Belkin F9K1103 v1



"P/N: 141911720003J R01C" is silkscreened on the board.

The default SSID patterns for this model is:
 * belkin.XXX (where XXX is the last three octets of the wireless interface MAC for this SSID) and
 * belkin.XXX.5GHz (MAC = 2.4GHz network MAC + 2, same XXX from the 2.4GHz network).

The guest network is (if enabled) belkin.XXX.guests
 * (MAC = 2.4GHz network MAC + 1, same XXX from the 2.4GHz network).

Reviews

 * Reviewed on SmallNetBuilder
 * OUI of 08:86:3B and SSID of belkin_2

Forum threads

 * Support Request - Belkin N 750 DB - F9K1103 v1 (01A) on DD-WRT forums
 * Belkin F9K1103 (N750 DB) equivalent and support for openwrt on OpenWRT forums

third party firmware

 * https://yadi.sk/d/6ttXcerpJ2hg3
 * https://app.box.com/s/2wxyv4cjdgd52m4a1wzd

Serial
Pinout ^ to RAM © (GND) © (RxD) © (TxD)   --> 5 GHz ant (B) ® [3.3]   NC J12

Info derived from
{{SCollapse|boot log ARC Uboot:1.7.4 (May 2 2011 - 17:16:40)

Board: Ralink APSoC DRAM: 64 MB relocate_code Pointer at: 83fa0000 spi_wait_nsec: 30 spi device id: c2 20 17 c2 20 (2017c220) find flash: MX25L6405D ..============================================ Ralink UBoot Version: 3.5.2.0

ASIC 3883_MP (MAC to VITESSE Mode) DRAM_CONF_FROM: Boot-Strapping DRAM_TYPE: DDR2 DRAM_SIZE: 512 Mbits DRAM_WIDTH: 16 bits DRAM_TOTAL_WIDTH: 16 bits TOTAL_MEMORY_SIZE: 64 MBytes Flash component: SPI Flash Date:May 2 2011  Time:17:16:40

=
=============================== icache: sets:512, ways:4, linesz:32 ,total:65536 dcache: sets:256, ways:4, linesz:32 ,total:32768

estimate memory size =64 Mbytes
 * 1) The CPU freq = 500 MHZ ####

Please choose the operation: 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. 4 initializing CHIP_RTL8367R_VB 1010                                                                                                                      0 initializing CHIP_RTL8367R_VB 1010

3: System Boot system code via Flash. Image Name:  N750F9K1103VB Created:     2012-12-12   3:46:09 UTC Image Type:  MIPS Linux Kernel Image (lzma compressed) Data Size:   7398303 Bytes =  7.1 MB   Load Address: 80000000 Entry Point: 8033e000 Verifying Checksum ... OK  Uncompressing Kernel Image ... OK No initrd
 * 1) Booting image at bc050000 ...
 * 1) Transferring control to Linux (at address 8033e000) ...
 * 2) Giving linux memsize in MB, 64

Starting kernel ... LINUX started...

THIS IS ASIC Linux version 2.6.22 (kevinlin@arc-vcs) (gcc version 4.1.2) #4 Wed Dec 12 11:41:34 CST 2012 cmd line = console=ttyS1,57600n8 root=/dev/mtdblock5 init=/sbin/preinit

The CPU feqenuce set to 500 MHz CPU revision is: 0001974c Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Built 1 zonelists. Total pages: 16256 Kernel command lkne: console=ttyS1,57600n8 root=/dev/mtdblock5 init=/sbin/preinit Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). cause = 40808000, status = 11000000 PID hash table entries: 256 (order: 8, 1024 bytes) calculating r4koff... 001e8480(2000000) CPU frequency 500.00 MHz Using 250.000 MHz high precision timer. console handover: boot [early0] -> real [ttyS1] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 61184k/65536k available (2649k kernel code, 4336k reserved, 666k data, 124k init, 0k highmem) Mount-cache hash table entries: 512 NET: Registered protocol family 16 RALINK_PCI_PCICFG_ADDR = 0

registering PCI controller with io_map_base unset SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb [junius] pcibios_init Next Bus No=0 hose= 80307758 Mem=8030778C Io=803077A8 2->[1][0][0][30]=0 5->[1][0][0][30]=fffffffe 2->[1][0][0][30]=0 5->[1][0][0][30]=0 PCI: Bridge: 0000:00:00.0 IO window: disabled. MEM window: 20000000-200fffff PREFETCH window: disabled. BAR0 at slot 0 = 0 bus=0, slot = 0x0 P2P(PCI) 0x00 = 08021814 P2P(PCI) 0x04 = 00100007 P2P(PCI) 0x08 = 06040001 P2P(PCI) 0x0c = 00010000 P2P(PCI) 0x10 = 00000000 P2P(PCI) 0x14 = 20100000 P2P(PCI) 0x18 = 00010100 P2P(PCI) 0x1c = 000000f0 P2P(PCI) 0x20 = 20002000 P2P(PCI) 0x24 = 0000fff0 P2P(PCI) 0x28 = 00000000 P2P(PCI) 0x2c = 00000000 P2P(PCI) 0x30 = 00000000 P2P(PCI) 0x34 = 00000040 P2P(PCI) 0x38 = 00000000 P2P(PCI) 0x3c = 000401ff res[0]->start = 0 res[0]->end = 1ffffff res[1]->start = 20100000 res[1]->end = 2010ffff res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 bus=1, slot = 0x0 dev III(PCIe) 0x00 = 30911814 dev III(PCIe) 0x04 = 00100000 dev III(PCIe) 0x08 = 02800000 dev III(PCIe) 0x0c = 00000000 dev III(PCIe) 0x10 = 20000000 dev III(PCIe) 0x14 = 00000000 dev III(PCIe) 0x18 = 00000000 dev III(PCIe) 0x1c = 00000000 dev III(PCIe) 0x20 = 00000000 dev III(PCIe) 0x24 = 00000000 dev III(PCIe) 0x28 = 00000000 dev III(PCIe) 0x2c = 30911814 dev III(PCIe) 0x30 = 00000000 dev III(PCIe) 0x34 = 00000040 dev III(PCIe) 0x38 = 00000000 dev III(PCIe) 0x3c = 000001ff res[0]->start = 20000000 res[0]->end = 2000ffff res[1]->start = 0 res[1]->end = 0 res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 register_mtd_chip_driver for cfi_probe Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered deice id : c2 20 17 c2 20 (2017c220) MX25L6405D(c2 2017c220) (8192 Kbytes) mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 8 MTD partitions on "raspi": 0x00000000-0x00800000 : "ALL" 0x00000000-0x00030000 : "Bootloader" 0x00030000-0x00040000 : "Config" 0x00040000-0x00050000 : "Factory" 0x00050000-0x0019d3df : "Kernel" mtd: partition "Kernel" doesn't end on an erase block -- force read-only 0x0019d3df-0x00800000 : "RootFS" mtd: partition "RootFS" doesn't start on an erase block boundary -- force read-only 0x00050000-0x007f0000 : "Kernel_RootFS" 0x007f0000-0x00800000 : "UserCfg" RT3xxx EHCI/OHCI init. VFS: Disk quotas dquot_6.5.1 Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher fuse init (API version 7.8) io scheduler noop registered (default) pcie_portdrv_probe->Dev[1814:0802] has invalid IRQ. Check vendor BIOS assign_interrupt_mode Found MSI capability Ralink gpio driver initialized spidrv_major = 217 ARC_KERNEL_OSIX_init success HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096 N_HDLC line discipline registered. Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 2 ports, IRQ sharing disabled serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A loop: module loaded MAC_ADRH -- : 0x00000000 MAC_ADRL -- : 0x00000000 MAC_ADRH -- : 0x00000000 MAC_ADRL -- : 0x00000000 Ralink APSoC Ethernet Driver Initilization. v2.0 256 rx/tx descriptors allocated, mtu = 1500! MAC_ADRH -- : 0x0000000c MAC_ADRL -- : 0x4328808e PROC INIT OK!
 * Ralink PCIe RC mode *************

Pull high SDA & SCK

GPIO pin 24 reset to switch rtl8367_RouterVlanInit rv=0 IsolateWanPort rtk_vlan_set(VLAN1) rv=0 IsolateWanPort rtk_vlan_set(VLAN2) rv=0 IsolateWanPort rtk_vlan_get(VLAN1) rv=0 mbrmsk=ef untagmsk=f fid=0 IsolateWanPort rtk_vlan_get(VLAN2) rv=0 mbrmsk=30 untagmsk=10 fid=1 IsolateWanPort rtk_vlan_portPvid_get(0) rv=0 vid=1 pri=0 IsolateWanPort rtk_vlan_portPvid_get(1) rv=0 vid=1 pri=0 IsolateWanPort rtk_vlan_portPvid_get(2) rv=0 vid=1 pri=0 IsolateWanPort rtk_vlan_portPvid_get(3) rv=0 vid=1 pri=0 IsolateWanPort rtk_vlan_portPvid_get(4) rv=0 vid=2 pri=0 IsolateWanPort rtk_vlan_portPvid_get(5) rv=0 vid=1 pri=0 rtl8367b driver initialized PPP generic driver version 2.4.2 PPP BSD Compression module registered NET: Registered protocol family 24 block2mtd: version $Revision: 1.1.1.1 $ dev_nvram_init 827 mtd->name=UserCfg rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1 rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000 rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2 rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (512 buckets, 4096 max) ctnetlink v0.93: registering with nfnetlink. ip_tables: (C) 2000-2006 Netfilter Core Team ClusterIP Version 0.8 loaded successfully arp_tables: (C) 2002 David S. Miller TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 17 mcps_module_init initializing Ebtables v2.0 registered 802.1Q VLAN Support v1.8 Ben Greear  All bugs added by David S. Miller  VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 124k freed Warning: unable to open an initial console. Algorithmics/MIPS FPU Emulator v1.5 [sighandler]: No more events to be processed, quitting. [cleanup]: Waiting for children. [cleanup]: All children terminated. sysinit done use original.... Assume Wi-Fi RadioOn everytime reboot!! connect: Network is unreachable rt2860v2_ap: module license 'unspecified' taints kernel.

pAd = c000f000, size = 487768
<-- RTMPAllocTxRxRingMemory, Status=0 <-- RTMPAllocAdapterBlock, Status=0

pAd = c0307000, size = 513184
<-- RTMPAllocAdapterBlock, Status=0 pAd->CSRBaseAddress =0xc01a0000, csr_addr=0xc01a0000! Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. NET: Registered protocol family 10 MAC_ADRH -- : 0x00000886 MAC_ADRL -- : 0x3b288f94

phy_tx_ring = 0x00340000, tx_ring = 0xa0340000 phy_rx_ring0 = 0x00341000, rx_ring0 = 0xa0341000 CDMA_CSG_CFG = 81000007 GDMA1_FWD_CFG = C0710000 eth2.1: dev_set_promiscuity(master, 1) device eth2 entered promiscuous mode device eth2.1 entered promiscuous mode br0: port 1(eth2.1) entering learning state force port 0 up force port 1 up force port 2 up force port 3 up rmmod: hw_nat Starting HotPlug:         /usr/sbin/hotplugd -D -f Starting jcpd daemon:     /usr/sbin/jcpd br0: topology change detected, propagating br0: port 1(eth2.1) entering forwarding state fw_rule_isolatedlan: br0 fw_rule_isolatedlan: br0 fw_rule_SkipSnatToLans: br0 fw_rule_SkipDnatFromLans: br0 RX DESC a0357000 size = 2048 Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) 1. Phy Mode = 8 2. Phy Mode = 8 3. Phy Mode = 8 RTMPSetPhyMode: channel is out of range, use first channel=0 MCS Set = ff ff ff 00 01 SYNC - BBP R4 to 20MHz.l Starting Samba:                        /usr/sbin/smbd -D Main bssid = 08:86:3b:28:8f:96 <==== rt28xx_init, Status=0 0x1300 = 00064380 device ra0 entered promiscuous mode br0: port 2(ra0) entering learning state /usr/sbin/nmbd -D RX DESC a2dff000 size = 2048 <-- RTMPAllocTxRxRingMemory, Status=0 br0: topology change detected, propagating br0: port 2(ra0) entering forwarding state Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) 1. Phy Mode = 9 2. Phy Mode = 9 3. Phy Mode = 9 RTMPSetPhyMode: channel is out of range, use first channel=0 MCS Set = ff ff 00 00 01 SYNC - BBP R4 to 20MHz.l Starting sxuptpd USB port mode selector has been enabled Initializing USB port mode: port1 = NAS port2 = NAS usbcore: registered new interface driver sxuptp_driver Starting usbjcpd insmod: cannot insert '/lib/modules/2.6.22/kernel/drivers/usb/storage/usb-storage.ko': Invalid parameters (17): Invalid argument SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l Main bssid = 08:86:3b:28:8f:94 <==== rt28xx_init, Status=0 0x1300 = 00064380 device rai0 entered promiscuous mode br0: port 3(rai0) entering learning state br0: topology change detected, propagating br0: port 3(rai0) entering forwarding state do init wsc MsgQ System Initializationeth2.2: Setting MAC address to ! 08 86 3b 28 8f 95. <                 rc_wan_start:  640>: ifconfig eth2.2 up Create netlink socket thread success! Create ioctl socket(6) success! Create wscd udhcpc_main(452): udhcp client (v0.9.8) started rc_nat_dmz_stop, 256 rc_nat_dmz_action nat_dmz_rule_flush, 67: wan_index 0 set FW_DMZ_STAT 0 with wan_index 0 ipv6 started 0 CFG_NAT_DMZ_HOST = 2145950120   host = rc_nat_vts_stop, 336

share memory key=74565 successful id on creating=32769 led_process_init eco=0 wpsm_upnp_attach OK signalling RUNNING rc_fw_macflt_stop : 163 start Eco_mode rc_nat_Masquerade_stop, 182 rc_nat_Masquerade_action nat_Masquerade_rule_flush

lld2d: listening on interface br0 start belkin_wan_cfg udhcpc_main(737): Received SIGTERM belkin_wan_cfg running on 102a8c0 UPnP daemon is ready to run ctrl_flags=0x38 rc_twonky_start: 1166 rc_all_start 112 mcps: mcps_netlink_rcv nlh->nlmsg_len=528mcps: mcps_process_registration mcps_pid=954 mcps: mcps_process_registration set control flag 0x38 /bin/mknod /dev/ARCOSIX_DEV c 253 0 }}
 * g_wl_interface = rai0 ******

GPIO

 * Source
 * I've gathered some of GPIO functions:

Tested by telnet:

Gathered from OpenWrt:
 * wired/wireless leds are controlled via bit shift register sitting on gpio pins 14 (ctl) and 4 (clk)
 * speed leds are controlled via bit shift register sitting on pins 17 (ctl) and 18 (clk)

Some notes:
 * restore config function doesn't work properly, the router get stucked.
 * PPPoE doesn't work with preselected want port, bridge port must be selected for wan, br0
 * current firmware level is more to instable to use it for a long period of time,
 * if there will be any new releases and if the time permits I'll test them.

Images
Belkin Images