Hi guys!
Recently I have discovered for myself that I want improve functionality of my backup router DIR-140L. It's very interesting model even with it base functions, but there is no telnet/ssh, no support for rndis modems, no print server, etc, but hardware can do it all together.
SoC Ralink RT6856F (RT63135) @700MHz
RAM 128MB @200MHz
ROM 16MB
Switch 5-port 10/100
USB 2-port 2.0 hub (1 internal, 1 external)One interesting thing is that it have internal USB-to-Serial controller based on Prolific PL2303 chip with DB9 connector to connect to external ISDN modems, with alternate firmware it can control devices without network access, directly by RS232 (eg PBX), or even provide serial-over-network.
On PCB I've found TTL signs near 4 holes, so it's not so hard to asemble pins and get bootlog:
BDE701DL_001 Jboot S644
flash manufacture id: c2, device id 20 18
SPI FLASH: MX25l12805d 16M
CSID 6E37->6E32
....................
Starting kernel @80000000...
Linux version 2.6.36 (root@amit-25611232.amit.com.tw) (gcc version 3.4.2) #7 Wed Apr 2 18:47:38 CST 2014
ISPRAM0: PA=00300000,Size=00008000,enabled
Ralink RT63165 SOC prom init
CPU revision is: 00019555 (MIPS 34Kc)
Determined physical RAM map:
memory: 07fe0000 @ 00020000 (usable)
Wasting 1024 bytes for tracking 32 unused pages
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000020 -> 0x00008000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000020 -> 0x00008000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32480
Kernel command line: es=1 console=ttyS0,57600n8 root=/dev/mtdblock3
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=0000000c
Readback ErrCtl register=0000000c
Memory: 125784k/130944k available (3104k kernel code, 5160k reserved, 714k data, 204k init, 0k highmem)
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is disabled.
Verbose stalled-CPUs detection is disabled.
NR_IRQS:64
CPU frequency 699.00 MHz
console [ttyS0] enabled
Calibrating delay loop... 465.30 BogoMIPS (lpj=2326528)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
start PCIe register access
0xbfb00834 = 8000000
0xbfb00088 = 12800000
*************** RT6855A PCIe RC mode *************
PCIE0 no card, disable it
PCIE1 no card, disable it(RST&CLK)
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
vgaarb: loaded
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RT3xxx EHCI/OHCI init.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 245
io scheduler noop registered (default)
arch_mem_init check 0xBFBF0114: fffffff7
Ralink gpio driver initialized
HDLC line discipline maxframe=4096
N_HDLC line discipline registered.
ttyS0 at I/O 0xbfbf0003 (irq = 1) is a TC3162
brd: module loaded
loop: module loaded
Generic platform RAM MTD, (c) 2004 Simtec Electronics
flash manufacture id: c2, device id 20 18
MX25L12805D(c2 2018c220) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (0M) .erasesize = 0x00000010 (0K) .numeraseregions = 4096
Creating 8 MTD partitions on "raspi":
0x000000000000-0x000001000000 : "Whole"
0x000000000000-0x000000010000 : "Bootloader"
0x000000010000-0x000000180000 : "Kernel"
0x000000180000-0x000000e90000 : "RootFS"
0x000000e90000-0x000000f10000 : "MyDlink"
0x000000f10010-0x000000fa8000 : "UI"
mtd: partition "UI" doesn't start on an erase block boundary -- force read-only
0x000000fa8010-0x000000ff0000 : "LANG"
mtd: partition "LANG" doesn't start on an erase block boundary -- force read-only
0x000000ff0000-0x000001000000 : "Config"
rdm_major = 253
MAC_ADRH -- : 0x0000000c
SMACCR1 -- : 0x0000000c
MAC_ADRL -- : 0x432880e2
SMACCR0 -- : 0x432880e2
Ralink APSoC Ethernet Driver Initilization. v2.1 256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, Tx Ring = 256, Rx Ring = 256
MAC_ADRH -- : 0x0000000c
SMACCR1 -- : 0x0000000c
MAC_ADRL -- : 0x432880df
SMACCR0 -- : 0x432880df
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
USB Serial support registered for pl2303
usbcore: registered new interface driver pl2303
pl2303: Prolific PL2303 USB to serial adaptor driver
u32 classifier
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1965 buckets, 7860 max)
xt_time: kernel timezone is -0000
IPv4 over IPv4 tunneling driver
GRE over IPv4 demultiplexor driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
Mobile IPv6
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
L2TP IP encapsulation support (L2TPv3)
L2TP netlink interface
L2TP ethernet pseudowire support (L2TPv3)
L2TP debugfs support
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
Freeing unused kernel memory: 204k freed
Algorithmics/MIPS FPU Emulator v1.5
Inter-| Receive
phy_tx_ring = 0x07f10000, tx_ring = 0xa7f10000
phy_rx_ring0 = 0x07f11000, rx_ring0 = 0xa7f11000
MAC_ADRH -- : 0x0000000c
SMACCR1 -- : 0x0000000c
MAC_ADRL -- : 0x432880df
SMACCR0 -- : 0x432880df
ESW: Link Status Changed - Port5 Link UP
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = C0710000
| Transmit
face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed
lo: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
eth2: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
tunl0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
gre0: ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
sit0: rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x1fbb0000
0 0 0 0 0 0 0 0 rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
0hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
0 0 0 0 0 0 0
ip6tnl0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x1fba1000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
crypto_k: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Adapter_Interrupts_Init: Successfully hooked IRQ 29
Adapter_Interrupts_Init: call back registeredAdapter_EIP93_Init: CmdRing_Handle=87f56ffc
Adapter_EIP93_Init: ResRing_Handle=87f56ff8
Adapter: Successfully initialized EIP93v2 in ARM mode
[EIP93_ARM_Level0_WriteDescriptor]
ControlWord:0x00000041
0-byte Src packet from 0x(null):
Dst packet Addr:0x00000000
128-byte SA Content from 0xa7f5c000:
0x00001307 0x02000000 0xe0fc631d 0xcbb9fb9a 0x869285cb
0xcbb9fb9a 0x00000000 0x00000000 0x00000000 0x00000000
0x758bac03 0xf20ab39e 0xa569f104 0x95dfaea6 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000
56-byte SAState Content from 0xa0000000:
0x08000fcc 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x41606000 0x10000002
0x000000c0 0xaf900048 0x8fa80098 0x31080010
SAARC4 Content from 0xa0000000:
PE_userID:0x00000000
PE_length:0x00400000
[EIP93_WriteCB], CD_BASE:0xa7f78000 (B4 kcik PE):
CD_Control:0x00000041
CD_SrcPktAddr:0x00000000
CD_DstPktAddr:0x00000000
CD_SADataAddr:0x07f5c000
CD_SAStateAddr:0x00000000
CD_SAStateAddr:0x00000000
CD_UserIdAddr:0x00000000
CD_Length:0x00400000
PEC_Init: PRNG is initialized
== IPSEC Crypto Engine Driver : Mar 31 2014 10:45:02 ==
modprobe: module xt_time not found
modprobe: failed to load module xt_time
flash_open: flash_fd=3
Mount D Section.
mount: /dev/mtdblock5 is write-protected, mounting read-only
Mount MyDlink Section.
usb 2-2: new full speed USB device using rt3xxx-ohci and address 2
pl2303 2-2:1.0: pl2303 converter detected
usb 2-2: pl2303 converter now attached to ttyUSB0
flash_open: flash_fd=9
Set: phy[4].reg[0] = 3900
Set: phy[0].reg[0] = 3900
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
switch register base addr to 0xbfb58000
write offset 0x7014, value 0x808
write offset 0x1fe0, value 0xa0087864
switch reg write offset=2004, value=ff0003
switch reg write offset=2104, value=ff0003
switch reg write offset=2204, value=ff0003
switch reg write offset=2304, value=ff0003
switch reg write offset=2404, value=ff0003
switch reg write offset=2504, value=ff0003
switch reg write offset=2010, value=810000c0
switch reg write offset=2110, value=810000c0
switch reg write offset=2210, value=810000c0
switch reg write offset=2310, value=810000c0
switch reg write offset=2410, value=810000c0
switch reg write offset=2510, value=810000c0
switch reg write offset=2610, value=81000000
switch reg write offset=2710, value=81000000
switch reg write offset=2604, value=20ff0003
switch reg write offset=2704, value=20ff0003
switch reg write offset=2014, value=10001
switch reg write offset=2114, value=10001
switch reg write offset=2214, value=10001
switch reg write offset=2314, value=10001
switch reg write offset=2414, value=10002
switch reg write offset=2514, value=10001
Set: phy[4].reg[0] = 3100
Set: phy[0].reg[0] = 3100
Set: phy[1].reg[0] = 3100
Set: phy[2].reg[0] = 3100
Set: phy[3].reg[0] = 3100
device eth2 entered promiscuous mode
device eth2.1 entered promiscuous mode
Init handler: lan
br0: port 1(eth2.1) entering learning state
br0: port 1(eth2.1) entering learning state
Init handler: dhcpsrv
ESW: Link Status Changed - Port4 Link UP
Failure parsing line 12 of /etc/udhcpd.conf
server_config.pool_check = 1
server_config.pool_check = 1
start = 192.168.0.100, end = 192.168.0.199, lan_ip = 192.168.0.1, interface=br0, ifindex=0
start = 192.168.0.100, end = 192.168.0.199, lan_ip = 192.168.0.1, interface=br0, ifindex=0
0
Unable to open /var/run/udhcpd.leases for reading
udhcpd (v0.9.9-pre) started
Unable to open /var/run/udhcpd.leases for reading
Init handler: stp
Init handler: reset_btn
Init handler: watchdog
Init handler: wlanap
sh: cannot create /etc/Wireless/RT2860/RT2860.dat: Directory nonexistent
ifconfig: SIOCSIFADDR: No such device
framtd_erase: addr:ff0000 len:1000
lash_open: flash_fd=9
ramtd_write: to:ff0000 len:0
ramtd_write: to:ff0010 len:0
ramtd_erase: addr:ff1000 len:1000
ramtd_write: to:ff1000 len:0
ramtd_write: to:ff0000 len:0
interface ra0 does not exist!
ifconfig: SIOCSIFADDR: No such device
interface ra1 does not exist!
ifconfig: SIOCSIFADDR: No such device
interface ra2 does not exist!
ifconfig: SIOCSIFADDR: No such device
interface ra3 does not exist!
sh: rt2860apd: not found
sh: wpsv2-action: not found
sh: wpsv2-action: not found
sh: iwpriv: not found
sh: iwpriv: not found
sh: iwpriv: not found
WLAN Station Log ALive
Init handler: wan
Init handler: ondemand
Init handler: ipv6
Init handler: ipv6-filter
Init handler: nat
Ralink HW NAT Module Enabled
==== NAT START (WAN:ALL Func:ALL) ====
iptables: No chain/target/match by that name.
Empty rules for port-forward
iptables: No chain/target/match by that name.
Empty rules for port-forward
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
Empty rules for port-forward
iptables: No chain/target/match by that name.
Bad argument `0.0.0.0'
Try `iptables -h' or 'iptables --help' for more information.
Init handler: dnsrelay
initial loops = 255
Mac Address IP-Address HOSTNAME Expires in
lease count is 0 now
sh: wcli_list: not found
sh: wcli_list: not found
Init handler: time
timezone:-180
dsttime:0
Init handler: schedule
Init handler: telnet
Init handler: wps_btn
Init handler: russian_p1wan
Init handler: gre
Init handler: ddns
Init handler: routing
Init handler: autobak
Init handler: keepalive
Init handler: upnp
Init handler: 3g_status
Init handler: hotplug
Init handler: disk_util
Init handler: usb_alert
Init handler: pptp
Init handler: pptpserv
PPTP Server starting ..... [WAITING]
PPTP Server configure file found ..... [OK]
==== NAT START (WAN:ALL Func:stealth) ====
==== NAT START (WAN:ALL Func:spi) ====
Init handler: l2tp
Init handler: l2tpserv
Init handler: ipsec
Init handler: failover
Init handler: mydlink
opt.local start ok.
Init handler: igmp
Init handler: vrrp
Init handler: pwr_saving
Init handler: init_discover
Init handler: rbydom
Init handler: rbyip
Init handler: qos
Init handler: snmp
Init handler: spap
Init handler: ftp_alg
Init handler: sip_alg
Init handler: fwquery
Init handler: ate
Init handler: bonjour
Init handler: host_resolution
Init handler: wanspeed
Set: phy[4].reg[0] = 3100
Init handler: recent
Init handler: wps_status
Init handler: reboot
sh: lltd-action: not found
/usr/bin/telnetd-action: Starting telnetd...
flash_open: flash_fd=7
/usr/bin/telnetd-action start ok
flash_open: flash_fd=7
flash_open: flash_fd=7
sh: cannot create /proc/sys/net/bridge/bridge-nf-call-iptables: Directory nonexistent
# br0: port 1(eth2.1) entering forwarding state
ip6_tables: (C) 2000-2006 Netfilter Core Team
Ralink APSoC Hardware Watchdog Timer
Started WatchDog Timer. LoadVlaue1: 0x471c2aae TIMEOUT: 10
#There is also GPL source code available for original firmwares:
htps:/dlink-gpl.s3.amazonaws.com/GPL1300102/buildroot-gcc342.tar.bz2
htps:/dlink-gpl.s3.amazonaws.com/GPL1300102/DIR-140LA1_GPL_FW102b02.tar.bz2
What is the next step after getting all of this information to make OpenWRT build for this router and flash/test it?
(Last edited by zedalert on 20 Feb 2018, 08:11)