Newegg had the D-link DIR-505 on shell shocker, and I couldn't resist.
It is very similar to the TP-Link TP-MR3020: one USB, and one ethernet,
but it conveniently plugs directly into a wall outlet, and has twice the flash
and RAM.
I have been looking at how to get OpenWrt working on it, but I'm not
sure how to proceed. Here is the information I have so far:
Hardware:
CPU - atheros AR1311-AL1A
- MIPS 32 bit, usb, ddr2, 802.11 bgn
RAM - NANYA NT5TU32M16DG
- 512Mb (64MB)
FLASH - MXIC - 25l6406EM2
- serial, 8 pin SOP
- 64Mb (8MB)
Serial port: (small test point pads on underside of cpu board)
- tp10 - 3.3v
- tp11 - gnd
- tp12 - tx
- tp13 - rx
Disassembly:
- remove sticker below power plug, and remove exposed screw
- pry the now unfastened cap straight up over power plug
- pry two remaining halves apart - there are three plastic tabs,
one above reset hole, and one on each side of mode switch
- remove screw holding power plug in place
- pull power module straight up away from cpu board
- pop cpu board up (two plastic tabs hold it down).
I am working on annotated photos of the disassembly and circuit board.
----------------------------------------------------------------------------------------
firmware image from dlink.com: dir505_fw_103.bin:
binwalk and unsquashfs-4.0-lzma (from http://code.google.com/p/firmware-mod-kit/)
output:
[dave@localhost src]$ ./binwalk ../../../dir505_fw_103.bin
DECIMAL HEX DESCRIPTION
----------------------------------------------------------------------------------------
84 0x54 uImage header, header size: 64 bytes, header CRC: 0xA5DC0F71,
created: Thu Jun 14 07:31:28 2012, image size: 979551 bytes,
Data Address: 0x80002000, Entry Point: 0x801FF5C0, data CRC:
0x2ED0B35A, OS: Linux, CPU: MIPS, image type: OS Kernel Image,
compression type: lzma, image name: Linux Kernel Image
148 0x94 LZMA compressed data, properties: 0x5D, dictionary size: 8388608
bytes, uncompressed size: 2861320 bytes
1048660 0x100054 Squashfs filesystem, little endian, version 4.0, compression:
lzma, size: 5699516 bytes, 493 inodes, blocksize: 16384 bytes,
created: Thu Jun 14 07:31:59 2012
Image details: (hexdump)
ID:
00000000 32 C1 84 8D 00 78 00 00 00 10 00 00 48 4F 52 4E 2....x......HORN
00000010 45 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ET..............
00000020 48 4F 52 4E 45 54 2D 50 41 43 4B 45 54 2D 44 49 HORNET-PACKET-DI
00000030 52 35 30 35 41 31 2D 33 00 00 00 00 00 00 44 45 R505A1-3......DE
00000040 46 00 31 2E 30 33 2E 30 33 00 00 00 00 00 54 00 F.1.03.03.....T.
00000050 00 00 00 00
uboot header:
00000054 27 05 19 56 A5 DC 0F 71 4F D9 CB 90 ....'..V...qO...
^ magic ^hdr csum ^ time
00000060 00 0E F2 5F 80 00 20 00 80 1F F5 C0 2E D0 B3 5A ..._.. ........Z
^size ^load addr ^entry addr ^data csum
00000070 05 05 02 03 4C 69 6E 75 78 20 4B 65 72 6E 65 6C ....Linux Kernel
^linux
^mips
^kernel
^lzma
^name
00000080 20 49 6D 61 67 65 00 00 00 00 00 00 00 00 00 00 Image..........
unsquashing root fs:(from http://code.google.com/p/firmware-mod-kit/)
unsquashfs-4.0-lzma:
created 230 files
created 64 directories
created 116 symlinks
created 0 devices
created 0 fifos
File system sucessfully extracted!
MKFS="./src/others/squashfs-4.0-lzma/mksquashfs-lzma"
------------------------------------------------------------------------------------
Here is output for u-boot and linux via the serial console:
U-Boot 1.1.4 (Feb 9 2012 - 20:12:45)
AP121 (ar9331) U-boot
DRAM: 64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 161k for U-Boot at: 83fd4000
Reserving 192k for malloc() at: 83fa4000
Reserving 44 Bytes for Board Info at: 83fa3fd4
Reserving 36 Bytes for Global Data at: 83fa3fb0
Reserving 128k for boot params() at: 83f83fb0
Stack Pointer at: 83f83f98
Now running in RAM - U-Boot at: 83fd4000
============================================
Date:Feb 9 2012 Time:20:12:45
Cameo Version: v1.00 Build:03
Module Name: D-Link DIR-505A1
============================================
id read 0x100000ff
flash size 8388608, sector count = 128
Flash: 8 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize...
: cfg1 0x5 cfg2 0x7114
eth0: 00:18:e7:92:26:15
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:ff:ff:fe
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot: x
ar7240> printenv
bootargs=console=ttyS0,115200 root=31:06 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:64k(u-boot),64k(ART),64k(mac),64k(nvram),256k(language),1024k(uImage),6656k(rootfs)
bootcmd=bootm 0x9f080000
bootdelay=2
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.0.1
serverip=192.168.0.100
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
Environment size: 368/65532 bytes
ar7240> help
fake - fake
? - alias for 'help'
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
cp - memory copy
erase - erase FLASH memory
help - print online help
httpboot- entering the backup mode.
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset - Perform RESET of the CPU
run - run commands in an environment variable
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
ar7240> boot
## Booting image at 9f080000 ...
Image Name: Linux Kernel Image
Created: 2012-06-14 11:31:28 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 979551 Bytes = 956.6 kB
Load Address: 80002000
Entry Point: 801ff5c0
Verifying Checksum at 0x9f080040 ...OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 801ff5c0) ...
## Giving linux memsize in bytes, 67108864
Starting kernel ...
Booting AR9330(Hornet)...
Linux version 2.6.31--LSDK-9.2.0_U9.915 (root@pin-laptop) (gcc version 4.3.3 (GCC) ) #1 Thu Jun 14 19:26:36 CST 2012
flash_size passed from bootloader = 8
arg 1: console=ttyS0,115200
arg 2: root=31:06
arg 3: rootfstype=squashfs
arg 4: init=/sbin/init
arg 5: mtdparts=ar7240-nor0:64k(u-boot),64k(ART),64k(mac),64k(nvram),256k(language),1024k(uImage),6656k(rootfs)
arg 6: mem=64M
CPU revision is: 00019374 (MIPS 24Kc)
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:06 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:64k(u-boot),64k(ART),64k(mac),64k(nvram),256k(language),1024k(uImage),6656k(rootfs) mem=64M
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 62004k/65536k available (2054k kernel code, 3464k reserved, 615k data, 124k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 266.24 BogoMIPS (lpj=532480)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
===== ar7240_platform_init: 0
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
AR7240 GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.12)
msgmni has been set to 121
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered (default)
HDLC line discipline maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
ttyS0: detected caps 00000000 should be 00000100
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
loop: module loaded
PPP generic driver version 2.4.2
NET: Registered protocol family 24
PPTP driver version 0.8.5
PPPoL2TP kernel driver, V1.0
7 cmdlinepart partitions found on MTD device ar7240-nor0
Creating 7 MTD partitions on "ar7240-nor0":
0x000000000000-0x000000010000 : "u-boot"
0x000000010000-0x000000020000 : "ART"
0x000000020000-0x000000030000 : "mac"
0x000000030000-0x000000040000 : "nvram"
0x000000040000-0x000000080000 : "language"
0x000000080000-0x000000180000 : "uImage"
0x000000180000-0x000000800000 : "rootfs"
usbcore: registered new interface driver libusual
u32 classifier
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
xt_time: kernel timezone is -0000
nf_conntrack_rtsp v0.6.21 loading
IPv4 over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
nf_nat_rtsp v0.6.21 loading
TCP cubic registered
NET: Registered protocol family 17
arch/mips/ar7240/gpio.c (ar7240_simple_config_init) AP_RESET_GPIO: 12
ar7240wdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
Freeing unused kernel memory: 124k freed
init started: BusyBox v1.01 (2012.06.14-11:27+0000) multi-call binary
ln: /sbin/hotplug: File exists
TFTP main
----------------standard_tftp_server launched on port 69. -----------------
Please press Enter to activate this console. init NVRAM_SPACE from mtdblock size
init nvram memory map size: 0x10000 order of pages: 0x4
nvram module init:
/dev/nvram major number 225 glues to mtd: "nvram" size: 0x00010000
nvram_space: 0x00010000 mapped via mmap(2)
openfile :/var/etc/nvram.default
gpio_module: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Port Status 1c000004
ar7240-ehci ar7240-ehci.0: ATH EHCI
ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000
ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000
ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ATHR_GMAC: Length per segment 1536
ATHR_GMAC: fifo cfg 3 01f00140
ATHR_GMAC: unit 0 --> 00:18:e7:92:26:15
ATHR_GMAC: Max segments per packet : 1
ATHR_GMAC: Max tx descriptor count : 40
ATHR_GMAC: Max rx descriptor count : 252
ATHR_GMAC: Mac capability flags : 5403
ATHR_GMAC: unit 1 --> 00:03:7f:ff:ff:fe
ATHR_GMAC: Max segments per packet : 1
ATHR_GMAC: Max tx descriptor count : 40
ATHR_GMAC: Max rx descriptor count : 96
ATHR_GMAC: Mac capability flags : 25D93
athr_gmac_ring_alloc Allocated 640 at 0x83b4bc00
athr_gmac_ring_alloc Allocated 4032 at 0x83b0f000
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
device eth0 entered promiscuous mode
killall: wlan_schedule: no process killed
killall: klogd: no process killed
killall: syslogd: no process killed
killall: netbios_checker: no process killed
killall: timer: no process killed
killall: timer: no process killed
Sat Jan 1 00:00:00 UTC 2011
killall: dnsmasq: no process killed
ath_hal: 0.9.17.1 (AR9380, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
killall: udhcpc: no process killed
ath_ahb: 9.2.0_U9.915 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
Restoring Cal data from Flash
ath_get_caps[4913] rx chainmask mismatch actual 1 sc_chainmak 0
ath_get_caps[4888] tx chainmask mismatch actual 1 sc_chainmak 0
killall: lld2d: no process killed
cp: /www/xml/help.xml: No such file or directory
wifi0: Atheros 9380: mem=0xb8100000, irq=2
killall: check_conn_status: no process killed
tar: Invalid tar magic
rm: cannot remove `/tmp/lang_ver.txt': No such file or directory
rm: cannot remove `/tmp/*.xml': No such file or directory
wlan_vap_create : enter. devhandle=0x82c682c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x82c682c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created
ath0
wlan_vap_create : enter. devhandle=0x82c682c0, opmode=IEEE80211_M_STA, flags=0x1
wlan_vap_create : exit. devhandle=0x82c682c0, opmode=IEEE80211_M_STA, flags=0x1.
VAP device ath1 created
ath1
Failed to kill daemon: No such file or directory
Interface doesn't accept private ioctl...
HALDbg (8BE0): Operation not permitted
2011-01-01 00:00:05: (log.c.166) server started
ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
ieee80211_ioctl_siwmode: imr.ifm_active=131200, new mode=2, valid=1
device ath1 entered promiscuous mode
br0: port 2(ath1) entering learning state
device ath0 entered promiscuous mode
br0: port 3(ath0) entering learning state
br0: port 2(ath1) entering forwarding state
br0: port 3(ath0) entering forwarding state
killall: sta_notifier: no process killed
ieee80211_ioctl_getparam : parameter 0x284 not supported
ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
Scan in progress.. Cancelling it
br0: port 3(ath0) entering disabled state
DEVICE IS DOWN ifname=ath0
DEVICE IS DOWN ifname=ath0
br0: port 3(ath0) entering learning state
br0: port 3(ath0) entering forwarding state
killall: llmnr: no process killed
killall: udhcpc: no process killed
ieee80211_ioctl_setmlme: os_opmode=1
[ieee80211_ioctl_setmlme] set desired bssid 00:21:29:b2:10:c6
route: SIOC[ADD|DEL]RT: No such process
zcip: version 0.75 (18 April 2005)
DHCP client start.
Sending discover...
DHCPC get gateway = 192.168.1.1
Sending select for 192.168.1.130...
Lease of 192.168.1.130 obtained, lease time 86400
deleting routers
route: SIOC[ADD|DEL]RT: No such process
adding dns 192.168.1.1
killall: check_conn_status: no process killed
RTNETLINK answers: Cannot assign requested address
BusyBox v1.01 (2012.06.14-11:27+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
/ # df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/mtdblock6 5568 5568 0 100% /
/ # ps
PID Uid VmSize Stat Command
1 root 444 S init
2 root SW< [kthreadd]
3 root SW< [ksoftirqd/0]
4 root SW< [events/0]
5 root SW< [khelper]
8 root SW< [async/mgr]
67 root SW< [kblockd/0]
76 root SW< [khubd]
94 root SW [pdflush]
95 root SW [pdflush]
96 root SW< [kswapd0]
98 root SW< [crypto/0]
133 root SW< [kpppd/0]
137 root SW< [mtdblockd]
167 root SW< [unlzma/0]
184 root 484 S system_manager
186 root 260 S tftpd
188 root 548 S /bin/ash
204 root 244 S reset_gpio
207 root 288 S wps_gpio
211 root 300 S mode_gpio
314 root 388 S syslogd -C 20
316 root 316 S klogd
321 root 360 S timer 60
364 root 340 S netbios_checker br0 dlinkrouter
398 root 300 S lld2d br0
400 root 440 S dnsmasq -i br0 -o -P 4096 -A /router.dlink.com/0.0.0.
428 root 252 S switch_notifier
465 root 716 S lighttpd -f /etc/lighttpd/lighttpd.conf
482 root 1124 S avahi-daemon: running [dlinkrouter.local]
526 root 364 S sta_notifier
534 root 524 S wpa_supplicant -B -c/var/tmp/stafwd-wsc.conf -iath1 -
542 root 396 S hostapd /var/tmp/oob.ap_bss -B -P /var/run/ath0
546 root 364 S llmnr br0 dlinkrouter
617 root 304 S udhcpc -i br0 -H dlinkrouter -s /usr/share/udhcpc/def
644 root 432 R ps
/ # ls
bin lib lost+found root usr www
dev libexec mnt sbin var
etc linuxrc proc tmp version
/ # cd proc
/proc # ls
1 5 crypto pagetypeinfo
133 526 devices partitions
137 534 diskstats reset_btn
167 542 driver scsi
184 546 execdomains self
186 617 filesystems slabinfo
188 646 fs softirqs
2 67 interrupts sta_notifier
204 76 iomem stat
207 8 ioports switch_mode
211 94 irq switch_pid
3 95 kallsyms sys
314 96 kcore sysvipc
316 98 kmsg timer_list
321 athdebug loadavg tty
364 athnodefixedrate locks uptime
398 athrtscts meminfo version
4 athversion misc vmallocinfo
400 buddyinfo modules vmstat
428 bus mounts wps_btn
465 cmdline mtd zoneinfo
482 cpuinfo net
/proc # cat cpuinfo
system type : Atheros AR9330 (Hornet)
processor : 0
cpu model : MIPS 24Kc V7.4
BogoMIPS : 266.24
wait instruction : yes
microsecond timers : yes
tlb_entries : 16
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x00b0, 0x0ff8, 0x011b]
ASEs implemented : mips16
shadow register sets : 1
core : 0
VCED exceptions : not available
VCEI exceptions : not available