Belkin F9K1103 v1
(Redirected from Belkin F9K1103)
Jump to navigation
Jump to search
Belkin F9K1103 v1
Availability: common
Manuf (OEM/ODM): Arcadyan WG9117 A23-AK
FCC approval date: 06 May 2011
(Est.) release date: 27 May 2011
UPC: 722868817872 (UPC DB, On eBay)
Country of manuf.: China
S/N prefix: 12113
Type: wireless router
FCC ID: K7SF9K1103V1
IC ID: 3623A-F9K1103V1
Power: 12 VDC, 2 A
Connector type: barrel
CPU1: Ralink RT3883 (500 MHz)
FLA1: 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (Macronix MX25L6406EM2I-12G)
RAM1: 64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (EtronTech EM68B16CWPA-25H)
Expansion IFs: USB 2.0
USB ports: 2
Serial: yes, 4-pin header, (57600,8,N,1), 3.3V TTL, J12
WI1 chip1: Ralink RT3883
WI1 802dot11 protocols: an
WI1 MIMO config: 3x3:3
WI1 antenna connector: U.FL
WI2 chip1: Ralink RT3092
WI2 802dot11 protocols: bgn
WI2 MIMO config: 2x2:2
WI2 antenna connector: none
ETH chip1: Ralink RT3883
Switch: Realtek RTL8367R-VB
LAN speed: 1G
LAN ports: 4
WAN speed: 1G
WAN ports: 1
abgn
Stock bootloader: U-Boot 3.5.2.0 Ralink
Stock FW OS: Linux 2.6.22
Default SSID: belkin.XXX (20 addl. devices)
, belkin.XXX.5GHz (5 addl. devices)
Default IP address: 192.168.2.1
the IP 192.168.2.1 is used by 295 additional devices
of which 97 are Belkin devices
Default login user: admin
Default login password: password
admin:password credentials used by 423 additional devices
of which 0 are Belkin devices
802dot11 OUI: 08:86:3B (10 E, 14 W), 94:44:52 (17 E, 22 W)
Ethernet OUI: 08:86:3B (10 E, 14 W), 94:44:52 (17 E, 22 W)
For a list of all currently documented Ralink chipsets with specifications, see Ralink.
N750 DB Wi-Fi Dual-Band N+ Gigabit Router
"P/N: 141911720003J R01C" is silkscreened on the board.
The default SSID patterns for this model is:
- belkin.XXX (where XXX is the last three octets of the wireless interface MAC for this SSID) and
- belkin.XXX.5GHz (MAC = 2.4GHz network MAC + 2, same XXX from the 2.4GHz network).
The guest network is (if enabled) belkin.XXX.guests
- (MAC = 2.4GHz network MAC + 1, same XXX from the 2.4GHz network).
Reviews
- OUI of 08:86:3B and SSID of belkin_2
Forum threads
- Support Request - Belkin N 750 DB - F9K1103 v1 (01A) on DD-WRT forums
- Belkin F9K1103 (N750 DB) equivalent and support for openwrt on OpenWRT forums
third party firmware
Serial
Pinout
^ to RAM © (GND) © (RxD) © (TxD) --> 5 GHz ant (B) ® [3.3] NC J12
Info derived from
| • boot log |
|---|
ARC Uboot:1.7.4 (May 2 2011 - 17:16:40)
Board: Ralink APSoC DRAM: 64 MB
relocate_code Pointer at: 83fa0000
spi_wait_nsec: 30
spi device id: c2 20 17 c2 20 (2017c220)
find flash: MX25L6405D
..============================================
Ralink UBoot Version: 3.5.2.0
--------------------------------------------
ASIC 3883_MP (MAC to VITESSE Mode)
DRAM_CONF_FROM: Boot-Strapping
DRAM_TYPE: DDR2
DRAM_SIZE: 512 Mbits
DRAM_WIDTH: 16 bits
DRAM_TOTAL_WIDTH: 16 bits
TOTAL_MEMORY_SIZE: 64 MBytes
Flash component: SPI Flash
Date:May 2 2011 Time:17:16:40
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 500 MHZ ####
estimate memory size =64 Mbytes
Please choose the operation:
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP. 4 initializing CHIP_RTL8367R_VB 1010 0
initializing CHIP_RTL8367R_VB 1010
3: System Boot system code via Flash.
## Booting image at bc050000 ...
Image Name: N750F9K1103VB
Created: 2012-12-12 3:46:09 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 7398303 Bytes = 7.1 MB
Load Address: 80000000
Entry Point: 8033e000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8033e000) ...
## Giving linux memsize in MB, 64
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.22 (kevinlin@arc-vcs) (gcc version 4.1.2) #4 Wed Dec 12 11:41:34 CST 2012
cmd line = console=ttyS1,57600n8 root=/dev/mtdblock5 init=/sbin/preinit
The CPU feqenuce set to 500 MHz
CPU revision is: 0001974c
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Built 1 zonelists. Total pages: 16256
Kernel command lkne: console=ttyS1,57600n8 root=/dev/mtdblock5 init=/sbin/preinit
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
cause = 40808000, status = 11000000
PID hash table entries: 256 (order: 8, 1024 bytes)
calculating r4koff... 001e8480(2000000)
CPU frequency 500.00 MHz
Using 250.000 MHz high precision timer.
console handover: boot [early0] -> real [ttyS1]
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61184k/65536k available (2649k kernel code, 4336k reserved, 666k data, 124k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
RALINK_PCI_PCICFG_ADDR = 0
*************** Ralink PCIe RC mode *************
registering PCI controller with io_map_base unset
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
[junius] pcibios_init
Next Bus No=0 hose= 80307758 Mem=8030778C Io=803077A8
2->[1][0][0][30]=0
5->[1][0][0][30]=fffffffe
2->[1][0][0][30]=0
5->[1][0][0][30]=0
PCI: Bridge: 0000:00:00.0
IO window: disabled.
MEM window: 20000000-200fffff
PREFETCH window: disabled.
BAR0 at slot 0 = 0
bus=0, slot = 0x0
P2P(PCI) 0x00 = 08021814
P2P(PCI) 0x04 = 00100007
P2P(PCI) 0x08 = 06040001
P2P(PCI) 0x0c = 00010000
P2P(PCI) 0x10 = 00000000
P2P(PCI) 0x14 = 20100000
P2P(PCI) 0x18 = 00010100
P2P(PCI) 0x1c = 000000f0
P2P(PCI) 0x20 = 20002000
P2P(PCI) 0x24 = 0000fff0
P2P(PCI) 0x28 = 00000000
P2P(PCI) 0x2c = 00000000
P2P(PCI) 0x30 = 00000000
P2P(PCI) 0x34 = 00000040
P2P(PCI) 0x38 = 00000000
P2P(PCI) 0x3c = 000401ff
res[0]->start = 0
res[0]->end = 1ffffff
res[1]->start = 20100000
res[1]->end = 2010ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=1, slot = 0x0
dev III(PCIe) 0x00 = 30911814
dev III(PCIe) 0x04 = 00100000
dev III(PCIe) 0x08 = 02800000
dev III(PCIe) 0x0c = 00000000
dev III(PCIe) 0x10 = 20000000
dev III(PCIe) 0x14 = 00000000
dev III(PCIe) 0x18 = 00000000
dev III(PCIe) 0x1c = 00000000
dev III(PCIe) 0x20 = 00000000
dev III(PCIe) 0x24 = 00000000
dev III(PCIe) 0x28 = 00000000
dev III(PCIe) 0x2c = 30911814
dev III(PCIe) 0x30 = 00000000
dev III(PCIe) 0x34 = 00000040
dev III(PCIe) 0x38 = 00000000
dev III(PCIe) 0x3c = 000001ff
res[0]->start = 20000000
res[0]->end = 2000ffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
register_mtd_chip_driver for cfi_probe
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
deice id : c2 20 17 c2 20 (2017c220)
MX25L6405D(c2 2017c220) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 8 MTD partitions on "raspi":
0x00000000-0x00800000 : "ALL"
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x0019d3df : "Kernel"
mtd: partition "Kernel" doesn't end on an erase block -- force read-only
0x0019d3df-0x00800000 : "RootFS"
mtd: partition "RootFS" doesn't start on an erase block boundary -- force read-only
0x00050000-0x007f0000 : "Kernel_RootFS"
0x007f0000-0x00800000 : "UserCfg"
RT3xxx EHCI/OHCI init.
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
fuse init (API version 7.8)
io scheduler noop registered (default)
pcie_portdrv_probe->Dev[1814:0802] has invalid IRQ. Check vendor BIOS
assign_interrupt_mode Found MSI capability
Ralink gpio driver initialized
spidrv_major = 217
ARC_KERNEL_OSIX_init() success
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: module loaded
MAC_ADRH -- : 0x00000000
MAC_ADRL -- : 0x00000000
MAC_ADRH -- : 0x00000000
MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.0 256 rx/tx descriptors allocated, mtu = 1500!
MAC_ADRH -- : 0x0000000c
MAC_ADRL -- : 0x4328808e
PROC INIT OK!
Pull high SDA & SCK
GPIO pin 24 reset to switch
rtl8367_RouterVlanInit() rv=0
IsolateWanPort() rtk_vlan_set(VLAN1) rv=0
IsolateWanPort() rtk_vlan_set(VLAN2) rv=0
IsolateWanPort() rtk_vlan_get(VLAN1) rv=0 mbrmsk=ef untagmsk=f fid=0
IsolateWanPort() rtk_vlan_get(VLAN2) rv=0 mbrmsk=30 untagmsk=10 fid=1
IsolateWanPort() rtk_vlan_portPvid_get(0) rv=0 vid=1 pri=0
IsolateWanPort() rtk_vlan_portPvid_get(1) rv=0 vid=1 pri=0
IsolateWanPort() rtk_vlan_portPvid_get(2) rv=0 vid=1 pri=0
IsolateWanPort() rtk_vlan_portPvid_get(3) rv=0 vid=1 pri=0
IsolateWanPort() rtk_vlan_portPvid_get(4) rv=0 vid=2 pri=0
IsolateWanPort() rtk_vlan_portPvid_get(5) rv=0 vid=1 pri=0
rtl8367b driver initialized
PPP generic driver version 2.4.2
PPP BSD Compression module registered
NET: Registered protocol family 24
block2mtd: version $Revision: 1.1.1.1 $
dev_nvram_init() 827 mtd->name=UserCfg
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (512 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
ip_tables: (C) 2000-2006 Netfilter Core Team
ClusterIP Version 0.8 loaded successfully
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
mcps_module_init() initializing
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 124k freed
Warning: unable to open an initial console.
Algorithmics/MIPS FPU Emulator v1.5
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
sysinit() done
use original....
Assume Wi-Fi RadioOn everytime reboot!!
connect: Network is unreachable
rt2860v2_ap: module license 'unspecified' taints kernel.
=== pAd = c000f000, size = 487768 ===
<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
=== pAd = c0307000, size = 513184 ===
<-- RTMPAllocAdapterBlock, Status=0
pAd->CSRBaseAddress =0xc01a0000, csr_addr=0xc01a0000!
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
NET: Registered protocol family 10
MAC_ADRH -- : 0x00000886
MAC_ADRL -- : 0x3b288f94
phy_tx_ring = 0x00340000, tx_ring = 0xa0340000
phy_rx_ring0 = 0x00341000, rx_ring0 = 0xa0341000
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = C0710000
eth2.1: dev_set_promiscuity(master, 1)
device eth2 entered promiscuous mode
device eth2.1 entered promiscuous mode
br0: port 1(eth2.1) entering learning state
force port 0 up
force port 1 up
force port 2 up
force port 3 up
rmmod: hw_nat
Starting HotPlug: /usr/sbin/hotplugd -D -f
Starting jcpd daemon: /usr/sbin/jcpd
br0: topology change detected, propagating
br0: port 1(eth2.1) entering forwarding state
fw_rule_isolatedlan: br0
fw_rule_isolatedlan: br0
fw_rule_SkipSnatToLans: br0
fw_rule_SkipDnatFromLans: br0
RX DESC a0357000 size = 2048
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 8
2. Phy Mode = 8
3. Phy Mode = 8
RTMPSetPhyMode: channel is out of range, use first channel=0
MCS Set = ff ff ff 00 01
SYNC - BBP R4 to 20MHz.l
Starting Samba: /usr/sbin/smbd -D
Main bssid = 08:86:3b:28:8f:96
<==== rt28xx_init, Status=0
0x1300 = 00064380
device ra0 entered promiscuous mode
br0: port 2(ra0) entering learning state
/usr/sbin/nmbd -D
RX DESC a2dff000 size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
RTMPSetPhyMode: channel is out of range, use first channel=0
MCS Set = ff ff 00 00 01
SYNC - BBP R4 to 20MHz.l
Starting sxuptpd
USB port mode selector has been enabled
Initializing USB port mode:
port1 = NAS
port2 = NAS
usbcore: registered new interface driver sxuptp_driver
Starting usbjcpd
insmod: cannot insert '/lib/modules/2.6.22/kernel/drivers/usb/storage/usb-storage.ko':
Invalid parameters (17): Invalid argument
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
Main bssid = 08:86:3b:28:8f:94
<==== rt28xx_init, Status=0
0x1300 = 00064380
device rai0 entered promiscuous mode
br0: port 3(rai0) entering learning state
br0: topology change detected, propagating
br0: port 3(rai0) entering forwarding state
do init
wsc MsgQ System Initializationeth2.2: Setting MAC address to !
08 86 3b 28 8f 95.
< rc_wan_start: 640>: ifconfig eth2.2 up
Create netlink socket thread success!
Create ioctl socket(6) success!
Create wscd
udhcpc_main(452): udhcp client (v0.9.8) started
rc_nat_dmz_stop, 256
rc_nat_dmz_action
nat_dmz_rule_flush, 67: wan_index 0
set FW_DMZ_STAT 0 with wan_index 0
ipv6 started 0
CFG_NAT_DMZ_HOST = 2145950120 host =
rc_nat_vts_stop, 336
share memory key=74565 successful id on creating=32769
led_process_init() eco=0
wpsm_upnp_attach() OK
signalling RUNNING
rc_fw_macflt_stop : 163
start Eco_mode
rc_nat_Masquerade_stop, 182
rc_nat_Masquerade_action
nat_Masquerade_rule_flush
***** g_wl_interface = rai0 ******
lld2d: listening on interface br0
start belkin_wan_cfg
udhcpc_main(737): Received SIGTERM
belkin_wan_cfg running on 102a8c0
UPnP daemon is ready to run
ctrl_flags=0x38
rc_twonky_start: 1166
rc_all_start 112
mcps: mcps_netlink_rcv() nlh->nlmsg_len=528mcps: mcps_process_registration() mcps_pid=954
mcps: mcps_process_registration() set control flag 0x38
/bin/mknod /dev/ARCOSIX_DEV c 253 0
|
| • ps w |
|---|
# ps w
PID Uid VSZ Stat Command
1 root 2552 S /sbin/preinit
2 root SW< [kthreadd]
3 root SWN [ksoftirqd/0]
4 root SW< [watchdog/0]
5 root SW< [events/0]
6 root SW< [khelper]
36 root SW< [kblockd/0]
39 root SW< [khubd]
57 root SW [pdflush]
58 root SW [pdflush]
59 root SW< [kswapd0]
60 root SW< [aio/0]
100 root SW< [mtdblockd]
308 root 2548 S /sbin/preinit
309 root 2548 S /sbin/preinit
429 root 1516 S /usr/sbin/hotplugd -D -f
430 root 1516 S /usr/sbin/hotplugd -D -f
450 root 1516 S /usr/sbin/hotplugd -D -f
452 root 1540 S /usr/sbin/jcpd
717 root SW [RtmpCmdQTask]
718 root SW [RtmpWscTask]
723 root 6404 S /usr/sbin/smbd -D
735 root SW [RtmpCmdQTask]
736 root 6028 S /usr/sbin/nmbd -D
737 root 6404 S /usr/sbin/smbd -D
738 root SW [RtmpWscTask]
745 root SW< [sxuptp-wq]
746 root SW [sxuptp-ka]
758 root SW [jcpcore]
777 root 1848 S httpd
783 root 1352 S /usr/sbin/dnsmasq -n -i br0 -i rai1 -r /tmp/resolv.conf -x /var/run/dnsmasq.pid -u root
785 root 2140 S udhcpd /tmp/udhcpd0.conf
789 root 2140 S udhcpd /tmp/udhcpd1.conf
793 root 2708 S upnp -D
812 root 3024 S wps_monitor
815 root 3024 S wps_monitor
819 root 2336 S /usr/sbin/phychkd
820 root 3024 S wps_monitor
826 root 3024 S wps_monitor
843 root 2608 S /usr/sbin/ledd
844 root 2088 S /usr/sbin/ipv6_mon 0 0
847 root 2560 S reset_button
849 root 1864 S syslogd -C
854 root 2068 S /sbin/ulogd -d
863 root 2324 S /usr/sbin/wanstatus
868 root 2600 S /usr/sbin/self_health
899 root 2604 S Eco_mode
917 root 1284 S lld2d br0 rai0
930 root 10712 S /usr/bin/belkin_wan_cfg
934 root 2016 S /usr/sbin/usb_led_daemon
936 root 1672 S /usr/sbin/mcpsd 38
994 root 1240 S /usr/sbin/radvd-1.4 -C /tmp/radvd.conf_br0 -p /tmp/radvd.pid0
1387 root 1852 S /bin/sh
1414 root 1852 R ps w
|
| • netstat -l |
|---|
# netstat -l Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:netbios-ssn 0.0.0.0:* LISTEN tcp 0 0 router.Belkin:http 0.0.0.0:* LISTEN tcp 0 0 router.Belkin:1780 0.0.0.0:* LISTEN tcp 0 0 router.Belkin:10101 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:domain 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:microsoft-ds 0.0.0.0:* LISTEN tcp 0 0 :::domain :::* LISTEN udp 0 0 router.Belkin:netbios-ns 0.0.0.0:* udp 0 0 0.0.0.0:netbios-ns 0.0.0.0:* udp 0 0 router.Belkin:netbios-dgm 0.0.0.0:* udp 0 0 0.0.0.0:netbios-dgm 0.0.0.0:* udp 0 0 localhost.localdomain:40100 0.0.0.0:* udp 0 0 0.0.0.0:domain 0.0.0.0:* udp 0 0 localhost.localdomain:40000 0.0.0.0:* udp 0 0 localhost.localdomain:40002 0.0.0.0:* udp 0 0 0.0.0.0:bootps 0.0.0.0:* udp 0 0 0.0.0.0:bootps 0.0.0.0:* udp 0 0 0.0.0.0:49235 0.0.0.0:* udp 0 0 0.0.0.0:19540 0.0.0.0:* udp 0 0 0.0.0.0:19541 0.0.0.0:* udp 0 0 localhost.localdomain:40040 0.0.0.0:* udp 0 0 localhost.localdomain:40042 0.0.0.0:* udp 0 0 0.0.0.0:1900 0.0.0.0:* udp 0 0 :::domain :::* raw 0 0 :::58 :::* 7 Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node Path |
| • cat /proc/bus/pci/devices |
|---|
# cat devices 0000 18140802 0 0 20100000 0 0 0 0 0 2000000 10000 0 0 0 0 0 pcieport-driver 0100 18143091 10 20000000 0 0 0 0 0 0 10000 0 0 0 0 0 0 rt2860 |
| • lsmod |
|---|
# lsmod Module Size Used by Tainted: P jcp_cmd 6240 0 jcp 10048 1 jcp_cmd sxuptp_driver 3552 0 sxuptp_usbmode 3952 0 sxuptp 44880 3 jcp_cmd,sxuptp_driver,sxuptp_usbmode nf_nat_h323 7488 0 nf_conntrack_h323 49600 1 nf_nat_h323 ipv6 316416 15 nf_conntrack_h323 usb_storage 38064 0 RT3090_ap_net 34592 1 RT3090_ap 948752 1 RT3090_ap_net RT3090_ap_util 24576 2 RT3090_ap_net,RT3090_ap rt2860v2_ap 1315792 1 xt_TCPMSS 4000 0 |
| • cat /proc/mtd |
|---|
# cat /proc/mtd dev: size erasesize name mtd0: 00800000 00010000 "ALL" mtd1: 00030000 00010000 "Bootloader" mtd2: 00010000 00010000 "Config" mtd3: 00010000 00010000 "Factory" mtd4: 0014d3df 00010000 "Kernel" mtd5: 00662c21 00010000 "RootFS" mtd6: 007a0000 00010000 "Kernel_RootFS" mtd7: 00010000 00010000 "UserCfg" |
bootloader stuff
| • help |
|---|
N750 # ?
? - alias for 'help'
base - print or set address offset
bdinfo - print Board Info structure
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
cpuloop - RT3883 CPU loopback test
crc32 - checksum calculation
erase - erase SPI FLASH memory
go - start application at address 'addr'
help - print online help
httpd - start webserveriminfo - print header information for application image
loadb - load binary file over serial line (kermit mode)
loop - infinite loop on address range
loopback - Ralink eth loopback test !!
md - memory display
mdio - Ralink PHY register R/W command !!
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
pseloop - RT3883 PSE loopback test
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
resetenv - reset environment variables (in RAM) to Unoot default
you must issue 'saveenv' command to take effect
rf - read/write rf register
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
spicmd - read/write data from/to eeprom or vtss
tftpboot- boot image via network using TFTP protocol
version - print monitor version
|
| • env. vars |
|---|
N750 # printenv bootargs=NoArg bootcmd=tftp bootdelay=5 baudrate=57600 ethaddr="00:AA:BB:CC:DD:10" ipaddr=10.10.10.123 serverip=10.10.10.3 ramargs=setenv bootargs root=/dev/ram rw addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1 flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramfisk_addr) kernel_addr=BFC40000 u-boot=u-boot.bin load=tftp 8A100000 $(u-boot) u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize) loadfs=tftp 8A100000 root.cramfs u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize) test_tftp=tftp 8A100000 root.cramfs;run test_tftp HW_BOOT_VER=1.7.4 HW_BOOT_DATE=May 2 2011 - 17:16:47 HW_WIFI_HIPOWER=0 ethact=Eth0 (10/100-M) HW_LAN_MAC=08:86:3B:28:8F:94 HW_WAN_MAC=08:86:3B:28:8F:95 HW_WIFI_MAC=08:86:3B:28:8F:96 HW_WIFI_PIN=22255181 HW_SN=121119GG106750 HW_VER=01A HW_SKU_ID=1 stdin=serial stdout=serial stderr=serial Environment size: 1005/4092 bytes |
| • board info |
|---|
N750 # bdinfo boot_params = 0x83F3EFB0 memstart = 0x80000000 memsize = 0x04000000 flashstart = 0x00000000 flashsize = 0x00800000 flashoffset = 0x00000000 ethaddr = 08:86:3B:28:8F:94 ip_addr = 10.10.10.123 baudrate = 57600 bps |
GPIO
- I've gathered some of GPIO functions:
Tested by telnet:
| • GPIO |
|---|
gpio disable 5 #internet blue on gpio enable 6 #internet orange off gpio disable 6 #internet orange on gpio enable 5 #internet blue off gpio disable 8 #modem orange on gpio enable 8 #modem orange off gpio disable 11 #modem blue on gpio enable 11 #modem blue off gpio disable 9 #router blue on gpio enable 9 #router blue off #Long press resset button gpio pool 10 pressed = 00 unpressed = 01 gpio disable 10 #factory reset gpio enable 12 #security orange off gpio disable 12 #security orange on gpio enable 13 #security blue off gpio disable 13 #security blue on gpio enable 22 #storage orange off gpio disable 22 #storage orange on gpio enable 23 #storage blue off gpio disable 23 #storage blue on #wps button gpio pool 0 pressed = 00 unpressed = 01 |
Gathered from OpenWrt:
- wired/wireless leds are controlled via bit shift register sitting on gpio pins 14 (ctl) and 4 (clk)
- speed leds are controlled via bit shift register sitting on pins 17 (ctl) and 18 (clk)
Some notes:
- restore config function doesn't work properly, the router get stucked.
- PPPoE doesn't work with preselected want port, bridge port must be selected for wan, br0
- current firmware level is more to instable to use it for a long period of time,
- if there will be any new releases and if the time permits I'll test them.
Images
Display
Display
DarkShadow's Unit
DarkShadow's Unit
board top
RT3883
Flash
EtronTech RAM
RT3092
RTL8367R GbE Switch
board top, shields off
board top, front, facing caps
board top, front-left, facing caps
board top, front-right, facing caps
board top, left, facing caps
board top, right, facing caps
board top, over caps + power section
Arcadyan P/N
board MAC+PIN+etc label
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
K7SF9K1103V1
