WikiDevi will be going offline 2019-10-31. For historical dumps of the database, see 'WikiDevi' @ the Internet Archive (MW XML, Files, Images).
Final dumps will be made available after the site goes offline.
There is no chance the data will not live on, in some form - even if it isn't 'WikiDevi' anymore. For example, see TechInfoDepot.

D-Link DIR-615 rev A1

From WikiDevi
Jump to: navigation, search

D-Link DIR-615 A1
Availability: common

Manuf/OEM/ODM Cameo

FCC approval date: 14 February 2007
Country of manuf.: China

Type: wireless router

Industry Canada ID: 4216A-IR615

Power: 5 VDC, 3 A
Connector type: barrel
Conn. measurements: 5.5 mm (OD), 2.2 mm (ID), 10 mm (LEN)

CPU1: Marvell 88F5180NB1 (500 MHz)
FLA1: 8 MiB
8,388,608 B
65,536 Kib
8,192 KiB
64 Mib
0.00781 GiB
(Intel JS28F640J3D75)
RAM1: 32 MiB
33,554,432 B
262,144 Kib
32,768 KiB
256 Mib
0.0313 GiB
(PSC A2S28D40CTP-G5 × 2)

Expansion IFs: Mini PCI
Mini PCI slots: 1
Serial: yes, internal, 4-pin header, (115200,8,N,1), unpopulated, 3.3V TTL

WI1 module: Cameo WLN-1307
WI1 module IF: Mini PCI
WI1 chip1: Marvell 88W8361P
WI1 chip2: Marvell 88W8060
WI1 802dot11 protocols: bgn
WI1 MIMO config: 2x3:2
WI1 antenna connector: U.FL, RP-SMA

ETH chip1: Marvell 88F5180NB1
Switch: Marvell 88E6061
LAN speed: 100M
LAN ports: 4
WAN speed: 100M
WAN ports: 1


Stock bootloader: U-Boot 1.1.1 vendor modified

Stock FW OS: Linux 2.4.27 -vrs1

Flags: boot log

Default SSID: dlink (38 addl. devices), MarvellAP8x
Default IP address:
the IP is used by 738 additional devices
of which 209 are D-Link devices
Default login user: admin
Default login password: blank
admin:blank credentials used by 316 additional devices
of which 180 are D-Link devices

802dot11 OUI: 00:1B:11 (7 E, 16 W, 2006), 00:1C:F0 (12 E, 19 W, 2006), 00:1E:58 (11 E, 12 W, 2007)
Ethernet OUI: 00:1B:11 (7 E, 16 W, 2006), 00:1C:F0 (12 E, 19 W, 2006), 00:1E:58 (11 E, 12 W, 2007)

Cameo WLN-1307KA2DIR615A1
 CPU1 brandWI1 chip1 brandWI1 chip2 brand
D-Link DIR-615 rev A1MarvellMarvellMarvell
D-Link DIR-615 rev B2UbicomAtherosAtheros
D-Link DIR-615 rev C1AtherosAtherosAtheros
D-Link DIR-615 rev DRalinkRalink
D-Link DIR-615 rev E1AtherosAtheros
D-Link DIR-615 rev E3 / E4AtherosAtheros
D-Link DIR-615 rev E5AtherosAtheros
D-Link DIR-615 rev F3RealtekRealtek
D-Link DIR-615 rev G1RalinkRalink
D-Link DIR-615 rev H1RalinkRalink
D-Link DIR-615 rev I1AtherosAtheros
D-Link DIR-615 rev I3AtherosAtheros
D-Link DIR-615 rev K1BroadcomBroadcom
D-Link DIR-615 rev K2BroadcomBroadcom
D-Link DIR-615 rev M1RealtekRealtek
D-Link DIR-615 rev N1RealtekRealtek
D-Link DIR-615 rev Q2RealtekRealtek
D-Link DIR-615 rev R1BroadcomBroadcom
D-Link DIR-615 rev S1RealtekRealtek
D-Link DIR-615 rev T1RealtekRealtek
D-Link DIR-615 rev T3RealtekRealtek
D-Link DIR-615S rev A1RealtekRealtek
For a list of all currently documented Marvell chipsets with specifications, see Marvell.

Product page  • Support page

"21514DR635B11A1" and "DIR-635B1 VER:A1" is silkscreened on the board.

The wireless module has PCI ID: 11ab:2a02 (07d1:3b02).


See also Warner's Random Hacking Blog here and here

(boot log, there is a serial port under the internal antenna).

This board has been assigned ARM Linux Board ID# 4262.

To recover a soft-bricked unit without use of the serial console..

Under Linux,
curl -0F files=@dir615_firmware_110.bin

When booting, the AP assumes the SSID of MarvellAP8x.

The default SSID is dlink.


The pinout for the serial connection is labelled on the board's silkscreen.

Logs + info dump[edit]

boot log from a non-working unit
U-Boot 1.1.1 (Jan 19 2007 - 11:08:07)
CAMEO uBoot Linux Loader version:

DRAM CS[0] base 0x00000000   size  32MB
DRAM Total size  32MB
before entry mvFlashInit
Flash: flashStructGet manu 0x89 id 0x17
INTEL 28F640J3A (64 Mbit)
Size:  8 MB,Bus Width: 1, device Width: 1.
Flash base: 0xff800000,Number of Sectors: 64 Type: REGULAR.
  Sector Start Addresses:
    00000000      00020000      00040000      00060000      00080000
    000a0000      000c0000      000e0000      00100000      00120000
    00140000      00160000      00180000      001a0000      001c0000
    001e0000      00200000      00220000      00240000      00260000
    00280000      002a0000      002c0000      002e0000      00300000
    00320000      00340000      00360000      00380000      003a0000
    003c0000      003e0000      00400000      00420000      00440000
    00460000      00480000      004a0000      004c0000      004e0000
    00500000      00520000      00540000      00560000      00580000
    005a0000      005c0000      005e0000      00600000      00620000
    00640000      00660000      00680000      006a0000      006c0000
    006e0000      00700000      00720000      00740000      00760000 (RO)
    00780000 (RO) 007a0000 (RO) 007c0000 (RO) 007e0000 (RO)
[8192kB@ff800000] Flash:  8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
*** Warning - bad CRC, using default environment

Soc: 88F5181 B1
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz

USB 0: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0
### JFFS2 loading 'uImage' to 0x400000
Scanning JFFS2 FS: ..... done.
### JFFS2 load complete: 1099492 bytes loaded to 0x400000
## Booting image at 00400000 ...
   Image Name:   Linux-2.4.27-vrs1
   Created:      2007-07-26   6:29:23 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1099428 Bytes =  1 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK

Starting kernel ...
Uncompressing Linux...done, booting the kernel.
ZLinux version 2.4.27-vrs1 (root@localhost.localdomain) (gcc version 3.4.4 (release) 
 (CodeSourcery ARM 2005q3-1)) #2 Thu Jul 26 14:28:55 CST 2007
CPU: ARM926EJ-Sid(wb) revision 0
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 166000000, Tclk = 166000000

- Warning - This LSP release was tested only with U-Boot release 1.7.0

On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,115200 mtdparts=phys_mapped_flash:6m(root),1m@6m(nvram),
 1m@7m(uboot)ro root=/dev/mtdblock1 rw ip=
Calibrating delay loop... 331.77 BogoMIPS
Memory: 32MB 0MB 0MB 0MB = 32MB total
Memory: 29884KB available (2034K code, 366K data, 88K init)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
CPU: Testing write buffer: pass
POSIX conformance testing by UNIFIX
init hw started.

CPU Interface
SDRAM_CS0 ....base 00000000, size  32MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e0000000, size 128MB
PEX0_IO ....base f2000000, size   1MB
PCI0_MEM ....base e8000000, size 128MB
PCI0_IO ....base f2100000, size   1MB
INTER_REGS ....base f1000000, size   1MB
DEV_BOOCS ....base f4000000, size  16MB
PCI: bus0: Fast back to back transfers enabled
HW already initialized.
PCI: bus1: Fast back to back transfers enabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
 bankwidth 1, base f4000000, size 1000000

  Marvell Development Board (LSP Version 0.0.102)-- RD-88F5181L-VOIP-FE

 Detected Tclk 166000000 and SysClk 166000000
Starting kswapd
Journalled Block Device driver loaded
NTFS driver v1.1.22 [Flags: R/O]
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xf1012000 (irq = 3) is a 16550A
HDLC line discipline: version $Revision: $, maxframe=4096
N_HDLC line discipline registered.
Marvell Gigabit Ethernet Driver 'egiga':
  o Ethernet descriptors in DRAM
  o DRAM SW cache-coherency
  o Loading network interface
  o Using switch header mode
qdStart: CPU port 0x5
Switch driver initialized
Can't get netConfig: Use default
UNM is not initialized yet
2 VLANs created: CpuPortMask = 0x1f
vid=0:  DISABLED(0), portMask=0x7c0, portNum=5
vid=1:       VLAN_1, portMask=0x10, portNum=1
vid=2:       VLAN_2, portMask=0x0f, portNum=4
vid=12: ISOLATED(12), portMask=0x00, portNum=0
Port - Vlan
 0  - VLAN_2
 1  - VLAN_2
 2  - VLAN_2
 3  - VLAN_2
 4  - VLAN_1
 5  - VLAN_ALL
load virtual interface vid = 1
 register if with name
Init the hal
: Ilegal MTU value 1500,  rounding MTU to: 1506
 if eth0 registered
load virtual interface vid = 2
 register if with name
 if eth1 registered
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
SCSI subsystem driver Revision: 1.00
physmap flash device: 1000000 at f4000000
cfi_cmdset_0001: Erase suspend on write enabled
Using buffer write method
Using command line partition definition
Creating 3 MTD partitions on "Physically mapped flash":
0x00000000-0x00600000 : "root"
0x00600000-0x00700000 : "nvram"
0x00700000-0x00800000 : "uboot"
usb.c: registered new driver hub
EHCI Marvell Init
ehci_marvell_probe: driver=c01ecc40
hcd allocated: marvell_hcd=c02ee664
mv_ehci_0: IRQ=17, Regs=f1050100
mv_ehci - Bus allocated: bus=c035a1e0
usb.c: new USB bus registered, assigned bus number 1
mv_ehci - Bus registered: bus=c035a1e0
ehci_hcd <NULL>: USB 2.0 enabled, EHCI 1.00, driver 2003-Dec-29/2.4
hub.c: USB hub found
ehci_hub_descriptor: hcs_params=0x10011, ports=1, Characteristics=0x0089
hub.c: 1 port detected
mv_ehci - Started
host/usb-uhci.c: $Revision: $ time 14:28:59 Jul 26 2007
host/usb-uhci.c: High bandwidth mode enabled
host/usb-uhci.c: v1.275:USB Universal Host Controller Interface driver
usb.c: registered new driver hiddev
usb.c: registered new driver hid
hid-core.c: v1.8.1 Andreas Gal, Vojtech Pavlik <>
hid-core.c: USB HID support drivers
pegasus.c: v0.4.32 (2003/06/06):Pegasus/Pegasus II USB Ethernet driver
usb.c: registered new driver pegasus
rtl8150.c: rtl8150 based usb-ethernet driver v0.4.3 (2002/12/31)
usb.c: registered new driver rtl8150
Initializing USB Mass Storage driver...
usb.c: registered new driver usb-storage
USB Mass Storage support registered.
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
GRE over IPv4 tunneling driver
Linux IP multicast router 0.06 plus PIM-SM
vid = 1 mvBindings[priv->vid]->header[0] = 24
IP-Config: Guessing netmask
IP-Config: Complete:
      device=eth0, addr=, mask=, gw=,
     host=DB88FXX81, domain=, nis-domain=(none),
     bootserver=, rootserver=, rootpath=
ip_conntrack version 2.1 (256 buckets, 2048 max) - 308 bytes per conntrack
ip_conntrack_rtsp v0.01 loading
ip_nat_rtsp v0.01 loading
ip_conntrack_pptp version 1.9 loaded
ip_nat_pptp version 1.5 loaded
ip_tables: (C) 2000-2002 Netfilter core team
ipt_time loading
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
Fast Floating Point Emulator V0.94M by Peter Teichmann.
cramfs: wrong magic
FAT: bogus logical sector size 34276
UMSDOS: msdos_read_super failed, mount aborted.
FAT: bogus logical sector size 34276
FAT: bogus logical sector size 34276
CLEANMARKER node found at 0x00010000, not first node in block (0x00000000)
CLEANMARKER node found at 0x00030000, not first node in block (0x00020000)
CLEANMARKER node found at 0x00050000, not first node in block (0x00040000)
CLEANMARKER node found at 0x00070000, not first node in block (0x00060000)
CLEANMARKER node found at 0x00090000, not first node in block (0x00080000)
CLEANMARKER node found at 0x000b0000, not first node in block (0x000a0000)
CLEANMARKER node found at 0x000d0000, not first node in block (0x000c0000)
CLEANMARKER node found at 0x000f0000, not first node in block (0x000e0000)
CLEANMARKER node found at 0x00110000, not first node in block (0x00100000)
CLEANMARKER node found at 0x00130000, not first node in block (0x00120000)
CLEANMARKER node found at 0x00150000, not first node in block (0x00140000)
CLEANMARKER node found at 0x00170000, not first node in block (0x00160000)
CLEANMARKER node found at 0x00190000, not first node in block (0x00180000)
CLEANMARKER node found at 0x001b0000, not first node in block (0x001a0000)
CLEANMARKER node found at 0x001d0000, not first node in block (0x001c0000)
CLEANMARKER node found at 0x001f0000, not first node in block (0x001e0000)
CLEANMARKER node found at 0x00210000, not first node in block (0x00200000)
CLEANMARKER node found at 0x00230000, not first node in block (0x00220000)
CLEANMARKER node found at 0x00250000, not first node in block (0x00240000)
CLEANMARKER node found at 0x00270000, not first node in block (0x00260000)
CLEANMARKER node found at 0x00290000, not first node in block (0x00280000)
CLEANMARKER node found at 0x002b0000, not first node in block (0x002a0000)
CLEANMARKER node found at 0x002d0000, not first node in block (0x002c0000)
CLEANMARKER node found at 0x002f0000, not first node in block (0x002e0000)
CLEANMARKER node found at 0x00310000, not first node in block (0x00300000)
CLEANMARKER node found at 0x00330000, not first node in block (0x00320000)
CLEANMARKER node found at 0x00350000, not first node in block (0x00340000)
CLEANMARKER node found at 0x00370000, not first node in block (0x00360000)
CLEANMARKER node found at 0x00390000, not first node in block (0x00380000)
CLEANMARKER node found at 0x003b0000, not first node in block (0x003a0000)
CLEANMARKER node found at 0x003d0000, not first node in block (0x003c0000)
CLEANMARKER node found at 0x003f0000, not first node in block (0x003e0000)
CLEANMARKER node found at 0x00410000, not first node in block (0x00400000)
CLEANMARKER node found at 0x00430000, not first node in block (0x00420000)
CLEANMARKER node found at 0x00450000, not first node in block (0x00440000)
VFS: Mounted root (jffs2 filesystem).
Freeing init memory: 88K

BusyBox v1.1.0 (2007.07.26-06:29+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # pc : [<40146968>]    lr : [<400ca0b8>]    Not tainted
sp : befaf8a0  ip : 00000001  fp : 40079bf8
r10: 00000003  r9 : 40079bb8  r8 : 00050500
r7 : befb4cc7  r6 : 00026740  r5 : befb4cc6  r4 : 00026744
r3 : 00000072  r2 : 00000004  r1 : 00026741  r0 : 400ca0b7
Flags: nzCv  IRQs on  FIQs on  Mode USER_32  Segment user
Control: A005317F  Table: 01DF0000  DAC: 00000015

cat /proc/version

/proc # cat version
Linux version 2.4.27-vrs1 (root@localhost.localdomain) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-1)) #2 Thu Jul 26 14:28:55 CST 2007

cat /proc/mtd

/proc # cat mtd
dev:    size   erasesize  name
mtd0: 00800000 00020000 "Physically mapped flash"
mtd1: 00600000 00020000 "root"
mtd2: 00100000 00020000 "nvram"
mtd3: 00100000 00020000 "uboot"


/ # lsmod
Module                  Size  Used by    Tainted: P
ap8x                  775272   1
gpio                    1184   4

netstat -l

/ # netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 *:80                    *:*                     LISTEN
udp        0      0 *:67                    *:*
udp        0      0 *:69                    *:*
udp        0      0 *:2003                  *:*
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path


/ # ps
  PID  Uid     VmSize Stat Command
    1 0           548 S   init
    2 0               SW  [keventd]
    3 0               SWN [ksoftirqd_CPU0]
    4 0               SW  [kswapd]
    5 0               SW  [bdflush]
    6 0               SW  [kupdated]
    7 0               SW  [mtdblockd]
    8 0               SW  [khubd]
    9 0               SWN [jffs2_gcd_mtd1]
   14 0          1376 S   rc init
   16 0           788 S   /bin/sh
   49 0           548 S   syslogd
   54 0           536 S   klogd
   57 0           448 S   httpd
   59 0           404 S   wcnd
   61 0           868 S   dcc
   67 0           452 S   lld2d br0
   74 0           988 S   wanmonitor
   96 0           388 S   /sbin/gpio SYSTEM check
   98 0           372 S   /sbin/gpio STATUS_LED blink
  100 0           932 S   /sbin/gpio TC on
  102 0           420 S   gpio WLAN_LED blink
  122 0           352 S   tftpd
  128 0           392 S   wantimer
  146 0           508 S   udhcpc -i eth0 -H DIR-615 -s /usr/share/udhcpc/defaul
  160 0          1080 S   udhcpd
  482 0           640 R   ps

bootloader stuff[edit]

Marvell>> ?
?       - alias for 'help'
FSdel   - del a file from the Flash MV FS
FSdir   - ls the Flash MV FS
FSformat- format the Flash MV FS
FSlef   - Load an exe file to the Flash MV FS
FSlf    - Load a file to the Flash MV FS
FSrun   - Load an exe file from the Flash MV FS and run it
FStftp  - tftp a file to the Flash MV FS
FStftpe - tftp an exe file to the Flash MV FS
FStype  - cat file from the Flash MV FS
base    - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootext2    dev:boot_part1,boot_part2 addr boot_image linux_dev_name
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
bootvx  - Boot vxWorks from an ELF image
bubt    - Burn an image on the Boot Flash.
chpart  - change active partition
cmp     - memory compare
cmpm    - Compare Memory
cp      - memory copy
cpumap - Display CPU memory mapping settings.
crc32   - checksum calculation
date    - get/set/reset date & time
dclk    - Display the MV device CLKs.
ddimm  - Display SPD Dimm Info
dhcp    - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
dma     - Perform DMA
echo    - echo args to console
eeprom  - EEPROM sub-system
erase   - erase FLASH memory
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fi      - Find value in the memory.
flinfo  - print FLASH memory information
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
g       - start application at cached address 'addr'(default addr 0x40000)
go      - start application at address 'addr'
help    - print online help
icrc32  - checksum calculation
ide     - IDE sub-system
iloop   - infinite loop on address range
imd     - i2c memory display
imm     - i2c memory modify (auto-incrementing)
imw     - memory write (fill)
inm     - memory modify (constant address)
iprobe  - probe to discover valid I2C chip addresses
ir      - reading and changing MV internal register values.
ln      - Load S-Record executable file through the network interface.
loop    - infinite loop on address range
ls      - list files in a directory (default /)
map     - Diasplay address decode windows
md      - memory display
me      - PCI master enable
mm      - memory modify (auto-incrementing)
mp      - map PCI BAR
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
pci     - list and access PCI Configuraton Space
phyRead - Read Phy register
phyWrite        - Write Phy register
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
resetenv        - Return all environment variable to default.
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
se      - PCI Slave enable
setenv  - set environment variables
sg      - scanning the PHYs status
sleep   - delay execution for some time
sp      - Scan PCI bus.
tftpboot- boot image via network using TFTP protocol
version - print monitor version
environment variables
Marvell>> printenv
bootargs=console=ttyS0,115200 mtdparts=phys_mapped_flash:6m(root),1m@6m(nvram),1m@7m(uboot)ro
bootcmd=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock1 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
bootargs_root=root=/dev/nfs rw
standalone=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;

Environment size: 799/40956 bytes