Router Image:
Router Innards:
Processor: Ralink RT5350F
Specifications:
CPU architecture: MIPS 24KEc, 360 MHz
802.11n 1T/1R (1x1:1) 2.4 GHz 150Mbps MAC/BB/PA/RF
5-port 10/100 Mbps Ethernet switch w/ 5 10/100 PHYs
USB 2.0 host/client
Ram: EM63A165TS-6G - 16Mega x 16 Synchronous DRAM (SDRAM)
Flash: MXIC MX 25L3206E M2I-12G, SOIC-8, 32MBit, 4Mb SPI Flash
Preinstalled firmware has a way to load custom firmwares.
I found the router on this thread to have almost identical hardware except the flash
http://my-embedded.blogspot.in/2013/12/ … 5350f.html
Another link with exact same hardware:
https://forum.openwrt.org/viewtopic.php?id=42471
Serial console wiring:
Serial console output(Set speed to 57600):
JRecovery Version R1.2 2013/09/03 13:05
SPI FLASH: MX25l3205d 4M
................
Starting kernel @80000000...
LINUX started...
THIS IS ASIC
Linux version 2.6.21 (tja@dot7) (gcc version 3.4.2) #2 Fri Nov 29 09:59:34 CST 2013
The CPU feqenuce set to 360 MHz
CPU revision is: 0001964c
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Built 1 zonelists. Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock3
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = d0808000, status = 11000000
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 0015f900(1440000)
CPU frequency 360.00 MHz
Using 180.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29372k/32768k available (2297k kernel code, 3396k reserved, 567k data, 124k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
RT3xxx EHCI/OHCI init.
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered (default)
arch_mem_init check 0xb000001c: 00000000
------------------GPIO--------------------------
GPIOMODE:2df
SLIC INTR ==> gpio 1
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.7 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
rdm_major = 254
net_speed proc file Create
MAC_ADRH -- : 0x00000000
MAC_ADRL -- : 0x00000000
eth2 mii.o query= phy_id:0, address:1 retval:7849
Ralink APSoC Ethernet Driver Initilization. v2.0 256 rx/tx descriptors allocated, mtu = 1500!
MAC_ADRH -- : 0x0000000c
MAC_ADRL -- : 0x432880bd
PROC INIT OK!
=== 0xB0100004 = 00000000
Insmod eth_ping skb_diy module.
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
physmap platform flash device: 00400000 at bf000000
physmap-flash physmap-flash.0: map_probe failed
block2mtd: version $Revision: 1.1.1.1 $
deice id : c2 20 16 c2 20 (2016c220)
MX25L3205D(c2 2016c220) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00001000 (4K) .numeraseregions = 0
Creating 6 MTD partitions on "raspi":
0x00000000-0x00400000 : "Whole"
0x00000000-0x00010000 : "Bootloader"
0x00010000-0x00110000 : "Kernel"
0x00110000-0x003a0000 : "RootFS"
0x003a0010-0x003f0000 : "UI"
mtd: partition "UI" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "Config"
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
drivers/usb/net/rtl8150.c: rtl8150 based usb-ethernet driver v0.6.2 (2004/08/27)
usbcore: registered new interface driver rtl8150
u32 classifier
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
Register conntrack protocol helper for ESP...
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_conntrack version 2.4 (256 buckets, 2048 max) - 184 bytes per conntrack
nf_sock overlap: 0-0/80-81 v 0-0/80-81
Unable to register netfilter socket option
Init IP_nat_proto_esp register.
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 124k freed
Algorithmics/MIPS FPU Emulator v1.5
Inter-| Receive
phy_tx_ring = 0x01c29000, tx_ring = 0xa1c29000
phy_rx_ring0 = 0x01c2a000, rx_ring0 = 0xa1c2a000
| Transmit
face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed
eth2: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
lo: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
tunl0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
gre0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
modprobe: module ehci-hcd not found
modprobe: failed to load module ehci-hcd
modprobe: module ohci-hcd not found
modprobe: failed to load module ohci-hcd
ipt_webstr: module license 'unspecified' taints kernel.
flash_open: flash_fd=3
Mount D Section.
mount: /dev/mtdblock4 is write-protected, mounting read-only
flash_open: flash_fd=9
phy 4, reg 0, val 0x3900
Set: phy[4].reg[0] = 3900
phy 0, reg 0, val 0x3900
Set: phy[0].reg[0] = 3900
phy 1, reg 0, val 0x3900
Set: phy[1].reg[0] = 3900
phy 2, reg 0, val 0x3900
Set: phy[2].reg[0] = 3900
phy 3, reg 0, val 0x3900
Set: phy[3].reg[0] = 3900
Set gpio_range = gpio2300, dir = 301
switch reg write offset=168, value=17
switch reg write offset=14, value=405555
switch reg write offset=50, value=2001
switch reg write offset=98, value=7f3f
switch reg write offset=e4, value=3f
switch reg write offset=40, value=1001
switch reg write offset=44, value=1001
switch reg write offset=48, value=1002
switch reg write offset=70, value=ffff506f
phy 4, reg 0, val 0x3300
Set: phy[4].reg[0] = 3300
phy 0, reg 30, val 0x58
Set: phy[0].reg[30] = 0058
phy 1, reg 30, val 0x58
Set: phy[1].reg[30] = 0058
phy 2, reg 30, val 0x58
Set: phy[2].reg[30] = 0058
phy 3, reg 30, val 0x58
Set: phy[3].reg[30] = 0058
phy 4, reg 30, val 0x58
Set: phy[4].reg[30] = 0058
phy 0, reg 29, val 0x7005
Set: phy[0].reg[29] = 7005
phy 1, reg 29, val 0x7005
Set: phy[1].reg[29] = 7005
phy 2, reg 29, val 0x7005
Set: phy[2].reg[29] = 7005
phy 3, reg 29, val 0x7005
Set: phy[3].reg[29] = 7005
phy 4, reg 29, val 0x7005
Set: phy[4].reg[29] = 7005
phy 4, reg 0, val 0x3100
Set: phy[4].reg[0] = 3100
phy 0, reg 0, val 0x3100
Set: phy[0].reg[0] = 3100
phy 1, reg 0, val 0x3100
Set: phy[1].reg[0] = 3100
phy 2, reg 0, val 0x3100
Set: phy[2].reg[0] = 3100
phy 3, reg 0, val 0x3100
Set: phy[3].reg[0] = 3100
eth2.1: Setting MAC address to :::::.
device eth2 entered promiscuous mode
VLAN (eth2.1): Setting underlying device (eth2) to promiscious mode.
eth2 mii.o query= phy_id:1, address:4 retval:5e1
eth2 mii.o query= phy_id:1, address:0 retval:3100
eth2 mii.o query= phy_id:1, address:5 retval:0
eth2.1: dev_set_promiscuity(master, 1)
device eth2.1 entered promiscuous mode
eth2.2: Setting MAC address to 6c 19 8f d4 ce 22.
Init handler: lan
br0: port 1(eth2.1) entering learning state
Init handler: dhcpsrv
br0: topology change detected, propagating
br0: port 1(eth2.1) entering forwarding state
Failure parsing line 12 of /etc/udhcpd.conf
server_config.pool_check = 1
server_config.pool_check = 1
start = 192.168.0, end = 192.168.0, lan_ip = 192.168.0, interface=br0, ifindex=0
start = 192.168.0, end = 192.168.0, lan_ip = 192.168.0, interface=br0, ifindex=0
0
Unable to open /var/run/udhcpd.leases for reading
udhcpd (v0.9.9-pre) started
Unable to open /var/run/udhcpd.leases for reading
Init handler: stp
Init handler: reset_btn
Init handler: watchdog
Init handler: wlanap
Length of MAC:6
mac:::::::
----
=== pAd = c007d000, size = 620440 ===
<-- RTMPAllocAdapterBlock, Status=0
RX DESC a1912000 size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
RTMPSetPhyMode: channel is out of range, use first channel=0
MCS Set = ff 00 00 00 01
SYNC - BBP R4 to 20MHz.l
Main bssid = 6c:19:8f:d4:ce:24
<==== rt28xx_init, Status=0
0x1300 = 00064380
device ra0 entered promiscuous mode
br0: port 2(ra0) entering learning state
Ralink DOT1X daemon, version = '2.4.0.0'
prefix_name = 'ra, argv[1] = (null)'
killall: check_status: no process killed
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
ra0 ledstart:
WLAN Station Log ALive
Init handler: wan
Init handler: ondemand
Init handler: nat
==== NAT START (WAN:ALL Func:ALL) ====
wscd: SSDP UDP PORT = 1900
/var/nat//nat-draft.uyg: /var/nat//nat-draft.uyg: 193: cannot create /proc/sys/net/ipv4/rt_cache_rebuild_count: Directory nonexistent
/var/nat//nat-draft.uyg: /var/nat//nat-draft.uyg: 193: cannot create /proc/sys/net/netfilter/nf_conntrack_expect_max: Directory nonexistent
/var/nat//nat-draft.uyg: /var/nat//nat-draft.uyg: 193: cannot create /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_unacknowledged: Directory nonexistent
Bad argument `0.0.0.0'
Try `iptables -h' or 'iptables --help' for more information.
Init handler: dnsrelay
Init handler: time
timezone:480
dsttime:0
Init handler: schedule
Init handler: telnet
Init handler: wps_btn
Init handler: ddns
Init handler: routing
Init handler: autobak
Init handler: keepalive
Init handler: upnp
============= AMIT UPNP Start =============
WAN_IF=eth2.2,LAN_IF=br0
Init handler: pptp
Init handler: l2tp
Init handler: failover
Init handler: loadsharingctrl
Init handler: pwr_saving
Init handler: rbydom
Init handler: rbyip
Init handler: qos
Init handler: snmp
Init handler: spap
Init handler: ftp_alg
Init handler: sip_alg
Init handler: ate
eth2.2 br0
iptables: Chain already exists
Init handler: recent
Init handler: wps_status
Init handler: reboot
sh: lltd-action: not found
flash_open: flash_fd=7
iptables: Chain already exists
/usr/bin/telnetd-action: Starting telnetd...
flash_open: flash_fd=7
/usr/bin/telnetd-action start ok
flash_open: flash_fd=7
sh: cannot create /proc/sys/net/bridge/bridge-nf-call-iptables: Directory non# Ralink APSoC Hardware Watchdog Timer
Started WatchDog Timer. LoadVlaue: 36600 sysclk: 120000000 TIMEOUT: 60
Stopped WatchDog Timer.
Disable Kernel Mode Watchdog
Started WatchDog Timer. LoadVlaue: 36600 sysclk: 120000000 TIMEOUT: 60
(Last edited by clayteau on 2 Sep 2015, 18:38)