DQ Technology VisionNet W203ER-4

DQ Technology VisionNet W203-4

Manuf (OEM/ODM): XAVi XW203ER-4 (01-SSC-5515)

(Est.) release date: 2005
Country of manuf.: China

Type: wireless router, dsl modem

FCC ID: none available
US: XAVDL01BX8268R

Power: 12 VDC, 1 A
Connector type: barrel
Conn. measurements: 5 mm (OD), 2.5 mm (ID), 10 mm (LEN)

CPU1: Texas Instruments TNETD7300A (160 MHz)
FLA1: 4 MiB 4,194,304 B <br />32,768 Kib <br />4,096 KiB <br />32 Mib <br />0.00391 GiB <br /> (Macronix MX29LV320ABTC-90)
RAM1: 16 MiB 16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br /> (Hynix HY57V281620HCT-H)

Expansion IFs: Mini PCI
Mini PCI slots: 1
Serial: yes, 3-pin header, internal, populated, 3.3V TTL, (9600,8,N,1), J101

WI1 module: unknown
WI1 module IF: Mini PCI
WI1 chip1: Texas Instruments TNETW1130
WI1 chip2: Radia RC2422B
WI1 802dot11 protocols: bg
WI1 antenna connector: U.FL, RP-SMA

ETH chip1: Texas Instruments TNETD7300A
Switch: Marvell 88E6060
LAN speed: 100M
LAN ports: 4

bg

Stock bootloader: PSPBoot 1.2.1.5

Stock FW OS: Linux 2.4.17_mvl21-malta-mips_fp_le MontaVista

Flags: ADSL

Default SSID: stiwifi
Default IP address: 192.168.5.1
the IP 192.168.5.1 is used by 1 additional devices
of which 0 are DQ Technology devices
Default login user: admin
Default login password: sti.admin5

802dot11 OUI: 00:01:38 (6 E, 5 W)
Ethernet OUI: 00:01:38 (6 E, 5 W)

For a list of all currently documented Texas Instruments (TI) chipsets with specifications, see Texas Instruments.

---

There is no FCC ID printed on the unit (but there is a FCC registration number).

The power adapter that came with the unit is an OEM AD-121A (12V, 1A).

ID/OD/Len measurements are approximate.

Credentials

Multiple credentials appear to be usable with the HTTP interface.

admin/sti.admin5 or xavi886/xavi886

The default credentials for telnet seem to be

root/sti.admin5

Images

External

• 

  angled shot

• 

  bottom and label

• 

  back

Internal

• 

  board top

• 

  board bottom

• 

  CPU, RAM, and Flash closeup

Serial

Pinout

<--- to SoC

J101
(GND) (RxD) [TxD]

       to wireless module -->

Info derived from

Expand • boot log

Minimal POST completed... Success. Last reset cause: Hardware reset (Power-on reset) PSPBoot1.2 rev: 1.2.1.5 (c) Copyright 2002-2004 Texas Instruments, Inc. All Rights Reserved. Press ESC for monitor... 1 (psbl) Booting... Launching kernel decompressor. Starting LZMA Uncompression Algorithm. Copyright (C) 2003 Texas Instruments Incorporated; Copyright (C) 1999-2003 Igor Pavlov. Compressed file is LZMA format. Kernel decompressor was successful ... launching kernel. LINUX started... Config serial console: ttyS0,9600 CPU revision is: 00018448 Primary instruction cache 16kb, linesize 16 bytes (4 ways) Primary data cache 16kb, linesize 16 bytes (4 ways) Number of TLB entries 16. Linux version 2.4.17_mvl21-malta-mips_fp_le (paul@vserver3) (gcc version 2.95.3 20010315 (release/MontaVista)) #1 Wed Oct 5 13:27:47 CST 2005 Determined physical RAM map: memory: 14000000 @ 00000000 (reserved) memory: 00020000 @ 14000000 (ROM data) memory: 00fe0000 @ 14020000 (usable) On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: calculating r4koff... 000b71b0(750000) CPU frequency 150.00 MHz Calibrating delay loop... 149.91 BogoMIPS Freeing Adam2 reserved memory [0x14001000,0x0001f000] Memory: 14372k/16384k available (1494k kernel code, 2012k reserved, 103k data, 60k init) Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes) Inode-cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 TI Optimizations: Allocating TI-Cached Memory Pool. Warning: Number of buffers is not configured.Setting default to 512 Using 512 Buffers for TI-Cached Memory Pool. DEBUG: Using Hybrid Mode. NSP Optimizations: Succesfully allocated TI-Cached Memory Pool. Initializing RT netlink socket Starting kswapd Disabling the Out Of Memory Killer devfs: v1.7 (20011216) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 pty: 32 Unix98 ptys configured Serial driver version 5.05c (2001-07-08) with no serial options enabled ttyS00 at 0xa8610e00 (irq = 15) is a 16550A ttyS01 at 0xa8610f00 (irq = 16) is a 16550A Vlynq CONFIG_MIPS_AVALANCHE_VLYNQ_PORTS=2 Vlynq Device vlynq0 registered with minor no 63 as misc device. Result=0 Vlynq instance:0 Link UP Vlynq Device vlynq1 registered with minor no 62 as misc device. Result=0 VLYNQ 1 : init failed block: 64 slots per queue, batch=16 Cpmac driver is allocating buffer memory at init time. Cpmac driver Disable TX complete interrupt setting threshold to 20. Default Asymmetric MTU for eth0 1500 PPP generic driver version 2.4.1 avalanche flash device: 0x400000 at 0x10000000. Amd/Fujitsu Extended Query Table v1.1 at 0x0040 number of CFI chips: 1 Looking for mtd device :mtd0: Found a mtd0 image (0xa1000), with size (0x35f000). Creating 1 MTD partitions on "Physically mapped flash:0": 0x000a1000-0x00400000 : "mtd0" mtd: partition "mtd0" doesn't start on an erase block boundary -- force read-only Looking for mtd device :mtd1: Found a mtd1 image (0x20090), with size (0x80f70). Creating 1 MTD partitions on "Physically mapped flash:0": 0x00020090-0x000a1000 : "mtd1" mtd: partition "mtd1" doesn't start on an erase block boundary -- force read-only Looking for mtd device :mtd2: Found a mtd2 image (0x0), with size (0x10000). Creating 1 MTD partitions on "Physically mapped flash:0": 0x00000000-0x00010000 : "mtd2" Looking for mtd device :mtd3: Found a mtd3 image (0x10000), with size (0x10000). Creating 1 MTD partitions on "Physically mapped flash:0": 0x00010000-0x00020000 : "mtd3" Looking for mtd device :mtd4: Found a mtd4 image (0x20000), with size (0x3e0000). Creating 1 MTD partitions on "Physically mapped flash:0": 0x00020000-0x00400000 : "mtd4" NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 1024 bind 1024) Linux IP multicast router 0.06 plus PIM-SM ip_conntrack version 2.0 (128 buckets, 1024 max) - 364 bytes per conntrack ip_tables: (c)2000 Netfilter core team netfilter PSD loaded - (c) astaro AG NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 Initializing the WAN Bridge. Please set the MAC Address for the WAN Bridge. Set the Environment variable 'wan_br_mac'. MAC Address should be in the following format: xx.xx.xx.xx.xx.xx VFS: Mounted root (squashfs filesystem) readonly. Mounted devfs on /dev Freeing unused kernel memory: 60k freed serial console detected. Disabling virtual terminals. console=/dev/tts/0 init started: BusyBox v0.61.pre (2005.10.05-05:30+0000) multi-call binary Starting pid 9, console /dev/tts/0: '/etc/init.d/rcS' Algorithmics/MIPS FPU Emulator v1.5 Reading Standard Configuration File /etc/led.conf Configured 15 states Using /lib/modules/2.4.17_mvl21-malta-mips_fp_le/kernel/drivers/atm/tiatm.o registered device TI Avalanche SAR Texas Instruments ATM driver: version:[4.03.03.00] Waiting for enter to start '/bin/sh' (pid 31, terminal /dev/tts/0) Please press Enter to activate this console. SIOCGIFFLAGS: No such device SIOCGIFFLAGS: No such device SIOCGIFFLAGS: No such device Sep 8 12:00:14 cfgmgr(ap): AP is disabled Sep 8 12:00:14 cfgmgr(pppoe-106): Valid Configuration Tree PVC dB vpi = -1 vci = -1 in_use = 0 vpi = -1 vci = -1 in_use = 0 vpi = -1 vci = -1 in_use = 0 vpi = -1 vci = -1 in_use = 0 vpi = -1 vci = -1 in_use = 0 vpi = -1 vci = -1 in_use = 0 vpi = -1 vci = -1 in_use = 0 vpi = -1 vci = -1 in_use = 0 Doing BRCTL ... addbr br0 Doing BRCTL ... addbr br1 Doing BRCTL ... addbr br2 Sep 8 12:00:14 cfgmgr(snmpcm): snmpd starts (1) Sep 8 12:00:14 cfgmgr(sntp): NTP Polling Timer for DHCP Started succesfully. Sep 8 12:00:14 cfgmgr(sar): DSL Polling Timer Started succesfully. Sep 8 12:00:14 cfgmgr(fdb): Firewall NAT service started Default Asymmetric MTU for nas0 1500 Sep 8 12:00:16 IP: routing cache hash table of 512 buckets, 4Kbytes Sep 8 12:00:16 TCP: Hash tables configured (established 1024 bind 1024) Sep 8 12:00:16 : ip_conntrack version 2.0 (128 buckets, 1024 max) - 364 bytes per conntrack Sep 8 12:00:16 ip_tables: (c)2000 Netfilter core team Sep 8 12:00:16 : netfilter PSD loaded - (c) astaro AG Sep 8 12:00:16 : Initializing the WAN Bridge. Sep 8 12:00:16 : Please set the MAC Address for the WAN Bridge. Sep 8 12:00:16 : Set the Environment variable 'wan_br_mac'. Sep 8 12:00:16 MAC Address should be in the following format: xx.xx.xx.xx.xx.xx Sep 8 12:00:16 VFS: Mounted root (squashfs filesystem) readonly. Sep 8 12:00:16 : Mounted devfs on /dev Sep 8 12:00:16 Freeing unused kernel memory: 60k freed Sep 8 12:00:16 : Algorithmics/MIPS FPU Emulator v1.5 Sep 8 12:00:16 : registered device TI Avalanche SAR Sep 8 12:00:16 Texas Instruments ATM driver: version:[4.03.03.00] Sep 8 12:00:16 : Default Asymmetric MTU for nas0 1500 Sep 8 12:00:16 : Default Asymmetric MTU for br0 1500 Sep 8 12:00:16 cfgmgr(lanbridge0): Bridge Created: br0 Doing BRCTL ... setfilter br0 0 Doing BRCTL ... addif br0 eth0 Doing BRCTL ... addif br0 usb0 Sep 8 12:00:16 cfgmgr(lanbridge1): Bridge Created: br1 Doing BRCTL ... setfilter br1 0 Sep 8 12:00:17 cfgmgr(lanbridge2): Bridge Created: br2 Doing BRCTL ... setfilter br2 0 Doing BRCTL ... stp br0 off Sep 8 12:00:17 cfgmgr(lanbridge0): Bridge Interface Added: eth0 Doing BRCTL ... setfilter br0 0 Sep 8 12:00:18 cfgmgr(lanbridge0): Add Bridge Iface Error: 1 Doing BRCTL ... stp br1 off Doing BRCTL ... stp br2 off Sep 8 12:00:18 : Default Asymmetric MTU for br1 1500 Sep 8 12:00:18 : Default Asymmetric MTU for br2 1500 Sep 8 12:00:24 cfgmgr(sar): DSL Carrier is down

cat /proc/version

# cat /proc/version
Linux version 2.4.17_mvl21-malta-mips_fp_le (paul@vserver3) (gcc version 2.95.3 20010315 (release/MontaVista)) #1 Wed Oct 5 13:27:47 CST 2005

cat /proc/cpuinfo

# cat /proc/cpuinfo
processor               : 0
cpu model               : MIPS 4KEc V4.8
BogoMIPS                : 149.91
wait instruction        : no
microsecond timers      : yes
extra interrupt vector  : yes
hardware watchpoint     : yes
VCED exceptions         : not available
VCEI exceptions         : not available

cat /proc/mtd

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 0035f000 00010000 "mtd0"
mtd1: 00080f70 00010000 "mtd1"
mtd2: 00010000 00002000 "mtd2"
mtd3: 00010000 00010000 "mtd3"
mtd4: 003e0000 00010000 "mtd4"

ps aux

# ps aux
  PID  Uid     VmSize Stat Command
    1 root       1284 S    init
    2 root            S    [keventd]
    3 root            S    [ksoftirqd_CPU0]
    4 root            S    [kswapd]
    5 root            S    [bdflush]
    6 root            S    [kupdated]
    7 root            S    [mtdblockd]
   29 root       2804 S    /usr/bin/cm_pc
   31 root       1288 S    -sh
   32 root       1308 S    /usr/sbin/thttpd -d /usr/www -u root -p 80 -c /cgi-b
   33 root       3588 S    /usr/bin/cm_logic -m /dev/ticfg -c /etc/config.xml
   56 root        608 S    /usr/bin/cm_klogd /dev/klog
   57 root        700 S    /sbin/dproxy -c /etc/resolv.conf -d
   60 root       1668 S    /usr/sbin/snmpd
  144 root        688 S    /usr/sbin/udhcpd /var/tmp/udhcpd.conf
  200 root        628 S    /sbin/utelnetd
  201 root       1288 S    -sh
  202 root       1284 R    ps aux

cat /proc/meminfo

# cat meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  14778368  9900032  4878336        0  1093632  3874816
Swap:        0        0        0
MemTotal:        14432 kB
MemFree:          4764 kB
MemShared:           0 kB
Buffers:          1068 kB
Cached:           3784 kB
SwapCached:          0 kB
Active:           2344 kB
Inactive:         3956 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        14432 kB
LowFree:          4764 kB
SwapTotal:           0 kB
SwapFree:            0 kB

cat /etc/*versions

# cat xaviversions
1.0.0T14_Rev14e.4.2_XW203ER-4
051103
BYS_localhost.localdomain
# cat versions
BUILD=
VERSION=3.6.0A
BOARD=AR7WRD
FSSTAMP=20051005133124

other

Expand • cat /etc/led.conf

# cat led.conf ################################################################# # Configuration File for AR7WRD board ################################################################## ################################################################## # The GPIO numbers 0 to 31 ==> correspond to GPIO pins ######### # The GPIO numbers 32,33 are mapped to ADSL (LED) pins ########### ################################################################## module = adsl # module = {adsl,usb,pppoe,wlan} ################################################################## # Note: state 0 for adsl is dummy state and is present only for ## # compatibility with the new LED driver ## ################################################################## state = 0 # 0=dummy, 1=idle, 2=training, 3=sync, 4=activity gpio = 33 # gpio number mode = 0 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash state = 1 # 0=dummy, 1=idle, 2=training, 3=sync, 4=activity gpio = 33 # gpio number mode = 0 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash state = 2 # 0=dummy, 1=idle, 2=training, 3=sync, 4=activity gpio = 33 # gpio number mode = 4 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash param1 = 200 # flash on duration in ms param2 = 200 # flash off duration in ms state = 3 # 0=dummy, 1=idle, 2=training, 3=sync, 4=activity gpio = 33 # gpio number mode = 1 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash state = 4 # 0=dummy, 1=idle, 2=training, 3=sync, 4=activity gpio = 32 # gpio number mode = 2 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash param1 = 100 # blink/flash rate in ms ###################################################################### module = cpmac # module = {adsl,usb,pppoe,wlan,cpmac} state = 0 # 0 = link down, 1 = link up, 2 = pkt rcv, 3 = pkt xmit gpio = 15 # gpio number mode = 0 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash state = 1 # 0 = link down, 1 = link up, 2 = pkt rcv, 3 = pkt xmit gpio = 15 # gpio number mode = 1 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash state = 2 # 0 = link down, 1 = link up, 2 = pkt rcv, 3 = pkt xmit gpio = 15 # gpio number mode = 2 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash param1 = 100 # blink/flash rate in ms state = 3 # 0 = link down, 1 = link up, 2 = pkt rcv, 3 = pkt xmit gpio = 15 # gpio number mode = 2 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash param1 = 100 # blink/flash rate in ms ################################################# #module = usb # module = {adsl,usb,pppoe,wlan} #state = 0 # 0 = link down, 1 = link up, 2 = pkt rcv, 3 = pkt xmit #gpio = 12 # gpio number #mode = 0 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash #state = 1 # 0 = link down, 1 = link up, 2 = pkt rcv, 3 = pkt xmit #gpio = 12 # gpio number #mode = 1 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash #state = 2 # 0 = link down, 1 = link up, 2 = pkt rcv, 3 = pkt xmit #gpio = 12 # gpio number #mode = 2 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash #param1 = 100 # blink/flash rate in ms #state = 3 # 0 = link down, 1 = link up, 2 = pkt rcv, 3 = pkt xmit #gpio = 12 # gpio number #mode = 2 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash #param1 = 100 # blink/flash rate in ms ##################################################################### module = pppoe # module = {adsl,usb,pppoe,wlan} state = 0 # 0 = pppoe down, 1 = pppoe active gpio = 13 # gpio number mode = 0 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash state = 1 # 0 = pppoe down, 1 = pppoe active gpio = 13 # gpio number mode = 1 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash ###################################################################### module = wlan # module = {adsl,usb,pppoe,wlan} state = 0 # 0 = link down, 1 = link up gpio = 6 # gpio number mode = 0 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash state = 1 # 0 = link down, 1 = link up gpio = 6 # gpio number mode = 1 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash state = 2 # 0 = link down, 1 = link up, 2 = pkt rcv, 3 = pkt xmit gpio = 6 # gpio number mode = 2 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash param1 = 100 # blink/flash rate in ms state = 3 # 0 = link down, 1 = link up, 2 = pkt rcv, 3 = pkt xmit gpio = 6 # gpio number mode = 2 # 0 = off,1 = on,2 = blinkoff,3 = blinkon, 4 = Flash param1 = 100 # blink/flash rate in ms

nmap 192.168.5.1 -p 1-65535

# nmap 192.168.5.1 -p 1-65535

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-06 22:03 EDT
Nmap scan report for mygateway1.ar7 (192.168.5.1)
Host is up (0.0050s latency).
Not shown: 65531 closed ports
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
23/tcp open  telnet
80/tcp open  http
MAC Address: 00:01:38:50:8D:BA (XAVi Technologies)

Nmap done: 1 IP address (1 host up) scanned in 32.59 seconds