User Tools

Site Tools


toh:zsun:wifi-card-reader

Zsun wifi card reader

Status: upstream support being added, flashing information available on multiple external websites. See the Hardware and Flashing sections just below for more detailed info.

Summary

Zsun produces an Atheros AR9331 based wireless card reader. Coming with 64 MiB RAM and 16 MiB SPI flash it can easily run OpenWrt. The device can be bought for ~$11 on AliExpress, DealExtreme or similar websites.

Along with the A5-V11 it's one of the smallest, cheapest platforms for running an embedded Linux node.

This thing has many uses ranging from plain networking to embedded systems. For example it can be used as a:

  • wireless AP/client/repeater
  • supports at least two connections with good quality (for example a client connection and an AP)
  • embedded Linux device, you can turn it into a "dumb" client and use it as a IoT node
  • an OpenVPN plug-in AP
  • mesh network participant, simply buy a dozen
  • wifi hacktivism, such as running a minimal TOR node
  • use it for its intende purpose: serving files :-)

Pictures

Hardware

The device consists of two PCBs sandwiched together and connected via 8 pins. The bottom PCB only contains the SD card reader chip and SD slot, so it can be safely removed without affecting operation.

Here's the summary:

Architecture: MIPS
Vendor: Atheros/Qualcomm
System-On-Chip: Atheros/Qualcomm AR9331 WiSoC
Flash size: 16MiB SPI
RAM: 64MiB (32MiB version possibly out there)
Ethernet port: yes, via external PHY, TX/RX pairs on testpoints
Serial: yes, on testpoints, 115200 8N1
Bootloader: u-boot
Extras: GL827L card reader controller, WAS7227Q USB switch

As you can see we have some extra goodies on board such as the WAS7227Q USB switch, which connects the SD card reader chip to either the AR9331 SoC (GPIO21 HIGH) or the USB plug (GPIO21 LOW).

Talking about GPIOs, they operate at 2.5V logic level and they can be identified as such:

  • GPIO0: LED
  • GPIO18: card reader reset
  • GPIO21: USB switch
  • GPIO22: card detect

Bootstrap GPIOs:

  • GPIO0: Crystal frequency of external clock 0=25, 1=40 MHz
  • GPIO1: Booting from internal 0=ROM, 1=SPI Flash
  • GPIO11: 0=General JTAG, 1=CPU ICE
  • GPIO12/28: external memory type (00=SDR, 01=DDR, 10=DDR2)
  • GPIO13: USB mode 0=device, 1=host
  • GPIO16: Download firmware from 0=USB, 1=MDIO

As you may have noticed from the table above an Ethernet port (eth1) can be added via external magnetics (such as a MagJack)

or you can use this python tool (very slow >1kb/s ) https://github.com/maurerr/ubootwrite

Flashing

Upstream support is coming. Meanwhile, you can follow these guides:

From serial console only (untested) https://forum.openwrt.org/viewtopic.php?pid=183315#p183315

Credits

Original firmware

Software information

# cat /proc/cpuinfo 
system type             : Atheros AR9330 (Hornet)
processor               : 0
cpu model               : MIPS 24Kc V7.4
BogoMIPS                : 266.24
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 16
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0120, 0x0c90, 0x0a08]
ASEs implemented        : mips16
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

# cat /proc/mounts 
rootfs / rootfs rw 0 0
/dev/root / jffs2 rw,relatime 0 0
/proc /proc proc rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
none /tmp ramfs rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00010000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00e90000 00010000 "rootfs"
mtd3: 00130000 00010000 "uImage"
mtd4: 00010000 00010000 "NVRAM"
mtd5: 00010000 00010000 "ART"

# cat /proc/partitions 
major minor  #blocks  name

  31        0         64 mtdblock0
  31        1         64 mtdblock1
  31        2      14912 mtdblock2
  31        3       1216 mtdblock3
  31        4         64 mtdblock4
  31        5         64 mtdblock5

# cat /proc/iomem 
00000000-03ffffff : System RAM
  00002000-0023d507 : Kernel code
  0023d508-002e05ff : Kernel data
18020000-18020fff : serial8250.0
1b000000-1bffffff : ar7240-ehci.0
  1b000000-1bffffff : ehci_hcd

# cat /proc/cmdline 
console=ttyS0,115200 root=31:02 rootfstype=jffs2 rw init=/sbin/init mtdparts=ar7240-nor0:64k(u-boot),64k(u-boot-env),14912k(rootfs),1216k(uImage),64k(NVRAM),64k(ART) mem=64M

# cat /proc/version 
Linux version 2.6.31--LSDK-9.2.0_U11.14 (root@jwyue) (gcc version 4.3.3 (GCC) ) #1 Wed Dec 17 15:53:04 CST 2014

# cat /proc/crypto 
name         : ecb(arc4)
driver       : ecb(arc4-generic)
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : blkcipher
blocksize    : 1
min keysize  : 1
max keysize  : 256
ivsize       : 0
geniv        : <default>

name         : stdrng
driver       : krng
module       : kernel
priority     : 200
refcnt       : 1
selftest     : passed
type         : rng
seedsize     : 0

name         : lzma
driver       : lzma-generic
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : pcomp

name         : arc4
driver       : arc4-generic
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : cipher
blocksize    : 1
min keysize  : 1
max keysize  : 256

name         : aes
driver       : aes-generic
module       : kernel
priority     : 100
refcnt       : 1
selftest     : passed
type         : cipher
blocksize    : 16
min keysize  : 16
max keysize  : 32

name         : sha1
driver       : sha1-generic
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : shash
blocksize    : 64
digestsize   : 20
descsize     : 96

# cat /proc/meminfo 
MemTotal:          61936 kB
MemFree:           47076 kB
Buffers:               0 kB
Cached:             3496 kB
SwapCached:            0 kB
Active:             5644 kB
Inactive:           2384 kB
Active(anon):       4532 kB
Inactive(anon):        0 kB
Active(file):       1112 kB
Inactive(file):     2384 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          4564 kB
Mapped:             3032 kB
Slab:               4424 kB
SReclaimable:        220 kB
SUnreclaim:         4204 kB
PageTables:          312 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       30968 kB
Committed_AS:      12232 kB
VmallocTotal:    1048404 kB
VmallocUsed:        1740 kB
VmallocChunk:    1044668 kB

# ifconfig
ath0      Link encap:Ethernet  HWaddr A0:03:8F:xx:xx:x5  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:365 errors:0 dropped:0 overruns:0 frame:0
          TX packets:309 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:46390 (45.3 KiB)  TX bytes:55642 (54.3 KiB)

br0       Link encap:Ethernet  HWaddr 00:03:7F:xx:xx:x8  
          inet addr:10.168.168.1  Bcast:10.168.168.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:369 errors:0 dropped:0 overruns:0 frame:0
          TX packets:168 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:33282 (32.5 KiB)  TX bytes:17181 (16.7 KiB)

eth0      Link encap:Ethernet  HWaddr 00:03:7F:xx:xx:x8  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth1      Link encap:Ethernet  HWaddr 00:03:7F:xx:xx:x9  
          inet addr:10.253.253.253  Bcast:10.253.253.255  Mask:255.255.255.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wifi0     Link encap:UNSPEC  HWaddr A0-03-8F-xx-xx-x5-00-4C-00-00-00-00-00-00-00-00  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:21441 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7653 errors:92 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:2 Memory:b8100000-b811ffff 

# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.00037fxxxxx8       no              eth0
                                                        ath0

Bootlogs

Firmware bootlog

arg 6: mtdparts=ar7240-nor0:64k(u-boot),64k(u-boot-env),14912k(rootfs),1216k(uImage),64k(NVRAM),64k(ART) arg 7: mem=64M CPU revision is: 00019374 (MIPS 24Kc) Determined physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map: memory: 04000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 On node 0 totalpages: 16384 free_area_init_node: node 0, pgdat 802ded70, node_mem_map 81000000 Normal zone: 128 pages used for memmap Normal zone: 0 pages reserved Normal zone: 16256 pages, LIFO batch:3 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=jffs2 rw init=/sbin/init mtdparts=ar7240-nor0:64k(u-boot),64k(u-boot-env),14912k(rootfs),1216k(uImage),64k(NVRAM),64k(ART) mem=64M PID hash table entries: 256 (order: 8, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 61736k/65536k available (2285k kernel code, 3732k reserved, 652k data, 132k init, 0k highmem) NR_IRQS:128 plat_time_init: plat time init done Calibrating delay loop... 266.24 BogoMIPS (lpj=532480) Mount-cache hash table entries: 512 NET: Registered protocol family 16 ===== ar7240_platform_init: 0 bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 AR7240 GPIOC major 0 squashfs: version 4.0 (2009/01/31) Phillip Lougher NTFS driver 2.1.29 [Flags: R/W DEBUG]. JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc. fuse init (API version 7.12) msgmni has been set to 120 alg: No test for lzma (lzma-generic) alg: No test for stdrng (krng) io scheduler noop registered (default) gpio: ath-gpio module inited! Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled ttyS0: detected caps 00000000 should be 00000100 serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A console [ttyS0] enabled brd: module loaded PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 PPPoL2TP kernel driver, V1.0 6 cmdlinepart partitions found on MTD device ar7240-nor0 Creating 6 MTD partitions on "ar7240-nor0": 0x000000000000-0x000000010000 : "u-boot" 0x000000010000-0x000000020000 : "u-boot-env" 0x000000020000-0x000000eb0000 : "rootfs" 0x000000eb0000-0x000000fe0000 : "uImage" 0x000000fe0000-0x000000ff0000 : "NVRAM" 0x000000ff0000-0x000001000000 : "ART" usbmon: debugfs is not available usbcore: registered new interface driver usbserial USB Serial support registered for generic usbcore: registered new interface driver usbserial_generic usbserial: USB Serial Driver core USB Serial support registered for GSM modem (1-port) usbcore: registered new interface driver option option: v0.7.2:USB Driver for GSM modems Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (1024 buckets, 4096 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. xt_time: kernel timezone is -0000 ip_tables: (C) 2000-2006 Netfilter Core Team ClusterIP Version 0.8 loaded successfully arp_tables: (C) 2002 David S. Miller TCP cubic registered NET: Registered protocol family 17 Bridge firewalling registered Ebtables v2.0 registered ebt_ulog: out of memory trying to call netlink_kernel_create 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> arch/mips/ar7240/gpio.c (ar7240_simple_config_init) ZS_RESET_GPIO: 12 ar7240wdt_init: Registering WDT success VFS: Mounted root (jffs2 filesystem) on device 31:2. Freeing unused kernel memory: 132k freed ATHR_GMAC: Length per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 ATHR_GMAC: Mac address for unit 0:bfff0000 ATHR_GMAC: 00:03:7f:xx:xx:x8 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 252 ATHR_GMAC: Mac capability flags : 4403 ATHR_GMAC: Mac address for unit 1:bfff0006 ATHR_GMAC: 00:03:7f:xx:xx:x9 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 96 ATHR_GMAC: Mac capability flags : 4D83 athr_gmac_ring_alloc Allocated 640 at 0x83979c00 athr_gmac_ring_alloc Allocated 4032 at 0x8394d000 Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY... athr_gmac_ring_alloc Allocated 640 at 0x83979800 athr_gmac_ring_alloc Allocated 1536 at 0x83977800 ATHRS26: resetting s26 ATHRS26: s26 reset done Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY... device eth0 entered promiscuous mode ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver Port Status 1c000004 ar7240-ehci ar7240-ehci.0: ATH EHCI ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1 ehci_reset Intialize USB CONTROLLER in host mode: 3 ehci_reset Port Status 1c000000 ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000 ehci_reset Intialize USB CONTROLLER in host mode: 3 ehci_reset Port Status 1c000000 ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. **** drop_caches_sysctl_handler: all done timer added ...**** asf: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_ahb: 9.2.0_U11.14 (Atheros/multi-bss) __ath_attach: Set global_scn[0] ACBKMinfree = 48 ACBEMinfree = 32 ACVIMinfree = 16 ACVOMinfree = 0 CABMinfree = 48 UAPSDMinfree = 0 Bootstrap clock 25MHz ar9300RadioAttach: Need analog access recipe!! Restoring Cal data from Flash Using Cal data from Flash 0xbfff0000 ath_get_caps[5184] rx chainmask mismatch actual 1 sc_chainmak 0 ath_get_caps[5159] tx chainmask mismatch actual 1 sc_chainmak 0 SC Callback Registration for wifi0 wifi0: Atheros 9380: mem=0xb8100000, irq=2 wlan_vap_create : enter. devhandle=0x83c202c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x83c202c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. device ath0 entered promiscuous mode br0: port 2(ath0) entering forwarding state ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1 Scan in progress.. Cancelling it br0: port 2(ath0) entering disabled state DEVICE IS DOWN ifname=ath0 DEVICE IS DOWN ifname=ath0 br0: port 2(ath0) entering forwarding state usb 1-1: new high speed USB device using ar7240-ehci and address 2 usb 1-1: configuration #1 chosen from 1 choice scsi0 : SCSI emulation for USB Mass Storage devices usb-storage: device found at 2 usb-storage: waiting for device to settle before scanning usb 1-1: USB disconnect, address 2 usb 1-1: new high speed USB device using ar7240-ehci and address 3 usb 1-1: configuration #1 chosen from 1 choice scsi1 : SCSI emulation for USB Mass Storage devices usb-storage: device found at 3 usb-storage: waiting for device to settle before scanning scsi 1:0:0:0: Direct-Access Generic STORAGE DEVICE 9454 PQ: 0 ANSI: 0 usb-storage: device scan complete sd 1:0:0:0: [sda] 124735488 512-byte logical blocks: (63.8 GB/59.4 GiB) sd 1:0:0:0: [sda] Write Protect is off sd 1:0:0:0: [sda] Mode Sense: 03 00 00 00 sd 1:0:0:0: [sda] Assuming drive cache: write through sd 1:0:0:0: [sda] Assuming drive cache: write through sda: sda1 sd 1:0:0:0: [sda] Assuming drive cache: write through sd 1:0:0:0: [sda] Attached SCSI removable disk ath_tx_edma_tasklet: TXQ[1] tailindex 0

toh/zsun/wifi-card-reader.txt · Last modified: 2017/01/11 22:02 by gdm85