Picked up one of these at a thrift shop. Specs from here appears to be accurate. Key points:
- IPQ4018 & QCA8072
- 256MB RAM (Nanya NT5CC128M16iP-D1? )
- 16MiB Flash (25L12835F?)
- Dual RJ45 ethernet ports
- Serial pinout:
- RX?
- Blank (no hole)
- VCC
- GND
- TX
- FCC ID: KA2AP1655A1 (same as DAP-1655 A1)
- D-Link Recovery GUI (activated by booting while holding reset) is present
I soldered a header to the TX and RX pins and connected to it via an FTDI USB adapter. Using Putty on Windows with 115200 8N1 (flow control disabled) I was able to get output but my inputs don't seem to do anything, so I can only monitor.
There is some similarity between the COVR-1300E and the DAP-2610 (D-Link, IPQ4018 & QCA8072), but it looks like the flash layout of the DAP-2610 (under openwrt) is different from the COVR-1300E (stock firmware). Not sure if that's simply a result of openwrt and stock layouts being different.
I would like to back up the flash before I try to build and upload an openwrt image. Can this be done without serial input or a clip to read from the flash chip directly? What else should I be doing to get the required info to build a compatible openwrt image?
Serial outputs are below (cut off what was needed to fit in character limit):
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00108
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1339 - bootable_media_detect_entry, Start
B - 1679 - bootable_media_detect_success, Start
B - 1693 - elf_loader_entry, Start
B - 5069 - auth_hash_seg_entry, Start
B - 7212 - auth_hash_seg_exit, Start
B - 578516 - elf_segs_hash_verify_entry, Start
B - 694685 - PBL, End
B - 694709 - SBL1, Start
B - 784990 - pm_device_init, Start
D - 7 - pm_device_init, Delta
B - 786518 - boot_flash_init, Start
D - 54246 - boot_flash_init, Delta
B - 844905 - boot_config_data_table_init, Start
D - 3839 - boot_config_data_table_init, Delta - (419 Bytes)
B - 852116 - clock_init, Start
D - 7565 - clock_init, Delta
B - 864180 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:2,Subtype:0
B - 867593 - sbl1_ddr_set_params, Start
B - 872690 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 877072 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13175 - sbl1_ddr_set_params, Delta
B - 890804 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 960622 - sbl1_wait_for_ddr_training, Start
D - 27 - sbl1_wait_for_ddr_training, Delta
B - 976311 - Image Load, Start
D - 138363 - QSEE Image Loaded, Delta - (269176 Bytes)
B - 1115102 - Image Load, Start
D - 1440 - SEC Image Loaded, Delta - (2048 Bytes)
B - 1125512 - Image Load, Start
D - 217068 - APPSBL Image Loaded, Delta - (444207 Bytes)
B - 1342978 - QSEE Execution, Start
D - 60 - QSEE Execution, Delta
B - 1349222 - SBL1, End
D - 656591 - SBL1, Delta
S - Flash Throughput, 2006 KB/s (715850 Bytes, 356683 us)
S - DDR Frequency, 537 MHz
U-Boot 2012.07 [Chaos Calmer 15.05.1,unknown] (Feb 21 2017 - 20:19:24) ALPHA v1.01
Board Name: WAPAC29
SVN revision: 1375
smem ram ptable found: ver: 1 len: 3
DRAM: 256 MiB
machid : 0x8010200
NAND: SF: Detected MX25L12805D with page size 4 KiB, total 16 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x1000000
16 MiB
MMC:
In: serial
Out: serial
Err: serial
machid: 8010200
flash_type: 0
Net: MAC0 addr:{{OMITTED}}
PHY ID1: 0x4d
PHY ID2: 0xd0b2
ipq40xx_ess_sw_init done
eth0
Detecting Reset Button...
Hit any key to stop autoboot: 2 1 0
SF: Detected MX25L12805D with page size 4 KiB, total 16 MiB
## Booting kernel from FIT Image at 84000000 ...
Using 'config@4' configuration
Trying 'kernel@1' kernel subimage
Description: ARM OpenWrt Linux-3.14.43
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x840000e4
Data Size: 3086116 Bytes = 2.9 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80208000
Entry Point: 0x80208000
Hash algo: crc32
Hash value: 9f49f2b7
Hash algo: sha1
Hash value: 80873016153eb184bf3a884d28b7f34d1afdcc0c
Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 84000000
Using 'config@4' configuration
Trying 'fdt@4' FDT blob subimage
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8430f840
Data Size: 34862 Bytes = 34 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 097adbf8
Hash algo: sha1
Hash value: 298acd04e2ac9872fe3f18894140aeacbb981358
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x8430f840
Uncompressing Kernel Image ... OK
Loading Device Tree to 86ff4000, end 86fff82d ... OK
eth0 MAC Address from ART is not valid
eth1 MAC Address from ART is not valid
Using machid 0x8010200 from environment
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 3.14.43 (arriy@cdBSCMPL08) (gcc version 5.2.0 (OpenWrt GCC 5.2.0 r35193) ) #1 SMP PREEMPT Thu Jun 1 23:20:08 EDT 2017
[ 0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine model: Qualcomm Technologies, Inc. IPQ40xx/AP-DK01.1-C1
[ 0.000000] Memory policy: Data cache writealloc
[ 0.000000] PERCPU: Embedded 7 pages/cpu @cfdca000 s8192 r8192 d12288 u32768
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 60928
[ 0.000000] Kernel command line: rootfsname=rootfs rootwait clk_ignore_unused
[ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Memory: 236516K/245760K available (4204K kernel code, 357K rwdata, 1460K rodata, 176K init, 536K bss, 9244K reserved, 0K highmem)
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] vmalloc : 0xd0800000 - 0xff000000 ( 744 MB)
[ 0.000000] lowmem : 0xc0000000 - 0xd0000000 ( 256 MB)
[ 0.000000] pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
[ 0.000000] modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
[ 0.000000] .text : 0xc0208000 - 0xc079024c (5665 kB)
[ 0.000000] .init : 0xc0791000 - 0xc07bd000 ( 176 kB)
[ 0.000000] .data : 0xc07be000 - 0xc081767c ( 358 kB)
[ 0.000000] .bss : 0xc081767c - 0xc089d890 ( 537 kB)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] Preemptible hierarchical RCU implementation.
[ 0.000000] NR_IRQS:16 nr_irqs:16 16
[ 0.000000] Architected cp15 timer(s) running at 48.00MHz (virt).
[ 0.000009] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 2863311552512ns
[ 0.000018] Switching to timer-based delay loop
[ 0.000302] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000)
[ 0.000319] pid_max: default: 32768 minimum: 301
[ 0.000590] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000604] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.010980] CPU: Testing write buffer coherency: ok
[ 0.011354] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[ 0.011430] Setting up static identity map for 0x80212e80 - 0x80212ed8
[ 0.090602] CPU1: Booted secondary processor
[ 0.090649] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
[ 0.110594] CPU2: Booted secondary processor
[ 0.110630] CPU2: thread -1, cpu 2, socket 0, mpidr 80000002
[ 0.130637] CPU3: Booted secondary processor
[ 0.130672] CPU3: thread -1, cpu 3, socket 0, mpidr 80000003
[ 0.130802] Brought up 4 CPUs
[ 0.130841] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[ 0.130849] CPU: All CPU(s) started in SVC mode.
[ 0.140825] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[ 0.141217] pinctrl core: initialized pinctrl subsystem
[ 0.141651] regulator-dummy: no parameters
[ 0.142301] NET: Registered protocol family 16
[ 0.143819] DMA: preallocated 2048 KiB pool for atomic coherent allocations
[ 0.144363] cpuidle: using governor ladder
[ 0.144375] cpuidle: using governor menu
[ 0.152319] hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 3
[ 0.152328] hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 1
[ 0.152337] hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 2
[ 0.152341] hw-breakpoint: CPU 1 failed to disable vector catch
[ 0.152370] hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 0
[ 0.152460]
[ 0.152460] Version Rollback Feature Disabled
[ 0.155923] sps:sps is ready.
[ 0.160227] bio: create slab <bio-0> at 0
[ 0.162030] SCSI subsystem initialized
[ 0.162588] msm_bus_fabric_init_driver
[ 0.162765] msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100
[ 0.162782] msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100
[ 0.162802] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus4096 ctx1
[ 0.162846] msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100
[ 0.162860] msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100
[ 0.162876] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus1024 ctx1
[ 0.188689] Switched to clocksource arch_sys_counter
[ 0.190481] NET: Registered protocol family 2
[ 0.191663] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.191712] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.191760] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.191824] TCP: reno registered
[ 0.191841] UDP hash table entries: 256 (order: 1, 8192 bytes)
[ 0.191874] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[ 0.192228] NET: Registered protocol family 1
[ 0.192907] hw perfevents: enabled with ARMv7 Cortex-A7 PMU driver, 5 counters available
[ 0.194238] futex hash table entries: 1024 (order: 4, 65536 bytes)
[ 0.203136] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.203152] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.204075] msgmni has been set to 461
[ 0.205473] Key type asymmetric registered
[ 0.205488] Asymmetric key parser 'x509' registered
[ 0.205525] io scheduler noop registered
[ 0.205534] io scheduler deadline registered (default)
[ 0.206676] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7
[ 0.206743] tcsr 1953000.ess_tcsr: setting ess interface select = 0
[ 0.206815] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[ 0.206870] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[ 0.207579] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 0.208651] msm_serial_hsl_probe: detected port #0 (ttyMSM0)
[ 0.208775] msm_serial_hsl_probe: Bus scaling is disabled
[ 0.208947] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 139, base_baud = 115200) is a MSM
[ 0.209021] msm_hsl_console_setup: console setup on port #0
[ 0.791185] console [ttyMSM0] enabled
[ 0.795276] msm_serial_hsl_init: driver initialized
[ 0.800108] msm_serial_hs module loaded
[ 0.803836] qca_serial_hs module loaded
[ 0.809872] sps: BAM device 0x07884000 is not registered yet.
[ 0.814592] sps:BAM 0x07884000 is registered.
[ 0.820058] sps:BAM 0x07884000 (va:0xd0b40000) enabled: ver:0x19, number of pipes:12
[ 0.827209] m25p80 spi0.0: found mx25l12805d, expected n25q128a11
[ 0.833049] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[ 0.838102] 13 ofpart partitions found on MTD device spi0.0
[ 0.843618] Creating 13 MTD partitions on "spi0.0":
[ 0.848468] 0x000000000000-0x000000040000 : "0:SBL1"
[ 0.854597] 0x000000040000-0x000000060000 : "0:MIBIB"
[ 0.859686] 0x000000060000-0x0000000c0000 : "0:QSEE"
[ 0.864664] 0x0000000c0000-0x0000000d0000 : "0:CDT"
[ 0.869521] 0x0000000d0000-0x0000000e0000 : "0:DDRPARAMS"
[ 0.874816] 0x0000000e0000-0x0000000f0000 : "0:APPSBLENV"
[ 0.880242] 0x0000000f0000-0x000000170000 : "0:APPSBL"
[ 0.885324] 0x000000170000-0x000000180000 : "0:ART"
[ 0.890262] 0x000000180000-0x000000190000 : "devconf"
[ 0.895269] 0x000000190000-0x0000001a0000 : "devdata"
[ 0.900271] 0x0000001a0000-0x0000001c0000 : "langpack"
[ 0.905325] 0x0000001c0000-0x0000005c0000 : "0:HLOS"
[ 0.910337] 0x0000005c0000-0x000001000000 : "rootfs"
[ 0.915273] mtd: device 12 (rootfs) set to be root filesystem
[ 0.921148] libphy: ipq40xx_mdio: probed
[ 0.927652] ipq40xx-mdio 90000.mdio: ipq40xx-mdio driver was registered
[ 0.933320] i2c /dev entries driver
[ 0.940968] TCP: cubic registered
[ 0.943927] NET: Registered protocol family 10
[ 0.948754] NET: Registered protocol family 17
[ 0.952274] Bridge firewalling registered
[ 0.956164] 8021q: 802.1Q VLAN Support v1.8
[ 0.960445] Registering SWP/SWPB emulation handler
[ 0.966258] regulator-dummy: disabling
[ 0.970363] input: gpio_keys.7 as /devices/soc.0/gpio_keys.7/input/input0
[ 0.976385] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[ 0.985786] clk: Not disabling unused clocks
[ 1.003257] VFS: Mounted root (squashfs filesystem) readonly on device 31:12.
[ 1.009882] Freeing unused kernel memory: 176K (c0791000 - c07bd000)
starting pid 71, tty '': '/etc/init.d/rcS'
[/etc/init.d/S10init.sh]
[/etc/init.d/S15udevd.sh]
[ 2.143133] udevd (85): /proc/85/oom_adj is deprecated, please use /proc/85/oom_score_adj instead.
now hotplug_net.sh is called:add ...................................
[/etc/init.d/S16ipv6.sh]
[/etc/init.d/S19init.sh]
[/etc/init.d/S20init.sh]
[ 2.874253] random: nonblocking pool is initialized
DEFNODE[/etc/defnodes/S11devdata.xml]
DEFNODE[/etc/defnodes/S12devdata.php]
DEFNODE[/etc/defnodes/S13dfs.php]
DEFNODE[/etc/defnodes/S14setchlist.php]
DEFNODE[/etc/defnodes/S20device.xml]
DEFNODE[/etc/defnodes/S22timezone.php]
[/etc/scripts/setdate.sh] 01/01/2000 ...
Sat Jan 1 00:00:04 UTC 2000
DEFNODE[/etc/defnodes/S30device.php]
DEFNODE[/etc/defnodes/S30device.xml]
DEFNODE[/etc/defnodes/S31diagnostic.xml]
DEFNODE[/etc/defnodes/S31locale.php]
DEFNODE[/etc/defnodes/S33wifi.php]
DEFNODE[/etc/defnodes/S40device.xml]
DEFNODE[/etc/defnodes/S80mtfwu.php]
DEFNODE[/etc/defnodes/S90opendns.php]
DEFNODE[/etc/defnodes/S90sessions.php]
DEFNODE[/etc/defnodes/S90sessions_privatekey.php]
DEFNODE[/etc/defnodes/S90upnpigd.php]
DEFNODE[/etc/defnodes/S90upnpwfa.php]
DEFNODE[/etc/defnodes/S91upnpigd2.php]
SERVD: start service [LOGD]
[/etc/init.d/S20interfaces.sh]
[ 4.971241] ess-switch DT exist!
[ 4.973863] switchreg_base_addr: 0xc000000
[ 4.977523] switchreg_size: 0x80000
[ 4.981046] switch_access_mode: local bus
[ 4.984991] wan bmp:0x2
[ 4.987439] ess-psgmii DT exist!
[ 4.990674] mac mode=0
[ 4.992974] current mac mode = 0
[ 4.996187] current dts led_source_num is 0
[ 5.000389] mdio DT exist!
[ 5.003050] ssdk_plat_init start
[ 5.006391] enable ess clk
[ 5.119298] reset ok in probe!
[ 5.123055] PHY ID is 0x4dd0b2
[ 5.186319] qca probe malibu phy driver succeeded!
[ 6.969083] Dakota Chip version 0x1401
[ 6.973154] qca-ssdk module init succeeded!
[ 7.050091] **********************************************************
[ 7.055973] * Driver :NSS GMAC Driver for RTL v(3.72a)
[ 7.061018] * Version :1.0
[ 7.063844] * Copyright :Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
[ 7.072202] **********************************************************
[ 7.288566] qca-nss-drv.ko is loaded for symbol link
[ 7.483806] QCA Hy-Fi multicast installation successfully
[ 7.615811] QCA multicast snooping installed successfully
[ 7.626128] edma module_init
[ 7.629593] EDMA using MAC@ - using {{OMITTED}}