Topic: OpenWRT on a Sitecom WLR-6000

13 Feb 2016, 14:22

Hi people,

[Update]
I received the GPL code from Sitecom. I've uploaded it and it can be downloaded here: Link

I would like to know if it is possible to flash OpenWRT on a Sitecom WLR-6000.
It seems that all used hardware in this router is available in packages.

See the WikiDevi(not all information is correct): Link
See the OpenWRT_Wiki: Link

Quick specs:
CPU1: Ralink RT3883 (500 MHz)
FLA1: 8 MiB (Macronix MX25L6405D or MX25L6406E)
RAM1: 64 MiB (Nanya NT5TU32M16DG-AC)
WI1 chip1: Ralink RT3883
WI2 chip1: Ralink RT5392
Switch: Atheros AR8327
USB2.0 - 1x

Similar devices:
Engenius ESR750H
Senao WBR5200MGN

Picture of the PCB:

So this seems to me like a great device for OpenWRT and it is really cheap. Could someone help me on my way?
And if you are also interested in seeing this device working with OpenWRT, please leave a reply.

(Last edited by Timeless on 12 Aug 2016, 21:36)

17 Mar 2016, 20:53

Hi,

This will probably be a do-it-yourself project, but you and many others will benefit (NOTE: I'm not a low-level hardware hacker IRL nor do I build my own images.)

https://wiki.openwrt.org/doc/devel/add.new.device

https://wiki.openwrt.org/doc/devel/add.new.platform

You've already opened your device, so the next step should be easy: Figure out where to solder on a serial pad or pins and use a USB-to-TTL converter to connect to the PCB's serial port. Then get ckermit or another serial comm program running to that port, set the serial params (115200, 8-N-1 seems to be a vanilla setting), see here:

https://wiki.openwrt.org/doc/hardware/port.serial

Then you can post a bootlog so you and developers can see what's running on it, how the flash memory is organized, and a whole bunch of other stuff.

Since you've already torn it apart, you're almost there Good luck!

Clemmitt

3 Apr 2016, 00:52

Thanks for your info. I will see what I can do

3 Apr 2016, 10:39

Conjecture (the image posted @ http://www.smallnetbuilder.com/images/s … h_fcc.jpg) -

cmsigler wrote:

You've already opened your device ...

3 Apr 2016, 10:49

Max Hopper wrote:

Conjecture (the image posted @ http://www.smallnetbuilder.com/images/s … h_fcc.jpg) -
cmsigler wrote:
You've already opened your device ...

You are correct. I never said that the image was mine? But that is also inrelevant for the case. I could have opened the router without uploading a picture.

(Last edited by Timeless on 3 Apr 2016, 10:51)

3 Apr 2016, 10:51

Correct. cmsigler ass-u-med you indeed had opened the router.

19 May 2016, 21:28

Hi,

I booted the openwrt-ramips-rt3883-tew-692gr-initramfs-uImage.bin image since it got semi-identical hardware and this is the result:

 U-boot Ver:1.0.6.193 2011/09/22


Board: Ralink APSoC DRAM:  64 MB
spi_wait_nsec: 48 
spi device id: c2 20 17 c2 20 (2017c220)
find flash: MX25L6405D
raspi_read: from:30000 len:1000 
.raspi_read: from:30000 len:1000 
.============================================ 
ASIC 3883_MP (MAC to GigaPHY Mode)
Product Name: WLR-6000
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 

You choosed 1


raspi_read: from:40028 len:6 
.   
1: System Load Linux to SDRAM via TFTP. 
 Please Input new ones /or Ctrl-C to discard
        Input device IP (192.168.1.1) ==: 
        Input server IP (192.168.1.2) ==:
        Input Linux Kernel filename (ramdisk.bin) ==:

 Waitting for RX_DMA_BUSY status Start... done

 Header Payload scatter function is Disable !! 
Using Eth0 (10/100-M) device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'ramdisk.bin'.
Loading: Got ARP REPLY, set server/gtwy eth addr (hidden)
Got it
#
 first block received  
################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################################
done
Bytes transferred = 3198471 (30ce07 hex)
raspi_read: from:30000 len:10000 
.Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
raspi_write: to:30000 len:10000 
.
done
[    0.000000] Linux version 3.18.29 (user@Development) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r49363) ) #2 Thu May 19 22:16:30 CE6
[    0.000000] SoC Type: Ralink RT3883 ver:1 eco:5
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[    0.000000] MIPS: machine is TRENDnet TEW-692GR
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Initmem setup node 0 [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 59384K/65536K available (2526K kernel code, 125K rwdata, 532K rodata, 2120K init, 186K bss, 6152K reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] CPU Clock: 500MHz
[    0.000000] Calibrating delay loop... 249.44 BogoMIPS (lpj=1247232)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.080000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.090000] pinctrl core: initialized pinctrl subsystem
[    0.100000] NET: Registered protocol family 16
[    0.110000] rt3883-pci 10140000.pci: mode: PCIe
[    1.710000] PCI host bridge /pci@10140000/host-bridge ranges:
[    1.720000]  MEM 0x0000000020000000..0x000000002fffffff
[    1.730000]   IO 0x0000000010160000..0x000000001016ffff
[    1.740000] rt2880_gpio 10000600.gpio: registering 24 gpios
[    1.750000] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    1.760000] rt2880_gpio 10000638.gpio: registering 16 gpios
[    1.770000] PCI host bridge to bus 0000:00
[    1.770000] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    1.780000] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    1.790000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.800000] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.810000] pci 0000:00:01.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    1.820000] pci 0000:00:01.0: BAR 1: assigned [mem 0x20100000-0x2010ffff]
[    1.830000] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x2000ffff]
[    1.840000] pci 0000:00:01.0: PCI bridge to [bus 01]
[    1.840000] pci 0000:00:01.0:   bridge window [mem 0x20000000-0x200fffff]
[    1.850000] pci 0000:00:01.0: of_irq_parse_pci() failed with rc=-22
[    1.860000] Switched to clocksource MIPS
[    1.870000] NET: Registered protocol family 2
[    1.870000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    1.890000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    1.900000] TCP: Hash tables configured (established 1024 bind 1024)
[    1.910000] TCP: reno registered
[    1.920000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.930000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.940000] NET: Registered protocol family 1
[    4.880000] rt-timer 10000100.timer: maximum frequency is 10131Hz
[    4.900000] futex hash table entries: 256 (order: -1, 3072 bytes)
[    4.920000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    4.930000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    4.960000] msgmni has been set to 115
[    4.970000] io scheduler noop registered
[    4.970000] io scheduler deadline registered (default)
[    4.990000] ralink-usb-phy usbphy: invalid resource
[    5.000000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    5.010000] console [ttyS0] disabled
[    5.020000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a 16550A
[    5.030000] console [ttyS0] enabled
[    5.030000] console [ttyS0] enabled
[    5.050000] bootconsole [early0] disabled
[    5.050000] bootconsole [early0] disabled
[    5.070000] of-flash 1c000000.nor-flash: do_map_probe() failed
[    5.080000] ralink_soc_eth 10100000.ethernet: generated random MAC address 36:8e:58:e4:50:41
[    5.100000] libphy: mdio: probed
[    5.110000] switch0: Atheros AR8327 rev. 2 switch registered on mdio-bus
[    5.120000] Atheros AR8216/AR8236/AR8316: probe of mdio-bus:00 failed with error -22
[    5.140000] ralink_soc_eth 10100000.ethernet: incorrect phy-mode -22
[    5.150000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5
[    5.160000] rt2880_wdt 10000120.watchdog: Initialized
[    5.180000] TCP: cubic registered
[    5.180000] NET: Registered protocol family 17
[    5.190000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    5.220000] 8021q: 802.1Q VLAN Support v1.8
[    5.240000] Freeing unused kernel memory: 2120K (8031e000 - 80530000)
[    5.270000] init: Console is alive
[    5.280000] init: - watchdog -
[    6.280000] init: - preinit -
[    6.410000] 8021q: adding VLAN 0 to HW filter on device eth0
[    6.440000] random: procd urandom read with 9 bits of entropy available
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    9.600000] procd: - early -
[    9.610000] procd: - watchdog -
[   10.140000] procd: - ubus -
[   11.160000] procd: - init -
Please press Enter to activate this console.
[   11.880000] NET: Registered protocol family 10
[   11.900000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   11.920000] Loading modules backported from Linux version v4.4-rc5-1913-gc8fdf68
[   11.940000] Backport generated by backports.git backports-20151218-0-g2f58d9d
[   11.950000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   11.970000] nf_conntrack version 0.5.0 (961 buckets, 3844 max)
[   12.020000] xt_time: kernel timezone is -0000
[   12.110000] PPP generic driver version 2.4.2
[   12.120000] NET: Registered protocol family 24
[   12.160000] PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
[   12.170000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 5392, rev 0222 detected
[   12.190000] ieee80211 phy0: rt2800_init_eeprom: Error - Invalid RF chipset 0xffff detected
[   12.210000] ieee80211 phy0: rt2x00lib_probe_dev: Error - Failed to allocate device
[   12.230000] rt2800_wmac 10180000.wmac: failed to load eeprom property
[   12.240000] ieee80211 phy1: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'soc_wmac.eeprom'.
[   12.260000] rt2800_wmac 10180000.wmac: Direct firmware load for soc_wmac.eeprom failed with error -2
[   12.280000] rt2800_wmac 10180000.wmac: Falling back to user helper
[   12.330000] firmware soc_wmac.eeprom: firmware_loading_store: map pages failed
[   12.350000] ieee80211 phy1: rt2x00lib_request_eeprom_file: Error - Failed to request EEPROM.
[   12.360000] rt2800_wmac: probe of 10180000.wmac failed with error -11
[   19.450000] 8021q: adding VLAN 0 to HW filter on device eth0
[   19.470000] device eth0.1 entered promiscuous mode
[   19.480000] device eth0 entered promiscuous mode
[   19.510000] br-lan: port 1(eth0.1) entered forwarding state
[   19.520000] br-lan: port 1(eth0.1) entered forwarding state
[   21.520000] br-lan: port 1(eth0.1) entered forwarding state

Dmesg:

root@OpenWrt:/# dmesg
[    0.000000] Linux version 3.18.29 (user@Development) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r49363) ) #2 Thu May 19 22:16:30 CE6
[    0.000000] SoC Type: Ralink RT3883 ver:1 eco:5
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[    0.000000] MIPS: machine is TRENDnet TEW-692GR
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Initmem setup node 0 [mem 0x00000000-0x03ffffff]
[    0.000000] On node 0 totalpages: 16384
[    0.000000] free_area_init_node: node 0, pgdat 803060d0, node_mem_map 81000000
[    0.000000]   Normal zone: 128 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16384 pages, LIFO batch:3
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 59384K/65536K available (2526K kernel code, 125K rwdata, 532K rodata, 2120K init, 186K bss, 6152K reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] CPU Clock: 500MHz
[    0.060000] Calibrating delay loop... 249.44 BogoMIPS (lpj=1247232)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.080000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.090000] pinctrl core: initialized pinctrl subsystem
[    0.100000] NET: Registered protocol family 16
[    0.110000] rt2880-pinmux pinctrl: try to register 96 pins ...
[    0.110000] pinctrl core: registered pin 0 (io0) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 1 (io1) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 2 (io2) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 3 (io3) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 4 (io4) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 5 (io5) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 6 (io6) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 7 (io7) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 8 (io8) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 9 (io9) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 10 (io10) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 11 (io11) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 12 (io12) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 13 (io13) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 14 (io14) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 15 (io15) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 16 (io16) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 17 (io17) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 18 (io18) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 19 (io19) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 20 (io20) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 21 (io21) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 22 (io22) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 23 (io23) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 24 (io24) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 25 (io25) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 26 (io26) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 27 (io27) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 28 (io28) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 29 (io29) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 30 (io30) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 31 (io31) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 32 (io32) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 33 (io33) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 34 (io34) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 35 (io35) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 36 (io36) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 37 (io37) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 38 (io38) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 39 (io39) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 40 (io40) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 41 (io41) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 42 (io42) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 43 (io43) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 44 (io44) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 45 (io45) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 46 (io46) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 47 (io47) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 48 (io48) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 49 (io49) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 50 (io50) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 51 (io51) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 52 (io52) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 53 (io53) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 54 (io54) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 55 (io55) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 56 (io56) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 57 (io57) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 58 (io58) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 59 (io59) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 60 (io60) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 61 (io61) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 62 (io62) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 63 (io63) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 64 (io64) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 65 (io65) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 66 (io66) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 67 (io67) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 68 (io68) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 69 (io69) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 70 (io70) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 71 (io71) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 72 (io72) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 73 (io73) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 74 (io74) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 75 (io75) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 76 (io76) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 77 (io77) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 78 (io78) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 79 (io79) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 80 (io80) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 81 (io81) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 82 (io82) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 83 (io83) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 84 (io84) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 85 (io85) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 86 (io86) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 87 (io87) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 88 (io88) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 89 (io89) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 90 (io90) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 91 (io91) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 92 (io92) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 93 (io93) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 94 (io94) on rt2880-pinmux
[    0.110000] pinctrl core: registered pin 95 (io95) on rt2880-pinmux
[    0.110000] pinctrl core: add 4 pinmux maps
[    0.110000] rt2880-pinmux pinctrl: found group selector 1 for spi
[    0.110000] rt2880-pinmux pinctrl: found group selector 0 for i2c
[    0.110000] rt2880-pinmux pinctrl: found group selector 4 for jtag
[    0.110000] rt2880-pinmux pinctrl: found group selector 2 for uartf
[    0.110000] rt2880-pinmux pinctrl: request pin 3 (io3) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 4 (io4) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 5 (io5) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 6 (io6) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 1 (io1) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 2 (io2) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 17 (io17) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 18 (io18) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 19 (io19) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 20 (io20) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 21 (io21) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 7 (io7) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 8 (io8) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 9 (io9) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 10 (io10) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 11 (io11) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 12 (io12) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 13 (io13) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: request pin 14 (io14) for pinctrl
[    0.110000] rt2880-pinmux pinctrl: failed to lookup the sleep state
[    0.110000] rt3883-pci 10140000.pci: mode: PCIe
[    1.710000] PCI host bridge /pci@10140000/host-bridge ranges:
[    1.720000]  MEM 0x0000000020000000..0x000000002fffffff
[    1.730000]   IO 0x0000000010160000..0x000000001016ffff
[    1.740000] rt2880_gpio 10000600.gpio: registering 24 gpios
[    1.750000] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    1.760000] rt2880_gpio 10000638.gpio: registering 16 gpios
[    1.770000] PCI host bridge to bus 0000:00
[    1.770000] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    1.780000] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    1.790000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.800000] pci 0000:00:01.0: [1814:0802] type 01 class 0x060400
[    1.800000] pci 0000:00:01.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    1.800000] pci 0000:00:01.0: supports D1
[    1.800000] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    1.800000] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.810000] pci 0000:01:00.0: [1814:3091] type 00 class 0x028000
[    1.810000] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x0000ffff]
[    1.810000] pci 0000:01:00.0: PME# supported from D0 D3hot
[    1.810000] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.810000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    1.810000] pci 0000:00:01.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    1.820000] pci 0000:00:01.0: BAR 1: assigned [mem 0x20100000-0x2010ffff]
[    1.830000] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x2000ffff]
[    1.840000] pci 0000:00:01.0: PCI bridge to [bus 01]
[    1.840000] pci 0000:00:01.0:   bridge window [mem 0x20000000-0x200fffff]
[    1.850000] pci 0000:00:01.0: of_irq_parse_pci() failed with rc=-22
[    1.860000] Switched to clocksource MIPS
[    1.870000] NET: Registered protocol family 2
[    1.870000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    1.890000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    1.900000] TCP: Hash tables configured (established 1024 bind 1024)
[    1.910000] TCP: reno registered
[    1.920000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.930000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.940000] NET: Registered protocol family 1
[    1.950000] PCI: CLS 0 bytes, default 32
[    4.880000] rt-timer 10000100.timer: maximum frequency is 10131Hz
[    4.900000] alarmtimer alarmtimer: no of_node; not parsing pinctrl DT
[    4.900000] futex hash table entries: 256 (order: -1, 3072 bytes)
[    4.920000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    4.930000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    4.960000] msgmni has been set to 115
[    4.970000] io scheduler noop registered
[    4.970000] io scheduler deadline registered (default)
[    4.990000] ralink-usb-phy usbphy: invalid resource
[    5.000000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    5.010000] serial8250 serial8250: no of_node; not parsing pinctrl DT
[    5.010000] pinctrl core: add 1 pinmux maps
[    5.010000] rt2880-pinmux pinctrl: found group selector 3 for uartlite
[    5.010000] rt2880-pinmux pinctrl: request pin 15 (io15) for 10000c00.uartlite
[    5.010000] rt2880-pinmux pinctrl: request pin 16 (io16) for 10000c00.uartlite
[    5.010000] console [ttyS0] disabled
[    5.020000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a 16550A
[    5.030000] console [ttyS0] enabled
[    5.050000] bootconsole [early0] disabled
[    5.070000] of-flash 1c000000.nor-flash: do_map_probe() failed
[    5.080000] ralink_soc_eth 10100000.ethernet: generated random MAC address 82:24:57:5a:80:1d
[    5.100000] libphy: mdio: probed
[    5.110000] switch0: Atheros AR8327 rev. 2 switch registered on mdio-bus
[    5.120000] Atheros AR8216/AR8236/AR8316: probe of mdio-bus:00 failed with error -22
[    5.140000] ralink_soc_eth 10100000.ethernet: incorrect phy-mode -22
[    5.150000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5
[    5.160000] rt2880_wdt 10000120.watchdog: Initialized
[    5.180000] TCP: cubic registered
[    5.180000] NET: Registered protocol family 17
[    5.190000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    5.220000] 8021q: 802.1Q VLAN Support v1.8
[    5.240000] Freeing unused kernel memory: 2120K (8031e000 - 80530000)
[    5.270000] init: Console is alive
[    5.280000] init: - watchdog -
[    5.290000] rt2880-pinmux pinctrl: request pin 10 (io10) for pio:10
[    5.290000] rt2880-pinmux pinctrl: request pin 26 (io26) for pio:26
[    5.300000] rt2880-pinmux pinctrl: request pin 9 (io9) for pio:9
[    5.300000] rt2880-pinmux pinctrl: request pin 28 (io28) for pio:28
[    6.280000] init: - preinit -
[    6.410000] 8021q: adding VLAN 0 to HW filter on device eth0
[    6.440000] random: procd urandom read with 9 bits of entropy available
[    9.620000] procd: - early -
[    9.630000] procd: - watchdog -
[   10.180000] procd: - ubus -
[   11.200000] procd: - init -
[   11.920000] NET: Registered protocol family 10
[   11.940000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   11.960000] Loading modules backported from Linux version v4.4-rc5-1913-gc8fdf68
[   11.980000] Backport generated by backports.git backports-20151218-0-g2f58d9d
[   11.990000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   12.010000] nf_conntrack version 0.5.0 (961 buckets, 3844 max)
[   12.060000] xt_time: kernel timezone is -0000
[   12.150000] PPP generic driver version 2.4.2
[   12.170000] NET: Registered protocol family 24
[   12.210000] rt2800pci 0000:01:00.0: no of_node; not parsing pinctrl DT
[   12.210000] PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
[   12.220000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 5392, rev 0222 detected
[   12.240000] ieee80211 phy0: rt2800_init_eeprom: Error - Invalid RF chipset 0xffff detected
[   12.260000] ieee80211 phy0: rt2x00lib_probe_dev: Error - Failed to allocate device
[   12.270000] rt2800_wmac 10180000.wmac: failed to load eeprom property
[   12.290000] ieee80211 phy1: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'soc_wmac.eeprom'.
[   12.310000] rt2800_wmac 10180000.wmac: Direct firmware load for soc_wmac.eeprom failed with error -2
[   12.320000] rt2800_wmac 10180000.wmac: Falling back to user helper
[   12.380000] firmware soc_wmac.eeprom: firmware_loading_store: map pages failed
[   12.390000] ieee80211 phy1: rt2x00lib_request_eeprom_file: Error - Failed to request EEPROM.
[   12.410000] rt2800_wmac: probe of 10180000.wmac failed with error -11
[   19.500000] 8021q: adding VLAN 0 to HW filter on device eth0
[   19.540000] device eth0.1 entered promiscuous mode
[   19.550000] device eth0 entered promiscuous mode
[   19.610000] br-lan: port 1(eth0.1) entered forwarding state
[   19.620000] br-lan: port 1(eth0.1) entered forwarding state
[   21.620000] br-lan: port 1(eth0.1) entered forwarding state
[   74.620000] random: nonblocking pool is initialized

The Bootloader:

4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Sep 22 2011 - 14:21:09)
Unknown command 'echo' - try 'help'
Unknown command 'echo' - try 'help'
RT3883 # print
bootcmd=tftp
bootdelay=5
baudrate=57600
ethaddr="[hidden]"
sn=122348463
hw_ver=1.1.0
hw_id=02020041
pro_id=000
country=000
domain=1
wanaddr=[hidden]
wlanaddr=[hidden]
iNICaddr=[hidden]
fwaddr=[hidden]
eth_en=0
snextra=00000000000000000000
preboot=echo;echo
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
kernel_addr=BFC40000
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
ethact=Eth0 (10/100-M)
op_mode=0
uboot_ver=1.0.6.193
filesize=30ce07
fileaddr=80800000
ipaddr=192.168.1.1
serverip=192.168.1.2
autostart=no
bootfile=WLR6000.bin
stdin=serial
stdout=serial
stderr=serial

Environment size: 1107/4092 bytes

This all seems promising.

(Last edited by Timeless on 12 Aug 2016, 10:04)

25 May 2016, 19:51

Another update:

I changed the op_mode to 1 and now this is the serial output:

3: System Boot system code via Flash.                                           
raspi_read: from:50000 len:40                                                   
.raspi_read: from:50040 len:148674                                              
.....................                                                           
LINUX started...                                                                
                                                                                
 THIS IS ASIC                                                                   
init started: BusyBox v1.7.5 (2012-05-22 20:00:54 CST)                          
starting pid 200, tty '/dev/console': '/sbin/config_init'                       
Config Init version: 3.1.0.2 date: 2012/05/22                                   
starting pid 252, tty '/dev/ttyS1': '/sbin/config_term'                         
************************************************************************        
*                                 WLR-6000                             *        
************************************************************************        
                                                                                
KernelApp/Ramdisk Ver:3.1.0.2                    Date:2012/05/22                
Application Ver:3.1.0.2          Date:2012/05/22                                
                                                                                
Mount tmpfs size 6074368B                                                       
password: cat: can't open '/apps/lib/modules/2.6.21/modulesApp.dep': No such fiy
ln: /sbin/./apps_init: File exists                                              
ln: /sbin/./opmode.sh: File exists                                              
createShareMem keyid 7001 shmId 0                                               
CTRL_INTERFACE:[/var/sysconfd_if]  CTRL_INTERFACE_IF:[if0]                      
                                                                                
System Monitoring                                                               
*********************************************************************           
Initializing system environment                                                 
Setting up /tmp directory ...                                                   
Setting up loopback device ...                                                  
***************************************************                             
System is in    AP Router Mode [0]                                              
***************************************************                             
SEM_GETID got id -1                                                             
Mac: 0, rtcTime:1293840001                                                      
Starting system logging daemon ...OK                                            
Setting up Ethernet devices ...                                                 
OK                                                                              
Configuring Bridge device ...          OK                                       
Setting the host&domain name ...Finished.                                       
Configuring net ...          OK                                                 
Configuring LAN device ...          OK                                          
getRegularDomain,1                                                              
Configuring RT28XX device ...Wlan is in AP Mode                                 
Using fixWDSLowTP function.                                                     
getRegularDomain,1                                                              
Create iNic configuration file OK.                                              
Wan Manager...                                                                  
Configuring WAN device[WAN0] ...                                                
Obtaining IP address from DHCP ...                                              
No PHY Link                                                                     
Starting DNS Proxy ...            FAILED                                        
Stopping DHCP server ...            fwmCheck[71]                                
Starting FW manager ...           fwmUpdate[188], sending signal USR1 to pid(0) 
OK                                                                              
Starting ntpclient ...                                                          
Setup tc for QoS ... QoS Disable                                                
Disabled                                                                        
Configuring network routing and filtering ...                                   
Init mini iptable rule...OK                                                     
Starting DDNS  ...  Disabled                                                    
Set Static Routing ...            Starting UPNPD  ...  Disabled.                
Starting HTTPD server ...           OK                                          
Staring ALG...           Disabled                                               
Starting LLTD ...           OK                                                  
Starting SC utmproxy ...                                                        
Starting hotplug2 ... OK                                                        
[KCODES]---> you are in server mode(Samba) now                                  
[KCODES]---> mount point:[(null)]                                               
Initialization has completed                                                    
*We used 5.350000 seconds to initialize all modules*                            
pSEM_GETID got id 65538                                                         
[RMGMT DBG] RMGMT_VERSION: 3.1.2                                                
Reload WAN: eth2.2 ...                                                          
Close WAN: eth2.2 ...                                                           
*** PROCESS MANAGER Starts ***                                                  
Processmanager update modules                                                   
Configuring WAN device[WAN0] ...                                                
Obtaining IP address from DHCP ...                                              
No PHY Link                                                                     
Phy(eth2.2) link disconnected ...Wait for link recover                          
Processmanager update modules                                                   
                                                                                
!!! wrong password !!!                                                          
password:                                                                       
!!! wrong password !!!                                                          
password:                                                                       
!!! wrong password !!!                                                          
password:                                                                       
!!! wrong password !!!                                                          
password:                                                                       
sh: /sbin/manufac_test: not found                                               
password:                                                                       
sh: /sbin/cli: not found

Unfortunately I tried several passwords like "pe" "admin" "senao_kcodes" but neither of them seem to show any console I get the /sbin/xxx not found errors. So this seem to be the right passwords but something is just not right with the factory firmware. Or simply locked down.

(Last edited by Timeless on 25 May 2016, 22:55)

25 May 2016, 22:27

Another update:

I received the GPL code from Sitecom. I've uploaded it and it can be downloaded here: Link

(Last edited by Timeless on 25 May 2016, 23:18)

25 May 2016, 22:44

Another update:

The available commands in u-boot

                                        
RT3883 # help                                                                   
?       - alias for 'help'                                                      
bootm   - boot application image from memory                                    
cp      - memory copy                                                           
erase   - erase SPI FLASH memory                                                
go      - start application at address 'addr'                                   
help    - print online help                                                     
loadb   - load binary file over serial line (kermit mode)                       
md      - memory display                                                        
mdio   - Ralink PHY register R/W command !!                                     
mm      - memory modify (auto-incrementing)                                     
mw      - memory write (fill)                                                   
nm      - memory modify (constant address)                                      
printenv- print environment variables                                           
reset   - Perform RESET of the CPU                                              
rf      - read/write rf register                                                
saveenv - save environment variables to persistent storage                      
setenv  - set environment variables                                             
spicmd  - read/write data from/to eeprom or vtss                                
tftpboot- boot image via network using TFTP protocol                            
version - print monitor version

And this seems to be the flash layout:

static struct mtd_partition_t physmap_partitions_t[] = {
        {
                name:           "Bootloader", 
                size:           0x30000,
                offset:         0,
        },{
                name:           "Config ",
                size:           0x10000,
                offset:         0x30000,
        }, {
                name:           "Factory",
                size:           0x8000,
                offset:         0x40000,
        }, {
                name:           "iNIC_rf",
                size:           0x8000,
                offset:         0x48000,
        }, {
                name:           "Kernel",      /* mtdblock4 : kernel(no-router) + web-backup + DNS(fake) + DHCPD */
                size:           0x713000,      /* 0x100000 */
                offset:         0x50000,
        }, {
                name:           "app",         /* mtdblock5 : kernel + APP */
                size:           0x6FA000,
                offset:         0x150000,
        }, {
                name:            "manufacture",      /* kernel(0X140000) + APP(0x560000) */
                size:            0x7D000,       
                offset:            0x763000,
        }, {
                name:            "backup",     
                size:            0x10000,       /* 64 KB */
                offset:            0x7E0000,
        }, {
                name:           "storage",  
                size:           0x10000,       
                offset:         0x7F0000,
        }

(Last edited by Timeless on 12 Aug 2016, 10:04)

22 Jul 2016, 15:03

I have a TP-Link WDR4300 with OpenWRT. This is my production router. For a new setup I want to experiment and in the crate with hardware I found the Sitecom WLR-6000. So I am interested in getting OpenWRT on this router...

Timeless wrote:

I received the GPL code from Sitecom.

In my box there was a cd-rom which has a directory with the source.

In your photo J12 has a header. I presume you soldered it? Is ths 3,3 V and is the layout btoom to top: Vcc, GND and then RX en TX or visa versa?

Not completely clear is the experiment with the openwrt-ramips-rt3883-tew-692gr-initramfs-uImage.bin. If I understand correctly you uploaded this via TFTP (serial) to RAM and then started it? If this works have you flashed this?

1 Aug 2016, 15:37

cmsigler wrote:

Figure out where to solder on a serial pad or pins and use a USB-to-TTL converter to connect to the PCB's serial port. Then get ckermit or another serial comm program running to that port, set the serial params (115200, 8-N-1 seems to be a vanilla setting)

In the above photo this was already done (bottom right near the capcitator). It is labeled J12 and pin 1 has a small white triangle. Pin 1 is Vref, pin 2 is GND, pin 3 is TXD and pin 4 is RXD. The serial parameters are 57600,8,N,1.

Press immediately a U-boot option when text appears. The interval seems to be one second, so be quick . I've identified the following options:

Load system code to SDRAM via TFTP
System Load Linux Kernel then write to Flash via TFTP
System Boot system code via Flash
System Enter Boot Command Line Interface
same as 1 with default choices, starts immediately
- (starts 3)
System Load Boot Loader then write to Flash via Serial
System Load UBoot to SDRAM via TFTP
System Load Boot Loader then write to Flash via TFTP

Here the complete output from start to one of the above choices.

1 Aug 2016, 15:47

Timeless wrote:

Unfortunately I tried several passwords like "pe" "admin" "senao_kcodes" but neither of them seem to show any console I get the /sbin/xxx not found errors. So this seem to be the right passwords but something is just not right with the factory firmware. Or simply locked down.

Nope. On the bottom of the router is a sticker with default, random WPA2 passwords for 2,4 and 5 GHz. There is also a password for admin and that is on mine the same as the 2,4 GHz one. Will try your op_mode experiment...

1 Aug 2016, 21:08

Timeless wrote:

Unfortunately I tried several passwords like "pe" "admin" "senao_kcodes" but neither of them seem to show any console I get the /sbin/xxx not found errors. So this seem to be the right passwords but something is just not right with the factory firmware. Or simply locked down.

I don't have the password prompt but I noticed:

KernelApp/Ramdisk Ver:2.0.1.16                   Date:2011/12/12
console> Application Ver:2.0.1.16                Date:2011/12/12

cmd [mkdir -p /dev/shm/tmp]
cmd [chmod 1777 /dev/shm/tmp/]
...

The text after console> is the config_init output. With a Ctrl-C at the end I get the console> prompt again and after searching the web I found two possible passwords lin17 and sn2450. The latter worked and I've now a root-prompt through the serial console.

3 Aug 2016, 11:15

hvdkamer wrote:

KernelApp/Ramdisk Ver:2.0.1.16                   Date:2011/12/12
console> Application Ver:2.0.1.16                Date:2011/12/12

The upgrade to the newest version (3.1.0.2) was broken. I asked Sitecom for a download and they repaired the portal so now I have:

KernelApp/Ramdisk Ver:3.1.0.2      Date:2012/05/22
Application Ver:3.1.0.2            Date:2012/05/22

The console> prompt is now a password: prompt and that is changed from sn2450 to lin17.

3 Aug 2016, 11:30

Timeless wrote:

And this seems to be the flash layout:

...
                name:           "app",         /* mtdblock5 : kernel + APP */
                size:           0x6FA000,
                offset:         0x150000,
,,,

This can't be right. The offset plus size gives 0x84A000 and that is outside the 8 MiB of the flash. The correct size is:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00001000 "Bootloader"
mtd1: 00010000 00001000 "Config "
mtd2: 00008000 00001000 "Factory"
mtd3: 00008000 00001000 "iNIC_rf"
mtd4: 00713000 00001000 "Kernel"
mtd5: 005ca000 00001000 "app"
mtd6: 0007d000 00001000 "manufacture"
mtd7: 00010000 00001000 "backup"
mtd8: 00010000 00001000 "storage"

So my guess is that md4 and md5 overlap. The sum of all sizes minus mtd5 is 0x800000 and that is 8 MiB. So the kernel is present from 0x050000 to 0x199000 (1.316 KiB) and from that point we have a 5.808 KiB squashfs.

10 Aug 2016, 15:29

Hi,

I'm glad to see that you are also interested in the WLR-6000 . I was on holiday so that's the reason of my late reply.

hvdkamer wrote:

In your photo J12 has a header. I presume you soldered it? Is ths 3,3 V and is the layout btoom to top: Vcc, GND and then RX en TX or visa versa?

It is not my own picture. I took it from the WIKI page. But no I did not solder anything permanent yet. I removed the existing solder so I could use "PogoPins' to make a temporally connection. And I saw you figured the pinout scheme out yourself

hvdkamer wrote:

This can't be right. The offset plus size gives 0x84A000 and that is outside the 8 MiB of the flash.

The flash layout is directly copied from the GPL Archive Sitecom provided. I could be mistaken but isn't there 16MiB of flash on this router?

hvdkamer wrote:

Not completely clear is the experiment with the openwrt-ramips-rt3883-tew-692gr-initramfs-uImage.bin. If I understand correctly you uploaded this via TFTP (serial) to RAM and then started it? If this works have you flashed this?

I compiled a RAM image of the rt3883(Trendnet TEW-692GR) from source and started it with console option "1: Load system code to SDRAM via TFTP." so the flash was unaffected during this process. The reason I chose this platform is because of its hardware similarities with the WLR6000. So I had a starting point to work with.

I did not tried to flash this since the flash chip and other hardware is not properly addressed yet so this would make my router useless.
Another thing: I took a quick browse on your website and noticed that you did a try on the initramfs aswel? But you had problems getting the file uploaded? please make sure that you're uploading the correct file. From what I can see is that you are uploading the "squashfs" file instead of the "initramfs" file.

hvdkamer wrote:

The upgrade to the newest version (3.1.0.2) was broken. I asked Sitecom for a download and they repaired the portal so now I have:

Great, we now have thesame version. But yeah I noticed that as well. They gave me a link to some random file sharing page with the firmware file. I saved it locally for future references.

hvdkamer wrote:

The console> prompt is now a password: prompt and that is changed from sn2450 to lin17.

Mhh... so you are able to login to the console and browse the filesystem?

hvdkamer wrote:

Here the complete output from start to one of the above choices.

Ps. I noticed the words "KEUZE" in your complete bootlog. Is it correct to assume that you're dutch? (Which is also my nationality )

(Last edited by Timeless on 10 Aug 2016, 15:48)

10 Aug 2016, 16:08

Timeless wrote:

I was on holiday so that's the reason of my late reply.

No problem. Hope it was a nice break . I was trying to repeat your experiments and got almost as far and discovered a phew new things. Good to finally have your answers.

Timeless wrote:

But no I did not solder anything permanent yet. I removed the existing solder

I removed the solder by hand drilling with a 0,8 mm drill. And then soldered a header. I didn't mind that it is permanent . If I can get the router to work: great. If not I will probably learn a lot. Already have...

Timeless wrote:

The flash layout is directly copied from the GPL Archive Sitecom provided. I could be mistaken but isn't there 16MiB of flash on this router?

Hmm, mine is 8 MiB. I have the impression that the quality of the source archive is a mess. I've created a layout for the one I have (version 3.1.0.2 of the firmware). Sorry for the Dutch, but probably Google translate will help.

Timeless wrote:

I compiled a RAM image of the rt3883(Trendnet TEW-692GR) from source and started it with console option "1: Load system code to SDRAM via TFTP." so the flash was unaffected during this process. The reason I chose this platform is because of its hardware similarities with the WLR6000. So I had a starting point to work with.

And that is the point wher I'm stuck. I figured it out that I needed to compile a initramfs. I choosed the same platform you mentioned, but I don't get the filename. Instead:

hvdkamer@openwrt:~/openwrt$ ls -l bin/ramips/
total 24644
-rw-r--r--  1 hvdkamer hvdkamer     506 aug  6 00:10 md5sums
-rw-r--r--  1 hvdkamer hvdkamer 1835008 aug  6 00:10 openwrt-ramips-rt3883-root.squashfs
-rw-r--r--  1 hvdkamer hvdkamer 2953674 aug  6 00:10 openwrt-ramips-rt3883-uImage-initramfs.bin
-rw-r--r--  1 hvdkamer hvdkamer 1274244 aug  6 00:10 openwrt-ramips-rt3883-uImage.bin
-rwxr-xr-x  1 hvdkamer hvdkamer 5611580 aug  6 00:10 openwrt-ramips-rt3883-vmlinux-initramfs.bin
-rwxr-xr-x  1 hvdkamer hvdkamer 5616644 aug  6 00:10 openwrt-ramips-rt3883-vmlinux-initramfs.elf
-rwxr-xr-x  1 hvdkamer hvdkamer 3953532 aug  6 00:10 openwrt-ramips-rt3883-vmlinux.bin
-rwxr-xr-x  1 hvdkamer hvdkamer 3958596 aug  6 00:10 openwrt-ramips-rt3883-vmlinux.elf
drwxr-xr-x 10 hvdkamer hvdkamer    4096 aug  6 00:10 packages
-rw-r--r--  1 hvdkamer hvdkamer     871 aug  6 00:10 sha256sums

When I load openwrt-ramips-rt3883-uImage-initramfs.bin via TFTP to RAM the kernels starts, but reboots endlessly after four lines of output. I don't have the capture, but it looks like:

[    0.000000] Linux version <build information>
[    0.000000] SoC Type: Ralink RT3883 ver:1 eco:5
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)

I've also tried openwrt-15.05.1-ramips-rt3883-uImage.bin uboot.img and openwrt-15.05.1-ramips-rt3883-tew-692gr-squashfs-factory.bin from the OpenWRT download site. The first does the same as what I've compiled, the second boots the kernel but then says it need an initramfs. That clue prompted me to compile one myself because I couldn't find the one you mentioned.

What did you do to get the explicit filename and not the generic one. I probably do something wrong, but the Wiki is very confusing. Do you still have the one you compiled. Can I try it?

Timeless wrote:

Mhh... so you are able to login to the console and browse the filesystem?

Correct. That is one of the things I discovered. You get a root prompt, but the available commands are very limited. One of my next ideas was to compile missing packages and use the USB -- yes, a flashdrive can be mounted -- to get them temporarily. A bit like the initramfs...

I've the impression that this router could be upgraded to OpenWRT. I have some information about the dlf format os if successful other users don't have to solder a header but can flash through the normal Sitecom firmware. We are not there yet, but together we can probably get closer to that goal.

(Last edited by hvdkamer on 10 Aug 2016, 16:08)

10 Aug 2016, 16:31

hvdkamer wrote:

No problem. Hope it was a nice break . I was trying to repeat your experiments and got almost as far and discovered a phew new things. Good to finally have your answers.

Yeah it was, Thanks

hvdkamer wrote:

I removed the solder by hand drilling with a 0,8 mm drill. And then soldered a header. I didn't mind that it is permanent . If I can get the router to work: great. If not I will probably learn a lot. Already have...

Mmh. interesting way of de-soldering things .

hvdkamer wrote:

Hmm, mine is 8 MiB. I have the impression that the quality of the source archive is a mess. I've created a layout for the one I have (version 3.1.0.2 of the firmware).

I have not checked the flash chip myself and copied the information from the WIKI. But I will check the chip on my board to verify that.

hvdkamer wrote:

Sorry for the Dutch, but probably Google translate will help.

You probably missed:

timeless wrote:

Ps. I noticed the words "KEUZE" in your complete bootlog. Is it correct to assume that you're dutch? (Which is also my nationality )

So dutch is not a problem for me .

hvdkamer wrote:

And that is the point wher I'm stuck. I figured it out that I needed to compile a initramfs. I choosed the same platform you mentioned, but I don't get the filename. Instead:
hvdkamer@openwrt:~/openwrt$ ls -l bin/ramips/
total 24644
-rw-r--r--  1 hvdkamer hvdkamer     506 aug  6 00:10 md5sums
-rw-r--r--  1 hvdkamer hvdkamer 1835008 aug  6 00:10 openwrt-ramips-rt3883-root.squashfs
-rw-r--r--  1 hvdkamer hvdkamer 2953674 aug  6 00:10 openwrt-ramips-rt3883-uImage-initramfs.bin
-rw-r--r--  1 hvdkamer hvdkamer 1274244 aug  6 00:10 openwrt-ramips-rt3883-uImage.bin
-rwxr-xr-x  1 hvdkamer hvdkamer 5611580 aug  6 00:10 openwrt-ramips-rt3883-vmlinux-initramfs.bin
-rwxr-xr-x  1 hvdkamer hvdkamer 5616644 aug  6 00:10 openwrt-ramips-rt3883-vmlinux-initramfs.elf
-rwxr-xr-x  1 hvdkamer hvdkamer 3953532 aug  6 00:10 openwrt-ramips-rt3883-vmlinux.bin
-rwxr-xr-x  1 hvdkamer hvdkamer 3958596 aug  6 00:10 openwrt-ramips-rt3883-vmlinux.elf
drwxr-xr-x 10 hvdkamer hvdkamer    4096 aug  6 00:10 packages
-rw-r--r--  1 hvdkamer hvdkamer     871 aug  6 00:10 sha256sums
When I load openwrt-ramips-rt3883-uImage-initramfs.bin via TFTP to RAM the kernels starts, but reboots endlessly after four lines of output. I don't have the capture, but it looks like:
[    0.000000] Linux version <build information>
[    0.000000] SoC Type: Ralink RT3883 ver:1 eco:5
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
I've also tried openwrt-15.05.1-ramips-rt3883-uImage.bin uboot.img and openwrt-15.05.1-ramips-rt3883-tew-692gr-squashfs-factory.bin from the OpenWRT download site. The first does the same as what I've compiled, the second boots the kernel but then says it need an initramfs. That clue prompted me to compile one myself because I couldn't find the one you mentioned.
What did you do to get the explicit filename and not the generic one. I probably do something wrong, but the Wiki is very confusing. Do you still have the one you compiled. Can I try it?

Yeah you're correct, there is something wrong with the TEW-692gr profile. The correct files are only generated when using the 15.05 source. I noticed this as well but ignored this for now. Mostly because the TEW-692GR is not the goal platform here. please repeat your steps on a 15.05 checkout and I'm sure you will get the same results I had.

I'll have a look to see if I have the files. I cleaned up some space and accidentally removed some of my compiled stuff last time .

hvdkamer wrote:

I've the impression that this router could be upgraded to OpenWRT

Yeah correct. also since most of the hardware is already supported. We only have to connect the dots.

hvdkamer wrote:

I have some information about the dlf format os if successful other users don't have to solder a header but can flash through the normal Sitecom firmware. We are not there yet, but together we can probably get closer to that goal.

Yeah this is also a more user friendly way.

(Last edited by Timeless on 10 Aug 2016, 16:34)

11 Aug 2016, 10:02

Timeless wrote:

Mmh. interesting way of de-soldering things .

Found it on the internet and it is very easy without risk of over heating...

timeless wrote:

Ps. I noticed the words "KEUZE" in your complete bootlog. Is it correct to assume that you're dutch? (Which is also my nationality )

That was added will I was still busy creating my response .

timeless wrote:

Yeah you're correct, there is something wrong with the TEW-692gr profile. The correct files are only generated when using the 15.05 source. I noticed this as well but ignored this for now. Mostly because the TEW-692GR is not the goal platform here. please repeat your steps on a 15.05 checkout and I'm sure you will get the same results I had.

I used trunk. Tonight I will try to do a build with 15.05. The only partial success I had was with the TEW-692GR uImage. Probably because there is a check for the machine ID. At least that is my hypothesis for the moment.

A working OpenWRT with initramfs even if it is the wrong profile is almost certain more useful then the root access in the original Sitecom firmware. So my list for the coming days:

Compile the 15.05 TEW-692GR profile and see if it boots
If success: Test if the main components -- network, switch, wireless, usb -- works
If success: Check which patch has broken the TEW-692GR profile in 15.05.1 and later
If fail: compile kernel with CONFIG_DEBUG_LL to see if the machine ID is the problem

timeless wrote:

I'll have a look to see if I have the files. I cleaned up some space and accidentally removed some of my compiled stuff last time .

If the above succeeds then it is not a problem. I got exited when I saw you had a non destructive working environment. At least until the next reboot. One of the options to get a permanent OpenWRT firmware is through this route. Not the most easy one, but at least a proof of concept.

Hope you can find your working image. Then you can check which hardware works and which don't. And please confirm/disprove the flash size. Did you already make a back-up (for others: in Dutch) of the mtd partitions?

Another question. Should we start a wiki page. We have a lot of information and a good chance of success. At least more then a lot of other routers in the TOH.

(Last edited by hvdkamer on 11 Aug 2016, 10:04)

11 Aug 2016, 10:18

hvdkamer wrote:

Found it on the internet and it is very easy without risk of over heating...

Ah seems like a legit method indeed.

hvdkamer wrote:

I used trunk. Tonight I will try to do a build with 15.05. The only partial success I had was with the TEW-692GR uImage. Probably because there is a check for the machine ID. At least that is my hypothesis for the moment.

I guess the uImage you're uploading only contains the kernel and therefor will not boot any further. And with the current trunk there is no file generated specific for this hardware. but just a generic image.

hvdkamer wrote:

Compile the 15.05 TEW-692GR profile and see if it boots
If success: Test if the main components -- network, switch, wireless, usb -- works
If success: Check which patch has broken the TEW-692GR profile in 15.05.1 and later
If fail: compile kernel with CONFIG_DEBUG_LL to see if the machine ID is the problem

1. Does work
2. Network, switch, wireless does not work. Have not yet tested USB.
WIFI:

[   12.210000] rt2800pci 0000:01:00.0: no of_node; not parsing pinctrl DT
[   12.210000] PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
[   12.220000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 5392, rev 0222 detected
[   12.240000] ieee80211 phy0: rt2800_init_eeprom: Error - Invalid RF chipset 0xffff detected
[   12.260000] ieee80211 phy0: rt2x00lib_probe_dev: Error - Failed to allocate device
[   12.270000] rt2800_wmac 10180000.wmac: failed to load eeprom property
[   12.290000] ieee80211 phy1: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'soc_wmac.eeprom'.
[   12.310000] rt2800_wmac 10180000.wmac: Direct firmware load for soc_wmac.eeprom failed with error -2
[   12.320000] rt2800_wmac 10180000.wmac: Falling back to user helper
[   12.380000] firmware soc_wmac.eeprom: firmware_loading_store: map pages failed
[   12.390000] ieee80211 phy1: rt2x00lib_request_eeprom_file: Error - Failed to request EEPROM.
[   12.410000] rt2800_wmac: probe of 10180000.wmac failed with error -11

SWITCH:

[    5.070000] of-flash 1c000000.nor-flash: do_map_probe() failed
[    5.080000] ralink_soc_eth 10100000.ethernet: generated random MAC address 36:8e:58:e4:50:41
[    5.100000] libphy: mdio: probed
[    5.110000] switch0: Atheros AR8327 rev. 2 switch registered on mdio-bus
[    5.120000] Atheros AR8216/AR8236/AR8316: probe of mdio-bus:00 failed with error -22
[    5.140000] ralink_soc_eth 10100000.ethernet: incorrect phy-mode -22
[    5.150000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5

For more check the "dmesg" output of post #8.

hvdkamer wrote:

If the above succeeds then it is not a problem. I got exited when I saw you had a non destructive working environment. At least until the next reboot. One of the options to get a permanent OpenWRT firmware is through this route. Not the most easy one, but at least a proof of concept.
Hope you can find your working image. Then you can check which hardware works and which don't. And please confirm/disprove the flash size.
Another question. Should we start a wiki page. We have a lot of information and a good chance of success. At least more then a lot of other routers in the TOH.

I'm currently working on some domotics systems. Which will limit my time here. But I will help the best I can. After today's work I'll check if I can find the initramfs file. And if not maybe compile one for you, to check if you get the same results as I had?

hvdkamer wrote:

Did you already make a back-up (for others: in Dutch) of the mtd partitions?

I did not make a backup yet. That's also the reason why I used a RAM image so my flash stayed unharmed .

(Last edited by Timeless on 11 Aug 2016, 10:23)

11 Aug 2016, 10:59

Timeless wrote:

I guess the uImage you're uploading only contains the kernel and therefor will not boot any further. And with the current trunk there is no file generated specific for this hardware. but just a generic image.

I did three experiments:

openwrt-15.05.1-ramips-rt3883-uImage.bin
openwrt-15.05.1-ramips-rt3883-tew-692gr-squashfs-factory.bin
openwrt-ramips-rt3883-uImage-initramfs.bin

I do a binwalk on all images to see what they contain. The first has the name suggests only the kernel. That one gives a endless reboot with only four messages from the kernel.

The second one contains a kernel and squasfs root filesystem for flashing. This kernel starts fully, but can't find a initramfs to boot from.

Those two let to the experiment of compilng the TEW-692GR profile from trunk. That didn't give the correct filename but a binwalk shows a kernel and initramfs. I don't have the log, but it is similar as the first experiment: endless reboot with four kernel lines per boot.

Thanks to your reply it seems now that building the TEW-692GR profile is broken. But that one has something which is needed for booting on the SItecom WLR-6000 .

Timeless wrote:

2. Network, switch, wireless does not work. Have not yet tested USB.

Ok. The last would be handy for importing/exporting stuff from a running initramfs.

Timeless wrote:

I'm currently working on some domotics systems. Which will limit my time here. But I will help the best I can. After today's work I'll check if I can find the initramfs file. And if not maybe compile one for you, to check if you get the same results as I had?

Finding it could be useful. But I also want to compile my own for two reasons. One to confirm your experiment and two because then I have a system to build variations of the firmware. So no need for you to compile a new one.

I'll do the work for now. No problem. I'll probably use it for another episode of my Het Lab articles in a Dutch computermagazine. Your replies with clarification already helped a lot. Thanks!

11 Aug 2016, 14:49

Timeless wrote:

I have not checked the flash chip myself and copied the information from the WIKI. But I will check the chip on my board to verify that.

In my bootlog it says:

Board: Ralink APSoC DRAM:  64 MB
spi_wait_nsec: 48
spi device id: c2 20 17 c2 20 (2017c220)
find flash: MX25L6405D

Acoording to the manufacturer this is a 64 Mbit chip, so 8 MiB.

11 Aug 2016, 16:39

hvdkamer wrote:

Another question. Should we start a wiki page. We have a lot of information and a good chance of success. At least more then a lot of other routers in the TOH.

I've created a page about this router. Hope this attracts other interested persons to this topic.

12 Aug 2016, 09:48

hvdkamer wrote:

In my bootlog it says:
Board: Ralink APSoC DRAM:  64 MB
spi_wait_nsec: 48
spi device id: c2 20 17 c2 20 (2017c220)
find flash: MX25L6405D
Acoording to the manufacturer this is a 64 Mbit chip, so 8 MiB.

You are indeed correct. This is also in my bootlog. So I do not need to check that on the PCB anymore. I think it is more or less confirmed now.

hvdkamer wrote:

hvdkamer wrote:
Another question. Should we start a wiki page. We have a lot of information and a good chance of success. At least more then a lot of other routers in the TOH.
I've created a page about this router. Hope this attracts other interested persons to this topic.

Yes I noticed, great work.

If remembered correctly this brakes a 'warranty seal' sticker

There was no seal on my WLR-6000.

I also spoke to mkresin. He helped me with the Astoria networks VGV7519 before. and he followed this topic as well. He send me the altered TEW-692GR profile file (.dts) with initial Macronix 25L6406E support, Have to check if it also works for the MX25L6405D. I asked him if I may post it here as well. And he told me that he will reply on this topic later.

Ps. I also noticed your backdoor warning in the original Sitecom firmware. This can be very serious . but seems only possible from LAN (Management WAN disabled) and if the WiFi password is not changed. But still Sitecom does not patch it while there is a 10year warranty.

(Last edited by Timeless on 12 Aug 2016, 09:59)