipkg is a code packaging and installation technology, a package

repository, and a command line program It takes away a lot of the drudgery of installing new

software Listing 14-1 shows a typical interaction with the ipkgcommand If you’re familiar

with other network-based packaging systems like ports,yum, or apt-get, using ipkgwill be

immediately familiar to you

Listing 14-1: Using ipkg to Find and Install ntpclient

root@OpenWrt:~# ipkg update

root@OpenWrt:~# ipkg list | grep ntp

ntpclient - 2003_194-2 - NTP client for setting system time

from NTP servers

openntpd - 3.7p1-1 - OpenNTPD is a FREE, easy to use

implementation of NTP

Continued

Listing 14-1 Continued

root@OpenWrt:~# ipkg install ntpclient

Installing ntpclient (2003_194-2) to root

Downloadinghttp://downloads.openwrt.org/whiterussian/packages/ntpclient_i2003_194-2_mipsel.ipk

Configuring ntpclientntSuccessfully terminated

root@OpenWrt:~# date

Sat Jan 1 00:29:08 UTC 2000

root@OpenWrt:~# ntpclient -c 1 -s -h pool.ntp.org

38914 01341.848 19061.0 2251.5 9917.4 50613.4 0

root@OpenWrt:~# date

Mon Jul 17 23:21:59 UTC 2006

Reverting to Factory Firmware

In the event you run into some problems with OpenWrt or if you want to sell the WL-HDD,you can always re-flash with the factory firmware The steps are almost exactly the same asflashing OpenWrt:

1 Go to http://support.asus.com/and find the latest firmware file for the HDD You will download a ZIP file and inside it will be a file named something likeWLHDD_1.2.3.9_en.trx Notice how the trx extension is the same as the OpenWrtfirmware you flashed

WL-2 Use the method above with flash-wd-hdd.shto reflash the WL-HDD There is autility program for Windows on the ASUS site that also supposedly will help youreflash Also, inside of OpenWrt, there is a Firmware Upgrade page under the Systemcategory

There have been no reported cases of irreparably bricking an ASUS wireless router by usingOpenWrt, so you shouldn’t be reluctant to try it

Controlling Roomba in OpenWrt

Now that you have a working tiny Linux system, it’s time to figure out how to get it to talk tothe Roomba As mentioned earlier, most of the chips OpenWrt supports have one or twobuilt-in serial ports (UARTs) that you could solder to if you opened up the box The WL-HDDdoesn’t appear to have one of those chips That’s okay, because not only does the WL-HDD have

a USB port, but OpenWrt has several USB serial drivers

The Linux USB serial device drivers that have been packaged for OpenWrt are:ftdi_sio,

pl2303,belkin_sa, and mct_u232 These four drivers enable you to communicate with

90 percent of the USB-to-serial adapters out there and all of the generic ones

Figure 14-9 shows a common generic USB-to-serial adapter The actual chip for the adapter is

embedded in the hood of the RS-232 connector These are available from various online retailers

like NewEgg.com for around $9 There’s no indication as to which chip one uses; you have to

plug it in to find out But for only $9 it’s a pretty cheap experiment, and if it isn’t supported you

can probably use it on a fully-fledged PC

The Keyspan adapter you’ve used in the previous chapters doesn’t use any of these drivers

There does exist an open-source Linux driver for the Keyspan adapter It just hasn’t been

packaged for OpenWrt yet There’s no reason to think that it wouldn’t work Most users of

USB serial on OpenWrt are connecting to GPS devices and PDAs, both of which tend to use

the same USB-to-serial chips as the generic adapters

The RooStick uses the Silicon Labas CP2103 chip, which appears to work with the standard

Linux cp2101driver Unfortunately that’s another driver that hasn’t been packaged for use

with OpenWrt yet There’s no reason to think it couldn’t be and it may be part of the next

OpenWrt distribution

On the positive side, the Arduino board uses an FTDI chip that is supported by the ftdi_sio

driver This means you could program an Arduino board to do something based on serial

com-mands and then plug the board into the WL-HDD This is very powerful It’s so easy to add

sensors and actuators to Arduino that Arduino could become a sort of I/O co-processor for the

WL-HDD

There have been sporadic reports of problems with combinations of some WL-HDDs with certain

USB-to-serial adapters If you have problems with one serial adapter, try another If you think the

problem is due to the WL-HDD, try the Linksys WRTSL54GS discussed in Chapter 15 It’s almost

twice as expensive but has a more advanced USB interface with fewer reported problems This is

the disadvantage of hacking consumer electronics: there’s no guarantee the vendor will keep the

device the same

Installing USB Serial Port Drivers in OpenWrt

Thanks to ipkg, installing new kernel modules is a snap Kernel modules are packaged up just

like normal programs The two kernel module packages needed to get serial working are:

䡲 kmod-usb-ohci: Contains the drivers usbcoreand usb-ohcineeded to talk to the

USB interface

䡲 kmod-usb-serial: Contains the general driver usbserialand the device-specific

drivers ftdi_sio,pl2303,belkin_sa, and mct_u232

F IGURE 14-9: Generic USB-to-serial adapter, uses PL2303 chip

Listing 14-2 shows how to use ipkgto install the drivers and insmodto load the drivers Todetermine if these drivers loaded successfully, the best way is to check the output of dmesgandlook for appropriate status or error messages The last part of Listing 14-2 shows what youshould expect to see The most important line is the last one, which tells you which device filethe driver has created for you to use In the example, the device is /dev/usb/tts/0.OpenWrt uses the new devFS naming scheme for device files, instead of the more familiar

/dev/ttyUSB0

Listing 14-2: Installing Serial Port Drivers in OpenWrt

root@OpenWrt:~# ipkg install kmod-usb-ohci kmod-usb-serial

Installing kmod-usb-ohci (2.4.30-brcm-3) to root

Downloadinghttp://downloads.openwrt.org/whiterussian/packages/ikmod-usb-ohci_2.4.30-brcm-3_mipsel.ipk

Installing kmod-usb-serial (2.4.30-brcm-3) to root

Downloadinghttp://downloads.openwrt.org/whiterussian/packages/i

usb.c: registered new driver usbdevfs

usb.c: registered new driver hub

PCI: Setting latency timer of device 00:04.0 to 64

usb-ohci.c: USB OHCI at membase 0xb8004000, IRQ 2

usb-ohci.c: usb-00:04.0, PCI device 14e4:4715

usb.c: new USB bus registered, assigned bus number 1

hub.c: USB hub found

hub.c: 2 ports detected

usb.c: registered new driver serial

usbserial.c: USB Serial support registered for Generic

usbserial.c: USB Serial Driver core v1.4

usbserial.c: USB Serial support registered for PL-2303

hub.c: new USB device 01:02.0-1, assigned address 2

pl2303.c: Prolific PL2303 USB to serial adaptor driver v0.11

usbserial.c: pl2303 converter detected

usbserial.c: PL-2303 converter now attached to ttyUSB0 (or

usb/tts/0 for devfs)

Making the Drivers Load on Reboot

Although the drivers are loaded now, they won’t reload on reboot To have them load

automati-cally each time the WL-HDD is rebooted, do the following to add the module names to the

/etc/modulesfile:

root@OpenWrt:~# echo “usbcore” >> /etc/modules

root@OpenWrt:~# echo “usb-ohci” >> /etc/modules

root@OpenWrt:~# echo “usbserial” >> /etc/modules

root@OpenWrt:~# echo “pl2303” >> /etc/modules

The order of the above lines is important The usbcoredriver must load before usb-ohci,

and so on

Debugging USB Devices

If you ever have problems with USB devices on Linux (any Linux, not just OpenWrt), youhave options to diagnose them The first is to look at all the dmesgoutput you can, as shown inListing 14-2 The next is to see which kernel modules are currently loaded:

root@OpenWrt:~# lsmod

Module Size Used by Tainted: P ftdi_sio 21848 0 (unused)

usb-ohci 19204 0 (unused)pl2303 12552 0

usbserial 23868 0 [ftdi_sio pl2303]

switch-core 4896 0wlcompat 14896 0 (unused)usbcore 74792 1 [ftdi_sio usb-ohci pl2303usbserial]

wl 423640 0 (unused)diag 3320 0 (unused)

If you see something missing (or something that shouldn’t be there), use insmodand rmmodtofix things up To see which kernel modules are available, look in the /lib/modules/2.4.30/

directory Each file is a different kernel module

The /procvirtual file system contains huge amounts of interesting data about the runningkernel Use cat /proc/cpuinfoto get details on the processor or cat /proc/pcito seewhat exists on the internal PCI bus Similarly for USB, you can see what’s connected on theUSB bus by doing as in Listing 14-3 If you understand USB, it gives you a lot of good infor-mation It’s a bit verbose, however, and if all you really want to know is if something is plugged

in, install lsusband run it

The dmesgprogram spews many apparent errors Usually you can ignore these OpenWrt is still

a work in progress, and some parts of the system are a little too chatty for users who aren’tdevelopers As you become more familiar with OpenWrt, you’ll get to learn which messages aretrue errors and which are not As OpenWrt approaches a 1.0 release, the volume of dmesgout-put has been going down

Listing 14-3: Inspecting USB Devices via /proc and lsusb

root@OpenWrt:~# cat /proc/bus/usb/devices

T: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh=2

B: Alloc= 0/900 us ( 0%), #Int= 0, #Iso= 0D: Ver= 1.10 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1P: Vendor=0000 ProdID=0000 Rev= 0.00

S: Product=USB OHCI Root HubS: SerialNumber=b8004000C:* #Ifs= 1 Cfg#= 1 Atr=40 MxPwr= 0mAI: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00Driver=hub

E: Ad=81(I) Atr=03(Int.) MxPS= 2 Ivl=255ms

T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh=

0

D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1

P: Vendor=0557 ProdID=2008 Rev= 3.00

S: Manufacturer=Prolific Technology Inc

S: Product=USB-Serial Controller

C:* #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=100mA

I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00

Driver=serial

E: Ad=81(I) Atr=03(Int.) MxPS= 10 Ivl=1ms

E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms

E: Ad=83(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms

root@OpenWrt:~# ipkg install lsusb

Scripting Language Control

Now you have an embedded Linux system with a functioning serial port It is time to hook it

up to Roomba Since the USB-to-serial adapter has the same RS-232 connector as the serial

tether of Chapter 3, just connect it to the adapter and Roomba and you’re good to go

There have been efforts to get Java working in OpenWrt via the SableVM (http://

sablevm.org/) or JamVM (http://jamvm.sourceforge.net/), but getting a working

Java VM with the system classes in the remaining space of the WL-HDD would be difficult

There are many alternatives to Java, however, and it would be interesting to try some of them

Shell Script Control

Linux supports many ways of dealing with serial ports Unix-like operating systems treat

everything as files, even devices such as serial ports This level of abstraction enables you to

deal with almost any device in any language, all just by opening files Need to format a disk?

Open /dev/hdd Need to play an audio file? Send your WAV file to /dev/audio You can

even control Roomba from the command line:

% printf “\x89\x00\xc8\x80\x00” > /dev/usb/tts/0 # DRIVE

straight at 200 mm/s

(You use \x89to send bytes using hexadecimal codes.)

Treating devices as files is great for sending and receiving data, but in order to configure thedevice something else is needed For serial devices, you need to set the baud rate and otherparameters, and the standard way of setting those parameters is with the sttyprogram Thus,the full set of command line commands to make a Roomba drive straight is:

% stty F /dev/usb/tts/0 57600 raw parenb parodd cs8 hupcl cstopb clocal

-% printf “\x80” > /dev/usb/tts/0 # ROI START

% printf “\x82” > /dev/usb/tts/0 # ROI CONTROL

% printf “\x89\x00\xc8\x80\x00” > /dev/usb/tts/0 # ROI DRIVEThe sttygobbledygook sets the serial port to 57600 8N1 with no input or output data manip-ulation (“raw” mode) The sttyprogram is normally used to help control serial terminalsconnecting to the computer, which is why there’s so much configuration to undo all that

If you wanted, you could put those four commands in a file, call it roomba_forward.sh, andrun it whenever you wanted That’s the beauty of shell script programming: You can find a set

of typed commands that perform a task you want to repeat and put them in a file so you onlyhave to remember one thing instead of four

The sttyprogram has slightly different syntax on different versions of Unix For example, onMac OS X uses the syntax stty -f <port>instead of stty -F <port>

Perl Script Control

But writing shell programs of any complexity is frustrating; its syntax is strange compared toJava or C While Java may be out of reach for now, a version of Perl called microPerl is part

of the standard OpenWrt distribution It gives you most all of Perl’s capability but in a fewhundred kilobytes With microPerl you can write nicely structured code but still be able toeasily modify it on the WL-HDD itself

Listing 14-4 shows a microPerl script called roombacmd.mplthat enables you to controlRoomba from the command line It is a microPerl program, but it’s also a normal Perl pro-gram Swap the two lines at the top and it will run on any system with Perl (and stty).The roomba_init()function both executes the appropriate sttycommand as well as putsthe Roomba into SAFE mode so it can receive DRIVE instructions The rest of the functionsare just implementations of various DRIVE functions you’ve seen before

Listing 14-4: (micro)Perl Script roombacmd.mpl

printf “Usage: $0 {serialport} “.

“{init|forward|backward|spinleft|spinright|stop}\n”;

exit(1);

}

sub roomba_init() {

# this style stty is for linux

system(“stty -F $PORT 57600 raw -parenb -parodd cs8 -hupcl

-cstopb clocal”);

printf “\x80” > $PORT; sleep 0.2;

printf “\x82” > $PORT; sleep 0.2;

# If not enough arguments were passed, return

usage() if( @ARGV < 2 );

Listing 14-4 Continued

elsif( $CMD eq ‘backward’ ) {roomba_backward();

}elsif( $CMD eq ‘spinleft’ ) {roomba_spinleft();

}elsif( $CMD eq ‘spinright’ ) {roomba_spinright();

}elsif( $CMD eq ‘stop’ ) {roomba_stop();

}else {usage();

}

In order to use the roombacmd.mplscript, you must first install microperland get stty(ifit’s not already on your system) Listing 14-5 shows the commands needed to do that, as well asdownload the roombacmd.mplscript and install everything in a non-volatile location

Listing 14-5: Installing and Using roombacmd.mpl

root@OpenWrt:~# ipkg install microperlroot@OpenWrt:~# ipkg install libgccroot@OpenWrt:~# wget

http://roombahacking.com/software/roombacmd/roombacmd.mplroot@OpenWrt:~# wget

http://roombahacking.com/software/roombacmd/stty.tar.gzroot@OpenWrt:~# tar xvzf stty.tar.gz

root@OpenWrt:~# chmod +x /sttyroot@OpenWrt:~# chmod +x /roombacmd.mplroot@OpenWrt:~# mv stty roombacmd.mpl /usr/bin

With everything in place you can now control Roomba from the command line of the HDD Listing 14-6 shows a simple Logo-like example of drawing a square with the Roomba

WL-Listing 14-6: Controlling Roomba from the Command Line

root@OpenWrt:~# # draw a squareroot@OpenWrt:~# /roombacmd.mpl /dev/usb/tts/0 initroot@OpenWrt:~# /roombacmd.mpl /dev/usb/tts/0 forward ;sleep 5

root@OpenWrt:~# /roombacmd.mpl /dev/usb/tts/0 spinright ; i

root@OpenWrt:~# /roombacmd.mpl /dev/usb/tts/0 stop

Making It All Truly Wireless

Until now you’ve been powering the WL-HDD from its AC adapter That’s fine for

debug-ging, but the point is to make the WL-HDD completely stand-alone and mobile on top of the

Roomba So the next step is to figure out how to power the WL-HDD

Asus products usually ship with a high-quality switching power supply that outputs a regulated

+5 VDC instead of the heavy bulky wall warts shipped with most consumer electronics and

which put out a noisy and only approximate +12 VDC The advantage of the bulky wall wart

to the hacker is that there must be voltage regulator inside the device and the device can take a

wide range of input power This is not so for the WL-HDD, so you have to construct an

exter-nal voltage regulator to power it off the Roomba voltage of +16V

Battery Pack Instead of Roomba

The WL-HDD is a pretty useful device by itself Instead of tying it to Roomba power, you

could instead make a battery pack and then you could stick the WL-HDD up to whatever you

wanted Imagine making your own network access point and file server at a café without

need-ing any wires at all Instead of usneed-ing the +16V supply from Roomba, you can create a supply

using just enough batteries to make a voltage regulator work The 7805 needs at least 6V in

order to regulate down to 5V The nominal voltage across AA cells is between 1.2 and 1.5V Six

cells makes 7.29V, so that’s about optimal Any more and you’d just be causing the 7805 to

work harder regulating a higher voltage down

Figure 14-10 shows a battery pack circuit for the WL-HDD SparkFun sells some 2700 mAh

NiMH AA cells for $2 apiece This is an amazing amount of capacity in an AA battery Normal

NiCd rechargable AA cells only put out at most 1000 mAh, so this is about a three-times

improvement in capacity SparkFun also sells a good but inexpensive charger for the batteries

F IGURE 14-10: Battery power supply circuit for WL-HDD

The WL-HDD draws enough current that a heat sink should be used on the 7805 voltageregulator Figure 14-11 shows a close-up of how one can attach the heat sink with a smallscrew and nut You generally don’t need heat sink compound if the power draw is lower thanabout 500 mA

F IGURE 14-11: Attaching a heatsink to the 7805 voltage regulator

C1

GND

C2 1µF 1µF

IN OUT GND IC2 7805

B1 6 X AA

w/ heatsink

DC power jack