Devolo Dlan 500 Duo Plus Firmware

Devolo, the device manufacturer, added support for it in OpenWrt. This is great!

The dLAN pro 500 Wireless plus (also spelled "dLAN 500 wireless+") is a device with:

Layer0	raw NOR flash memory chip (m25p80 compatible spi0.0) 8192 KiB
Layer1 partition	mtd0	mtd1	mtd2	mtd3	mtd4			mtd8
Layer1 name	u-boot	u-kick-env	Config1	Config2	firmware			art
Layer1 size (KiB)	256KiB	64KiB	64KiB	64KiB	7680KiB			64KiB
Layer2 partition					mtd5	mtd6
Layer2 name					kernel	rootfs
Layer3 partition						-	mtd7
Layer3 name						-	rootfs_data

$ cat /proc/mtd dev:    size   erasesize  name mtd0: 00040000 00010000 "u-boot" mtd1: 00010000 00010000 "u-boot-env" mtd2: 00010000 00010000 "Config1" mtd3: 00010000 00010000 "Config2" mtd4: 00780000 00010000 "firmware" mtd5: 00140000 00010000 "kernel" mtd6: 00640000 00010000 "rootfs" mtd7: 00110000 00010000 "rootfs_data" mtd8: 00010000 00010000 "art"

Installation procedure

The devices comes with a bootloader called u-kicking. It's the outset software that runs on the device.

At boot, if the internal push button is pressed, the bootloader will load and wink a file named "uploadfile" from a tftp server at 192.168.0.100.

This permits us to easily install OpenWrt, but it will erase the original organisation while doing it. That ways that we cannot backup the original system by using this installation process.

Preparation

So to install OpenWrt, y'all need to do a chip of preparation first.

Setup tftp server

Knowing what is going on

Installation

Then go a ability strip with a button and put the power strip on the table where your estimator is located and plug the device(The "dlan pro 500 wireless plus") in it, to hands ability-on/power-off the device.

You also need to become a screwdriver that can press the internal push button: That push is barely visible from the outside, it is hidden under the black encompass, on the bottom-right of the device. Information technology can be pressed past using a screwdriver in the second hole from the bottom-right.

Then to make the device install OpenWrt:

Specific values needed for tftp

TFTP server IPv4 address	192.168.0.100
Firmware TFTP image	Latest OpenWrt release
Firmware filename on TFTP server	uploadfile

Installing OpenWrt doesn't reflash the booloader.

So if yous didn't reflash it by yourself, yous can hands recover just by re-installing an prototype trough the TFTP installation procedure.

→ Bones configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The default network configuration is:

Interface Name	Description	Default configuration
br-lan	Ethernet(LAN) and WiFi
eth0	Powerline ethernet interface
eth1	Ethernet interface (bridged with WiFi in br-lan)
wlan0	WiFi interface ridged (bridged with WiFi in br-lan)

Powerline introduction

The powerline ethernet interface name is eth0. Unfortunately information technology doesn't work without a (not-free) firmware and a configuration file. OpenWrt and LEDE do non ship them equally they would need the right to redistribute them.

They tin nonetheless exist extracted from the vendor firmware update or avpromanager.bin file. Information technology is currently easier download the firmware update from devolo'due south website and extract all the files of the firmware update with binwalk.

In one case this is washed you lot take to first make sure to become the correct firmware and configuration files. On my device you lot can spot "MT2555" in the top right of the device every bit seen on this image

So offset start by looking, on the top-left of the bottom of your device for either:

In the extracted firmware update, in /usr/intfw y'all volition have the post-obit files:

Yous can and then copy int6x00.nvm to the devolo dlan pro wireless 500 plus.

For the configuration file, it's more complicated as it must exist modified to make the powerline chip work properly.

Generating the configuration data

To do that yous must first install open-plc-utils on a computer (The source code is at https://github.com/qca/open-plc-utils.git). Once this is done y'all can then modify the configuration information. You need to configure several parameters:

The MAC address tin be retrived by running, on the devolo dlan pro wireless 500 plus:

ifconfig eth0

The Device Admission Key (DAK) and the Network Membership Fundamental (NMK) can be generated. However the Network Membership key (NMN) can be used to join a network (more than on that later)

For at present we will but generate a valid configuration data file:

$ MAC=<the mac address of eth0 on the devolo> $ DAK=$(rkey cloak-and-dagger.primal -D) $ NMK=$(rkey secret.key -M) $ modpib -5 -Grand ${MAC} -North ${NMK} -D ${DAK} 2555.pib $ setpib 2555.pib 7 byte 0

Loading the firmware

Theses are the commands used to manually load the powerline firmware on the devolo dlan wireless 500 plus:

$ echo ane > "/sys/class/gpio/gpio13/value" $ ifconfig "eth0" upwardly $ amptool -i "eth0" -Iar $ ampboot -i "eth0" -P "bin/2555.pib" -N "bin/int6x00.nvm"

Joining networks

Using the same Network Membership Key between devices is a way to make device join the same network.

On some (other) powerline devices, the only way to pair devices together is to push a push button and await for the devices to connect together.

open-plc-utils also has documentation and utilities to exist compatible with this button push pairing.

Past default, the switch configuration permit devices on the different Ethernet ports to talk to the dlan pro wireless 500 plus, but practise non allow such devices to talk to other devices on a dissimilar Ethernet port of the switch, this tin be very confusing.

To let devices to talk to other devices on a different Ethernet port, the switch configuration needs to exist changed.

To modify it temporarily, until the next boot/reboot, you tin can run the following control:

swconfig dev switch0 set enable_vlan 1

Or to practice the modify it in a more permanent way, you can add the following to /etc/config/network:

config 'switch' 'switch0' 	pick 'enable_vlan' '1' 	option 'use' '1'

Information technology will then be applied at next reboot.

Information technology is probably also possible to do the change trough other means, like trough the web interface (luci).

The Devolo Dlan pro wireless 500 plus has the following buttons:

Push button	Result
ON/OFF (Wireless)	?
WPS	?
dLAN	?
Subconscious reset button	?

The hardware is made of two PCBs stacked together with pin-header-connectors:

WARNING Since the power supply is integrated into the unit of measurement, you should non open information technology.

Practise Non IGNORE THIS Alarm. If y'all die, you will non be able to contribute to costless and open source software anymore.

In doubt, DO Non Open THE DEVICE. If you lot open up it, You lot MIGHT DIE.

Opening the device will nearly probably also void your warranty.

Because of the above I didn't try to observe the serial and JTAG ports on this device. Exercise non even call back of operating the device while open, as information technology is even more unsafe.

In that location is an empty SOIC-8 emplacement on the "Access bespeak PCB" that isn't populated, but the pins aren't connected to the WSON-8 wink chip pins.

The details (chip marking names and so on) are within the pictures EXIF, they tin can for instance be viewed with okular.

PCB Pictures:

Provide OpenWrt boot log

# dmesg [ 0.000000] Linux version iv.4.61 (gnutoo@second-laptop) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3270-09a8183ce8) ) #0 Fri May 5 18:00:57 2017 [ 0.000000] MyLoader: sysp=80020044, boardp=00800223, parts=00004480 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc) [ 0.000000] SoC: Atheros AR9344 rev iii [ 0.000000] Determined concrete RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] User-divers physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] Initrd non found or empty - disabling initrd [ 0.000000] No valid device tree constitute, standing without [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Movable zone showtime for each node [ 0.000000] Early on retention node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] On node 0 totalpages: 32768 [ 0.000000] free_area_init_node: node 0, pgdat 8040a3d0, node_mem_map 81000000 [ 0.000000] Normal zone: 256 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 32768 pages, LIFO batch:7 [ 0.000000] Master pedagogy cache 64kB, VIPT, 4-mode, linesize 32 bytes. [ 0.000000] Primary data enshroud 32kB, 4-style, VIPT, cache aliases, linesize 32 bytes [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists in Zone order, mobility group on. Total pages: 32512 [ 0.000000] Kernel control line: board=dLAN-pro-500-wp console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,64k(Config1)ro,64k(Config2)ro,7680k@0x70000(firmware),64k(fine art)ro mem=128M rootfstype=squashfs,jffs2 noinitrd [ 0.000000] PID hash tabular array entries: 512 (order: -1, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Writing ErrCtl annals=00000000 [ 0.000000] Readback ErrCtl annals=00000000 [ 0.000000] Memory: 125140K/131072K available (2967K kernel lawmaking, 157K rwdata, 748K rodata, 280K init, 200K bss, 5932K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=ane, Nodes=1 [ 0.000000] NR_IRQS:51 [ 0.000000] Clocks: CPU:560.000MHz, DDR:450.000MHz, AHB:225.000MHz, Ref:40.000MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6825930166 ns [ 0.000009] sched_clock: 32 bits at 280MHz, resolution 3ns, wraps every 7669584382ns [ 0.008290] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688) [ 0.081137] pid_max: default: 32768 minimum: 301 [ 0.086171] Mountain-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.093219] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.103153] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.113676] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.120865] NET: Registered protocol family unit xvi [ 0.127007] MIPS: machine is devolo dLAN pro 500 Wireless+ [ 0.574961] clocksource: Switched to clocksource MIPS [ 0.581709] NET: Registered protocol family 2 [ 0.587123] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.594551] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.601361] TCP: Hash tables configured (established 1024 bind 1024) [ 0.608214] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.614435] UDP-Calorie-free hash table entries: 256 (guild: 0, 4096 bytes) [ 0.621382] NET: Registered protocol family 1 [ 0.626104] PCI: CLS 0 bytes, default 32 [ 0.630059] Crashlog allocated RAM at address 0x3f00000 [ 0.649661] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.655941] jffs2: version 2.two (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Ruby-red Hat, Inc. [ 0.669029] io scheduler noop registered [ 0.673212] io scheduler deadline registered (default) [ 0.678921] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled [ 0.686142] console [ttyS0] disabled [ 0.710019] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = xi, base_baud = 2500000) is a 16550A [ 0.719208] console [ttyS0] enabled [ 0.726629] bootconsole [early0] disabled [ 0.737952] m25p80 spi0.0: plant s25sl064p, expected m25p80 [ 0.743618] m25p80 spi0.0: s25sl064p (8192 Kbytes) [ 0.748554] 6 cmdlinepart partitions found on MTD device spi0.0 [ 0.754557] Creating half-dozen MTD partitions on "spi0.0": [ 0.759437] 0x000000000000-0x000000040000 : "u-boot" [ 0.766629] 0x000000040000-0x000000050000 : "u-kick-env" [ 0.773607] 0x000000050000-0x000000060000 : "Config1" [ 0.780362] 0x000000060000-0x000000070000 : "Config2" [ 0.787100] 0x000000070000-0x0000007f0000 : "firmware" [ 0.802460] 2 uimage-fw partitions institute on MTD device firmware [ 0.808514] 0x000000070000-0x0000001b0000 : "kernel" [ 0.815130] 0x0000001b0000-0x0000007f0000 : "rootfs" [ 0.821731] mtd: device 6 (rootfs) prepare to exist root filesystem [ 0.827552] 1 squashfs-split up partitions constitute on MTD device rootfs [ 0.833829] 0x0000006e0000-0x0000007f0000 : "rootfs_data" [ 0.840931] 0x0000007f0000-0x000000800000 : "art" [ 0.862957] libphy: ag71xx_mdio: probed [ 0.888594] libphy: ag71xx_mdio: probed [ 1.476880] eth0: Atheros AG71xx at 0xb9000000, irq 4, style:RGMII [ ii.066722] ag71xx-mdio.i: Found an AR934X congenital-in switch [ ii.109089] eth1: Atheros AG71xx at 0xba000000, irq v, style:GMII [ two.117360] Cyberspace: Registered protocol family 10 [ two.125559] Internet: Registered protocol family 17 [ 2.130157] span: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if yous demand this. [ 2.143103] 8021q: 802.1Q VLAN Support v1.viii [ 2.153903] VFS: Mounted root (squashfs filesystem) readonly on device 31:half dozen. [ 2.162399] Freeing unused kernel memory: 280K (8042a000 - 80470000) [ 3.335965] init: Console is alive [ 3.339624] init: - watchdog - [ four.256542] kmodloader: loading kernel modules from /etc/modules-kicking.d/* [ 4.377282] kmodloader: washed loading kernel modules from /etc/modules-boot.d/* [ 4.385539] init: - preinit - [ 5.103388] eth0: link upwardly (1000Mbps/Full duplex) [ v.127899] random: procd: uninitialized urandom read (4 bytes read, 8 $.25 of entropy bachelor) [ 7.370676] jffs2: notice: (411) jffs2_build_xattr_subsystem: complete edifice xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) constitute. [ vii.388072] mount_root: switching to jffs2 overlay [ 7.407891] urandom-seed: Seeding with /etc/urandom.seed [ 7.537186] eth0: link down [ 7.551169] procd: - early - [ seven.554192] procd: - watchdog - [ eight.249132] procd: - ubus - [ 8.451855] random: ubusd: uninitialized urandom read (4 bytes read, 14 bits of entropy available) [ 8.461452] random: ubusd: uninitialized urandom read (4 bytes read, 14 bits of entropy available) [ 8.470707] random: ubusd: uninitialized urandom read (four bytes read, 14 bits of entropy available) [ viii.483710] random: ubusd: uninitialized urandom read (4 bytes read, xiv bits of entropy available) [ 8.492948] random: ubusd: uninitialized urandom read (4 bytes read, xiv $.25 of entropy available) [ 8.502631] random: ubusd: uninitialized urandom read (four bytes read, 14 $.25 of entropy available) [ 8.512022] random: ubusd: uninitialized urandom read (4 bytes read, 14 bits of entropy available) [ 8.521567] procd: - init - [ nine.201984] kmodloader: loading kernel modules from /etc/modules.d/* [ 9.218396] tun: Universal TUN/TAP device driver, ane.6 [ 9.223528] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> [ ix.234474] ip6_tables: (C) 2000-2006 Netfilter Core Team [ nine.253403] Loading modules backported from Linux version wt-2017-01-31-0-ge882dff19e7f [ 9.261577] Backport generated past backports.git backports-20160324-13-g24da7d3c [ 9.276739] ip_tables: (C) 2000-2006 Netfilter Core Team [ ix.289959] nf_conntrack version 0.5.0 (1959 buckets, 7836 max) [ 9.316280] Netfilter letters via NETLINK v0.thirty. [ 9.612592] xt_time: kernel timezone is -0000 [ 9.678555] nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net> [ ix.760387] ath: EEPROM regdomain: 0x37 [ nine.760406] ath: EEPROM indicates nosotros should await a straight regpair map [ ix.760420] ath: Land alpha2 being used: AW [ 9.760430] ath: Regpair used: 0x37 [ 9.772929] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ nine.777801] ieee80211 phy0: Atheros AR9340 Rev:3 mem=0xb8100000, irq=47 [ 9.858892] kmodloader: washed loading kernel modules from /etc/modules.d/* [ 11.064893] random: jshn: uninitialized urandom read (4 bytes read, 18 bits of entropy available) [ 11.165071] random: ubusd: uninitialized urandom read (four bytes read, eighteen $.25 of entropy available) [ 11.970234] eth0: link upward (1000Mbps/Total duplex) [ 20.172699] eth0: link downwardly [ 20.239255] device eth1 entered promiscuous mode [ twenty.323572] br-lan: port 1(eth1) entered forwarding state [ 20.329138] br-lan: port 1(eth1) entered forwarding state [ 20.387717] eth0: link up (1000Mbps/Full duplex) [ 21.506178] br-lan: port 1(eth1) entered disabled state [ 21.846784] eth1: link up (1000Mbps/Total duplex) [ 21.895059] br-lan: port 1(eth1) entered forwarding land [ 21.900591] br-lan: port 1(eth1) entered forwarding state [ 23.553734] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 23.638880] device wlan0 entered promiscuous style [ 23.643750] br-lan: port 2(wlan0) entered forwarding land [ 23.649393] br-lan: port ii(wlan0) entered forwarding state [ 23.707613] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes fix [ 23.895010] br-lan: port 1(eth1) entered forwarding country [ 25.645010] br-lan: port two(wlan0) entered forwarding state [ 44.851108] random: nonblocking puddle is initialized [ 477.023372] eth1: link down [ 477.026551] br-lan: port ane(eth1) entered disabled state [ 478.524283] eth1: link up (1000Mbps/Full duplex) [ 478.529031] br-lan: port 1(eth1) entered forwarding land [ 478.534594] br-lan: port 1(eth1) entered forwarding state [ 480.532546] br-lan: port 1(eth1) entered forwarding country [ 760.021614] eth1: link downward [ 760.024801] br-lan: port i(eth1) entered disabled state [ 803.022261] eth1: link upwards (1000Mbps/Full duplex) [ 803.027003] br-lan: port 1(eth1) entered forwarding country [ 803.032559] br-lan: port 1(eth1) entered forwarding country [ 805.030432] br-lan: port 1(eth1) entered forwarding state [10443.947240] eth1: link downward [10443.950417] br-lan: port 1(eth1) entered disabled state [10489.447846] eth1: link up (1000Mbps/Total duplex) [10489.452588] br-lan: port 1(eth1) entered forwarding state [10489.458147] br-lan: port 1(eth1) entered forwarding state [10491.456088] br-lan: port ane(eth1) entered forwarding state

The u-kick has very early init lawmaking from atheros (grep for FPGA in the diff).