D-Link DAP-2553

The D-Link DAP-2553 is a wireless N dualband gigabit access point w/ PoE.

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
DAP-2553 A1 :?: - - -

NOTE:

OEM source code available at: http://tsd.dlink.com.tw/downloads2008list.asp?OS=GPL

Hardware Highlights

SoC Ram Flash Network USB Serial JTag
Atheros AR9132-BC1E@400MHz 64MiB 16MiB 1 (PoE) No Yes ?

Manufacturer's site: http://www.dlink.com/us/en/business-solutions/wireless/access-points/access-points/dap-2553-wireless-n600-dual-band-poe-access-point

Forum: https://forum.openwrt.org/viewtopic.php?id=52048

Flash Layout

D-Link DAP-2553 OEM
partition start end Name
mtd0 0x001700c0 0x01000000 rootfs
mtd1 0x000a0000 0x00fc0000 upgrade
mtd2 0x00060000 0x00080000 rgdb
mtd3 0x00040000 0x00060000 bdcfg
mtd4 0x00080000 0x000a0000 langpack
mtd5 0x00fc0000 0x00fe0000 certificate
mtd6 0x00fe0000 0x01000000 radiocfg
mtd7 0x00000000 0x01000000 flash
mtd8 0x00000000 0x00040000 bootloader
mtd9 0x00040000 0x00060000 boot config

Hardware

Info

Instruction set: MIPS
Vendor: Atheros
Bootloader: Das U-Boot
System-On-Chip: Atheros AR9132-BC1E
CPU @Frq MIPS 4KEc V4.8 @400MHz FIXME
Flash size: 16 MB
Flash Chip: Winbond W29GL128CH
RAM size: 64 MB
RAM Chip: MT46V32M16-5BF
Wireless No1: Atheros AR9106 w/ 3x3 MIMO antennas for 2.4GHz 802.11b/g/n
Switch: Atheros AR8021
Modem: none
USB: No
Serial: Yes
JTAG: :?:

Photos

Front:

FIXME

Back:

FIXME

Opening the case

Note: This will void your warranty!

  • FIXME

Main PCB

Serial

port.serial general information about the serial port, serial port cable, etc.

Serial console can be plugged to JP2: connector lacks, it has to be soldered on the board.

How to connect to the Serial Port of this specific device:

FIXME You can easily find it, look for the big diode at the front side of the board, the serial connector sits next to it:

-[DIODE]-  . . .   .
           1 2 3   5

Pin Signal
1 TxD
2 GND
3 VCC
4 n/a
5 RxD

The settings are: 115200 bauds, 8 bits, no parity, 1 stop bit (115200 8N1) FIXME

You are root, once connected to the serial port.

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

FIXME

Jtag pins seems to be located in JP1, but the connector lacks.

How to connect to the JTAG Port of this specific device:

FIXME

Debricking

OEM bootlog

U-Boot 1.1.4 (May 20 2011 - 16:44:33) ALPHA U-boot v2.00r009 DRAM: sri 64 MB Top of RAM usable for U-Boot at: 84000000 Reserving 227k for U-Boot at: 83fc4000 Reserving 256k for malloc() at: 83f84000 Reserving 44 Bytes for Board Info at: 83f83fd4 Reserving 36 Bytes for Global Data at: 83f83fb0 Reserving 128k for boot params() at: 83f63fb0 Stack Pointer at: 83f63f98 Now running in RAM - U-Boot at: 83fc4000 Name: AMD-SPANSION Flash id: 0x1227E, Size: 16777216 bytes. Flash: 16 MB In: serial Out: serial Err: serial Net: ag7100_enet_initialize... : cfg1 0xf cfg2 0x7114 ATHRF1E: Port 0, Neg Success ATHRF1E: unit 0 phy addr 0 ATHRF1E: reg0 1000 eth0: 00:05:0d:06:01:03 eth0 up eth0 ### main_loop entered: bootdelay=1 ### main_loop: bootcmd="run runtime" press 'q' to stop autoboot: 0 ---------1activeregion:1---------- Protect off BF040000 ... BF05FFFF Un-Protecting sectors 2..2 in bank 1 Un-Protected 1 sectors Erasing Flash...Erase Flash from 0xbf040000 to 0xbf05ffff in Bank # 1 First 0x2 last 0x2 ^H^H^H^H^H 100% Erased 1 sectors Writing to Flash... ^H^H^H^H^H 100% done Protecting sectors 2..2 in bank 1 Protected 1 sectors ---------2activeregion:1---------- env_relocate_dual_config[317] malloced ENV at 83fa4360, size()=4 ----------dual gd->env_valid == 1---------- ---------dual env flash--------- ---------dual env flash 4--------- env_ptr_dual_config->data=83fa4371 env_ptr_dual_config->data=83f84019 ---------after relocate_dual_config 3 activeregion:2---------- env_ptr_dual_config->data=83fa4364 env_ptr_dual_config->data=83f8400c oldval==d &env_data[ENV_SIZE]=83fa8360,env=83fa4364 len=10, env_data=3ffc &env_data[ENV_SIZE]=83fa8360,env=83fa4364 =====env_ptr_dual_config->crc=84ed927a----ENV_SIZE=3ffc====== -------test dual_config CFG_ENV_SECT_SIZE 3------- -------test dual_config CONFIG_INFERNO 4------- =====env_ptr_dual_config->crc=84ed927a----ENV_SIZE=3ffc====== Protect off BFFA0000 ... BFFBFFFF Un-Protecting sectors 125..125 in bank 1 Un-Protected 1 sectors Erasing Flash...Erase Flash from 0xbffa0000 to 0xbffbffff in Bank # 1 First 0x7d last 0x7d ^H^H^H^H^H 100% Erased 1 sectors Writing to Flash... ^H^H^H^H^H 100% done Protecting sectors 125..125 in bank 1 Protected 1 sectors env_ptr_dual_config->data=83fa4371 env_ptr_dual_config->data=83f84019 ---------4activeregion:2---------- ## Booting image at bf0a0000 ... Image Name: 7zip Linux Kernel Created: 1970-01-01 0:00:00 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: -1 Bytes = 4096 MB Load Address: 80002000 Entry Point: 80002000 Uncompressing Kernel Image with LZMA ... Check Image ... Image OK! OK No initrd ## Transferring control to Linux (at address 80002000) ... ## Giving linux memsize in bytes, 67108864 Starting kernel ... Linux version 2.6.15--LSDK-7.1.3.63 (release@J10) (gcc version 3.4.4) #2 Wed Sep 25 10:58:25 CST 2013 flash_size passed from bootloader = 16 CPU revision is: 00019374 Determined physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map: memory: 04000000 @ 00000000 (usable) Built 1 zonelists Kernel command line: console=ttyS0,115200 root=/dev/mtdblock0 rw mem=64m Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). Cache parity protection disabled PID hash table entries: 512 (order: 9, 8192 bytes) Using 200.000 MHz high precision timer. Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 62220k/65536k available (1949k kernel code, 3256k reserved, 402k data, 124k init, 0k highmem) Mount-cache hash table entries: 512 Checking for 'wait' instruction... available. NET: Registered protocol family 16 calling simple_config callback.. SCSI subsystem initialized AR7100 GPIOC major 0 squashfs: version 3.1 (2006/08/19) Phillip Lougher devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 Initializing Cryptographic API io scheduler noop registered io scheduler deadline registered Serial: 8250/16550 driver $Revision: #1 $ 1 ports, IRQ sharing disabled serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A RAMDISK driver initialized: 1 RAM disks of 65536K size 1024 blocksize ELBOX CFI physmap flash device: 1000000 at bf000000 FLASH ID: AMD-SPANSION SIZE: (16 MB) AR9100 serial flash !! ar9100-nor0: squashfs filesystem found at offset 0x00170000 Creating 10 MTD partitions on "ar9100-nor0": 0x001700c0-0x01000000 : "rootfs" 0x000a0000-0x00fc0000 : "upgrade" 0x00060000-0x00080000 : "rgdb" 0x00040000-0x00060000 : "bdcfg" 0x00080000-0x000a0000 : "langpack" 0x00fc0000-0x00fe0000 : "certificate" 0x00fe0000-0x01000000 : "radiocfg" 0x00000000-0x01000000 : "flash" 0x00000000-0x00040000 : "bootloader" 0x00040000-0x00060000 : "boot config" FLASH ID: AMD-SPANSION SIZE: (16 MB) u32 classifier NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 2, 16384 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered arp_tables: (C) 2002 David S. Miller TCP bic registered NET: Registered protocol family 1 NET: Registered protocol family 17 Bridge firewalling registered 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller ar7100wdt_init: Registering WDT success VFS: Mounted root (squashfs filesystem) readonly. Mounted devfs on /dev Freeing unused kernel memory: 124k freed init started: BusyBox v1.00 (2013.09.25-02:40+0000) multi-call binary Starting pid 14, console /dev/tts/0: '/etc/init.d/rcS' [/etc/init.d/S03config.sh] Mounting proc and var ... Inserting modules ... Inserting Rebootm ... Using /lib/modules/rebootm.ko Rebootm loading ... Inserting atheros ethernet ... Using /lib/modules/ag7100_mod.ko Inserting gpio ... Using /lib/modules/gpio.ko GPIO driver initialized. done. Start xmldb ... [/etc/scripts/misc/profile.sh] get ... [/etc/scripts/misc/defnodes.sh] ... [/etc/defnodes/S10setext.sh] ... PHP [/etc/defnodes/S11setnodes.php] ... PHP [/etc/defnodes/S12features.php] ... PHP [/etc/defnodes/S13flashspeed.php] ... PHP [/etc/defnodes/S20setnodes.php] ... SQUASHFS error: Can't find a SQUASHFS superblock on mtdblock4 mount: Mounting /dev/mtdblock/4 on /www/locale/alt failed: Invalid argument PHP [/etc/defnodes/S40brand.php] ...

Notes

Currently, the DAP-2553 is NOT supported. The hardware is, quite likely, qualified for Openwrt, but the DAP2553 seems to have it's own special firmware "header", and at the moment, there is no header calculation tool for the DAP2553. There is a lot of information though, that could help building such a utility, see the Openwrt forum at https://forum.openwrt.org/viewtopic.php?id=52048

Source code for this board is available from d-link. Their GPL-site seems to be http://tsd.dlink.com.tw/downloads2008list.asp?OS=GPL, at firmware available from https://dlink-gpl.s3.amazonaws.com/GPL1400207/DAP2553_GPL130.tar.gz (v1.30) and https://dlink-gpl.s3.amazonaws.com/GPL1300038/DAP-2553_A1_GPL_1.26.tar.gz (v1.26).

The machine runs "U-Boot 1.1.4 (May 20 2011 - 16:44:33)", with the following memory layout:

64 MB Top of RAM usable for U-Boot at: 84000000 Reserving 227k for U-Boot at: 83fc4000 Reserving 256k for malloc() at: 83f84000 Reserving 44 Bytes for Board Info at: 83f83fd4 Reserving 36 Bytes for Global Data at: 83f83fb0 Reserving 128k for boot params() at: 83f63fb0 Stack Pointer at: 83f63f98

After booting, (and pressing q) it says: press 'q' to stop autoboot: 0 Emergency web server start… Trying eth0 eth0 link down FAIL Press 'q' to quit

You can now access the "emergency web server" at 192.168.0.50. Uploading the default D-link firmware works. Download ftp://ftp.dlink.eu/Products/dap/dap-2553/driver_software/DAP-2553_fw_revALL_1-30-rc055_all_en_20131108.zip and unpack, and send the ".bin" file to your dap-2553 to unbrick it. It tells us:

TCP:Can't alloc pktbuf TCP:Can't alloc pktbuf TCP:Can't alloc pktbuf [… many, many times], then: Control flag in image header: 0x00000001 Control flag in boot config: 0x00000001 Upload file OK! (ENV) begin addr=0xbf0a0000,end=0xbf53ffff Erase Flash from 0xbf0a0000 to 0xbf53ffff in Bank # 1 First 0x5 last 0x29 100% Erased 37 sectors 100% write image into flash…OK,dest addr=0xbf0a0000

If you press q instead, you get a u-boot menu, that has the following functions: autoscr - run script from memory ? - alias for 'help' base - print or set address offset bdinfo - print Board Info structure boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootelf - Boot from an ELF image in memory bootm - boot application image from memory bootp - boot image via network using BootP/TFTP protocol bootvx - Boot vxWorks from an ELF image cmp - memory compare coninfo - print console devices and information cp - memory copy crc32 - checksum calculation echo - echo args to console erase - erase FLASH memory flinfo - print FLASH memory information go - start application at address 'addr' help - print online help iminfo - print header information for application image imls - list all images found in flash itest - return true/false on integer compare loadb - load binary file over serial line (kermit mode) loads - load S-Record file over serial line loady - load binary file over serial line (ymodem mode) loop - infinite loop on address range md - memory display mii - MII utility commands mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nfs - boot image via network using NFS protocol nm - memory modify (constant address) ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables protect - enable or disable FLASH write protection rarpboot- boot image via network using RARP/TFTP protocol reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage setenv - set environment variables sleep - delay execution for some time tftpboot- boot image via network using TFTP protocol version - print monitor version

Command bdinfo tells: boot_params = 0x83F63FB0 memstart = 0x80000000 memsize = 0x04000000 flashstart = 0xBF000000 flashsize = 0x01000000 flashoffset = 0x000279AC ethaddr = 00:05:0D:06:01:03 ip_addr = 192.168.0.50 baudrate = 115200 bps

Command printenv tells: loadstart=0x80002000 runtimeloadstart=0x80002000 bootstart=0xbf000000 bootsize=0x40000 bootend=0xBF03FFFF runtimestart=0xBF0A0000 runtimesize=0x00F20000 runtimeend=0xBFFBFFFF envstart=0xBF040000 envend=0xBF05FFFF bootargs=console=ttyS0,115200 bootcmd=run runtime bootdelay=1 baudrate=115200 signature=wapnd03_dkbs_dap2553 ethaddr=00:05:0D:06:01:03 ipaddr=192.168.0.50 serverip=192.168.0.90 update_bootloader=protect off $(bootstart) $(bootend);erase $(bootstart) $(boot) update_runtime=protect off $(runtimestart) $(runtimeend);erase $(runtimestart) ) clean_env=protect off $(envstart) $(envend); erase $(envstart) $(envend);protec) runtime=bootm $(runtimestart) $(runtimeloadstart) ctlcode=1 activeregion=1 stdin=serial stdout=serial stderr=serial ethact=eth0 Environment size: 894/16380 bytes

After booting, /proc/mtd is: dev: size erasesize name mtd0: 00e8ff40 00020000 "rootfs" mtd1: 00f20000 00020000 "upgrade" mtd2: 00020000 00020000 "rgdb" mtd3: 00020000 00020000 "bdcfg" mtd4: 00020000 00020000 "langpack" mtd5: 00020000 00020000 "certificate" mtd6: 00020000 00020000 "radiocfg" mtd7: 01000000 00020000 "flash" mtd8: 00040000 00020000 "bootloader" mtd9: 00020000 00020000 "boot config"

Or, from the kernel boot log: 0x001700c0-0x01000000 : "rootfs" 0x000a0000-0x00fc0000 : "upgrade" 0x00060000-0x00080000 : "rgdb" 0x00040000-0x00060000 : "bdcfg" 0x00080000-0x000a0000 : "langpack" 0x00fc0000-0x00fe0000 : "certificate" 0x00fe0000-0x01000000 : "radiocfg" 0x00000000-0x01000000 : "flash" 0x00000000-0x00040000 : "bootloader" 0x00040000-0x00060000 : "boot config"

Back to top

toh/d-link/dap-2553.txt · Last modified: 2014/08/11 11:15 by m3m3nt0