OpenWrt Forum Archive

Topic: D-link DIR-505 support?

The content of this topic has been archived between 2 Apr 2018 and 5 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Newegg had the D-link  DIR-505 on shell shocker, and I couldn't resist.
It is very similar to the TP-Link TP-MR3020: one USB, and one ethernet,
but it conveniently plugs directly into a wall outlet, and has twice the flash
and RAM.

I have been looking at how to get OpenWrt working on it, but I'm not
sure how to proceed. Here is the information I have so far:

Hardware:

CPU - atheros AR1311-AL1A
    - MIPS 32 bit, usb, ddr2, 802.11 bgn

RAM - NANYA NT5TU32M16DG
    - 512Mb (64MB)

FLASH - MXIC - 25l6406EM2
      - serial, 8 pin SOP
      - 64Mb (8MB)

Serial port: (small test point pads on underside of cpu board)
    - tp10 - 3.3v
    - tp11 - gnd
    - tp12 - tx
    - tp13 - rx

Disassembly:
  - remove sticker below power plug, and remove exposed screw
  - pry the now unfastened cap straight up over power plug
  - pry two remaining halves apart - there are three plastic tabs,
    one above reset hole, and one on each side of mode switch
  - remove screw holding power plug in place
  - pull power module straight up away from cpu board
  - pop cpu board up (two plastic tabs hold it down).

I am working on annotated photos of the disassembly and circuit board.

----------------------------------------------------------------------------------------
firmware image from dlink.com: dir505_fw_103.bin:

binwalk and unsquashfs-4.0-lzma (from http://code.google.com/p/firmware-mod-kit/)
output:

[dave@localhost src]$ ./binwalk ../../../dir505_fw_103.bin 

DECIMAL       HEX           DESCRIPTION
----------------------------------------------------------------------------------------
84            0x54          uImage header, header size: 64 bytes, header CRC: 0xA5DC0F71,
                                created: Thu Jun 14 07:31:28 2012, image size: 979551 bytes, 
                                Data Address: 0x80002000, Entry Point: 0x801FF5C0, data CRC:
                                0x2ED0B35A, OS: Linux, CPU: MIPS, image type: OS Kernel Image,
                                compression type: lzma, image name: Linux Kernel Image

148           0x94          LZMA compressed data, properties: 0x5D, dictionary size: 8388608
                                bytes, uncompressed size: 2861320 bytes

1048660       0x100054      Squashfs filesystem, little endian, version 4.0, compression:
                                lzma, size: 5699516 bytes, 493 inodes, blocksize: 16384 bytes,
                                created: Thu Jun 14 07:31:59 2012


Image details: (hexdump)

ID:
00000000   32 C1 84 8D  00 78 00 00  00 10 00 00  48 4F 52 4E  2....x......HORN
00000010   45 54 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ET..............
00000020   48 4F 52 4E  45 54 2D 50  41 43 4B 45  54 2D 44 49  HORNET-PACKET-DI
00000030   52 35 30 35  41 31 2D 33  00 00 00 00  00 00 44 45  R505A1-3......DE
00000040   46 00 31 2E  30 33 2E 30  33 00 00 00  00 00 54 00  F.1.03.03.....T.
00000050   00 00 00 00  

uboot header:
00000054   27 05 19 56  A5 DC 0F 71  4F D9 CB 90  ....'..V...qO...
           ^ magic      ^hdr csum    ^ time

00000060   00 0E F2 5F  80 00 20 00  80 1F F5 C0  2E D0 B3 5A  ..._.. ........Z
           ^size        ^load addr   ^entry addr  ^data csum

00000070   05 05 02 03  4C 69 6E 75  78 20 4B 65  72 6E 65 6C  ....Linux Kernel
           ^linux
              ^mips
                 ^kernel
                    ^lzma
                        ^name
00000080   20 49 6D 61  67 65 00 00  00 00 00 00  00 00 00 00   Image..........
 

unsquashing root fs:(from http://code.google.com/p/firmware-mod-kit/)

unsquashfs-4.0-lzma:
created 230 files
created 64 directories
created 116 symlinks
created 0 devices
created 0 fifos

File system sucessfully extracted!
MKFS="./src/others/squashfs-4.0-lzma/mksquashfs-lzma"

------------------------------------------------------------------------------------

Here is output for u-boot and linux via the serial console:

U-Boot 1.1.4 (Feb  9 2012 - 20:12:45)

AP121 (ar9331) U-boot

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 161k for U-Boot at: 83fd4000
Reserving 192k for malloc() at: 83fa4000
Reserving 44 Bytes for Board Info at: 83fa3fd4
Reserving 36 Bytes for Global Data at: 83fa3fb0
Reserving 128k for boot params() at: 83f83fb0
Stack Pointer at: 83f83f98
Now running in RAM - U-Boot at: 83fd4000
============================================ 
Date:Feb  9 2012  Time:20:12:45
Cameo Version: v1.00 Build:03
Module Name: D-Link DIR-505A1
============================================ 
id read 0x100000ff
flash size 8388608, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
: cfg1 0x5 cfg2 0x7114
eth0: 00:18:e7:92:26:15
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:ff:ff:fe
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1

Hit any key to stop autoboot:  x
ar7240> printenv
bootargs=console=ttyS0,115200 root=31:06 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:64k(u-boot),64k(ART),64k(mac),64k(nvram),256k(language),1024k(uImage),6656k(rootfs)
bootcmd=bootm 0x9f080000
bootdelay=2
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.0.1
serverip=192.168.0.100
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Environment size: 368/65532 bytes
ar7240> help
fake   - fake
?       - alias for 'help'
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
cp      - memory copy
erase   - erase FLASH memory
help    - print online help
httpboot- entering the backup mode.
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version

ar7240> boot
## Booting image at 9f080000 ...
   Image Name:   Linux Kernel Image
   Created:      2012-06-14  11:31:28 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    979551 Bytes = 956.6 kB
   Load Address: 80002000
   Entry Point:  801ff5c0
   Verifying Checksum at 0x9f080040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 801ff5c0) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

Booting AR9330(Hornet)...
Linux version 2.6.31--LSDK-9.2.0_U9.915 (root@pin-laptop) (gcc version 4.3.3 (GCC) ) #1 Thu Jun 14 19:26:36 CST 2012
flash_size passed from bootloader = 8
arg 1: console=ttyS0,115200
arg 2: root=31:06
arg 3: rootfstype=squashfs
arg 4: init=/sbin/init
arg 5: mtdparts=ar7240-nor0:64k(u-boot),64k(ART),64k(mac),64k(nvram),256k(language),1024k(uImage),6656k(rootfs)
arg 6: mem=64M
CPU revision is: 00019374 (MIPS 24Kc)
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:06 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:64k(u-boot),64k(ART),64k(mac),64k(nvram),256k(language),1024k(uImage),6656k(rootfs) mem=64M 
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 62004k/65536k available (2054k kernel code, 3464k reserved, 615k data, 124k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 266.24 BogoMIPS (lpj=532480)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
===== ar7240_platform_init: 0
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
AR7240 GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.12)
msgmni has been set to 121
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered (default)
HDLC line discipline maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
ttyS0: detected caps 00000000 should be 00000100
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
loop: module loaded
PPP generic driver version 2.4.2
NET: Registered protocol family 24
PPTP driver version 0.8.5
PPPoL2TP kernel driver, V1.0
7 cmdlinepart partitions found on MTD device ar7240-nor0
Creating 7 MTD partitions on "ar7240-nor0":
0x000000000000-0x000000010000 : "u-boot"
0x000000010000-0x000000020000 : "ART"
0x000000020000-0x000000030000 : "mac"
0x000000030000-0x000000040000 : "nvram"
0x000000040000-0x000000080000 : "language"
0x000000080000-0x000000180000 : "uImage"
0x000000180000-0x000000800000 : "rootfs"
usbcore: registered new interface driver libusual
u32 classifier
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
xt_time: kernel timezone is -0000
nf_conntrack_rtsp v0.6.21 loading
IPv4 over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
nf_nat_rtsp v0.6.21 loading
TCP cubic registered
NET: Registered protocol family 17
arch/mips/ar7240/gpio.c (ar7240_simple_config_init) AP_RESET_GPIO: 12
ar7240wdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
Freeing unused kernel memory: 124k freed
init started:  BusyBox v1.01 (2012.06.14-11:27+0000) multi-call binary
ln: /sbin/hotplug: File exists
TFTP main
----------------standard_tftp_server launched on port 69. -----------------

Please press Enter to activate this console. init NVRAM_SPACE from mtdblock size
init nvram memory map size: 0x10000 order of pages: 0x4
nvram module init:
    /dev/nvram major number 225 glues to mtd: "nvram" size: 0x00010000
    nvram_space: 0x00010000 mapped via mmap(2)
openfile :/var/etc/nvram.default
gpio_module: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Port Status 1c000004 
ar7240-ehci ar7240-ehci.0: ATH EHCI
ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000 
ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000 
ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ATHR_GMAC: Length per segment 1536
ATHR_GMAC: fifo cfg 3 01f00140
ATHR_GMAC: unit 0 --> 00:18:e7:92:26:15 
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   252
ATHR_GMAC: Mac capability flags    :   5403
ATHR_GMAC: unit 1 --> 00:03:7f:ff:ff:fe 
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   96
ATHR_GMAC: Mac capability flags    :   25D93
athr_gmac_ring_alloc Allocated 640 at 0x83b4bc00
athr_gmac_ring_alloc Allocated 4032 at 0x83b0f000
Setting Drop CRC Errors, Pause Frames and Length Error frames 
Setting PHY...
device eth0 entered promiscuous mode
killall: wlan_schedule: no process killed
killall: klogd: no process killed
killall: syslogd: no process killed
killall: netbios_checker: no process killed
killall: timer: no process killed
killall: timer: no process killed
Sat Jan  1 00:00:00 UTC 2011
killall: dnsmasq: no process killed
ath_hal: 0.9.17.1 (AR9380, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
killall: udhcpc: no process killed
ath_ahb: 9.2.0_U9.915 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
Restoring Cal data from Flash
ath_get_caps[4913] rx chainmask mismatch actual 1 sc_chainmak 0
ath_get_caps[4888] tx chainmask mismatch actual 1 sc_chainmak 0
killall: lld2d: no process killed
cp: /www/xml/help.xml: No such file or directory
wifi0: Atheros 9380: mem=0xb8100000, irq=2
killall: check_conn_status: no process killed
tar: Invalid tar magic
rm: cannot remove `/tmp/lang_ver.txt': No such file or directory
rm: cannot remove `/tmp/*.xml': No such file or directory
wlan_vap_create : enter. devhandle=0x82c682c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x82c682c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created 
ath0
wlan_vap_create : enter. devhandle=0x82c682c0, opmode=IEEE80211_M_STA, flags=0x1
wlan_vap_create : exit. devhandle=0x82c682c0, opmode=IEEE80211_M_STA, flags=0x1.
VAP device ath1 created 
ath1
Failed to kill daemon: No such file or directory
Interface doesn't accept private ioctl...
HALDbg (8BE0): Operation not permitted
2011-01-01 00:00:05: (log.c.166) server started 
 ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 
 ieee80211_ioctl_siwmode: imr.ifm_active=131200, new mode=2, valid=1 
device ath1 entered promiscuous mode
br0: port 2(ath1) entering learning state
device ath0 entered promiscuous mode
br0: port 3(ath0) entering learning state
br0: port 2(ath1) entering forwarding state
br0: port 3(ath0) entering forwarding state
killall: sta_notifier: no process killed
ieee80211_ioctl_getparam : parameter 0x284 not supported 
 ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 
 Scan in progress.. Cancelling it 
br0: port 3(ath0) entering disabled state
 DEVICE IS DOWN ifname=ath0
 DEVICE IS DOWN ifname=ath0
br0: port 3(ath0) entering learning state
br0: port 3(ath0) entering forwarding state
killall: llmnr: no process killed
killall: udhcpc: no process killed
 ieee80211_ioctl_setmlme: os_opmode=1 
[ieee80211_ioctl_setmlme] set desired bssid 00:21:29:b2:10:c6
route: SIOC[ADD|DEL]RT: No such process
zcip: version 0.75 (18 April 2005)
DHCP client start.
Sending discover...
DHCPC get gateway = 192.168.1.1
Sending select for 192.168.1.130...
Lease of 192.168.1.130 obtained, lease time 86400
deleting routers
route: SIOC[ADD|DEL]RT: No such process
adding dns 192.168.1.1
killall: check_conn_status: no process killed
RTNETLINK answers: Cannot assign requested address



BusyBox v1.01 (2012.06.14-11:27+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/mtdblock6            5568      5568         0 100% /
/ # ps
  PID  Uid     VmSize Stat Command
    1 root        444 S   init       
    2 root            SW< [kthreadd]
    3 root            SW< [ksoftirqd/0]
    4 root            SW< [events/0]
    5 root            SW< [khelper]
    8 root            SW< [async/mgr]
   67 root            SW< [kblockd/0]
   76 root            SW< [khubd]
   94 root            SW  [pdflush]
   95 root            SW  [pdflush]
   96 root            SW< [kswapd0]
   98 root            SW< [crypto/0]
  133 root            SW< [kpppd/0]
  137 root            SW< [mtdblockd]
  167 root            SW< [unlzma/0]
  184 root        484 S   system_manager 
  186 root        260 S   tftpd 
  188 root        548 S   /bin/ash 
  204 root        244 S   reset_gpio 
  207 root        288 S   wps_gpio 
  211 root        300 S   mode_gpio 
  314 root        388 S   syslogd -C 20 
  316 root        316 S   klogd 
  321 root        360 S   timer 60 
  364 root        340 S   netbios_checker br0 dlinkrouter 
  398 root        300 S   lld2d br0 
  400 root        440 S   dnsmasq -i br0 -o -P 4096 -A /router.dlink.com/0.0.0.
  428 root        252 S   switch_notifier 
  465 root        716 S   lighttpd -f /etc/lighttpd/lighttpd.conf 
  482 root       1124 S   avahi-daemon: running [dlinkrouter.local]    
  526 root        364 S   sta_notifier 
  534 root        524 S   wpa_supplicant -B -c/var/tmp/stafwd-wsc.conf -iath1 -
  542 root        396 S   hostapd /var/tmp/oob.ap_bss -B -P /var/run/ath0 
  546 root        364 S   llmnr br0 dlinkrouter 
  617 root        304 S   udhcpc -i br0 -H dlinkrouter -s /usr/share/udhcpc/def
  644 root        432 R   ps 

/ # ls
bin         lib         lost+found  root        usr         www
dev         libexec     mnt         sbin        var
etc         linuxrc     proc        tmp         version

/ # cd proc
/proc # ls
1                 5                 crypto            pagetypeinfo
133               526               devices           partitions
137               534               diskstats         reset_btn
167               542               driver            scsi
184               546               execdomains       self
186               617               filesystems       slabinfo
188               646               fs                softirqs
2                 67                interrupts        sta_notifier
204               76                iomem             stat
207               8                 ioports           switch_mode
211               94                irq               switch_pid
3                 95                kallsyms          sys
314               96                kcore             sysvipc
316               98                kmsg              timer_list
321               athdebug          loadavg           tty
364               athnodefixedrate  locks             uptime
398               athrtscts         meminfo           version
4                 athversion        misc              vmallocinfo
400               buddyinfo         modules           vmstat
428               bus               mounts            wps_btn
465               cmdline           mtd               zoneinfo
482               cpuinfo           net

/proc # cat cpuinfo
system type        : Atheros AR9330 (Hornet)
processor        : 0
cpu model        : MIPS 24Kc V7.4
BogoMIPS        : 266.24
wait instruction    : yes
microsecond timers    : yes
tlb_entries        : 16
extra interrupt vector    : yes
hardware watchpoint    : yes, count: 4, address/irw mask: [0x0000, 0x00b0, 0x0ff8, 0x011b]
ASEs implemented    : mips16
shadow register sets    : 1
core            : 0
VCED exceptions        : not available
VCEI exceptions        : not available

Thanks for the detailed info, ordered one too, uBoot is a good starting point to dig smile

Found PCB picture http://www.smallnetbuilder.com/images/s … 05_pcb.jpg
Is it your very model? The 4-pin sockel top right in the picture could be a serial port...

Can't believe my eyes!!
It boots with stock TEW-712 image!!

ar7240> tftpboot 81000000 openwrt-ar71xx-generic-tew-712br-initramfs-uImage.bin
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.0.100; our IP address is 192.168.0.1
Filename 'openwrt-ar71xx-generic-tew-712br-initramfs-uImage.bin'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ####################################
done
Bytes transferred = 2180263 (2144a7 hex)
ar7240> bootm 0x81000000
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-3.3.8
   Created:      2012-09-11  14:58:28 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2180199 Bytes =  2.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x81000040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

[    0.000000] Linux version 3.3.8 (onyx@randy.andy.net) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Tue Sep 11 16:57:51 CEST 2012
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR9330 rev 1
[    0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:25.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00004000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00004000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  board=TEW-712BR console=ttyATH0,115200 mtdparts=spi0.0:64k(u-boot)ro,64k(art)ro,64k(mac)ro,64k(nvram)ro,192k(language)ro,896k(kernel),2752k(rootfs),3648k@0x70000(firmware) rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 60540k/65536k available (2083k kernel code, 4996k reserved, 396k data, 1428k init, 0k highmem)
[    0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 512
[    0.090000] NET: Registered protocol family 16
[    0.090000] gpiochip_add: registered GPIOs 0 to 29 on device: ath79
[    0.100000] MIPS: machine is TRENDnet TEW-712BR
[    0.510000] bio: create slab <bio-0> at 0
[    0.520000] Switching to clocksource MIPS
[    0.520000] NET: Registered protocol family 2
[    0.530000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.530000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    0.540000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.540000] TCP: Hash tables configured (established 2048 bind 2048)
[    0.550000] TCP reno registered
[    0.550000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.560000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.560000] NET: Registered protocol family 1
[    2.980000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.990000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    3.000000] msgmni has been set to 118
[    3.000000] io scheduler noop registered
[    3.010000] io scheduler deadline registered (default)
[    3.010000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    3.020000] ar933x-uart: ttyATH0 at MMIO 0x18020000 (irq = 11) is a AR933X UART
[    3.020000] console [ttyATH0] enabled, bootconsole disabled
[    3.020000] console [ttyATH0] enabled, bootconsole disabled
[    3.040000] m25p80 spi0.0: found mx25l6405d, expected m25p80
[    3.040000] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    3.050000] 8 cmdlinepart partitions found on MTD device spi0.0
[    3.050000] Creating 8 MTD partitions on "spi0.0":
[    3.060000] 0x000000000000-0x000000010000 : "u-boot"
[    3.070000] 0x000000010000-0x000000020000 : "art"
[    3.070000] 0x000000020000-0x000000030000 : "mac"
[    3.080000] 0x000000030000-0x000000040000 : "nvram"
[    3.080000] 0x000000040000-0x000000070000 : "language"
[    3.090000] 0x000000070000-0x000000150000 : "kernel"
[    3.090000] 0x000000150000-0x000000400000 : "rootfs"
[    3.100000] mtd: partition "rootfs" set to be root filesystem
[    3.100000] split_squashfs: no squashfs found in "spi0.0"
[    3.110000] 0x000000070000-0x000000400000 : "firmware"
[    3.130000] ag71xx_mdio: probed
[    3.140000] eth0: Atheros AG71xx at 0xba000000, irq 5
[    3.690000] eth0: Found an AR7240/AR9330 built-in switch
[    4.720000] eth1: Atheros AG71xx at 0xb9000000, irq 4
[    5.270000] ag71xx ag71xx.0: eth1: connected to PHY at ag71xx-mdio.1:04 [uid=004dd041, driver=Generic PHY]
[    5.280000] TCP cubic registered
[    5.280000] NET: Registered protocol family 17
[    5.290000] 8021q: 802.1Q VLAN Support v1.8
[    5.300000] Freeing unused kernel memory: 1428k freed
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
- init -
[   10.480000] Compat-wireless backport release: compat-wireless-2012-07-13
[   10.480000] Backport based on wireless-testing.git master-2012-07-16
[   10.490000] compat.git: wireless-testing.git
[   10.510000] cfg80211: Calling CRDA to update world regulatory domain
[   10.520000] cfg80211: World regulatory domain updated:
[   10.520000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[   10.530000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   10.540000] cfg80211:   (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[   10.550000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[   10.550000] cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   10.560000] cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   10.720000] ieee80211 phy0: Atheros AR9330 Rev:1 mem=0xb8100000, irq=2
[   10.730000] cfg80211: Calling CRDA for country: US
[   10.730000] cfg80211: Regulatory domain changed to country: US
[   10.740000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[   10.750000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2700 mBm)
[   10.750000] cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 1700 mBm)
[   10.760000] cfg80211:   (5250000 KHz - 5330000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   10.770000] cfg80211:   (5490000 KHz - 5600000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   10.780000] cfg80211:   (5650000 KHz - 5710000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   10.780000] cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 3000 mBm)
[   10.850000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   10.960000] nf_conntrack version 0.5.0 (968 buckets, 3872 max)

Please press Enter to activate this console. [   15.360000] device eth0 entered promiscuous mode
[   18.270000] eth1: link up (100Mbps/Full duplex)



BusyBox v1.19.4 (2012-09-11 15:12:07 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 ATTITUDE ADJUSTMENT (Bleeding Edge, r33329)
 -----------------------------------------------------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------
root@OpenWrt:/#

with tftpbooted tew-712br image, ethernet and wifi works (just tested ap mode)

Unfortunately no u-boot env partition and no saveenv command in u-boot.
So only flashing is left as an option; now that i got right partition layout, i'll give it a try next week...

Still some bits of information:

* gpio 26 (active low) and 27 controls red and green leds, respectively.
* got correct mtd partion layout (see hunk below in target/linux/ar71xx/image/Makefile), i.e. ramdisk tftpbooted image shows no errors and a layout matching the one of original firmware.

Didn't dare to flash, usb isn't recognized at all; more inspecting work next week...

An initial patch, though it adds nothing to what tew-712br board initialization does, just to have an own profile to fiddle with (but al teast mtd layout should be correct...):

diff --git a/target/linux/ar71xx/base-files/etc/diag.sh b/target/linux/ar71xx/base-files/etc/diag.sh
index 420d690..a9120dd 100755
--- a/target/linux/ar71xx/base-files/etc/diag.sh
+++ b/target/linux/ar71xx/base-files/etc/diag.sh
@@ -57,6 +57,7 @@ get_status_led() {
        db120)
                status_led="db120:green:status"
                ;;
+       dir-505-a1 |\
        dir-600-a1 |\
        dir-615-e4)
                status_led="d-link:green:power"
diff --git a/target/linux/ar71xx/base-files/etc/uci-defaults/network b/target/linux/ar71xx/base-files/etc/uci-defaults/network
index 3f87950..0de3c7d 100755
--- a/target/linux/ar71xx/base-files/etc/uci-defaults/network
+++ b/target/linux/ar71xx/base-files/etc/uci-defaults/network
@@ -185,6 +185,10 @@ wzr-hp-ag300h)
        ucidef_add_switch_vlan "eth0" "1" "0 1 2 3 4"
        ;;

+dir-505-a1)
+       ucidef_set_interfaces_lan_wan "wlan0" "eth0"
+       ;;
+
 wzr-hp-g450h)
        ucidef_set_interfaces_lan_wan "eth0.1" "eth0.2"
        ucidef_add_switch "eth0" "1" "1"
diff --git a/target/linux/ar71xx/base-files/lib/ar71xx.sh b/target/linux/ar71xx/base-files/lib/ar71xx.sh
index 032988e..5f2b019 100755
--- a/target/linux/ar71xx/base-files/lib/ar71xx.sh
+++ b/target/linux/ar71xx/base-files/lib/ar71xx.sh
@@ -312,6 +312,9 @@ ar71xx_board_detect() {
        *TEW-712BR)
                name="tew-712br"
                ;;
+       *DIR-505-A1)
+               name="dir-505-a1"
+               ;;
        *"TL-WR1041N v2")
                name="tl-wr1041n-v2"
                ;;
diff --git a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
index 02e3916..670790d 100755
--- a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
@@ -97,6 +97,7 @@ platform_check_image() {
                ;;
        ap81 | \
        ap83 | \
+       dir-505-a1 | \
        dir-600-a1 | \
        dir-615-c1 | \
        dir-615-e4 | \
diff --git a/target/linux/ar71xx/config-3.3 b/target/linux/ar71xx/config-3.3
index db53c2b..1762e0a 100644
--- a/target/linux/ar71xx/config-3.3
+++ b/target/linux/ar71xx/config-3.3
@@ -31,6 +31,7 @@ CONFIG_ATH79_MACH_AP83=y
 CONFIG_ATH79_MACH_AP96=y
 CONFIG_ATH79_MACH_AW_NR580=y
 CONFIG_ATH79_MACH_DB120=y
+CONFIG_ATH79_MACH_DIR_505_A1=y
 CONFIG_ATH79_MACH_DIR_600_A1=y
 CONFIG_ATH79_MACH_DIR_615_C1=y
 CONFIG_ATH79_MACH_DIR_825_B1=y
diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-dir-505-a1.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-dir-505-a1.c
new file mode 100644
index 0000000..727faf6
--- /dev/null
+++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-dir-505-a1.c
@@ -0,0 +1,123 @@
+/*
+ *  TRENDnet TEW-712BR board support
+ *
+ *  Copyright (C) 2012 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/gpio.h>
+
+#include <asm/mach-ath79/ath79.h>
+#include <asm/mach-ath79/ar71xx_regs.h>
+
+#include "common.h"
+#include "dev-eth.h"
+#include "dev-gpio-buttons.h"
+#include "dev-leds-gpio.h"
+#include "dev-m25p80.h"
+#include "dev-wmac.h"
+#include "machtypes.h"
+
+#define DIR_505A1_GPIO_BTN_WPS         11 /* verify */
+#define DIR_505A1_GPIO_BTN_RESET       12 /* verify */
+
+#define DIR_505A1_GPIO_LED_RED         26 /* unused, fyi */
+#define DIR_505A1_GPIO_LED_GREEN       27
+
+#define DIR_505A1_GPIO_WAN_LED_ENABLE  1
+
+#define DIR_505A1_KEYS_POLL_INTERVAL   20      /* msecs */
+#define DIR_505A1_KEYS_DEBOUNCE_INTERVAL (3 * DIR_505A1_KEYS_POLL_INTERVAL)
+
+#define DIR_505A1_ART_ADDRESS          0x1f010000
+#define DIR_505A1_CALDATA_OFFSET       0x1000
+#define DIR_505A1_LAN_MAC_ADDRESS      0x1f020004
+#define DIR_505A1_WAN_MAC_ADDRESS      0x1f020016
+
+static struct gpio_led dir_505_a1_leds_gpio[] __initdata = {
+       {
+               .name           = "d-link:green:power",
+               .gpio           = DIR_505A1_GPIO_LED_GREEN,
+               .active_low     = 0,
+       }, {
+               .name           = "d-link:red:status",
+               .gpio           = DIR_505A1_GPIO_LED_RED,
+               .active_low     = 1,
+       },
+};
+
+static struct gpio_keys_button dir_505_a1_gpio_keys[] __initdata = {
+       {
+               .desc           = "Reset button",
+               .type           = EV_KEY,
+               .code           = KEY_RESTART,
+               .debounce_interval = DIR_505A1_KEYS_DEBOUNCE_INTERVAL,
+               .gpio           = DIR_505A1_GPIO_BTN_RESET,
+               .active_low     = 1,
+       }, {
+               .desc           = "WPS button",
+               .type           = EV_KEY,
+               .code           = KEY_WPS_BUTTON,
+               .debounce_interval = DIR_505A1_KEYS_DEBOUNCE_INTERVAL,
+               .gpio           = DIR_505A1_GPIO_BTN_WPS,
+               .active_low     = 1,
+       }
+};
+
+static void __init dir_505_a1_read_ascii_mac(u8 *dest, unsigned int src_addr)
+{
+       int ret;
+       u8 *src = (u8 *)KSEG1ADDR(src_addr);
+
+       ret = sscanf(src, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
+                    &dest[0], &dest[1], &dest[2],
+                    &dest[3], &dest[4], &dest[5]);
+
+       if (ret != ETH_ALEN)
+               memset(dest, 0, ETH_ALEN);
+}
+
+static void __init dir_505_a1_setup(void)
+{
+       u8 *art = (u8 *) KSEG1ADDR(DIR_505A1_ART_ADDRESS);
+       u8 lan_mac[ETH_ALEN];
+       u8 wan_mac[ETH_ALEN];
+
+       ath79_setup_ar933x_phy4_switch(false, false);
+
+       ath79_gpio_function_disable(AR933X_GPIO_FUNC_ETH_SWITCH_LED0_EN |
+                                   AR933X_GPIO_FUNC_ETH_SWITCH_LED1_EN |
+                                   AR933X_GPIO_FUNC_ETH_SWITCH_LED2_EN |
+                                   AR933X_GPIO_FUNC_ETH_SWITCH_LED3_EN |
+                                   AR933X_GPIO_FUNC_ETH_SWITCH_LED4_EN);
+
+       gpio_request_one(DIR_505A1_GPIO_WAN_LED_ENABLE,
+                        GPIOF_OUT_INIT_LOW, "WAN LED enable");
+
+       ath79_register_leds_gpio(-1, ARRAY_SIZE(dir_505_a1_leds_gpio),
+                                dir_505_a1_leds_gpio);
+
+       ath79_register_gpio_keys_polled(1, DIR_505A1_KEYS_POLL_INTERVAL,
+                                       ARRAY_SIZE(dir_505_a1_gpio_keys),
+                                       dir_505_a1_gpio_keys);
+
+       ath79_register_m25p80(NULL);
+
+       dir_505_a1_read_ascii_mac(lan_mac, DIR_505A1_LAN_MAC_ADDRESS);
+       dir_505_a1_read_ascii_mac(wan_mac, DIR_505A1_WAN_MAC_ADDRESS);
+
+       ath79_init_mac(ath79_eth0_data.mac_addr, wan_mac, 0);
+       ath79_init_mac(ath79_eth1_data.mac_addr, lan_mac, 0);
+
+       ath79_register_mdio(0, 0x0);
+       ath79_register_eth(1);
+       ath79_register_eth(0);
+
+       ath79_register_wmac(art + DIR_505A1_CALDATA_OFFSET, lan_mac);
+}
+
+MIPS_MACHINE(ATH79_MACH_DIR_505_A1, "DIR-505-A1",
+            "D-Link DIR-505 A1", dir_505_a1_setup);
diff --git a/target/linux/ar71xx/generic/profiles/d-link.mk b/target/linux/ar71xx/generic/profiles/d-link.mk
index 98fe00f..fa370ad 100644
--- a/target/linux/ar71xx/generic/profiles/d-link.mk
+++ b/target/linux/ar71xx/generic/profiles/d-link.mk
@@ -5,6 +5,17 @@
 # See /LICENSE for more information.
 #

+define Profile/DIR505A1
+       NAME:=D-Link DIR-505 rev. A1
+       PACKAGES:=
+endef
+
+define Profile/DIR505A1/Description
+       Package set optimized for the D-Link DIR-505 rev. A1.
+endef
+
+$(eval $(call Profile,DIR505A1))
+
 define Profile/DIR600A1
        NAME:=D-Link DIR-600 rev. A1
        PACKAGES:=
diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
index 9e038b6..797d606 100644
--- a/target/linux/ar71xx/image/Makefile
+++ b/target/linux/ar71xx/image/Makefile
@@ -168,6 +168,7 @@ ap121_mtdlayout_4M=mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,2752k(rootfs
 ap136_mtdlayout=mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,6336k(rootfs),1408k(kernel),64k(mib0),64k(art)ro,7744k@0x50000(firmware)
 cameo7240_mtdlayout=mtdparts=spi0.0:192k(u-boot)ro,64k(nvram)ro,960k(kernel),2752k(rootfs),64k(mac)ro,64k(art)ro,3712k@0x40000(firmware)
 cameo913x_mtdlayout=mtdparts=spi0.0:128k(u-boot)ro,64k(config)ro,960k(kernel),2880k(rootfs),64k(art)ro,3840k@0x30000(firmware)
+cameo9330_mtdlayout=mtdparts=spi0.0:64k(u-boot)ro,64k(art)ro,64k(mac)ro,64k(nvram)ro,256k(language)ro,1024k(kernel),6656k(rootfs),7680k@0x80000(firmware)
 cameo933x_mtdlayout=mtdparts=spi0.0:64k(u-boot)ro,64k(art)ro,64k(mac)ro,64k(nvram)ro,192k(language)ro,896k(kernel),2752k(rootfs),3648k@0x70000(firmware)
 db120_mtdlayout=mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,6336k(rootfs),1408k(kernel),64k(nvram),64k(art)ro,7744k@0x50000(firmware)
 dir825b1_mtdlayout=mtdparts=spi0.0:256k(uboot)ro,64k(config)ro,1024k(kernel),5184k(rootfs),64k(caldata)ro,1600k(unknown)ro,6208k@0x50000(firmware)
@@ -298,6 +299,14 @@ define Image/Build/Cameo7240/initramfs
        $(call MkuImageLzma/initramfs,$(2),$(3) $(cameo7240_mtdlayout))
 endef

+define Image/Build/Cameo9330
+    $(call Image/Build/CameoHornet,$(1),$(2),$(3),$(cameo9330_mtdlayout),1048576,6422528,$(4))
+endef
+
+define Image/Build/Cameo9330/initramfs
+    $(call MkuImageLzma/initramfs,$(2),$(3) $(cameo9330_mtdlayout))
+endef
+
 define Image/Build/Cameo933x
        $(call Image/Build/CameoHornet,$(1),$(2),$(3),$(cameo933x_mtdlayout),917504,2818048,$(4))
 endef
@@ -752,6 +761,8 @@ $(eval $(call SingleProfile,Cameo913x,$(fs_squash),TEW632BRP,tew-632brp,TEW-632B
 $(eval $(call SingleProfile,Cameo913x,$(fs_squash),TEW652BRP_FW,tew-652brp,TEW-632BRP,ttyS0,115200,"AP81-AR9130-RT-080609-05"))
 $(eval $(call SingleProfile,Cameo913x,$(fs_squash),TEW652BRP_RECOVERY,tew-652brp-recovery,TEW-632BRP,ttyS0,115200,"AP81-AR9130-RT-070614-02"))

+$(eval $(call SingleProfile,Cameo9330,$(fs_squash),DIR505A1,dir-505-a1,DIR-505-A1,ttyATH0,115200,"HORNET-RT-DIR505A1-3"))
+
 $(eval $(call SingleProfile,Cameo933x,$(fs_squash),TEW712BR,tew-712br,TEW-712BR,ttyATH0,115200,"HORNET-RT-TEW712BR-3"))

 $(eval $(call SingleProfile,CyberTAN,$(fs_64k),WRT160NL,wrt160nl,WRT160NL,ttyS0,115200,1.00.01))
diff --git a/target/linux/ar71xx/patches-3.3/613-MIPS-ath79-dir505a1-support.patch b/target/linux/ar71xx/patches-3.3/613-MIPS-ath79-dir505a1-support.patch
new file mode 100644
index 0000000..fc04901
--- /dev/null
+++ b/target/linux/ar71xx/patches-3.3/613-MIPS-ath79-dir505a1-support.patch
@@ -0,0 +1,39 @@
+--- a/arch/mips/ath79/Kconfig  2012-09-11 14:02:41.543926000 +0200
++++ b/arch/mips/ath79/Kconfig  2012-09-13 08:58:04.598633000 +0200
+@@ -568,6 +568,16 @@
+       select ATH79_DEV_WMAC
+       select ATH79_NVRAM
+
++config ATH79_MACH_DIR_505_A1
++      bool "D-Link DIR-505-A1 support"
++      select SOC_AR933X
++      select ATH79_DEV_ETH
++      select ATH79_DEV_GPIO_BUTTONS
++      select ATH79_DEV_LEDS_GPIO
++      select ATH79_DEV_M25P80
++      select ATH79_DEV_WMAC
++      select ATH79_NVRAM
++
+ config ATH79_MACH_UBNT
+       bool "Ubiquiti AR71xx based boards support"
+       select SOC_AR71XX
+--- a/arch/mips/ath79/Makefile 2012-09-11 14:02:41.543926000 +0200
++++ b/arch/mips/ath79/Makefile 2012-09-13 08:59:03.207080000 +0200
+@@ -48,6 +48,7 @@
+ obj-$(CONFIG_ATH79_MACH_AP96)         += mach-ap96.o
+ obj-$(CONFIG_ATH79_MACH_AW_NR580)     += mach-aw-nr580.o
+ obj-$(CONFIG_ATH79_MACH_DB120)                += mach-db120.o
++obj-$(CONFIG_ATH79_MACH_DIR_505_A1) += mach-dir-505-a1.o
+ obj-$(CONFIG_ATH79_MACH_DIR_600_A1)   += mach-dir-600-a1.o
+ obj-$(CONFIG_ATH79_MACH_DIR_615_C1)   += mach-dir-615-c1.o
+ obj-$(CONFIG_ATH79_MACH_DIR_825_B1)   += mach-dir-825-b1.o
+--- a/arch/mips/ath79/machtypes.h      2012-09-13 09:23:10.326705000 +0200
++++ b/arch/mips/ath79/machtypes.h      2012-09-13 10:29:32.844235000 +0200
+@@ -31,6 +31,7 @@
+       ATH79_MACH_AW_NR580,            /* AzureWave AW-NR580 */
+       ATH79_MACH_DB120,               /* Atheros DB120 reference board */
+       ATH79_MACH_PB44,                /* Atheros PB44 reference board */
++      ATH79_MACH_DIR_505_A1,          /* D-Link DIR-505 rev. A1 */
+       ATH79_MACH_DIR_600_A1,          /* D-Link DIR-600 rev. A1 */
+       ATH79_MACH_DIR_615_C1,          /* D-Link DIR-615 rev. C1 */
+       ATH79_MACH_DIR_615_E4,          /* D-Link DIR-615 rev. E4 */

Flashed, usb working (uvc webcam ok) big_smile

for usb working i missed completely usb init in board setup. Leds, WDS and reset gpio numbers verified
Updated diff:

diff --git a/target/linux/ar71xx/base-files/etc/diag.sh b/target/linux/ar71xx/base-files/etc/diag.sh
index 420d690..a9120dd 100755
--- a/target/linux/ar71xx/base-files/etc/diag.sh
+++ b/target/linux/ar71xx/base-files/etc/diag.sh
@@ -57,6 +57,7 @@ get_status_led() {
        db120)
                status_led="db120:green:status"
                ;;
+       dir-505-a1 |\
        dir-600-a1 |\
        dir-615-e4)
                status_led="d-link:green:power"
diff --git a/target/linux/ar71xx/base-files/etc/uci-defaults/network b/target/linux/ar71xx/base-files/etc/uci-defaults/network
index 0de3c7d..0120b56 100755
--- a/target/linux/ar71xx/base-files/etc/uci-defaults/network
+++ b/target/linux/ar71xx/base-files/etc/uci-defaults/network
@@ -136,6 +136,7 @@ wzr-hp-g300nh)
 all0305 |\
 aw-nr580 |\
 bullet-m |\
+dir-505-a1 |\
 eap7660d |\
 ew-dorin |\
 rb-411 |\
diff --git a/target/linux/ar71xx/base-files/lib/ar71xx.sh b/target/linux/ar71xx/base-files/lib/ar71xx.sh
index 032988e..5f2b019 100755
--- a/target/linux/ar71xx/base-files/lib/ar71xx.sh
+++ b/target/linux/ar71xx/base-files/lib/ar71xx.sh
@@ -312,6 +312,9 @@ ar71xx_board_detect() {
        *TEW-712BR)
                name="tew-712br"
                ;;
+       *DIR-505-A1)
+               name="dir-505-a1"
+               ;;
        *"TL-WR1041N v2")
                name="tl-wr1041n-v2"
                ;;
diff --git a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
index 02e3916..670790d 100755
--- a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
@@ -97,6 +97,7 @@ platform_check_image() {
                ;;
        ap81 | \
        ap83 | \
+       dir-505-a1 | \
        dir-600-a1 | \
        dir-615-c1 | \
        dir-615-e4 | \
diff --git a/target/linux/ar71xx/config-3.3 b/target/linux/ar71xx/config-3.3
index db53c2b..1762e0a 100644
--- a/target/linux/ar71xx/config-3.3
+++ b/target/linux/ar71xx/config-3.3
@@ -31,6 +31,7 @@ CONFIG_ATH79_MACH_AP83=y
 CONFIG_ATH79_MACH_AP96=y
 CONFIG_ATH79_MACH_AW_NR580=y
 CONFIG_ATH79_MACH_DB120=y
+CONFIG_ATH79_MACH_DIR_505_A1=y
 CONFIG_ATH79_MACH_DIR_600_A1=y
 CONFIG_ATH79_MACH_DIR_615_C1=y
 CONFIG_ATH79_MACH_DIR_825_B1=y
diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-dir-505-a1.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-dir-505-a1.c
new file mode 100644
index 0000000..792049f
--- /dev/null
+++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-dir-505-a1.c
@@ -0,0 +1,112 @@
+/*
+ *  TRENDnet TEW-712BR board support
+ *
+ *  Copyright (C) 2012 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/gpio.h>
+
+#include <asm/mach-ath79/ath79.h>
+#include <asm/mach-ath79/ar71xx_regs.h>
+
+#include "common.h"
+#include "dev-eth.h"
+#include "dev-usb.h"
+#include "dev-gpio-buttons.h"
+#include "dev-leds-gpio.h"
+#include "dev-m25p80.h"
+#include "dev-wmac.h"
+#include "machtypes.h"
+
+#define DIR_505A1_GPIO_BTN_WPS         11
+#define DIR_505A1_GPIO_BTN_RESET       12
+
+#define DIR_505A1_GPIO_LED_RED         26 /* unused, fyi */
+#define DIR_505A1_GPIO_LED_GREEN       27
+
+#define DIR_505A1_GPIO_WAN_LED_ENABLE  1
+
+#define DIR_505A1_KEYS_POLL_INTERVAL   20      /* msecs */
+#define DIR_505A1_KEYS_DEBOUNCE_INTERVAL (3 * DIR_505A1_KEYS_POLL_INTERVAL)
+
+#define DIR_505A1_ART_ADDRESS          0x1f010000
+#define DIR_505A1_CALDATA_OFFSET       0x1000
+#define DIR_505A1_LAN_MAC_ADDRESS      0x1f020004 /* wan (real eth) */
+
+static struct gpio_led dir_505_a1_leds_gpio[] __initdata = {
+       {
+               .name           = "d-link:green:power",
+               .gpio           = DIR_505A1_GPIO_LED_GREEN,
+               .active_low     = 0,
+       }, {
+               .name           = "d-link:red:status",
+               .gpio           = DIR_505A1_GPIO_LED_RED,
+               .active_low     = 1,
+       },
+};
+
+static struct gpio_keys_button dir_505_a1_gpio_keys[] __initdata = {
+       {
+               .desc           = "Reset button",
+               .type           = EV_KEY,
+               .code           = KEY_RESTART,
+               .debounce_interval = DIR_505A1_KEYS_DEBOUNCE_INTERVAL,
+               .gpio           = DIR_505A1_GPIO_BTN_RESET,
+               .active_low     = 1,
+       }, {
+               .desc           = "WPS button",
+               .type           = EV_KEY,
+               .code           = KEY_WPS_BUTTON,
+               .debounce_interval = DIR_505A1_KEYS_DEBOUNCE_INTERVAL,
+               .gpio           = DIR_505A1_GPIO_BTN_WPS,
+               .active_low     = 0,
+       }
+};
+
+static void __init dir_505_a1_read_ascii_mac(u8 *dest, unsigned int src_addr)
+{
+       int ret;
+       u8 *src = (u8 *)KSEG1ADDR(src_addr);
+
+       ret = sscanf(src, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
+                    &dest[0], &dest[1], &dest[2],
+                    &dest[3], &dest[4], &dest[5]);
+
+       if (ret != ETH_ALEN)
+               memset(dest, 0, ETH_ALEN);
+}
+
+static void __init dir_505_a1_setup(void)
+{
+       u8 *art = (u8 *) KSEG1ADDR(DIR_505A1_ART_ADDRESS);
+       u8 lan_mac[ETH_ALEN];
+
+       ath79_setup_ar933x_phy4_switch(false, false);
+
+       ath79_register_leds_gpio(-1, ARRAY_SIZE(dir_505_a1_leds_gpio),
+                                dir_505_a1_leds_gpio);
+
+       ath79_register_gpio_keys_polled(1, DIR_505A1_KEYS_POLL_INTERVAL,
+                                       ARRAY_SIZE(dir_505_a1_gpio_keys),
+                                       dir_505_a1_gpio_keys);
+
+       ath79_register_m25p80(NULL);
+
+       ath79_register_usb();
+
+       dir_505_a1_read_ascii_mac(lan_mac, DIR_505A1_LAN_MAC_ADDRESS);
+
+       ath79_init_mac(ath79_eth0_data.mac_addr, lan_mac, 0);
+
+       ath79_register_mdio(0, 0x0);
+       ath79_register_eth(0);
+
+       ath79_register_wmac(art + DIR_505A1_CALDATA_OFFSET, lan_mac);
+}
+
+MIPS_MACHINE(ATH79_MACH_DIR_505_A1, "DIR-505-A1",
+            "D-Link DIR-505 A1", dir_505_a1_setup);
diff --git a/target/linux/ar71xx/generic/profiles/d-link.mk b/target/linux/ar71xx/generic/profiles/d-link.mk
index 98fe00f..fa370ad 100644
--- a/target/linux/ar71xx/generic/profiles/d-link.mk
+++ b/target/linux/ar71xx/generic/profiles/d-link.mk
@@ -5,6 +5,17 @@
 # See /LICENSE for more information.
 #

+define Profile/DIR505A1
+       NAME:=D-Link DIR-505 rev. A1
+       PACKAGES:=
+endef
+
+define Profile/DIR505A1/Description
+       Package set optimized for the D-Link DIR-505 rev. A1.
+endef
+
+$(eval $(call Profile,DIR505A1))
+
 define Profile/DIR600A1
        NAME:=D-Link DIR-600 rev. A1
        PACKAGES:=
diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
index 9e038b6..797d606 100644
--- a/target/linux/ar71xx/image/Makefile
+++ b/target/linux/ar71xx/image/Makefile
@@ -168,6 +168,7 @@ ap121_mtdlayout_4M=mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,2752k(rootfs
 ap136_mtdlayout=mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,6336k(rootfs),1408k(kernel),64k(mib0),64k(art)ro,7744k@0x50000(firmware)
 cameo7240_mtdlayout=mtdparts=spi0.0:192k(u-boot)ro,64k(nvram)ro,960k(kernel),2752k(rootfs),64k(mac)ro,64k(art)ro,3712k@0x40000(firmware)
 cameo913x_mtdlayout=mtdparts=spi0.0:128k(u-boot)ro,64k(config)ro,960k(kernel),2880k(rootfs),64k(art)ro,3840k@0x30000(firmware)
+cameo9330_mtdlayout=mtdparts=spi0.0:64k(u-boot)ro,64k(art)ro,64k(mac)ro,64k(nvram)ro,256k(language)ro,1024k(kernel),6656k(rootfs),7680k@0x80000(firmware)
 cameo933x_mtdlayout=mtdparts=spi0.0:64k(u-boot)ro,64k(art)ro,64k(mac)ro,64k(nvram)ro,192k(language)ro,896k(kernel),2752k(rootfs),3648k@0x70000(firmware)
 db120_mtdlayout=mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,6336k(rootfs),1408k(kernel),64k(nvram),64k(art)ro,7744k@0x50000(firmware)
 dir825b1_mtdlayout=mtdparts=spi0.0:256k(uboot)ro,64k(config)ro,1024k(kernel),5184k(rootfs),64k(caldata)ro,1600k(unknown)ro,6208k@0x50000(firmware)
@@ -298,6 +299,14 @@ define Image/Build/Cameo7240/initramfs
        $(call MkuImageLzma/initramfs,$(2),$(3) $(cameo7240_mtdlayout))
 endef

+define Image/Build/Cameo9330
+    $(call Image/Build/CameoHornet,$(1),$(2),$(3),$(cameo9330_mtdlayout),1048576,6422528,$(4))
+endef
+
+define Image/Build/Cameo9330/initramfs
+    $(call MkuImageLzma/initramfs,$(2),$(3) $(cameo9330_mtdlayout))
+endef
+
 define Image/Build/Cameo933x
        $(call Image/Build/CameoHornet,$(1),$(2),$(3),$(cameo933x_mtdlayout),917504,2818048,$(4))
 endef
@@ -752,6 +761,8 @@ $(eval $(call SingleProfile,Cameo913x,$(fs_squash),TEW632BRP,tew-632brp,TEW-632B
 $(eval $(call SingleProfile,Cameo913x,$(fs_squash),TEW652BRP_FW,tew-652brp,TEW-632BRP,ttyS0,115200,"AP81-AR9130-RT-080609-05"))
 $(eval $(call SingleProfile,Cameo913x,$(fs_squash),TEW652BRP_RECOVERY,tew-652brp-recovery,TEW-632BRP,ttyS0,115200,"AP81-AR9130-RT-070614-02"))

+$(eval $(call SingleProfile,Cameo9330,$(fs_squash),DIR505A1,dir-505-a1,DIR-505-A1,ttyATH0,115200,"HORNET-RT-DIR505A1-3"))
+
 $(eval $(call SingleProfile,Cameo933x,$(fs_squash),TEW712BR,tew-712br,TEW-712BR,ttyATH0,115200,"HORNET-RT-TEW712BR-3"))

 $(eval $(call SingleProfile,CyberTAN,$(fs_64k),WRT160NL,wrt160nl,WRT160NL,ttyS0,115200,1.00.01))
diff --git a/target/linux/ar71xx/patches-3.3/613-MIPS-ath79-dir505a1-support.patch b/target/linux/ar71xx/patches-3.3/613-MIPS-ath79-dir505a1-support.patch
new file mode 100644
index 0000000..fc04901
--- /dev/null
+++ b/target/linux/ar71xx/patches-3.3/613-MIPS-ath79-dir505a1-support.patch
@@ -0,0 +1,39 @@
+--- a/arch/mips/ath79/Kconfig  2012-09-11 14:02:41.543926000 +0200
++++ b/arch/mips/ath79/Kconfig  2012-09-13 08:58:04.598633000 +0200
+@@ -568,6 +568,16 @@
+       select ATH79_DEV_WMAC
+       select ATH79_NVRAM
+
++config ATH79_MACH_DIR_505_A1
++      bool "D-Link DIR-505-A1 support"
++      select SOC_AR933X
++      select ATH79_DEV_ETH
++      select ATH79_DEV_GPIO_BUTTONS
++      select ATH79_DEV_LEDS_GPIO
++      select ATH79_DEV_M25P80
++      select ATH79_DEV_WMAC
++      select ATH79_NVRAM
++
+ config ATH79_MACH_UBNT
+       bool "Ubiquiti AR71xx based boards support"
+       select SOC_AR71XX
+--- a/arch/mips/ath79/Makefile 2012-09-11 14:02:41.543926000 +0200
++++ b/arch/mips/ath79/Makefile 2012-09-13 08:59:03.207080000 +0200
+@@ -48,6 +48,7 @@
+ obj-$(CONFIG_ATH79_MACH_AP96)         += mach-ap96.o
+ obj-$(CONFIG_ATH79_MACH_AW_NR580)     += mach-aw-nr580.o
+ obj-$(CONFIG_ATH79_MACH_DB120)                += mach-db120.o
++obj-$(CONFIG_ATH79_MACH_DIR_505_A1) += mach-dir-505-a1.o
+ obj-$(CONFIG_ATH79_MACH_DIR_600_A1)   += mach-dir-600-a1.o
+ obj-$(CONFIG_ATH79_MACH_DIR_615_C1)   += mach-dir-615-c1.o
+ obj-$(CONFIG_ATH79_MACH_DIR_825_B1)   += mach-dir-825-b1.o
+--- a/arch/mips/ath79/machtypes.h      2012-09-13 09:23:10.326705000 +0200
++++ b/arch/mips/ath79/machtypes.h      2012-09-13 10:29:32.844235000 +0200
+@@ -31,6 +31,7 @@
+       ATH79_MACH_AW_NR580,            /* AzureWave AW-NR580 */
+       ATH79_MACH_DB120,               /* Atheros DB120 reference board */
+       ATH79_MACH_PB44,                /* Atheros PB44 reference board */
++      ATH79_MACH_DIR_505_A1,          /* D-Link DIR-505 rev. A1 */
+       ATH79_MACH_DIR_600_A1,          /* D-Link DIR-600 rev. A1 */
+       ATH79_MACH_DIR_615_C1,          /* D-Link DIR-615 rev. C1 */
+       ATH79_MACH_DIR_615_E4,          /* D-Link DIR-615 rev. E4 */

Great news, got gpl pack from d-link, it includes u-boot src code!! \\o o//

Trying now to compile with net console activated, as serial console hookup with this device is a pain in the back...

Sounds great rAndy, let me know if I should test  something.

brt wrote:

Sounds great rAndy, let me know if I should test  something.

How would you do it? Did you identify JTAG pins on the board? smile

are there some news about the testing?
Is the porting avable?

My company asked me to develop a solution based on this. I'll post what progress I make.

Openwrt works on this device and seems stable; i tested router mode and failsafe (read my previous posts)

* put together the two patches i posted (here the whole diff for completeness http://pastie.org/5336238 )
* apply this patch to trunk@33493 , tftp boot it

If you want to flash the device the simplest thing is to wget squashfs image (build it again with this target) to /tmp on the device after booting via tftp an then mtd write it (so i did)

rAndy wrote:

Great news, got gpl pack from d-link, it includes u-boot src code!! \\o o//

Trying now to compile with net console activated, as serial console hookup with this device is a pain in the back...

hi smile

where did u get the source  ? tongue  D-Link TSD server in Taiwan?

Dlink server in Taiwan is unresponsive. Drop a mail to support, they'll put the tarball on another server.

Did somebody apply the patch to trunk yet?
Is there a nightly build already?

I didn't submit a patch, as building an image flashable throu web interface of original firmware is still missing...

If someone wants to try it, only way now is hook up serial interface, tftp image built with my patch (ramfs target), build image again with squashfs target, flash it with mtd utility

I'm right busy with porting of another board...

I was able to use imghdr from the GPL package to change the header of a custom firmware, and upload the custom firmware into the default web interface. I bricked it, but that's okay, it shows that it's possible.

I've also gotten the gpl to compile properly. Had to disable ppp in the makefile, but it's good to go. Might just add telnetd to that or something and upload that.

If anyone wants to meet on irc and work on this, i'm currently spending all my time on this.

Alright, I've flashed nearly 20 of these so far. 

I started to spend time figuring out what the custom firmware wanted as a header, but in the end it turned out to be eaiser to just solder-tack thin wires to the serial pads. I can flash one of these babies faster via serial port than it takes the default firmware to boot.

I did it with the 3V serial cable from sparkfun, all you have to do is:

solder-tack the cable's transmit line (orange) to the TP13 (see the picture above)

and the cable's recieve line (yellow) to TP12.

Hook ground from the cable (brown) to the RF shield can. Use a small allegator clip for the ground.

To get Openwrt on this, get a computer on your network with a tftp server, give it the address of 192.168.0.100, and place a custom compiled DIR-505 initramfs image, and a sysupgrade image in a tftp server.

(You'll need to compile openwrt twice, once to specify for the initramfs and then again for squashfs)

When you boot up the 505, hit any key right after u-boot startup, and issue the commands:

tftpboot 81000000 openwrt-ar71xx-generic-dir-505-a1-initramfs-uImage.bin
bootm 0x81000000

This loads up the initramfs image into memory, and then tells the cpu to boot from that memory location. Let it boot up, and then hit a key to start the console.

From there, just set up your network, (ifconfig eth0 192.168.xx.xx and route add default gw 192.168.xx.xx), wget the squashfs-factory.bin file you made earlier, and then do a sysupgrade. I made a custom filesystem for each box, and use the command sysupgrade to install that alone with the image, but you can just do a straight sysupgrade, or just mtd the flash.

Sysupgrade example:

sysupgrade -F -v [url]http://192.168.2.106/flash/openwrt-ar71xx-generic-dir-505-a1-squashfs-sysupgrade.bin[/url]

(it'll complain with an error about not checking format, but it's okay)

mtd example:

mtd write -r openwrt-ar71xx-generic-dir-505-a1-squashfs-factory.bin /dev/mtd7

I've got a couple other notes that might help get an image that the factory image will load..next post..

According to the gpl code from dlink I compiled, it looks like the header for the squashfs needs to be HORNET-PACKET-DIR505A1-3. That's different from the TP-Link device.

You can also see that in the make_header.sh file. It's specifically calling imghdr with that value.

Additional notes about the box:

It runs on 3V DC, between 70 to 250mA, meaning you can run it off a couple AA batteries. The small 2-pin black header is ground, and on the other end, the 4-pin black header provides ground on either end, and VCC of 3v on one of the middle pins.

-Dan N7NMD

Thanks for the information.
So flashing via web interface is not yet possible?

I just ordered one from Conrad.de for 24,95€ shipped. Great value with twice the memory and RAM compared to the MR3020.

For serial interface I can solder a Nokia Ca-42 data cable to the mentioned ports, correct ?

d1dd1 wrote:

Thanks for the information.
So flashing via web interface is not yet possible?

Not atm, afaik. but the method i described in this post worked for me

I just ordered one from Conrad.de for 24,95€ shipped. Great value with twice the memory and RAM compared to the MR3020.

d1dd1 wrote:

For serial interface I can solder a Nokia Ca-42 data cable to the mentioned ports, correct ?

Don't know, just make sure it's 3.3v
I didn't get it with soldering, pins are terribly near each other... maybe using a rj11 female plug for PCB mounting, pins should be correctly spaced for the pourpose

Okay, my bad. It's actually a 5 volt device, obviously USB is 5 volts. So the unit will work on 3.3 volts, except for the USB part. USB only works with 5 volts in.

Just a reminder though..the CPU is still 3.3 volts..DON'T use a 5 volt serial cable on it.

There is a 4 position switch on the top of the unit. The fourth position isn't used by the unit - the case keeps the switch from going out that far.

I mapped out the gpio values. The switch seems to modify GPIO 19,20,21,22 and 23. This is what I got, respectively:

"wifi hotspot" 01001
"repeater" is   11001
"Router/AP"    10001 
4th position    11000

(I know that shows 21 and 22 not changing, they're included for completeness, and so that I wouldn't get confused while scripting the tests.)

Basically, that makes the switch a BCD switch, for those of you that care.

Note there is a mark on the motherboard where the switch cannot go. You can see that in the picture in post5 above. (it's on the far right, white mark on the green mask) It would only make sense to put that mark there to indicate to assembly technicians that the switch was meant to be at that position, not that it is impossible or wrong for it to be there. Considering that, and the fact that GPIO 23 only changes when in that 'impossible' switch position, I would hazard a guess that that position indicates a special programming mode somehow, either in the uboot or in the firmware. If I had time, i would search through the code for all references to the string 23, or it's hex equivalent..but no time for that now.

I've gotten the GPL source off the dlink website and managed to rebuild an image with telnet that's flashable via the stock web interface.

I'm a relative OpenWRT newbie - recently converted from ddwrt ('stable' releases are way too far between); picked up a wdr4300 to replace my aging rt-n16. My point being that I don't understand a whole lot of the build process for openwrt yet.

At this point, I'm a bit stuck on how to flash the dir505 with openwrt. I can't do the serial port thing (i got a dongle specifically for this, and managed to burn/scrape the pads off, so that's totally out).

Suggestions?

Looking at the stock /proc/mtd, I've got these partitions.
dev:    size   erasesize  name
mtd0: 00010000 00010000 "u-boot"
mtd1: 00010000 00010000 "ART"
mtd2: 00010000 00010000 "mac"
mtd3: 00010000 00010000 "nvram"
mtd4: 00040000 00010000 "language"
mtd5: 00100000 00010000 "uImage"
mtd6: 00680000 00010000 "rootfs"