Hello,
I am looking for some advice or at least a point in the right direction regarding how to put OpenWRT on my ALFA R36 router.
A little background first though. I am a 17 year old who loves electronics and hacking but I am better at hardware than with software. I currently use linux as my main OS and I have some experience with embedded linux (on a Gumstix board). I recently bought a ALFA R36 router specifically to hack it. I have a 1w ALFA wifi dongle that works together with the R36, but my ultimate goal is to get OpenWRT on the R36 and connect the serial port to an Arduino. I want to be able to use the router as a mini computer to control stuff like robots. Unfortunately, I couldn't find ANY documentation on the R36 router.
I picked the ONE router that has never been hacked! 
I am not sure why though, this little router looks like it has a lot of potential. TWO LONG range wifi radios in one router system for about $100!
Here is a link to the ALFA R36 product page: http://www.alfa.com.tw/in/front/bin/ptd … Category=0
Here are some pictures that I took of it:
http://www.flickr.com/photos/58936758@N … hotostream
http://www.flickr.com/photos/58936758@N … hotostream
http://www.flickr.com/photos/58936758@N … hotostream
So here is everything that I came up with regarding the R36 hardware:
Processor: Ralink RT3050F @ 320Mhz
Flash: MXIC MX29LV640EBTI-70G (not sure what size)
RAM: EtronTech EM63A165TS-6G
One USB port
One Serial Port @ 115200bps
One WAN
One LAN
2 buttons - reset to factory default and one for the WPS thing
at least 6 LEDs
wifi - i believe it's built into the processor (there is an amplifier because the baord can put out 350mW I believe).
So the first thing I did was hook up my Bus Pirate as a plain serial to usb bridge. I used putty to communicate with the serial interface on the router. Here is a log of the boot up over the serial port:
----------------------------------------------------------------------------------
#
U-Boot 1.1.3 (Oct 4 2010 - 15:34:52)
Board: Ralink APSoC DRAM: 32 MB
relocate_code Pointer at: 81fb0000
flash_protect ON: from 0xBF000000 to 0xBF01D423
flash_protect ON: from 0xBF030000 to 0xBF030FFF
*** Warning - bad CRC, using default environment
============================================
Ralink UBoot Version: 3.3
--------------------------------------------
ASIC 3052_MP2 (Port5<->None)
DRAM component: 256 Mbits SDR
DRAM bus: 16 bit
Total memory: 32 MBytes
Flash component: NOR Flash
Date:Oct 4 2010 Time:15:34:52
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 320 MHZ ####
SDRAM bus set to 16 bit
SDRAM size =32 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
1 0
3: System Boot system code via Flash.
## Booting image at bf050000 ...
Image Name: Linux Kernel Image-1.2.0.6-0
Created: 2011-05-23 3:11:36 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 5427136 Bytes = 5.2 MB
Load Address: 80000000
Entry Point: 80294000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80294000) ...
## Giving linux memsize in MB, 32
Starting kernel ...
LINUX started...
THIS IS ASIC - AWB
Linux version 2.6.21-gb9609c50-dirty (root@minglinlee-Studio-1558) (gcc version 3.4.2) #5 Mon May 23 10:34:04 CST 2011
The CPU feqenuce set to 320 MHz
CPU revision is: 0001964c
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Built 1 zonelists. Total pages: 8128
Kernel command line: console=ttyS1,115200n8 root=/dev/mtdblock4
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load han fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 80800000, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calcung r4koff... 00138800(1280000)
CPU frequency 320.00 MHz
Using 160.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29612k/32768k available (2321k kernel code, 3156k reserved, 314k data, 116k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.8)
io scheduler noop registered (default)
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
rdm_major = 254
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
ralink flash device: 0x800000 at 0x1f000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 6 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x00120000 : "Kernel"
0x00120000-0x007f0000 : "RootFS"
0x007f0000-0x00800000 : "Data3G"
block2mtd: version $Revision: 1.1.1.1 $
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.00 256 rx/tx descriptors allocated, mtu = 1500!
GDMA1_MAC_ADRH -- : 0x000000c0
GDMA1_MAC_ADRL -- : 0xca49c69c
PROC INIT OK!
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 116k freed
Algorithmics/MIPS FPU Emulator v1.5
devpts: called with bogus options
[BC_Data]Init:Start=========
[BC_Data]Command_Initt:BC_next_empty_sector=1
[BC_Data]Init:Print SM informaiton.
pSMBC_Data->next_empty_sector=1
============BC_ParamShow=========
total_sum_elapsed_time=[ 0.000000]
sum_3g_data_xfer=[ 0.000000]
this_elapse=[ 0.000000]
rxqual=[ 0.000000]
RX_payload=[ 0.000000]
TX_payload=[ 0.000000]
systime=[ 10100002000.00]
reserved2=[ nan]
============BC_Flash_ParamShow:End=========
[BC_Data]Init:End=========
dwc_otg: version 2.72a 24-JUN-2008
DWC_otg: Core Release: 2.66a
DWC_otg: Periodic Transfer Interrupt Enhancement - disabled
DWC_otg: Multiprocessor Interrupt Enhancement - disabled
DWC_otg: Using DMA mode
DWC_otg: Device using Buffer DMA mode
dwc_otg lm0: DWC OTG Controller
dwc_otg lm0: new USB bus registered, assigned bus number 1
dwc_otg lm0: irq 18, io mem 0x00000000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mount: mounting usbfs on /proc/bus/usb failed: Device or resource busy
mount: mounting devpts on /dev/pts failed: Device or resource busy
Jan 1 00:00:02 udevd[637]: add_matching_files: unable to open '/etc/udev/rules.d': No such file or directory
Sat Jan 1 00:00:00 UTC 2011
set date/time -> Sat Jan 1 00:00:00 UTC 2011
date: invalid date '10100002000.00'
Sat Jan 1 00:00:00 UTC 2011
echo "1024 65000" >/proc/sys/net/ipv4/ip_local_port_range
echo "49576" > /proc/sys/fs/file-max
echo "5" > /proc/sys/net/netfilter/nf_conntrack_icmp_timeout
echo "2048" > /proc/sys/net/ipv4/netfilter/ip_conntrack_max
BusyBox v1.12.1 (2011-05-23 11:09:55 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
# echo "30" > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout
echo "120" > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout_stream
echo "1" > /proc/sys/net/ipv4/tcp_ecn
echo "5" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "3" > /proc/sys/net/ipv4/tcp_syn_retries
echo "2" > /proc/sys/net/ipv4/tcp_retries1
echo "1" > /proc/sys/net/ipv4/tcp_tw_recycle
echo "uuid=75802409-bccb-40e7-0c43-00c0ca49c69d" > /etc/uuid.dat
echo "serial=75802409" > /etc/serial.dat
session.sh
sh: session.sh: not found
internet.sh
WLAN DAEMON : Stop USB WLAN Detection Daemon fail.
Password for 'admin' changed
do nothing!!!
insmod: bridge.ko: module not found
insmod: mii.ko: module not found
insmod: raeth.ko: module not found
rtl8187L:
Linux kernel driver (v2023) for RTL8187L based WLAN cards
rtl8187L: Copyright (c) 2004-2005, Realtek
rtl8187L: Copyright (c) 2011, Island Consulting, Inc. (www.thewirie.com)
rtl8187L: Wireless extensions version 22
rtl8187L: Initializing proc filesystem
usbcore: registered new interface driver rtl8187L
phy_tx_ring = 0x01e9c000, tx_ring = 0xa1e9c000
phy_rx_ring = 0x00000000, rx_ring = 0x00000000
RT305x_ESW: Link Status Changed
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 710000
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
rmmod: rt2860v2_ap: No such file or directory
rmmod: rt2860v2_sta: No such file or directory
Commit crc = b81310d3
rt2860v2_ap: module license 'unspecified' taints kernel.
=== pAd = c00f1000, size = 504256 ===
<-- RTMPAllocAdapterBlock, Status=0
rmmod: nf_nat_pptp: No such file or directory
rmmod: nf_conntrack_pptp: No such file or directory
rmmod: nf_nat_proto_gre: No such file or directory
rmmod: nf_conntrack_proto_gre: No such file or directory
RX DESC a18b5000 size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff 00 00 00 00
Main bssid = 00:c0:ca:49:c6:9e
<==== rt28xx_init, Status=0
0x1300 = 00064380
insmod: 8021q.ko: module not found
eth2.2: Setting MAC address to 00 c0 ca 49 c6 9d.
device eth2 entered promiscuous mode
VLAN (eth2.2): Setting underlying device (eth2) to promiscious mode.
ifconfig: ioctl 0x8913 failed: No such device
brctl: bridge br0: No such device or address
##### config RT3052 vlan partition (WLLLL) #####
### usage USB Wireless No Vlan (0) ###
switch reg write offset=14, value=5555
switch reg write offset=40, value=1001
switch reg write offset=44, value=1001
switch reg write offset=48, value=1001
switch reg write offset=4c, value=1
switch reg write offset=50, value=2001
switch reg write offset=70, value=ffffffff
switch reg write offset=98, value=7f7f
switch reg write offset=e4, value=7f
device ra0 entered promiscuous mode
====== LAN_PRE =========
WLAN DAEMON : Start USB WLAN Detection Daemon....
br0: port 2(eth2) entering learning state
br0: port 1(ra0) entering learning state
ifconfig: ioctl 0x8914 failed: Cannot assign requested address
ifconfig: ioctl 0x8914 failed: Cannot assign requested address
==================== wpa_supplicant.conf ===========================
SSID=FQKRN
AUTHTICATION=2
ENCRYPTION=99
NETWORKTYPE=1
BSSID=00:26:B6:03:3D:08
====================================================================
/sbin/wpa_supplicant.sh KEY1: use hex key. > /dev/console
WLAN DAEMON : Turn ON USB Power....
WLAN DAEMON : check module fail
WLAN DAEMON : Insert Module & Driver
insmod: cannot insert '/lib/modules/2.6.21-gb9609c50-dirty/kernel/drivers/net/wireless/rtl8187l/r8187l.ko': invalid parameters
WLAN DAEMON : Turn ON USB Power....
killall: udhcpd: no process killed
Set: phy[1].reg[0] = 3900
Set: phy[1].reg[0] = 3100
====== LAN_PRE:end =========
====== LAN_POST =========
## stop lld2d ##
## restart lld2d ##
## stop igmpproxy ##
## restart igmpproxy ##
## stop miniupnpd ##
## restart miniupnpd ##
## stop radvd ##
Jan 1 00:00:12 miniupnpd[1113]: HTTP listening on port 5555
Jan 1 00:00:12 miniupnpd[1113]: Listening for NAT-PMP traffic on port 5351
Jan 1 00:00:12 miniupnpd[1113]: chain port_forward not found
Jan 1 00:00:12 miniupnpd[1113]: chain port_forward not found
## restart radvd ##
ifconfig: ioctl 0x8913 failed: No such device
## stop pppoe-relay ##
## restart pppoe-relay ##
## stop dnsmasq ##
## restart dnsmasq ##
====== LAN_POST:end =========
===== To Fix Coutnry Code does not depend on MFG procedure ====
Commit crc = b81310d3
WLAN DAEMON : wlan0 now is down...
ifconfig: ioctl 0x8913 failed: No such device
WLAN DAEMON : device not exists.
sh: 1: unknown operand
killall rt2860apd 1>/dev/null 2>&1
insmod /lib/modules/2.6.21/kernel/net/netfilter/xt_webstr.ko
iptables -F -t filter 1>/dev/null 2>&1
iptables -D FORWARD -j macipport_filter 1>/dev/null 2>&1
iptables -F macipport_filter 1>/dev/null 2>&1
iptables -D FORWARD -j web_filter 1>/dev/null 2>&1
iptables -F web_filter 1>/dev/null 2>&1
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t filter -N web_filter 1>/dev/null 2>&1
iptables -t filter -N macipport_filter 1>/dev/null 2>&1
iptables -t filter -N port_forward 1>/dev/null 2>&1
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 1>/dev/null 2>&1
iptables -A INPUT -i wlan0 -p tcp --dport 80 -j DROP
iptables -t nat -D PREROUTING -i ppp0 -j port_forward 1>/dev/null 2>&1
iptables -t nat -D PREROUTING -i eth2.2 -j port_forward 1>/dev/null 2>&1
iptables -t nat -F port_forward 1>/dev/null 2>&1; iptables -t nat -X port_forward 1>/dev/null 2>&1
iptables -t nat -D PREROUTING -i ppp0 -j DMZ 1>/dev/null 2>&1
iptables -t nat -D PREROUTING -i eth2.2 -j DMZ 1>/dev/null 2>&1
iptables -t nat -F DMZ 1>/dev/null 2>&1; iptables -t nat -X DMZ 1>/dev/null 2>&1
iptables -t nat -N port_forward 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 1 -i wlan0 -j port_forward 1>/dev/null 2>&1
iptables -t nat -N DMZ 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 2 -i wlan0 -j DMZ 1>/dev/null 2>&1
greenap.sh init
Jan 1 00:00:17 crond[1488]: crond (busybox 1.12.1) started, log level 6
/etc/init.d/cron.sh ok
ddns.sh
route delete 239.255.255.250 1>/dev/null 2>&1
killall wscd 1>/dev/null 2>&1
killall -9 wscd 1>/dev/null 2>&1
iwpriv ra0 set WscConfMode=0 1>/dev/null 2>&1
killall -q klogd
killall -q syslogd
syslogd -C8 1>/dev/null 2>&1
klogd 1>/dev/null 2>&1
killall -q zebra
killall -q ripd
/bin/qos_run
/etc/init.d/ntp.sh ntp_update
##### USB init #####
storage.sh admin
sh: storage.sh: not found
webs: Listening for HTTP requests at address 192.168.2.1
br0: topology change detected, propagating
br0: port 2(eth2) entering forwarding state
br0: topology change detected, propagating
br0: port 1(ra0) entering forwarding state
WLAN DAEMON : Turn ON USB Power....
WLAN DAEMON : wlan0 now is down...
ifconfig: ioctl 0x8913 failed: No such device
WLAN DAEMON : device not exists.
#
#
# ls
bin etc home lib mnt sbin tmp var
dev etc_ro init media proc sys usr
# ls 0a -all
drwxr-xr-x 16 admin admin 171 May 23 2011 .
drwxr-xr-x 16 admin admin 171 May 23 2011 ..
-rw-r--r-- 1 admin admin 539 May 23 2011 .config
drwxr-xr-x 2 admin admin 1124 May 9 2011 bin
drwxr-xr-x 3 admin admin 586 May 23 2011 dev
drwxr-xr-x 8 admin admin 0 Jan 1 00:00 etc
drwxr-xr-x 13 admin admin 351 May 16 2011 etc_ro
drwxr-xr-x 2 admin admin 3 May 23 2011 home
lrwxrwxrwx 1 admin admin 11 May 23 2011 init -> bin/busybox
drwxr-xr-x 5 admin admin 880 May 23 2011 lib
drwxr-xr-x 2 admin admin 0 Jan 1 2000 media
drwxr-xr-x 2 admin admin 3 May 23 2011 mnt
dr-xr-xr-x 40 admin admin 0 Jan 2000 proc
drwxr-xr-x 2 admin admin 1005 May 23 2011 sbin
drwxr-xr-x 10 admin admin 0 Jan 1 2000 sys
drwxr-xr-x 2 admin admin 0 Jan 1 00:00 tmp
drwxr-xr-x 8 admin admin 82 May 23 2011 usr
drwr-x 6 admin admin 0 Jan 1 00:00 var
#
#
-------------------------------------------------------------------------------------------------
So that's the output. I see that I could possibly load OpenWRT with the U-Boot TFTP option, but what version of OpenWRT should I use? Is there any version that will fully support this router? If not, can you give me a high level explanation of what I would need to do to get OpenWRT working on this router? I am still in the process of reading the documents on the OpenWRT wiki, but so far they are just confusing me. Any advice would be greatly appreciated.
Thanks for the help.
CoytHV
