Fonera SD Card Hack

I read on several websites, that some people managed to wire a SD Card (or a MMC) to a Fonera access point. After a little googling, I discover this can be done easily, so I decided to test.. but I run into one issue so I decided to describe the process here.

Here the finished result:

Let’s give it a try:

Solder the SD Card

The first step, is to locate the SW pins (near the antenna).. simply solder some wires like this:

SD Car      -----    Fonera
DO  (pin 7)          SW1
CLK (pin 5)          SW2
DI  (pin 2)          SW5
CS  (pin 1)          SW6
Gnd (pin 3)          Gnd
Vcc (pin 4)          Vcc

Here you can see the SD Card pinouts

You can solder the VCC, and Gnd on the serial pins.

Unsolder the Caps

In my first tests, I discovered the SD card is detected, so I checked the signals. And discover the clk isn’t really clear.. So I decided to remove the capacitor on the SPI bus. (C142, C143, C144, C145)

Install software and test

Next we need to install the kernel module on OpenWRT. You can find it on the Phrozen website . Simply ipkg install the file and it should be ok. Now, let’s try: insert a SD Card, and reboot, you should see something like this in your log.

Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : MMC Driver for Fonera Version 2.5 (050507) -- '2B|!2B' (
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : Card Found
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : card in op mode
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : SIZE : 241, nMUL : 6, COUNT : 1932, NAME : 256MB
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : Card Initialised
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : The inserted card has a capacity of 253231104 Bytes
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : adding disk
Jan  1 00:00:49 OpenWrt kernel:  mmc1
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : Card was Found

So now you can mount it:

mount /dev/mmc0 /mnt

This stuff, is working really well, I managed to have around 150Ko/s (reading) which is far enough for my needs. The only issue right now, is that you need to carefully umount the card before removing it, otherwise the fonera will crash.

Enjoy Fonera ??

Related Posts

39 thoughts on “Fonera SD Card Hack

  1. Great article , Weird for the transfer speed, as I saw industrial MMC readers that achieves 2 MB/s

  2. The main issue of this type of hack, is that is use some bit banging (read/write bit with the CPU), but no IRQ or other fancy stuff can be used. And another stuff, the CPU usually use a "slow" rate for IO. ( 25Mhz on a fonera I think).

    => So this eat quite a lot of CPU, and isn’t really effective, but really enought for common use. (This is not a filer ! ;)

  3. Neat hack!
    This might be a really stupid question… but what can you do with it after you put in a SD card?
    Can you say for example use it to host a webpage or something?

  4. You can write some stuff in (some log, scan results..) and read .. yes you can use it for a little web server or FTP.

  5. solid work, I’m looking forward to seeing SD card support implemented in dd-wrt for the fonera, will definitely follow this guide to solder on my homemade SDcard plug,the 5.25" floppy cable method(you know, the easy cheapskate methos :) )

    just one question: on removing the capacitators: what did you mean by the clk not being very clear? I mean, what does clk mean?
    srry if the questions sound dumb but I have never had the chance to learn decet electronics, I know how to solder and all, but that’s it.

    but again: solid work ;)

  6. Johnnyrico:

    In fact, clk (clock) is one of the SD card signal (pin 5). I check the signal with a oscilloscope, and discover the signal isn’t really clean (round square..)

    Hope this helps

  7. ah, thanks for clearing that up :)
    now all I gotta do is wait till dd-wrt support for SD-MMC, it’s already in hardware testing there so shouldn’t be long :)

  8. "The main issue of this type of hack, is that is use some bit banging (read/write bit with the CPU), but no IRQ or other fancy stuff can be used. And another stuff, the CPU usually use a "slow" rate for IO. ( 25Mhz on a fonera I think).

    => So this eat quite a lot of CPU, and isn’t really effective, but really enought for common use. (This is not a filer ! ;)"

    Idiot! The 25MHz crystal is a standard for ethernet communication chips. It’s for the lan controller, not the Atheros SoC. There is a much faster crystal next to the Atheros chip (inside the faraday cage if you have a fon2100). It’s gold in color, you should recognize it.

  9. This is L:

    Would you please give me the speed of the quartz ? I’m sure the speed is quite the same, cause I managed to see the flash (not SD Card) clock with my old 2x20Mhz scope.. so It should’nt be really more speedy. (Perhaps 50Mhz ..)

  10. Ok utter n00b here – what exactly is the purpose of being able to recognize a connected SD card with a wireless access point? And how do you load the software from the SD card into the memory of the wireless access point. I get the general concept of what you are trying to do I think, but i don’t exactly see the means or the uses of it. Can anyone fill me in?

  11. Dan, you need to wait a little since I release the full hack. This is only the first part: storing stuff on this little embeded hardware.

    And if you ask, you can install additionnal parckage on the SD card, and use it as a webserver, or bittorent client .. ;)

  12. Didn’t think people were still responding. By the way, that’s desolder, not unsolder.

    I have found four GPIOs on the fon2200 (shown above is the fon2100), a more power efficient version of the fonera. Those GPIOs are: 7,2,5, and 6. For more information, look in the dd-wrt ( forums for my posts (under the name, "meltyblood"). I should soon have my fon2200 SD mod finished. I have already compiled the driver. I also have a readied version of Openwrt with the X-wrt webif, MDK3, and Aircrack-ng installed. You will need to log into DD-WRT to see posted files.

  13. The max IO rate is not necessarily 40MHz. Microprocessors use xtals as timing references. The actual speed of the onboard processor is 183MHz, but I’m not sure how fast it can pulse its IOs. My Openwrt firmware includes usleep and gpio_proc, so feel free to conduct a few simple speed tests. You won’t hit anything near 40 MHz obviously just by pulsing the lines and waiting a short while, but you can test for hidden capacitance on the GPIOs. There is a limit to how fast SD cards operate in MMC (SPI) mode, so what’s more important is a REAL SD-Driver (needs 6 gpios instead of 4). That won’t happen though. One guy from the openwrt forum (was it cyril?) managed to hit 800kB/s write speeds on his SD-card on the broadcom platform, but he used a very special (non-adaptable) driver which will not work for Atheros by any means. If Fon made a model with an SD port, that would make things a bit more interesting. they would be forced to write a driver and the puzzle pieces would be out in broad-daylight. Wishful thinking???

  14. About the GPIO speed, you can check out the CPU datasheet, but usually you can not use a speed greater than the PLL (which seems to be 40Mhz here) This is the way ARM7 or ARM9 works. In some case this can even been a smaller (PLL / 2) ..

    About the Fon2200, I read a couple of stuff about it. The main feature of this board is the CPU temp which seems to be really nicer than the previous one. (Yeah you can cook with a Fonera).

    If you have any plans to get one or two for free, please leave a message here.

    Bye bye..

  15. It just say the Fonera use a precision timer at 92Mhz (timer used for Jitties and other stuff..)


  16. I made all, but don’t work, really is the driver that don’t work. I have OpenWRT kamikaze (last version) and i installed the ipkg driver, but at the reboot in dmesg it is hold in
    "Jan 1 00:00:49 OpenWrt user.warn kernel: mmc : MMC Driver for Fonera Version 2.5 (050507) — ’2B|!2B’ (" and also if i connect the card don’t happen anything. in the openwrt irc channel someone say that the problem is about my version of openwrt that is incompatibile with the driver, what do you think?

  17. Otacon22, you were the last poster on Cyril’s Whiterussian MMC driver thread. You were wondering if it would work on Kamikaze on a fonera right? I have a firmware with a precompiled MMC driver for the fon2100 and fon2200. You’ll have to log-in to DD-WRT to get it, you won’t see the file unless you create an account and log-in.
    MDK3, aircrack-ng and many other features are included. I am working on a new revision now.

  18. Thank you for the article, i love it, but it has some bugs anyway.
    My pal and me were suffering to make it working.
    First we solder the power to the sw3 and sw4, but it wasnt enough. We must cut off the C142, C143, C144, C145 condensers.
    After this we get a working sd/mmc card :)
    Thx again.

  19. EQ want’s to say: We solder the vcc to sw3 and sw4, gnd to j3 antenna connector ground.

    The sd dosn’t work until we cut off the C142, C143, C144, C145 capacitors.

    Thenx a lot.

  20. If you use openWRT (not DD-WRT) you can use a: ipkg install ftpd .

    On DD-WRT, I don’t know.


  21. Hi!

    Concerning large SD card suppport (>= approx. 1GB :-)
    I Contacted He stated, that registers differ a bit on cards with higher capacity. When he’s got time, he’ll have a look and fix it. So, hopefully soon :-))
    If I use preformatted card, fdisk complains, that partition is larger than available storage.


  22. Nice hack! I’ll try it as soon as I flash my Fonera with OpenWRT.

    I just found a nice way to build a veeery cheap SD/MMC slot: It might be interesting for people who don’t want to buy a "real" card reader just to take its SD slot…

    Thx anyway for this nice article!

  23. Hi,

    do you thing thath is possible to connect a serial device to la fonera?
    I need to connect a CCD Barcode Scanners and save the scanned data to SD memory or send them to a web server…


  24. Can we make a good totorial for sd/mmc in fonera 2200..
    I dont understand were are the gpio’s pin…

    help me please!!

  25. Some important lines from the boot sequence.  What does the last one say?

    Linux version (ubuntu@OpenWrt-DevEnv) (gcc version 4.1.2) #14 Wed Jun 13 00:49:03 EDT 2007
    CPU revision is: 00019064
    Determined physical RAM map:
     memory: 01000000 @ 00000000 (usable)
    Initrd not found or empty - disabling initrd
    Built 1 zonelists.  Total pages: 4064
    Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2 init=/etc/preinit
    Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
    Primary data cache 16kB, 4-way, linesize 16 bytes.
    Synthesized TLB refill handler (20 instructions).
    Synthesized TLB load handler fastpath (32 instructions).
    Synthesized TLB store handler fastpath (32 instructions).
    Synthesized TLB modify handler fastpath (31 instructions).
    PID hash table entries: 64 (order: 6, 256 bytes)
    Using 92.000 MHz high precision timer.
  26. Hi!

    Nice hack indeed. Just killed my HAMA 35 in 1 USB Card reader to extract SD card slot :-)

    Builds nicely and from its size it can easily be integrated in original fonera case.

    Although I encounter a problem with my 2GB SD card:

    mmc : MMC Driver for Fonera Version 2.5 (050507) -- '2B|!2B' (
    mmc : Card Found
    mmc : card in op mode
    mmc : SIZE : 231, nMUL : 6, COUNT : 3900, NAME : SD
    mmc : Card Initialised
    mmc : The inserted card has a capacity of 511180800 Bytes
    mmc : adding disk
    mmc: mmc1
    mmc : Card was Found

    511180800 bytes are 487,5MB and not ~2GB as expected.

    Any idea on this? Is the interface not supporting more memory?



  27. Hi.
    Someone tell me knows what I lose removing the 4 capacitors? Seems none. So that reason have to be welded them?

  28. Your english is worst than mine !!!

    The caps act as filtering the lines here. The caps degrade the signals, so I removed them. In fact, with the caps, the reader doesn’t work really well due to bad signal quality.


  29. Hi there
    Ive followed your instructions to the letter but ive got a problem.
    When the router boots the last line it generates before the login says:
    MMM_drv: version magic ’ mod_unload MIPS32_R1 23BIT ‘ should be ’ mod_unload MIPS32_R1 23BIT ‘
    Any ideas how I can work around this or where I can get the updated file from?
    Im running OpenWRT kamikaze

  30. can anyone leave some tips or tutorial on how to remove the capacitors from the equation?


  31. I know this if off topic but I’m looking into starting my own blog and was curious what all is required to get set up? I’m assuming having a blog like yours would cost a pretty penny? I’m not very internet savvy so I’m not 100% sure. Any tips or advice would be greatly appreciated. Cheers

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>