This is the current status of my assistance on the project;

/home/user # ./ps3pwn blob.bin
Loading blob.bin
Blob size is 0x6f0
mmapped 480ab000 -> 0x40002000 [0x1000]
mmapped 48004000 -> 0x40003000 [0x1000]
mmap ok!
Clocks: 032000d2
Revision: 00000033
Resetting OTG controller
Reset complete
Devctl: 00000080
High-speed mode disabled
Configuring endpoints
Waiting for connection...
VBUS detected!
Now soft-connecting
Entering IRQ loop
IRQs: 01
IRQs: 04
High-speed reset
get_descriptor(0, 1, 0) (0x8)
get_descriptor(0, 1, 0) (0x12)
Device 0 now has address 2
Commit pending address 2
get_descriptor(0, 2, 0) (0x8)
get_descriptor(0, 2, 0) (0x19)
Set configuration 1
get_descriptor(0, 41, 0) (0x20)
Set port 1 power to ON
Set port 2 power to ON
Set port 3 power to ON
Set port 4 power to ON
Set port 5 power to ON
Set port 6 power to ON
Triggering connection change for port 1
get_port_status(0001) = 0103 0001
Clear port 1 connect change
get_port_status(0001) = 0103 0000
Reset port 1
get_port_status(0001) = 0103 0010
Clear port 1 reset change
Switching to new device 1
get_descriptor(1, 1, 0) (0x8)
Got a SETUPEND condition
length 0?
get_descriptor(1, 1, 0) (0x8)

It fails after sending the descriptors - for some odd reason. Unable to get passed this on 3.41 with the N900. Beagleboard is a different story. I assum HAL and BME are tying up the driver from releasing and letting the userspace take over to deliver the payload.

If you can legitimately contribute, please do so.