OpenWrt Forum Archive

Topic: Belkin F5D8235-4 N router with gigabit switch

The content of this topic has been archived between 15 Apr 2018 and 25 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Here is photo of board. Please note console header pins were soldered at J2.

http://farm3.static.flickr.com/2600/3973238318_36e8369823_o.png

and here is a photo of the cover showing the location of the screw holes for securing the cover the the bottom case. They are covered over with a layer of plastic and should be locatable with the use of a pin or point object.

http://farm4.static.flickr.com/3505/3973238326_113f3b0803_o.png


Console pins are at J2. I had to solder on the pin header. Pin holes were open and not soldered over.
Console pin layout to the best of my knowledge --- If I'm wrong please let me know to correct.
pin 1 Power  ---- its a square pin
pin 2 Tx
pin 3 Rcv
pin 4 Gnd


Here is the console boot code.

Terminal ready

U-Boot 1.1.3 (Nov  7 2008 - 00:24:27)

Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81fa0000
=====config_usbotg =====
flash_protect ON: from 0xBF000000 to 0xBF02F0F7
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
============================================ 
Ralink UBoot Version: 3.2
-------------------------------------------- 
ASIC 3052_MP2 (Port5<->GigaSW)
DRAM COMPONENT: 128Mbits 
DRAM BUS: 32BIT 
Total memory: 32 MBytes
Date:Nov  7 2008  Time:00:24:27
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 384 MHZ #### 

 SDRAM bus set to 32 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
   0 
   
3: System Boot system code via Flash.
## Booting image at bf050000 ...
   Image Name:   Linux Kernel Image
   Created:      2009-03-31   6:24:29 UTC

 System Control Status = 0x10440000 
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1178131 Bytes =  1.1 MB
   Load Address: 80000000
   Entry Point:  80364000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80364000) ...
## Giving linux memsize in MB, 32

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.21 (root@localhost.localdomain) (gcc version 3.4.2) #16 Tue Mar 31 14:22:41 CST 2009

 The CPU feqenuce set to 384 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock2
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 80800060, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 00177000(1536000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
emory: 28756k/32768k available (2832k kernel code, 4012k reserved, 636k data, 132k init, 0k highmem)
ount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.8)
io scheduler noop registered (default)
FLASH_API: MAN_ID=C2 DEV_ID=22CB SIZE=8MB
Ralink RT2880 gpio driver initialized
Gemtek LED init...
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
smi_major=249
0 smi_init check[0x05c]1=0x5937
rdm_major = 254
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v1.60  128 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 128, Rx Ring = 128
GDMA1_MAC_ADRH -- : 0x0000000c
GDMA1_MAC_ADRL -- : 0x43305277
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
ralink flash device: 0x1000000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 5 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00050000 : "uboot"
0x00050000-0x007e0000 : "Kernel and Rootfs"
0x001d0000-0x007e0000 : "Rootfs"
0x007e0000-0x007f0000 : "Nvram"
0x007f0000-0x00800000 : "Factory"
block2mtd: version $Revision: 1.1.1.1 $
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Fully Cone
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
tunl0: Disabled Privacy Extensions
obile IPv6
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
NET: Registered protocol family 17
create_proc_read_write_entry: fail
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 132k freed
Algorithmics/MIPS FPU Emulator v1.5

phy_tx_ring = 0x01c9f000, tx_ring = 0xa1c9f000

phy_rx_ring = 0x00000000, rx_ring = 0x00000000
RT305x_ESW: Link Status Changed
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 790000
#sysinit: [sysinit]


BusyBox v1.1.0 (2009.03.30-07:26+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# ftok: No such file or directory
sgget: No such file or directory
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
Creat rmain device for LED and insmod it.
insmod: reset_btn.ko: no module by that name found
Starting Watchdog function !!!!!!!
cat: /proc/watchdog_ctrl_folder/watchdog_ctrl_run: No such file or directory
Done
Clean storage nvram value!!
# update nvram with default list!
Do 'echo 0 > /proc/USB_BLINK;echo 1 > /proc/GPIO23;echo 1 > /proc/GPIO22;' in ixp4xx_gpio.h   
# interfaces_init......
RTL8366 reg 0x5C=[0x5937]
Init RTL8366RB!!
switch reg write offset=98, value=7f40
switch reg write offset=e4, value=20
rmmod: rtl8366RB: Success
rtl_major = 253
0 smi_init check[0x0105]=0x0000
0 smi_init check[0x0105]=0x0000
0 smi_init check[0x0509]=0x5937
verid is 3
0 rtl8366rb_initChip
0 smi_init check[0x0509]1=0x5937
0 smi_init check[0x050a]1=0x0003
Gemtek Link status init.
verid is 3
rtl8366rb_initChip() initialized!
rtl8366rb_setMac5ForceLink() initialized!
verid is 3
[0]phy_abilityAutoNegotiation : 1
[0]phy_abilityHalf_10 : 1
[0]phy_abilityFull_10 : 1
[0]phy_abilityHalf_100 : 1
[0]phy_abilityFull_100 : 1
[0]phy_abilityFull_1000 : 1
[0]phy_abilityFC : 1
[0]phy_abilityAsyFC : 1
[1]phy_abilityAutoNegotiation : 1
[1]phy_abilityHalf_10 : 1
[1]phy_abilityFull_10 : 1
[1]phy_abilityHalf_100 : 1
[1]phy_abilityFull_100 : 1
[1]phy_abilityFull_1000 : 1
[1]phy_abilityFC : 1
[1]phy_abilityAsyFC : 1
[2]phy_abilityAutoNegotiation : 1
[2]phy_abilityHalf_10 : 1
[2]phy_abilityFull_10 : 1
[2]phy_abilityHalf_100 : 1
[2]phy_abilityFull_100 : 1
[2]phy_abilityFull_1000 : 1
[2]phy_abilityFC : 1
[2]phy_abilityAsyFC : 1
[3]phy_abilityAutoNegotiation : 1
[3]phy_abilityHalf_10 : 1
[3]phy_abilityFull_10 : 1
[3]phy_abilityHalf_100 : 1
[3]phy_abilityFull_100 : 1
[3]phy_abilityFull_1000 : 1
[3]phy_abilityFC : 1
[3]phy_abilityAsyFC : 1
[4]phy_abilityAutoNegotiation : 1
[4]phy_abilityHalf_10 : 1
[4]phy_abilityFull_10 : 1
[4]phy_abilityHalf_100 : 1
[4]phy_abilityFull_100 : 1
[4]phy_abilityFull_1000 : 1
[4]phy_abilityFC : 1
[4]phy_abilityAsyFC : 1
rtl8366s_getEthernetPHY fail for 5!!!!
rtl8366s_getEthernetPHY fail for 6!!!!
rtl8366s_getEthernetPHY fail for 7!!!!
rtl8366s_getEthernetPHY fail for 8!!!!
rtl8366s_getEthernetPHY fail for 9!!!!
rtl8366s_getEthernetPHY fail for 10!!!!
rtl8366s_getEthernetPHY fail for 11!!!!
rtl8366s_getEthernetPHY fail for 12!!!!
rtl8366s_getEthernetPHY fail for 13!!!!
rtl8366s_getEthernetPHY fail for 14!!!!
rtl8366s_getEthernetPHY fail for 15!!!!
gemtek_switch_reset failed
RTL_GET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET : tx is 0, rx is -2115259424
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
rtl:rtl_ge_read : 0
RTL_SET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET : tx is 1, rx is -2115259424
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
rtl:rtl_ge_read : 0
Setting ra0 configuration....
CountryRegionABand=1
WirelessMode=9
TxRate=0
Channel=0
BeaconPeriod=100
DtimPeriod=1
TxPower=100
BGProtection=2
RTSThreshold=2347
FragThreshold=2346
TxBurst=1
ShortSlot=1
PktAggregate=0
NoForwarding=0
NoForwardingBTNBSSID=0
HideSSID=0
Key1Type=0
Key2Type=0
Key3Type=0
Key4Type=0
WdsEnable=0
WdsList=
WdsKey=
WdsEncrypType=NONE
AutoChannelSelect=1
RekeyInterval=2000
AccessPolicy0=0
AccessPolicy1=0
RADIUS_Server=0.0.0.0
RADIUS_Port=1812
RADIUS_Key=
Ethifname=vlan1
own_ip_addr=192.168.2.1
session_timeout_interval=0
DisableOLBC=0
TxPreamble=0
WmmCapable=1
AckPolicy=0;0;0;0
APAifsn=3;7;1;1
APCwmin=4;4;3;2
APCwmax=6;10;4;3
APTxop=0;0;94;47
APACM=0;0;0;0
BSSAifsn=3;7;2;2
BSSCwmin=4;4;3;2
BSSCwmax=10;10;4;3
BSSTxop=0;0;94;47
BSSACM=0;0;0;0
BasicRate=15
IEEE8021X=0
Set N mode parameter...
Bring up ra0 interface....
rt2860v2_ap: module license 'unspecified' taints kernel.
2860 version : 2.0.0.0 (Mar 30 2009)


=== pAd = c103c000, size = 486208 ===

<-- RTMPAllocAdapterBlock, Status=0
RX DESC a1874000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
CS Set = ff ff 00 00 00
ain bssid = 00:22:75:b3:a8:a8
The UUID Hex string is:2880288028801880a880002275b3a8a8
The UUID ASCII string is:28802880-2880-1880-a880-002275b3a8a8!
<==== RTMPInitialize, Status=0
0x1300 = 00064320
interface ra0 does not exist!
No need to change ra0 to Nintendo NDS capable
No need to change ra0 to Nintendo NDS capable...Complete
ra0       mac:
[0x00001300]:00063330  
ra0       mac:
[0x00001304]:000a3700  
killall: rt2860apd: no process killed
rt2860apd: not found
ssid : init mode
killall : No such file or directory
get_WPS_PIN_code : WSCStatus : 17741200
check_WPS_status : WSCStatus is 3 now...STATUS_WSC_LINK_UP
WPS BUTTON press!!
killall: wscd: no process killed
route: SIOC[ADD|DEL]RT: No such device
gPassiveMsgQ Init success! gPassiveMsgID=0x386d4393!
ra0       mac:
[0x0000102c]:0f031e46  
gActiveMsgQ Init success!
sock=6!(0x0x7f892d08)
Create netlink socket thread success!
Create ioctl socket(7) success!
Pthread(wscDevNLHandle)vlan1: Setting MAC address to Now waiting for  00the netlink sock 22et incoming mess 75age!
wscd: SSDP b3 UDP PORT = 1900 a8
(wscDevNLHandl a8e):netlink socke.
t data is availadevice eth2 entered promiscuous mode
ble now.
VLAN (vlan1):  Setting underlying device (eth2) to promiscious mode.
wscNLEventRTMNewlinkHandle(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNvlan1: dev_set_promiscuity(master, 1)
ewlinkHandleErrodevice vlan1 entered promiscuous mode
r with UpnpInit -- -208
device ra0 entered promiscuous mode
br0: port 2(ra0) entering listening state
br0: port 1(vlan1) entering listening state
dwc_otg: version 2.60a 22-NOV-2006
DWC_otg: Using DMA mode
dwc_otg lm0: DWC OTG Controller
dwc_otg lm0: new USB bus registered, assigned bus number 1
dwc_otg lm0: irq 18, io mem 0x00000000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
# lan services init......
killall: rt2860apd: no process killed
rt2860apd: No such file or directory
Start UPnP
easyconf: start 20080820
easyconf: Waiting for client to connect...
route: resolving gw
br0: port 2(ra0) entering learning state
br0: port 1(vlan1) entering learning state
route: resolving gw
route: resolving gw
route: resolving gw
route: resolving gw
dnsmasq: failed to bind listening socket for fe80::222:75ff:feb3:a8a8: Cannot assign requested address
killall : No such file or directory
get_WPS_PIN_code : WSCStatus : 17741200
check_WPS_status : WSCStatus is 3 now...STATUS_WSC_LINK_UP
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(vlan1) entering forwarding state
killall: wscd: no process killed
route: SIOC[ADD|DEL]RT: File exists
gPassiveMsgQ Init success! gPassiveMsgID=0x386d4395!
gActiveMsgQ Init success!
(2136)Service enable wireless
# wan_init......
Set country code to us!!!
sock=6!(0x0x7ff41d08)
Pthread(wscDevNLHandle)Now waiting for the netlink socket incoming message!
Create netlink socket thread success!
Create ioctl socket(7) suvlan2: Setting MAC address to ccess!
wscd: SS 00DP UDP PORT = 19 2200
 75 b3 a8 aa.
(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNewlinkHandleUPnP Initialized
      IP-Addr: 192.168.2.1 Port: 49152
     HW-Addr: 00:22:75:b3:a8:a8!
Specifying the webserver root directory -- /etc_ro/xml/
UUID Str=uuid:28802880-2880-1880-a880-002275b3a8a8!
alloc memory size=1135!
<?xml version="1.0" encoding="utf-8"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">
  <specVersion>
    <major>1</major>
    <minor>0</minor>
  </specVersion>
  <device>
    <deviceType>urn:schemas-wifialliance-org:device:WFADevice:1</deviceType>
    <friendlyName>Belkin Wireless Router</friendlyName>
    <manufacturer>Belkin Corporation</manufacturer>
    <manufacturerURL>http://www.belkin.com</manufacturerURL>
    <modelDescription>Belkin Wireless Router</modelDescription>
    <modelName>Belkin Wireless Router</modelName>
    <modelNumber>F5D</modelNumber>
    <modelURL>http://www.belkin.com</modelURL>
    <serialNumber>111111111111</serialNumber>
<UDN>uuid:28802880-2880-1880-a880-002275b3a8a8</UDN>
    <serviceList>
      <service>
        <serviceType>urn:schemas-wifialliance-org:service:WFAWLANConfig:1</serviceType>
        <serviceId>urn:wifialliance-org:serviceId:WFAWLANConfig1</serviceId>
        <SCPDURL>WFAWLANConfigSCPD.xml</SCPDURL>
        <controlURL>control</controlURL>
        <eventSubURL>event</eventSubURL>
      </service>
    </servicClose speed boot up led...
eList>
  </device>
</root>
Registering the RootDevice
     with descDocUrl: http://192.168.2.1:49152/description.xml
RootDevice Registered
WscLocalDevice:
    Device:
        FriendlyName=Belkin Wireless Router!
        DescDocURL=http://192.168.2.1:49152/description.xml!
        UDN=uuid:28802880-2880-1880-a880-002275b3a8a8!
        PresURL=!
    Service:
        servIdStr=urn:wifialliance-org:serviceId:WFAWLANConfig1!
        servTypeStr=urn:schemas-wifialliance-org:service:WFAWLANConfig:1!
        scpdURL=http://192.168.2.1:49152/WFAWLANConfigSCPD.xml!
        eventURL=http://192.168.2.1:49152/event!
        controlURL=http://192.168.2.1:49152/control!
WscLocalDeviceInit Initialized
Changing password for guest
Bad password: too short.

Warning: weak password (continuing).
Jan  1 00:00:22 passwd[3475]: password for `guest' changed by user `root'
Password changed.
Can't load /etc/smb.conf - run testparm to debug it
Advertisement Sent
httpd : This is httpd...ssl_enabled is 0
(easystorage.c->main(201)) Easystorage Start 20080820

Thanks for using picocom
picocom v1.4

port is        : /dev/ttyUSB0
flowcontrol    : none
baudrate is    : 57600
parity is      : none
databits are   : 8
escape is      : C-a
noinit is      : no
noreset is     : no
nolock is      : no
send_cmd is    : ascii_xfr -s -v -l10
receive_cmd is : rz -vv

(Last edited by herbswanson on 2 Oct 2009, 12:40)

Progress to date:

1.   Downloaded open source from Belkin and rebuild factory firmware and flashed router.

2.   Modified busybox and linux .config file in the factory tree adding telnetd

3.   Flashed router and enabled telnetd on the running system

Now some details

Building the firmware:

Downloaded the source code from Belkin at this site:

https://www.belkin.com/support/opensource/

Two tar balls are available releases 2.01.06 and 2.01.07.
Production release is 2.01.06

These tar balls come with configuration files and the build was fairly easy. I created a virtual machine for my build using sun's virtualbox. Unpacked the tar bar into the "/" partition as instructed. Build required following fixes to run to completion. The "make" will find them for you.


modified sumversion.c  added a missing include
      /linux/scripts/mod/sumversion.c
      10a11
      > #include <limits.h>

changed HOSTCFLAGS  and CFLAGS in the linux/Makefile   allowed warning messages on compile

      197c197
      < HOSTCFLAGS = -Werror -Wstrict-prototypes -O2 -fomit-frame-pointer
      > HOSTCFLAGS = -Wall -O2 -fomit-frame-pointer
      312c312
      < CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
      > CFLAGS := -Wall -Wundef -Wno-trigraphs \


An extraneous "-e" was added to the bb_config.h file. Deleted these characters from line 1.

Flashing the router:

The firmware file is passed to the router by TFTP. You will need to install and configure a tftpd server

aptitude install tftpd-hpa

After a successful build the /Belkin_F5D8235-4_v2000_v2.01.06/images contains the following files

F5D8235v2_WW_2.01.06.bin
firmware.bin
linux_uImage
romfs.sqsh.lzma
zImage.lzma

The firmware.bin file is a trx file. The F5D8235v2_WW_2.01.06.bin is the same as the firmware.bin but has 19 bytes of additional identifier information prepended to the start of the file.

copy the firmware.bin file to the tftpd-hpa server directory (/var/lib/tftpboot on ubuntu) 

The router uses the das boot(uboot). The following menu is presented during boot and you have 1 second to enter a value.

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.

I used option 1 extensively to test if the kernel runs.

When it works I use option 2 to write the new firmware.
Console code of flash

U-Boot 1.1.3 (Nov  7 2008 - 00:24:27)

Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81fa0000
=====config_usbotg =====
flash_protect ON: from 0xBF000000 to 0xBF02F0F7
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
============================================ 
Ralink UBoot Version: 3.2
-------------------------------------------- 
ASIC 3052_MP2 (Port5<->GigaSW)
DRAM COMPONENT: 128Mbits 
DRAM BUS: 32BIT 
Total memory: 32 MBytes
Date:Nov  7 2008  Time:00:24:27
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 384 MHZ #### 

 SDRAM bus set to 32 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 

You choosed 2

 0 

 eth_register  
Eth0 (10/100-M)
 enetvar=ethaddr,Eth addr:00:AA:BB:CC:DD:10
 00:AA:BB:CC:DD:10:

 eth_current->name = Eth0 (10/100-M)

   
2: System Load Linux Kernel then write to Flash via TFTP. 
 Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
 Please Input new ones /or Ctrl-C to discard
        Input device IP (192.168.1.1) ==:

        Input server IP (192.168.1.64) ==:

        Input Linux Kernel filename (f5d8235.romfs-fix.2009.10.13.trx) ==:firmware.2009.10.14-v0.trx

 netboot_common, argc= 3 
 *************buf = 0x81fcf260
 **********NexTxPacket = 81fe7340

 NetTxPacket = 0x81FE7340 

 NetRxPackets[0] = 0x81FE7940

 NetRxPackets[1] = 0x81FE7F40

 NetRxPackets[2] = 0x81FE8540

 NetRxPackets[3] = 0x81FE8B40

 NetRxPackets[4] = 0x81FE9140

 NetRxPackets[5] = 0x81FE9740

 NetRxPackets[6] = 0x81FE9D40

 NetRxPackets[7] = 0x81FEA340

 NetRxPackets[8] = 0x81FEA940

 NetRxPackets[9] = 0x81FEAF40

 NetRxPackets[10] = 0x81FEB540

 NetRxPackets[11] = 0x81FEBB40

 NetRxPackets[12] = 0x81FEC140

 NetRxPackets[13] = 0x81FEC740

 NetRxPackets[14] = 0x81FECD40

 NetRxPackets[15] = 0x81FED340

 NetRxPackets[16] = 0x81FED940

 NetRxPackets[17] = 0x81FEDF40

 NetRxPackets[18] = 0x81FEE540

 NetRxPackets[19] = 0x81FEEB40

 KSEG1ADDR(NetTxPacket) = 0xA1FE7340 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done
0 smi_init check[0x0509]=0x5937
0 smi_init check[0x0509]=0x5937

 Header Payload scatter function is Disable !! 

 ETH_STATE_ACTIVE!! 
Using Eth0 (10/100-M) device
TFTP from server 192.168.1.64; our IP address is 192.168.1.1
Filename 'firmware.2009.10.14-v0.trx'.

 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (00:23:54:ef:98:f1)
Got it
T #
 first block received  
################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #############
done
Bytes transferred = 6385664 (617000 hex)
NetBootFileXferSize= 00617000
Erase linux kernel block !!
From 0xBF050000 To 0xBF66FFFF

 b_end =BF7FFFFF
Erase Flash from 0xbf050000 to 0xbf66ffff in Bank # 1 

 erase sector  = 12 
sect = 12,s_last = 109,erase poll = 828124

 erase sector  = 13 
sect = 13,s_last = 109,erase poll = 844256

 erase sector  = 14 
*sect = 14,s_last = 109,erase poll = 822779

 erase sector  = 15 
sect = 15,s_last = 109,erase poll = 830345

 erase sector  = 16 
*sect = 16,s_last = 109,erase poll = 828794

 erase sector  = 17 
sect = 17,s_last = 109,erase poll = 846010

 erase sector  = 18 
sect = 18,s_last = 109,erase poll = 844435

 erase sector  = 19 
*sect = 19,s_last = 109,erase poll = 845138

 erase sector  = 20 
sect = 20,s_last = 109,erase poll = 870838

 erase sector  = 21 
*sect = 21,s_last = 109,erase poll = 832141

 erase sector  = 22 
sect = 22,s_last = 109,erase poll = 818910

 erase sector  = 23 
sect = 23,s_last = 109,erase poll = 856100

 erase sector  = 24 
*sect = 24,s_last = 109,erase poll = 819070

 erase sector  = 25 
sect = 25,s_last = 109,erase poll = 829492

 erase sector  = 26 
*sect = 26,s_last = 109,erase poll = 833550

 erase sector  = 27 
sect = 27,s_last = 109,erase poll = 820866

 erase sector  = 28 
sect = 28,s_last = 109,erase poll = 819179

 erase sector  = 29 
*sect = 29,s_last = 109,erase poll = 819219

 erase sector  = 30 
sect = 30,s_last = 109,erase poll = 781204

 erase sector  = 31 
sect = 31,s_last = 109,erase poll = 676554

 erase sector  = 32 
*sect = 32,s_last = 109,erase poll = 679882

 erase sector  = 33 
sect = 33,s_last = 109,erase poll = 727867

 erase sector  = 34 
sect = 34,s_last = 109,erase poll = 690609

 erase sector  = 35 
*sect = 35,s_last = 109,erase poll = 659683

 erase sector  = 36 
sect = 36,s_last = 109,erase poll = 819193

 erase sector  = 37 
*sect = 37,s_last = 109,erase poll = 837984

 erase sector  = 38 
sect = 38,s_last = 109,erase poll = 824229

 erase sector  = 39 
sect = 39,s_last = 109,erase poll = 840464

 erase sector  = 40 
*sect = 40,s_last = 109,erase poll = 819403

 erase sector  = 41 
sect = 41,s_last = 109,erase poll = 842603

 erase sector  = 42 
*sect = 42,s_last = 109,erase poll = 819880

 erase sector  = 43 
sect = 43,s_last = 109,erase poll = 820251

 erase sector  = 44 
sect = 44,s_last = 109,erase poll = 819313

 erase sector  = 45 
*sect = 45,s_last = 109,erase poll = 841607

 erase sector  = 46 
sect = 46,s_last = 109,erase poll = 819565

 erase sector  = 47 
*sect = 47,s_last = 109,erase poll = 851433

 erase sector  = 48 
sect = 48,s_last = 109,erase poll = 835413

 erase sector  = 49 
sect = 49,s_last = 109,erase poll = 819538

 erase sector  = 50 
*sect = 50,s_last = 109,erase poll = 819025

 erase sector  = 51 
sect = 51,s_last = 109,erase poll = 833992

 erase sector  = 52 
*sect = 52,s_last = 109,erase poll = 846202

 erase sector  = 53 
sect = 53,s_last = 109,erase poll = 819307

 erase sector  = 54 
sect = 54,s_last = 109,erase poll = 808774

 erase sector  = 55 
*sect = 55,s_last = 109,erase poll = 886035

 erase sector  = 56 
sect = 56,s_last = 109,erase poll = 830668

 erase sector  = 57 
*sect = 57,s_last = 109,erase poll = 819470

 erase sector  = 58 
sect = 58,s_last = 109,erase poll = 843478

 erase sector  = 59 
sect = 59,s_last = 109,erase poll = 820893

 erase sector  = 60 
*sect = 60,s_last = 109,erase poll = 846664

 erase sector  = 61 
sect = 61,s_last = 109,erase poll = 831172

 erase sector  = 62 
*sect = 62,s_last = 109,erase poll = 840436

 erase sector  = 63 
sect = 63,s_last = 109,erase poll = 840946

 erase sector  = 64 
*sect = 64,s_last = 109,erase poll = 900289

 erase sector  = 65 
sect = 65,s_last = 109,erase poll = 819795

 erase sector  = 66 
sect = 66,s_last = 109,erase poll = 819295

 erase sector  = 67 
*sect = 67,s_last = 109,erase poll = 820132

 erase sector  = 68 
sect = 68,s_last = 109,erase poll = 833414

 erase sector  = 69 
*sect = 69,s_last = 109,erase poll = 819324

 erase sector  = 70 
sect = 70,s_last = 109,erase poll = 826787

 erase sector  = 71 
sect = 71,s_last = 109,erase poll = 857527

 erase sector  = 72 
*sect = 72,s_last = 109,erase poll = 832786

 erase sector  = 73 
sect = 73,s_last = 109,erase poll = 829730

 erase sector  = 74 
*sect = 74,s_last = 109,erase poll = 829931

 erase sector  = 75 
sect = 75,s_last = 109,erase poll = 847788

 erase sector  = 76 
sect = 76,s_last = 109,erase poll = 829908

 erase sector  = 77 
*sect = 77,s_last = 109,erase poll = 821290

 erase sector  = 78 
sect = 78,s_last = 109,erase poll = 836348

 erase sector  = 79 
*sect = 79,s_last = 109,erase poll = 840752

 erase sector  = 80 
sect = 80,s_last = 109,erase poll = 840348

 erase sector  = 81 
sect = 81,s_last = 109,erase poll = 872301

 erase sector  = 82 
*sect = 82,s_last = 109,erase poll = 862717

 erase sector  = 83 
sect = 83,s_last = 109,erase poll = 866147

 erase sector  = 84 
*sect = 84,s_last = 109,erase poll = 845215

 erase sector  = 85 
sect = 85,s_last = 109,erase poll = 819939

 erase sector  = 86 
sect = 86,s_last = 109,erase poll = 835800

 erase sector  = 87 
*sect = 87,s_last = 109,erase poll = 862549

 erase sector  = 88 
sect = 88,s_last = 109,erase poll = 843201

 erase sector  = 89 
*sect = 89,s_last = 109,erase poll = 904785

 erase sector  = 90 
sect = 90,s_last = 109,erase poll = 822938

 erase sector  = 91 
sect = 91,s_last = 109,erase poll = 820678
.
 erase sector  = 92 
sect = 92,s_last = 109,erase poll = 842488

 erase sector  = 93 
sect = 93,s_last = 109,erase poll = 831315

 erase sector  = 94 
*sect = 94,s_last = 109,erase poll = 821181

 erase sector  = 95 
sect = 95,s_last = 109,erase poll = 880157

 erase sector  = 96 
*sect = 96,s_last = 109,erase poll = 936438

 erase sector  = 97 
sect = 97,s_last = 109,erase poll = 839581

 erase sector  = 98 
sect = 98,s_last = 109,erase poll = 809073

 erase sector  = 99 
*sect = 99,s_last = 109,erase poll = 819420

 erase sector  = 100 
sect = 100,s_last = 109,erase poll = 819343

 erase sector  = 101 
*sect = 101,s_last = 109,erase poll = 859005

 erase sector  = 102 
sect = 102,s_last = 109,erase poll = 809665

 erase sector  = 103 
sect = 103,s_last = 109,erase poll = 837934

 erase sector  = 104 
*sect = 104,s_last = 109,erase poll = 830163

 erase sector  = 105 
sect = 105,s_last = 109,erase poll = 830708

 erase sector  = 106 
*sect = 106,s_last = 109,erase poll = 833737

 erase sector  = 107 
sect = 107,s_last = 109,erase poll = 830632

 erase sector  = 108 
sect = 108,s_last = 109,erase poll = 808868

 erase sector  = 109 
*sect = 109,s_last = 109,erase poll = 815174
 done
Erased 98 sectors

 Copy linux image[6385664 byte] to Flash[0xBF050000].... 
Copy to Flash... 
 Copy 6385664 byte to Flash... 
 addr = 0xBF0A409C ,cnt=6041444 
 addr = 0xBF0F813A ,cnt=5697222 
 addr = 0xBF14C1D8 ,cnt=5353000 
 addr = 0xBF1A0276 ,cnt=5008778 
 addr = 0xBF1F4314 ,cnt=4664556 
 addr = 0xBF2483B2 ,cnt=4320334 
 addr = 0xBF29C450 ,cnt=3976112 
 addr = 0xBF2F04EE ,cnt=3631890 
 addr = 0xBF34458C ,cnt=3287668 
 addr = 0xBF39862A ,cnt=2943446 
 addr = 0xBF3EC6C8 ,cnt=2599224 
 addr = 0xBF440766 ,cnt=2255002 
 addr = 0xBF494804 ,cnt=1910780 
 addr = 0xBF4E88A2 ,cnt=1566558 
 addr = 0xBF53C940 ,cnt=1222336 
 addr = 0xBF5909DE ,cnt=878114 
 addr = 0xBF5E4A7C ,cnt=533892 
 addr = 0xBF638B1A ,cnt=189670 done
## Booting image at bf050000 ...
   Image Name:   Linux Kernel Image
   Created:      2009-10-14   9:55:29 UTC

 System Control Status = 0x30440000 
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1210677 Bytes =  1.2 MB
   Load Address: 80000000
   Entry Point:  8037c000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8037c000) ...
## Giving linux memsize in MB, 32

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.21 (root@lab64-vb) (gcc version 3.4.2) #84 Wed Oct 14 02:55:03 PDT 2009

 The CPU feqenuce set to 384 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock2
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 80800060, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 00177000(1536000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 28644k/32768k available (2914k kernel code, 4124k reserved, 649k data, 132k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.8)
io scheduler noop registered (default)
FLASH_API: MAN_ID=C2 DEV_ID=22CB SIZE=8MB
Ralink RT2880 gpio driver initialized
Gemtek LED init...
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
rdm_major = 254
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v1.60  128 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 128, Rx Ring = 128
GDMA1_MAC_ADRH -- : 0x0000000c
GDMA1_MAC_ADRL -- : 0x43305277
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
ralink flash device: 0x1000000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 5 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00050000 : "uboot"
0x00050000-0x007e0000 : "Kernel and Rootfs"
0x001d0000-0x007e0000 : "Rootfs"
0x007e0000-0x007f0000 : "Nvram"
0x007f0000-0x00800000 : "Factory"
block2mtd: version $Revision: 1.1.1.1 $
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Fully Cone
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
tunl0: Disabled Privacy Extensions
Mobile IPv6
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
NET: Registered protocol family 17
create_proc_read_write_entry: fail
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 132k freed
Algorithmics/MIPS FPU Emulator v1.5
reset_btn : reset_btn is 1...press

phy_tx_ring = 0x01cc1000, tx_ring = 0xa1cc1000

phy_rx_ring = 0x00000000, rx_ring = 0x00000000
RT305x_ESW: Link Status Changed
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 790000
#sysinit: [sysinit]
rtl8366_smi: module license 'unspecified' taints kernel.
smi_major=249
0 smi_init check[0x05c]1=0x5937
mkdir: Cannot create directory `/dev/pts': File exists


BusyBox v1.1.0 (2009.10.12-23:11+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# ftok: No such file or directory
msgget: No such file or directory
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
Creat rmain device for LED and insmod it.
insmod: reset_btn.ko: no module by that name found
Starting Watchdog function !!!!!!!
-- BUTTON: REBOOT --
cat: /proc/watchdog_ctrl_folder/watchdog_ctrl_run: No such file or directory
Done
Clean storage nvram value!!
# update nvram with default list!
Do 'echo 0 > /proc/USB_BLINK;echo 1 > /proc/GPIO23;echo 1 > /proc/GPIO22;' in ixp4xx_gpio.h   
# interfaces_init......
RTL8366 reg 0x5C=[0x5937]
Init RTL8366RB!!
switch reg write offset=98, value=7f40
switch reg write offset=e4, value=20
rmmod: rtl8366RB: Success
killall: smbd: no process killed
rtl_major = 253
0 smi_init check[0x0105]=0x0000
0 smi_init check[0x0105]=0x0000
0 smi_init check[0x0509]=0x5937
verid is 3
0 rtl8366rb_initChip
0 smi_init check[0x0509]1=0x5937
0 smi_init check[0x050a]1=0x0003
Gemtek Link status init.
killall: nmbd: no process killed
killall: ntfs-3g: no process killed

The system is going down NOW !!
Sending SIGTERM to all processes.
Sending SIGKILL

BusyBox v1.1.0 (2009.10.12-23:11+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# Restarting system.


U-Boot 1.1.3 (Nov  7 2008 - 00:24:27)

Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81fa0000
=====config_usbotg =====
flash_protect ON: from 0xBF000000 to 0xBF02F0F7
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
============================================ 
Ralink UBoot Version: 3.2
-------------------------------------------- 
ASIC 3052_MP2 (Port5<->GigaSW)
DRAM COMPONENT: 128Mbits 
DRAM BUS: 32BIT 
Total memory: 32 MBytes
Date:Nov  7 2008  Time:00:24:27
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 384 MHZ #### 

 SDRAM bus set to 32 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
 0 
   
3: System Boot system code via Flash.
## Booting image at bf050000 ...
   Image Name:   Linux Kernel Image
   Created:      2009-10-14   9:55:29 UTC

 System Control Status = 0x30440000 
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1210677 Bytes =  1.2 MB
   Load Address: 80000000
   Entry Point:  8037c000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8037c000) ...
## Giving linux memsize in MB, 32

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.21 (root@lab64-vb) (gcc version 3.4.2) #84 Wed Oct 14 02:55:03 PDT 2009

 The CPU feqenuce set to 384 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock2
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 10800020, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 00177000(1536000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 28644k/32768k available (2914k kernel code, 4124k reserved, 649k data, 132k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.8)
io scheduler noop registered (default)
FLASH_API: MAN_ID=C2 DEV_ID=22CB SIZE=8MB
Ralink RT2880 gpio driver initialized
Gemtek LED init...
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
rdm_major = 254
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v1.60  128 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 128, Rx Ring = 128
GDMA1_MAC_ADRH -- : 0x0000000c
GDMA1_MAC_ADRL -- : 0x43305277
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
ralink flash device: 0x1000000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 5 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00050000 : "uboot"
0x00050000-0x007e0000 : "Kernel and Rootfs"
0x001d0000-0x007e0000 : "Rootfs"
0x007e0000-0x007f0000 : "Nvram"
0x007f0000-0x00800000 : "Factory"
block2mtd: version $Revision: 1.1.1.1 $
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Fully Cone
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
tunl0: Disabled Privacy Extensions
Mobile IPv6
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
NET: Registered protocol family 17
create_proc_read_write_entry: fail
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 132k freed
Algorithmics/MIPS FPU Emulator v1.5

phy_tx_ring = 0x01cbd000, tx_ring = 0xa1cbd000

phy_rx_ring = 0x00000000, rx_ring = 0x00000000
RT305x_ESW: Link Status Changed
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 790000
#sysinit: [sysinit]
rtl8366_smi: module license 'unspecified' taints kernel.
smi_major=249
0 smi_init check[0x05c]1=0x5937
mkdir: Cannot create directory `/dev/pts': File exists


BusyBox v1.1.0 (2009.10.12-23:11+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# ftok: No such file or directory
msgget: No such file or directory
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
Creat rmain device for LED and insmod it.
insmod: reset_btn.ko: no module by that name found
Starting Watchdog function !!!!!!!
cat: /proc/watchdog_ctrl_folder/watchdog_ctrl_run: No such file or directory
Done
Clean storage nvram value!!
# update nvram with default list!
Do 'echo 0 > /proc/USB_BLINK;echo 1 > /proc/GPIO23;echo 1 > /proc/GPIO22;' in ixp4xx_gpio.h   
# interfaces_init......
RTL8366 reg 0x5C=[0x5937]
Init RTL8366RB!!
switch reg write offset=98, value=7f40
switch reg write offset=e4, value=20
rmmod: rtl8366RB: Success
rtl_major = 253
0 smi_init check[0x0105]=0x0000
0 smi_init check[0x0105]=0x0000
0 smi_init check[0x0509]=0x5937
verid is 3
0 rtl8366rb_initChip
0 smi_init check[0x0509]1=0x5937
0 smi_init check[0x050a]1=0x0003
Gemtek Link status init.
verid is 3
rtl8366rb_initChip() initialized!
rtl8366rb_setMac5ForceLink() initialized!
verid is 3
[0]phy_abilityAutoNegotiation : 1
[0]phy_abilityHalf_10 : 1
[0]phy_abilityFull_10 : 1
[0]phy_abilityHalf_100 : 1
[0]phy_abilityFull_100 : 1
[0]phy_abilityFull_1000 : 1
[0]phy_abilityFC : 1
[0]phy_abilityAsyFC : 1
[1]phy_abilityAutoNegotiation : 1
[1]phy_abilityHalf_10 : 1
[1]phy_abilityFull_10 : 1
[1]phy_abilityHalf_100 : 1
[1]phy_abilityFull_100 : 1
[1]phy_abilityFull_1000 : 1
[1]phy_abilityFC : 1
[1]phy_abilityAsyFC : 1
[2]phy_abilityAutoNegotiation : 1
[2]phy_abilityHalf_10 : 1
[2]phy_abilityFull_10 : 1
[2]phy_abilityHalf_100 : 1
[2]phy_abilityFull_100 : 1
[2]phy_abilityFull_1000 : 1
[2]phy_abilityFC : 1
[2]phy_abilityAsyFC : 1
[3]phy_abilityAutoNegotiation : 1
[3]phy_abilityHalf_10 : 1
[3]phy_abilityFull_10 : 1
[3]phy_abilityHalf_100 : 1
[3]phy_abilityFull_100 : 1
[3]phy_abilityFull_1000 : 1
[3]phy_abilityFC : 1
[3]phy_abilityAsyFC : 1
[4]phy_abilityAutoNegotiation : 1
[4]phy_abilityHalf_10 : 1
[4]phy_abilityFull_10 : 1
[4]phy_abilityHalf_100 : 1
[4]phy_abilityFull_100 : 1
[4]phy_abilityFull_1000 : 1
[4]phy_abilityFC : 1
[4]phy_abilityAsyFC : 1
rtl8366s_getEthernetPHY fail for 5!!!!
rtl8366s_getEthernetPHY fail for 6!!!!
rtl8366s_getEthernetPHY fail for 7!!!!
rtl8366s_getEthernetPHY fail for 8!!!!
rtl8366s_getEthernetPHY fail for 9!!!!
rtl8366s_getEthernetPHY fail for 10!!!!
rtl8366s_getEthernetPHY fail for 11!!!!
rtl8366s_getEthernetPHY fail for 12!!!!
rtl8366s_getEthernetPHY fail for 13!!!!
rtl8366s_getEthernetPHY fail for 14!!!!
rtl8366s_getEthernetPHY fail for 15!!!!
gemtek_switch_reset failed
RTL_GET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET : tx is 0, rx is -2143516000
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
rtl:rtl_ge_read : 0
RTL_SET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET : tx is 1, rx is -2115564384
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
rtl:rtl_ge_read : 0
Setting ra0 configuration....
CountryRegionABand=1
WirelessMode=9
TxRate=0
Channel=0
BeaconPeriod=100
DtimPeriod=1
TxPower=100
BGProtection=2
RTSThreshold=2347
FragThreshold=2346
TxBurst=1
ShortSlot=1
PktAggregate=0
NoForwarding=0
NoForwardingBTNBSSID=0
HideSSID=0
Key1Type=0
Key2Type=0
Key3Type=0
Key4Type=0
WdsEnable=0
WdsList=
WdsKey=
WdsEncrypType=NONE
AutoChannelSelect=1
RekeyInterval=2000
AccessPolicy0=0
AccessPolicy1=0
RADIUS_Server=0.0.0.0
RADIUS_Port=1812
RADIUS_Key=
Ethifname=vlan1
own_ip_addr=192.168.1.247
session_timeout_interval=0
DisableOLBC=0
TxPreamble=0
WmmCapable=1
AckPolicy=0;0;0;0
APAifsn=3;7;1;1
APCwmin=4;4;3;2
APCwmax=6;10;4;3
APTxop=0;0;94;47
APACM=0;0;0;0
BSSAifsn=3;7;2;2
BSSCwmin=4;4;3;2
BSSCwmax=10;10;4;3
BSSTxop=0;0;94;47
BSSACM=0;0;0;0
BasicRate=15
IEEE8021X=0
Set N mode parameter...
Bring up ra0 interface....
2860 version : 2.0.0.0-Win7-20090331 (Jun  9 2009)


=== pAd = c1042000, size = 486296 ===

<-- RTMPAllocAdapterBlock, Status=0
RX DESC a181d000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff ff 00 00 00
Main bssid = 00:22:75:b3:a8:a8
The UUID Hex string is:2880288028801880a880002275b3a8a8
The UUID ASCII string is:28802880-2880-1880-a880-002275b3a8a8!
<==== RTMPInitialize, Status=0
0x1300 = 00064320
interface ra0 does not exist!
No need to change ra0 to Nintendo NDS capable
No need to change ra0 to Nintendo NDS capable...Complete
ra0       mac:
[0x00001300]:00063330  
ra0       mac:
[0x00001304]:000a3700  
killall: rt2860apd: no process killed
rt2860apd: not found
Mssid : init mode
killall : No such file or directory
get_WPS_PIN_code : WSCStatus : 17741200
check_WPS_status : WSCStatus is 3 now...STATUS_WSC_LINK_UP
WPS BUTTON press!!
killall: wscd: no process killed
route: SIOC[ADD|DEL]RT: No such device
ra0       mac:
[0x0000102c]:0f031e46  
The FW is NOT for WIN 7 LOGO TEST 
gPassiveMsgQ Init success! gPassiveMsgID=0x386d4399!
gActiveMsgQ Init success!
sock=6!(0x0x7fd88cf8)
Pthread(wscDevNLHandle)Now waiting for the netlink socket incoming message!
Create netlink socket thread success!
Create ioctl socket(7) success!
(wscDevNLHandle):netlink socket data is availablvlan1: Setting MAC address to e now.
 00 22 75 b3 a8 a8.
device eth2 entered promiscuous mode
VLAN (vlan1):  Setting underlying device (eth2) to promiscious mode.
vlan1: dev_set_promiscuity(master, 1)
device vlan1 entered promiscuous mode
device ra0 entered promiscuous mode
br0: port 2(ra0) entering listening state
br0: port 1(vlan1) entering listening state
wscNLEventRTMNewlinkHandle(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNewlinkHandle(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNewlinkHandle(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNewlinkHandle(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNewlinkHandle(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNewlinkHandle(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNewlinkHandle(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNewlinkHandlewscd: SSDP UDP PORT = 1900
Error with UpnpInit -- -208
dwc_otg: version 2.60a 22-NOV-2006
DWC_otg: Using DMA mode
dwc_otg lm0: DWC OTG Controller
dwc_otg lm0: new USB bus registered, assigned bus number 1
dwc_otg lm0: irq 18, io mem 0x00000000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
# lan services init......
killall: rt2860apd: no process killed
rt2860apd: No such file or directory
Start UPnP
easyconf: start 20080820
easyconf: Waiting for client to connect...
route: resolving gw
route: resolving gw
route: resolving gw
route: resolving gw
route: resolving gw
br0: port 2(ra0) entering learning state
br0: port 1(vlan1) entering learning state
dnsmasq: failed to bind listening socket for fe80::222:75ff:feb3:a8a8: Cannot assign requested address
killall : No such file or directory
get_WPS_PIN_code : WSCStatus : 17741200
check_WPS_status : WSCStatus is 3 now...STATUS_WSC_LINK_UP
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(vlan1) entering forwarding state
killall: wscd: no process killed
route: SIOC[ADD|DEL]RT: File exists
gPassiveMsgQ Init success! gPassiveMsgID=0x386d439c!
gActiveMsgQ Init success!
(2147)Service enable wireless
# wan_init......
Set country code to us!!!
sock=6!(0x0x7fb01cf8)
Create netlink socket thread success!
Create ioctl socket(7) success!
vlan2: Setting MAC address to  00 22 75 b3 a8 aa.
Pthread(wscDevNLHandle)Now waiting for the netlink socket incoming message!
(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNewlinkHandlewscd: SSDP UDP PORT = 1900
UPnP Initialized
         IP-Addr: 192.168.1.247 Port: 49152
         HW-Addr: 00:22:75:b3:a8:a8!
Specifying the webserver root directory -- /etc_ro/xml/
UUID Str=uuid:28802880-2880-1880-a880-002275b3a8a8!
alloc memory size=1135!
<?xml version="1.0" encoding="utf-8"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">
  <specVersion>
    <major>1</major>
    <minor>0</minor>
  </specVersion>
  <device>
    <deviceType>urn:schemas-wifialliance-org:device:WFADevice:1</deviceType>
    <friendlyName>Belkin Wireless Router</friendlyName>
    <manufacturer>Belkin Corporation</manufacturer>
    <manufacturerURL>http://www.belkin.com</manufacturerURL>
    <modelDescription>Belkin Wireless Router</modelDescription>
    <modelName>Belkin Wireless Router</modelName>
    <modelNumber>F5D</modelNumber>
    <modelURL>http://www.belkin.com</modelURL>
    <serialNumber>111111111111</serialNumber>
<UDN>uuid:28802880-2880-1880-a880-002275b3a8a8</UDN>
    <serviceList>
      <service>
        <serviceType>urn:schemas-wifialliance-org:service:WFAWLANConfig:1</serviceType>
        <serviceId>urn:wifialliance-org:serviceId:WFAWLANConfig1</serviceId>
        <SCPDURL>WFAWLANConfigSCPD.xml</SCPDURL>
        <controlURL>control</controlURL>
        <eventSubURL>event</eventSubURL>
      </service>
    </serviceList>
  </device>
</root>

Registering the RootDevice
         with descDocUrl: http://192.168.1.247:49152/description.xml
RootDevice Registered
WscLocalDevice:
        Device:
                FriendlyName=Belkin Wireless Router!
                DescDocURL=http://192.168.1.247:49152/description.xml!
                UDN=uuid:28802880-2880-1880-a880-002275b3a8a8!
                PresURL=!
        Service:
                servIdStr=urn:wifialliance-org:serviceId:WFAWLANConfig1!
                servTypeStr=urn:schemas-wifialliance-org:service:WFAWLANConfig:1!
                scpdURL=http://192.168.1.247:49152/WFAWLANConfigSCPD.xml!
                eventURL=http://192.168.1.247:49152/event!
                controlURL=http://192.168.1.247:49152/control!
WscLocalDeviceInit Initialized
Close speed boot up led...
Changing password for guest
Bad password: too short.

Warning: weak password (continuing).
Jan  1 00:00:29 passwd[3488]: password for `guest' changed by user `root'
Password changed.
Advertisement Sent
Can't load /etc/smb.conf - run testparm to debug it

# httpd : This is httpd...ssl_enabled is 0

# uname -a
Linux (none) 2.6.21 #84 Wed Oct 14 02:55:03 PDT 2009 mips unknown
# ps auxw | telnet(easystorage.c->main(201)) Easystorage Start 20080820

telnet: not found
# ps auxw | grep telnet
  687 root        164 R   telnetd 
 3733 root        320 S   grep telnet 
# mount
/dev/mtdblock2 on / type squashfs (rw)
/proc on /proc type proc (rw)
ramfs on /tmp type ramfs (rw)
none on /dev/pts type devpts (rw)
devfs on /dev type ramfs (rw)
sysfs on /sys type sysfs (rw)
# cat /etc/rc
ifconfig eth2 up
#insmod fvmac.ko debug_mii=0 share_mii=1 mac0_phyaddr=32 mac1_phyaddr=4 mac0_devname=eth1 mac1_devname
=eth0
#insmod fv_led.ko
#insmod fv_fastnat_core.ko
#insmod fv_watch_dog.ko
sysinit&
# herb swanson 10.14.2009 added in telnetd
mkdir /dev/pts
mount -t devpts none /dev/pts
telnetd

Adding Telnetd

Modified .config file for busybox I used the "make menuconfig" tool

< # CONFIG_TELNETD is not set
---
> CONFIG_TELNETD=y

Linux kernel needed no changes to .config

After router boot the following commands needed to be entered to activate the telnet daemon

mkdir /dev/pts
mount -t devpts none /dev/pts
telnetd

execute passwd command to give root a password otherwise root cannot login.

Regards

Herb Swanson

(Last edited by herbswanson on 15 Oct 2009, 00:24)

Success at installing Openwrt Linux on Belkin router

Only Linux is installed ---- the AP and  switch software are not included. I performed the following steps

Checked out the most current development branch

 
svn co svn://svn.openwrt.org/openwrt/trunk/

This openwrt topic provided the necessary documentation at getting openwrt linux on my machine

https://forum.openwrt.org/viewtopic.php?id=21782


obtained a .config file provided by openwrt user olecam

http://olecam.online.fr/dir-300-b2/rt305x.config

copied the above .config file to trunk/

executed following code

make menuconfig                # no changes but did a save
make

used following firmware file for flashing:   ../trunk/bin/openwrt-ramips-uImage-initramfs.bin

this is the boot code:

U-Boot 1.1.3 (Nov  7 2008 - 00:24:27)

Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81fa0000
=====config_usbotg =====
flash_protect ON: from 0xBF000000 to 0xBF02F0F7
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
============================================ 
Ralink UBoot Version: 3.2
-------------------------------------------- 
ASIC 3052_MP2 (Port5<->GigaSW)
DRAM COMPONENT: 128Mbits 
DRAM BUS: 32BIT 
Total memory: 32 MBytes
Date:Nov  7 2008  Time:00:24:27
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 384 MHZ #### 

 SDRAM bus set to 32 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
 0 
   
3: System Boot system code via Flash.
## Booting image at bf050000 ...
   Image Name:   MIPS OpenWrt Linux-2.6.30.8
   Created:      2009-10-15  22:54:53 UTC

 System Control Status = 0x30440000 
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2157776 Bytes =  2.1 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 32

Starting kernel ...

Linux version 2.6.30.8 (herb@lab64-vb) (gcc version 4.1.2) #1 Thu Oct 15 15:54:50 PDT 2009
console [early0] enabled
CPU revision is: 0001964c (MIPS 24Kc)
Ralink RT3052   id:1 rev:2 running at 384.00 MHz
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: console=ttyS1,57600 rootfstype=squashfs,jffs2
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=00062890
Readback ErrCtl register=00062890
NR_IRQS:48
PID hash table entries: 128 (order: 7, 512 bytes)
console handover: boot [early0] -> real [ttyS1]
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 28856k/32768k available (1698k kernel code, 3912k reserved, 364k data, 1476k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Calibrating delay loop... 255.59 BogoMIPS (lpj=1277952)
Mount-cache hash table entries: 512
net_namespace: 528 bytes
NET: Registered protocol family 16
MIPS: machine is Generic Ralink board
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
msgmni has been set to 56
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 13) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Freeing unused kernel memory: 1476k freed
- preinit -
Press CTRL-C for failsafe

Please press Enter to activate this console. PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 24
nf_conntrack version 0.5.0 (512 buckets, 2048 max)



BusyBox v1.14.4 (2009-10-15 15:41:08 PDT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r18050) ------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/# uname -a
Linux OpenWrt 2.6.30.8 #1 Thu Oct 15 15:54:50 PDT 2009 mips GNU/Linux
root@OpenWrt:/# cat /proc/cpuinfo
system type        : Ralink RT3052   id:1 rev:2
machine            : Generic Ralink board
processor        : 0
cpu model        : MIPS 24Kc V4.12
BogoMIPS        : 255.59
wait instruction    : yes
microsecond timers    : yes
tlb_entries        : 32
extra interrupt vector    : yes
hardware watchpoint    : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ff8, 0x0ffb]
ASEs implemented    : mips16
shadow register sets    : 1
core            : 0
VCED exceptions        : not available
VCEI exceptions        : not available

Successful installation of fonera 2.0n software

Whats not working:
Can NOT talk to the br-lan device or the RA0 ( wireless device). This is what I'll work on next. Fully functioning linux system exist; the network device can be seen --- both the LAN and WLAN (wireless) but are not functional!!

Procedure:

I just finished flashing the router with fonera 2.0n software. This software is a version of  openwrt and is discussed on these forums. I obtained the lead from comments made by "aport" in this forum  https://forum.openwrt.org/viewtopic.php?id=21782.

fonera2n software:
http://trac.fonosfera.org/fon-ng

I followed the instructions ---- obtained  a svn version of the software and running install.sh script after download.

Two configurations changes required to generate the software.

1.     
        cd trunk/openwrt/
        make menuconfig
        # change the target system to the La Fonera2.0n
        # the La Fonera2.0n router is based on the RT3052F (ralink) chip set
        Target System ---------------> La Fonera2.0n
         # save the config

2.    make kernel_menuconfig
       # this brings up the config menu for the kernel that will be run on the router
       # it is currently configured for a 64M of DRAM Belkin has  only has 32M
       # failure to change this item causes memory failures and BRICKED routers as reported in
       # this thread  https://forum.openwrt.org/viewtopic.php?id=21782.
      Target System -------------------> La Fonera2.0n -------------> Dram Size 32M
       # save configuration

make

        # this is a big build and takes along time 45min - 60 mins depends on your hardware

Test out the software by using u-boot option 1

When ready burn it using u-boot option 2


Boot Code

U-Boot 1.1.3 (Nov  7 2008 - 00:24:27)
Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81fa0000
=====config_usbotg =====
flash_protect ON: from 0xBF000000 to 0xBF02F0F7
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
============================================ 
Ralink UBoot Version: 3.2
-------------------------------------------- 
ASIC 3052_MP2 (Port5<->GigaSW)
DRAM COMPONENT: 128Mbits 
DRAM BUS: 32BIT 
Total memory: 32 MBytes
Date:Nov  7 2008  Time:00:24:27
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 384 MHZ #### 

 SDRAM bus set to 32 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
 0 
   
3: System Boot system code via Flash.
## Booting image at bf050000 ...
   Image Name:   MIPS OpenWrt Linux-2.6.21
   Created:      2009-10-26  19:01:01 UTC

 System Control Status = 0x30440000 
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    849953 Bytes = 830 kB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 32

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.21 (herb@lab64-vb) (gcc version 4.1.2) #2 Mon Oct 26 12:00:54 PDT 2009

 The CPU feqenuce set to 384 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 init=/etc/preinit
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 800008, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 003a9800(3840000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29680k/32768k available (2065k kernel code, 3088k reserved, 538k data, 104k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
ramips_gpio: done
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
ramips_wdt: loaded
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
ramips_mtd: kernel size is 850017 
Creating 6 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00030000 : "uboot"
0x00030000-0x00040000 : "uboot-config"
0x00040000-0x00050000 : "boardconfig"
0x00050000-0x00800000 : "image"
0x00050000-0x00150000 : "linux"
0x00150000-0x00800000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=540000, len=2C0000 
0x00540000-0x00800000 : "rootfs_data"
ramips_mtd: 0x1000000 at 0xbf000000
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver libusual
Registered led device: gpio7
Registered led device: gpio9
Registered led device: gpio11
Registered led device: gpio14
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 104k freed
Warning: unable to open an initial console.
Algorithmics/MIPS FPU Emulator v1.5
- preinit -
Press CTRL-C for failsafe
switching to jffs2
mini_fo: using base directory: /
mini_fo: using storage directory: /jffs
- init -

Please press Enter to activate this console. loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
IMQ starting with 2 devices...
IMQ driver loaded successfully.
    Hooking IMQ before NAT on PREROUTING.
    Hooking IMQ after NAT on POSTROUTING.
ipt_time loading
ramips: ethernet loaded
ramips_eth: loaded
dwc_otg: version 2.72a 24-JUN-2008
DWC_otg: Core Release: 2.66a
DWC_otg: Periodic Transfer Interrupt Enhancement - disabled
DWC_otg: Multiprocessor Interrupt Enhancement - disabled
DWC_otg: Using DMA mode
DWC_otg: Device using Buffer DMA mode
dwc_otg lm0: DWC OTG Controller
dwc_otg lm0: new USB bus registered, assigned bus number 1
dwc_otg lm0: irq 18, io mem 0x00000000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
usb usb1: Product: DWC OTG Controller
usb usb1: Manufacturer: Linux 2.6.21 dwc_otg_hcd
usb usb1: SerialNumber: lm0
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
RT305x_ESW: Link Status Changed
rt2860v2_ap: module license 'unspecified' taints kernel.


=== pAd = c11bd000, size = 495168 ===

<-- RTMPAllocAdapterBlock, Status=0
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial Driver core
Linux video capture interface: v2.00
hso: drivers/usb/serial/hso.c: 1.6-Option Option Wireless
usbcore: registered new interface driver hso
drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.2
drivers/usb/serial/usb-serial.c: USB Serial support registered for Sierra USB modem (1 port)
drivers/usb/serial/usb-serial.c: USB Serial support registered for Sierra USB modem (3 port)
usbcore: registered new interface driver sierra
drivers/usb/serial/sierra.c: USB Driver for Sierra Wireless USB modems: v.1.0.6
fuse init (API version 7.8)
fuse distribution version: 2.7.3
usbcore: registered new interface driver uvcvideo
USB Video Class driver (SVN r215)
eth0.1: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
device eth0.1 entered promiscuous mode
br-lan: port 1(eth0.1) entering learning state
br-lan: topology change detected, propagating
br-lan: port 1(eth0.1) entering forwarding state



BusyBox v1.11.1 (2009-10-26 11:48:59 PDT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

                                      _.--"""--,    
                                    .'          `\  
  .-""""""-.                      .'              | 
 /          '.                   /            .-._/ 
|             `.                |             |     
 \              \          .-._ |          _   \    
  `""'-.         \_.-.     \   `          ( \__/    
        |             )     '=.       .,   \        
       /             (         \     /  \  /        
     /`               `\        |   /    `'         
     '..-`\        _.-. `\ _.__/   .=.              
          |  _    / \  '.-`    `-.'  /              
          \_/ |  |   './ _     _  \.'               
               '-'    | /       \ |                 
                      |  .-. .-.  |                 
                      \ / o| |o \ /                 
                       |   / \   |                  
                      / `"`   `"` \                 
                     /             \                
                    | '._.'         \               
                    |  /             |              
                     \ |             |              
                      ||    _    _   /              
                      /|\  (_\  /_) /               
              jgs     \ \'._  ` '_.'                
                       `""` `"""`                   
                                                    
                       Elan the Elk                 
                                                    
--------  Fonera 20n Firmware (v2.3.0.0) -----------
      * Based on OpenWrt - http://openwrt.org       
      * Powered by FON - http://www.fon.com         
----------------------------------------------------
root@Fonera:/# ifconfig
br-lan    Link encap:Ethernet  HWaddr 00:0C:43:30:52:77  
          inet addr:192.168.10.1  Bcast:192.168.10.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:55 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:6775 (6.6 KiB)

br-lan:1  Link encap:Ethernet  HWaddr 00:0C:43:30:52:77  
          inet addr:169.254.255.1  Bcast:169.254.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0      Link encap:Ethernet  HWaddr 00:0C:43:30:52:77  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:14 errors:0 dropped:0 overruns:0 frame:0
          TX packets:55 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1947 (1.9 KiB)  TX bytes:7043 (6.8 KiB)
          Interrupt:3 

eth0.1    Link encap:Ethernet  HWaddr 00:0C:43:30:52:77  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:55 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:6995 (6.8 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.255.255.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

root@Fonera:/# iwconfig
lo        no wireless extensions.

imq0      no wireless extensions.

imq1      no wireless extensions.

eth0      no wireless extensions.

eth0.1    no wireless extensions.

eth0.2    no wireless extensions.

ra0       RT2860 SoftAP  
          
br-lan    no wireless extensions.


root@Fonera:/# cat /proc/cpuinfo
system type        : Ralink SoC
processor        : 0
cpu model        : MIPS 24K V4.12
BogoMIPS        : 255.59
wait instruction    : yes
microsecond timers    : yes
tlb_entries        : 32
extra interrupt vector    : yes
hardware watchpoint    : yes
ASEs implemented    : mips16 dsp
VCED exceptions        : not available
VCEI exceptions        : not available

root@Fonera:/# cat /proc/partitions 
major minor  #blocks  name

  31     0        192 mtdblock0
  31     1         64 mtdblock1
  31     2         64 mtdblock2
  31     3       7872 mtdblock3
  31     4       1024 mtdblock4
  31     5       6848 mtdblock5
  31     6       2816 mtdblock6

(Last edited by herbswanson on 27 Oct 2009, 15:10)

herbswanson did you've managed to compile the ralink_gpio suport using the fonera2n sources?
For me it's giving this error:

drivers/built-in.o: In function `read_zero':
drivers/char/mem.c:713: multiple definition of `info'
arch/mips/rt2880/built-in.o:arch/mips/rt2880/printf.c:56: first defined here
make[5]: *** [.tmp_vmlinux1] Error 1

I need those gpio pins so I can control the leds and receive events when buttons are pressed on the boards.

Note: I've fixed the above error by renaming the info structure from ralink_gpio.c

ralink_gpio_reg_info info;

I stil need to figure out how to control the leds and get events from buttons in hotplug2.

(Last edited by cj_man on 27 Oct 2009, 22:54)

Hi,

I have a Fonera 2.0n, i wanted to install openwrt. I have read that the firmware is functional, bur the wifi not sad
Is the wifi working now?

Thanks

hi mtelleria

You should have no problem if you indeed have the actual Fonera 2.0n hardware. The Fonera hardware already is running a version of openwrt. Its a 2.6.21 kernel,  you can download all the software from their site http://trac.fonosfera.org/fon-ng. You can then perform a build and perform your own modifications. I perceive that your challenge is going to be upgrading to a more current kernel that the 2.6.21. The ralink software has been included in the kernel since 2.6.24. In the 2.6.21 kernel the ralink drivers were a separate package. The drivers have advanced since 2.6.21 and the base code for the Fonera software may require many changes.

My situation is somewhat different. I have a board that has the same base chip as the fonera, (the SoC ralink 3052) and I am attempting to use the Fonera openwrt software on my unique Belkin board. In my case the ralink 3052 chip is seen and recognized by the fonera software but I have a unique gigabit switch (realtek rtl8366rb chip) that does not yet allow me to get to the lan or the wireless devices. Another path that I am following in using the latest svn software from openwrt and to use the recently included (in the kernel)  ralink drivers. The fonera software is providing me a guide as to what needs to be done. 

I hope this helps.
Regards

Herb Swanson

Hi herbswanson,

Thanks a lot for your reply. I will try to build the firmware.

Regards

Hello herbswanson,

thanks a lot for your posting, I have the same Router except the Version, my Router is V1 not V2 like yours, so I use the latest V1 open source firmware 1.01.24 from https://www.belkin.com/support/opensource/. Does anybody may know the differences between V1 and V2?

Now I like to build and flash the router with this open source firmware, the same way you did it, but I m totally new in this stuff, so may you could answer me a few questions?

1./ You wrote

herbswanson wrote:

Console pins are at J2. I had to solder on the pin header. Pin holes were open and not soldered over.
Console pin layout to the best of my knowledge --- If I'm wrong please let me know to correct.
pin 1 Power  ---- its a square pin
pin 2 Tx
pin 3 Rcv
pin 4 Gnd


Here is the console boot code.

Code:

Terminal ready

U-Boot 1.1.3 (Nov  7 2008 - 00:24:27)

Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81fa0000
=====config_usbotg =====
flash_protect ON: from 0xBF000000 to 0xBF02F0F7
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
============================================ 
Ralink UBoot Version: 3.2
-------------------------------------------- 
ASIC 3052_MP2 (Port5<->GigaSW)
DRAM COMPONENT: 128Mbits 
DRAM BUS: 32BIT 
Total memory: 32 MBytes
Date:Nov  7 2008  Time:00:24:27
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 384 MHZ #### 

 SDRAM bus set to 32 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
   0 
   
3: System Boot system code via Flash.
## Booting image at bf050000 ...
   Image Name:   Linux Kernel Image
   Created:      2009-03-31   6:24:29 UTC

 System Control Status = 0x10440000 
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1178131 Bytes =  1.1 MB
   Load Address: 80000000
   Entry Point:  80364000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80364000) ...
## Giving linux memsize in MB, 32

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.21 (root@localhost.localdomain) (gcc version 3.4.2) #16 Tue Mar 31 14:22:41 CST 2009

 The CPU feqenuce set to 384 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock2
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 80800060, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 00177000(1536000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
emory: 28756k/32768k available (2832k kernel code, 4012k reserved, 636k data, 132k init, 0k highmem)
ount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.8)
io scheduler noop registered (default)
FLASH_API: MAN_ID=C2 DEV_ID=22CB SIZE=8MB
Ralink RT2880 gpio driver initialized
Gemtek LED init...
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
smi_major=249
0 smi_init check[0x05c]1=0x5937
rdm_major = 254
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v1.60  128 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 128, Rx Ring = 128
GDMA1_MAC_ADRH -- : 0x0000000c
GDMA1_MAC_ADRL -- : 0x43305277
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
ralink flash device: 0x1000000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 5 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00050000 : "uboot"
0x00050000-0x007e0000 : "Kernel and Rootfs"
0x001d0000-0x007e0000 : "Rootfs"
0x007e0000-0x007f0000 : "Nvram"
0x007f0000-0x00800000 : "Factory"
block2mtd: version $Revision: 1.1.1.1 $
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Fully Cone
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
tunl0: Disabled Privacy Extensions
obile IPv6
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
NET: Registered protocol family 17
create_proc_read_write_entry: fail
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 132k freed
Algorithmics/MIPS FPU Emulator v1.5

phy_tx_ring = 0x01c9f000, tx_ring = 0xa1c9f000

phy_rx_ring = 0x00000000, rx_ring = 0x00000000
RT305x_ESW: Link Status Changed
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 790000
#sysinit: [sysinit]


BusyBox v1.1.0 (2009.03.30-07:26+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# ftok: No such file or directory
sgget: No such file or directory
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
Creat rmain device for LED and insmod it.
insmod: reset_btn.ko: no module by that name found
Starting Watchdog function !!!!!!!
cat: /proc/watchdog_ctrl_folder/watchdog_ctrl_run: No such file or directory
Done
Clean storage nvram value!!
# update nvram with default list!
Do 'echo 0 > /proc/USB_BLINK;echo 1 > /proc/GPIO23;echo 1 > /proc/GPIO22;' in ixp4xx_gpio.h   
# interfaces_init......
RTL8366 reg 0x5C=[0x5937]
Init RTL8366RB!!
switch reg write offset=98, value=7f40
switch reg write offset=e4, value=20
rmmod: rtl8366RB: Success
rtl_major = 253
0 smi_init check[0x0105]=0x0000
0 smi_init check[0x0105]=0x0000
0 smi_init check[0x0509]=0x5937
verid is 3
0 rtl8366rb_initChip
0 smi_init check[0x0509]1=0x5937
0 smi_init check[0x050a]1=0x0003
Gemtek Link status init.
verid is 3
rtl8366rb_initChip() initialized!
rtl8366rb_setMac5ForceLink() initialized!
verid is 3
[0]phy_abilityAutoNegotiation : 1
[0]phy_abilityHalf_10 : 1
[0]phy_abilityFull_10 : 1
[0]phy_abilityHalf_100 : 1
[0]phy_abilityFull_100 : 1
[0]phy_abilityFull_1000 : 1
[0]phy_abilityFC : 1
[0]phy_abilityAsyFC : 1
[1]phy_abilityAutoNegotiation : 1
[1]phy_abilityHalf_10 : 1
[1]phy_abilityFull_10 : 1
[1]phy_abilityHalf_100 : 1
[1]phy_abilityFull_100 : 1
[1]phy_abilityFull_1000 : 1
[1]phy_abilityFC : 1
[1]phy_abilityAsyFC : 1
[2]phy_abilityAutoNegotiation : 1
[2]phy_abilityHalf_10 : 1
[2]phy_abilityFull_10 : 1
[2]phy_abilityHalf_100 : 1
[2]phy_abilityFull_100 : 1
[2]phy_abilityFull_1000 : 1
[2]phy_abilityFC : 1
[2]phy_abilityAsyFC : 1
[3]phy_abilityAutoNegotiation : 1
[3]phy_abilityHalf_10 : 1
[3]phy_abilityFull_10 : 1
[3]phy_abilityHalf_100 : 1
[3]phy_abilityFull_100 : 1
[3]phy_abilityFull_1000 : 1
[3]phy_abilityFC : 1
[3]phy_abilityAsyFC : 1
[4]phy_abilityAutoNegotiation : 1
[4]phy_abilityHalf_10 : 1
[4]phy_abilityFull_10 : 1
[4]phy_abilityHalf_100 : 1
[4]phy_abilityFull_100 : 1
[4]phy_abilityFull_1000 : 1
[4]phy_abilityFC : 1
[4]phy_abilityAsyFC : 1
rtl8366s_getEthernetPHY fail for 5!!!!
rtl8366s_getEthernetPHY fail for 6!!!!
rtl8366s_getEthernetPHY fail for 7!!!!
rtl8366s_getEthernetPHY fail for 8!!!!
rtl8366s_getEthernetPHY fail for 9!!!!
rtl8366s_getEthernetPHY fail for 10!!!!
rtl8366s_getEthernetPHY fail for 11!!!!
rtl8366s_getEthernetPHY fail for 12!!!!
rtl8366s_getEthernetPHY fail for 13!!!!
rtl8366s_getEthernetPHY fail for 14!!!!
rtl8366s_getEthernetPHY fail for 15!!!!
gemtek_switch_reset failed
RTL_GET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET : tx is 0, rx is -2115259424
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
rtl:rtl_ge_read : 0
RTL_SET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET : tx is 1, rx is -2115259424
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
rtl:rtl_ge_read : 0
Setting ra0 configuration....
CountryRegionABand=1
WirelessMode=9
TxRate=0
Channel=0
BeaconPeriod=100
DtimPeriod=1
TxPower=100
BGProtection=2
RTSThreshold=2347
FragThreshold=2346
TxBurst=1
ShortSlot=1
PktAggregate=0
NoForwarding=0
NoForwardingBTNBSSID=0
HideSSID=0
Key1Type=0
Key2Type=0
Key3Type=0
Key4Type=0
WdsEnable=0
WdsList=
WdsKey=
WdsEncrypType=NONE
AutoChannelSelect=1
RekeyInterval=2000
AccessPolicy0=0
AccessPolicy1=0
RADIUS_Server=0.0.0.0
RADIUS_Port=1812
RADIUS_Key=
Ethifname=vlan1
own_ip_addr=192.168.2.1
session_timeout_interval=0
DisableOLBC=0
TxPreamble=0
WmmCapable=1
AckPolicy=0;0;0;0
APAifsn=3;7;1;1
APCwmin=4;4;3;2
APCwmax=6;10;4;3
APTxop=0;0;94;47
APACM=0;0;0;0
BSSAifsn=3;7;2;2
BSSCwmin=4;4;3;2
BSSCwmax=10;10;4;3
BSSTxop=0;0;94;47
BSSACM=0;0;0;0
BasicRate=15
IEEE8021X=0
Set N mode parameter...
Bring up ra0 interface....
rt2860v2_ap: module license 'unspecified' taints kernel.
2860 version : 2.0.0.0 (Mar 30 2009)


=== pAd = c103c000, size = 486208 ===

<-- RTMPAllocAdapterBlock, Status=0
RX DESC a1874000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
CS Set = ff ff 00 00 00
ain bssid = 00:22:75:b3:a8:a8
The UUID Hex string is:2880288028801880a880002275b3a8a8
The UUID ASCII string is:28802880-2880-1880-a880-002275b3a8a8!
<==== RTMPInitialize, Status=0
0x1300 = 00064320
interface ra0 does not exist!
No need to change ra0 to Nintendo NDS capable
No need to change ra0 to Nintendo NDS capable...Complete
ra0       mac:
[0x00001300]:00063330  
ra0       mac:
[0x00001304]:000a3700  
killall: rt2860apd: no process killed
rt2860apd: not found
ssid : init mode
killall : No such file or directory
get_WPS_PIN_code : WSCStatus : 17741200
check_WPS_status : WSCStatus is 3 now...STATUS_WSC_LINK_UP
WPS BUTTON press!!
killall: wscd: no process killed
route: SIOC[ADD|DEL]RT: No such device
gPassiveMsgQ Init success! gPassiveMsgID=0x386d4393!
ra0       mac:
[0x0000102c]:0f031e46  
gActiveMsgQ Init success!
sock=6!(0x0x7f892d08)
Create netlink socket thread success!
Create ioctl socket(7) success!
Pthread(wscDevNLHandle)vlan1: Setting MAC address to Now waiting for  00the netlink sock 22et incoming mess 75age!
wscd: SSDP b3 UDP PORT = 1900 a8
(wscDevNLHandl a8e):netlink socke.
t data is availadevice eth2 entered promiscuous mode
ble now.
VLAN (vlan1):  Setting underlying device (eth2) to promiscious mode.
wscNLEventRTMNewlinkHandle(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNvlan1: dev_set_promiscuity(master, 1)
ewlinkHandleErrodevice vlan1 entered promiscuous mode
r with UpnpInit -- -208
device ra0 entered promiscuous mode
br0: port 2(ra0) entering listening state
br0: port 1(vlan1) entering listening state
dwc_otg: version 2.60a 22-NOV-2006
DWC_otg: Using DMA mode
dwc_otg lm0: DWC OTG Controller
dwc_otg lm0: new USB bus registered, assigned bus number 1
dwc_otg lm0: irq 18, io mem 0x00000000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
# lan services init......
killall: rt2860apd: no process killed
rt2860apd: No such file or directory
Start UPnP
easyconf: start 20080820
easyconf: Waiting for client to connect...
route: resolving gw
br0: port 2(ra0) entering learning state
br0: port 1(vlan1) entering learning state
route: resolving gw
route: resolving gw
route: resolving gw
route: resolving gw
dnsmasq: failed to bind listening socket for fe80::222:75ff:feb3:a8a8: Cannot assign requested address
killall : No such file or directory
get_WPS_PIN_code : WSCStatus : 17741200
check_WPS_status : WSCStatus is 3 now...STATUS_WSC_LINK_UP
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(vlan1) entering forwarding state
killall: wscd: no process killed
route: SIOC[ADD|DEL]RT: File exists
gPassiveMsgQ Init success! gPassiveMsgID=0x386d4395!
gActiveMsgQ Init success!
(2136)Service enable wireless
# wan_init......
Set country code to us!!!
sock=6!(0x0x7ff41d08)
Pthread(wscDevNLHandle)Now waiting for the netlink socket incoming message!
Create netlink socket thread success!
Create ioctl socket(7) suvlan2: Setting MAC address to ccess!
wscd: SS 00DP UDP PORT = 19 2200
 75 b3 a8 aa.
(wscDevNLHandle):netlink socket data is available now.
wscNLEventRTMNewlinkHandleUPnP Initialized
      IP-Addr: 192.168.2.1 Port: 49152
     HW-Addr: 00:22:75:b3:a8:a8!
Specifying the webserver root directory -- /etc_ro/xml/
UUID Str=uuid:28802880-2880-1880-a880-002275b3a8a8!
alloc memory size=1135!
<?xml version="1.0" encoding="utf-8"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">
  <specVersion>
    <major>1</major>
    <minor>0</minor>
  </specVersion>
  <device>
    <deviceType>urn:schemas-wifialliance-org:device:WFADevice:1</deviceType>
    <friendlyName>Belkin Wireless Router</friendlyName>
    <manufacturer>Belkin Corporation</manufacturer>
    <manufacturerURL>http://www.belkin.com</manufacturerURL>
    <modelDescription>Belkin Wireless Router</modelDescription>
    <modelName>Belkin Wireless Router</modelName>
    <modelNumber>F5D</modelNumber>
    <modelURL>http://www.belkin.com</modelURL>
    <serialNumber>111111111111</serialNumber>
<UDN>uuid:28802880-2880-1880-a880-002275b3a8a8</UDN>
    <serviceList>
      <service>
        <serviceType>urn:schemas-wifialliance-org:service:WFAWLANConfig:1</serviceType>
        <serviceId>urn:wifialliance-org:serviceId:WFAWLANConfig1</serviceId>
        <SCPDURL>WFAWLANConfigSCPD.xml</SCPDURL>
        <controlURL>control</controlURL>
        <eventSubURL>event</eventSubURL>
      </service>
    </servicClose speed boot up led...
eList>
  </device>
</root>
Registering the RootDevice
     with descDocUrl: http://192.168.2.1:49152/description.xml
RootDevice Registered
WscLocalDevice:
    Device:
        FriendlyName=Belkin Wireless Router!
        DescDocURL=http://192.168.2.1:49152/description.xml!
        UDN=uuid:28802880-2880-1880-a880-002275b3a8a8!
        PresURL=!
    Service:
        servIdStr=urn:wifialliance-org:serviceId:WFAWLANConfig1!
        servTypeStr=urn:schemas-wifialliance-org:service:WFAWLANConfig:1!
        scpdURL=http://192.168.2.1:49152/WFAWLANConfigSCPD.xml!
        eventURL=http://192.168.2.1:49152/event!
        controlURL=http://192.168.2.1:49152/control!
WscLocalDeviceInit Initialized
Changing password for guest
Bad password: too short.

Warning: weak password (continuing).
Jan  1 00:00:22 passwd[3475]: password for `guest' changed by user `root'
Password changed.
Can't load /etc/smb.conf - run testparm to debug it
Advertisement Sent
httpd : This is httpd...ssl_enabled is 0
(easystorage.c->main(201)) Easystorage Start 20080820

Thanks for using picocom
picocom v1.4

port is        : /dev/ttyUSB0
flowcontrol    : none
baudrate is    : 57600
parity is      : none
databits are   : 8
escape is      : C-a
noinit is      : no
noreset is     : no
nolock is      : no
send_cmd is    : ascii_xfr -s -v -l10
receive_cmd is : rz -vv

How are you able to display this Bootcode without any terminal connection, how does it work? I did 'nt fund any open telnet, ssh port or something like that?


2./ Fixes?

herbswanson wrote:

modified sumversion.c  added a missing include
      /linux/scripts/mod/sumversion.c
      10a11
      > #include <limits.h>

changed HOSTCFLAGS  and CFLAGS in the linux/Makefile   allowed warning messages on compile

      197c197
      < HOSTCFLAGS = -Werror -Wstrict-prototypes -O2 -fomit-frame-pointer
      > HOSTCFLAGS = -Wall -O2 -fomit-frame-pointer
      312c312
      < CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
      > CFLAGS := -Wall -Wundef -Wno-trigraphs \


An extraneous "-e" was added to the bb_config.h file. Deleted these characters from line 1.

Why is this necessary? I was able to build it with suse 11.1 after adding gcc over rpm, only in ubuntu it does always stop at the busybox for some syntax errors?
But there a few warnings durning the make process, do i have to car about them?


3./ Flashing with tfpd-hpa

herbswanson wrote:

aptitude install tftpd-hpa

After a successful build the /Belkin_F5D8235-4_v2000_v2.01.06/images contains the following files

F5D8235v2_WW_2.01.06.bin
firmware.bin
linux_uImage
romfs.sqsh.lzma
zImage.lzma

The firmware.bin file is a trx file. The F5D8235v2_WW_2.01.06.bin is the same as the firmware.bin but has 19 bytes of additional identifier information prepended to the start of the file.

copy the firmware.bin file to the tftpd-hpa server directory (/var/lib/tftpboot on ubuntu)

The router uses the das boot(uboot). The following menu is presented during boot and you have 1 second to enter a value.

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.

I used option 1 extensively to test if the kernel runs.

How does it work with an TFTP Server to transfer the firmware, in the guides the only talk about a tftp client and a put command?
How can you display this boot menu, and how can you choose this options?

If I build the open source package, it also builds a uboot.bin after building the firmware to an other folder, do i need to update this too, and how can i flash the boot menu?



I hope you can help me, thanks a lot

yours

skyone

(Last edited by skyone on 9 Dec 2009, 16:41)

skyone

Boot Sequence and Serial console
The first thing I did was open the case, find where the console connection was located and soldered in a 4 pin header. Once I had the 4 pin header soldered in, I build a console cable using a ca-42. You can purchase the ca-42 cable online for about $4.00. As to how to build the cable (its a usb to serial connection) it best to google or youtube. Mostly you cutoff the non-usb end, expose the wires and attach them to the pins. Some soldering and building connectors is required. This was how I was able to obtain the boot sequence.

reference to someone else building a console cable
https://forum.openwrt.org/viewtopic.php?id=22620

Once you have serial console working
Uboot give you 1 second to enter a menu value from the serial console on power up, otherwise it defaults to factory boot from flash. Enter a numeric 4 initially, this takes you to the Uboot command line and you can look at the environmental variable, memory, request tftp files, modify the defaults etc.

Modification to gcc parms
The code I downloaded failed on compile on warning error message due to "-Werror -Wstrict-prototypes". I removed these option to accept warning messages on compile.

TFTP
You need to get to the Uboot Menu via the serial console to request the tftp download. The Uboot program has several option to download software via tftp. Thus once you have your serial console working and have the Uboot menu up you will neet your tftp server to serve over your firmware.

uboot.bin is the default file name that Uboot is looking to obtain from the tftp server. This can be changed once you get to the Uboot command line.

Regards

Herb Swanson

Hi herb,

on your second post, i followed the process of downloading the 2.01.07 firmware (this being the latest in GPL download of belkin). I did make the change in the files suggested, but not able to generate the standard binary. I am on VM having Ubuntu 9.10 desktop edition. Below is the list of messages and seems like it was compiling the source for samba. Not sure how to bypass this or make this work.


make[4]: Entering directory `/home/ashish/belkin/2.01.07/Belkin_F5D8235-4_v2000_v2.01.07/user/samba-3.0.2/source'
Compiling smbd/files.c
smbd/files.c: In function `file_init':
smbd/files.c:191: warning: assignment makes pointer from integer without a cast
Compiling smbd/chgpasswd.c
smbd/chgpasswd.c: In function `findpty':
smbd/chgpasswd.c:93: warning: pointer/integer type mismatch in conditional expression
smbd/chgpasswd.c:98: warning: assignment makes pointer from integer without a cast
smbd/chgpasswd.c: In function `expect':
smbd/chgpasswd.c:262: warning: pointer/integer type mismatch in conditional expression
smbd/chgpasswd.c: In function `talktochild':
smbd/chgpasswd.c:302: warning: pointer/integer type mismatch in conditional expression
smbd/chgpasswd.c:316: warning: pointer/integer type mismatch in conditional expression
smbd/chgpasswd.c:322: warning: pointer/integer type mismatch in conditional expression
smbd/chgpasswd.c: In function `chgpasswd':
smbd/chgpasswd.c:457: warning: assignment makes pointer from integer without a cast
smbd/chgpasswd.c:537: warning: pointer/integer type mismatch in conditional expression
smbd/chgpasswd.c:538: warning: pointer/integer type mismatch in conditional expression
smbd/chgpasswd.c: In function `check_lanman_password':
smbd/chgpasswd.c:605: warning: assignment makes pointer from integer without a cast
smbd/chgpasswd.c: In function `change_lanman_password':
smbd/chgpasswd.c:665: warning: assignment makes pointer from integer without a cast
smbd/chgpasswd.c: In function `pass_oem_change':
smbd/chgpasswd.c:728: error: incompatible types in assignment
smbd/chgpasswd.c: In function `check_oem_password':
smbd/chgpasswd.c:799: warning: assignment makes pointer from integer without a cast
smbd/chgpasswd.c:800: warning: assignment makes pointer from integer without a cast
smbd/chgpasswd.c:811: warning: comparison between pointer and integer
smbd/chgpasswd.c: At top level:
smbd/chgpasswd.c:911: error: conflicting types for 'change_oem_password'
smbd/chgpasswd.c:728: error: previous implicit declaration of 'change_oem_password' was here
smbd/chgpasswd.c: In function `change_oem_password':
smbd/chgpasswd.c:954: warning: passing arg 1 of `chgpasswd' makes pointer from integer without a cast
make[4]: *** [smbd/chgpasswd.o] Error 1
make[4]: Leaving directory `/home/ashish/belkin/2.01.07/Belkin_F5D8235-4_v2000_v2.01.07/user/samba-3.0.2/source'
make[3]: *** [all] Error 2
make[3]: Leaving directory `/home/ashish/belkin/2.01.07/Belkin_F5D8235-4_v2000_v2.01.07/user/samba-3.0.2/source'
make[2]: *** [all] Error 2
make[2]: Leaving directory `/home/ashish/belkin/2.01.07/Belkin_F5D8235-4_v2000_v2.01.07/user/samba-3.0.2'
make[1]: *** [all] Error 2
make[1]: Leaving directory `/home/ashish/belkin/2.01.07/Belkin_F5D8235-4_v2000_v2.01.07/user'
make: *** [user_gemtek] Error 2
make: *** [all] Error 2


Also, can the firmware that would get generated if passed across this point be uploaded through the web interface of the router. Also, how did you initialize the uboot console and logged into the console.

Thanks,
Ashish

ashishjain77

You have 'C' compile errors. You need to review and modify the smbd/chgpasswd.c program. From the error messages they appear fairly easy to correct. A prototype for the function change_oem_password needs to be added, and when it is called at line 911 of  program smbd/chgpasswd.c the data that is passed is cast properly. I've had to do the same for other programs. I'm not sure as to why this occurs but my guess is that we have a mix of newer code we download off the web (in the makeconfig process) and the older software downloaded from the vendor. Definition have been added or deleted from a common 'c' or 'h' file. If your not a 'c' person just ask one of your friends, any intermediate level 'c' person should be able to help.

I got to the uboot console by opening the belkin case, soldering pin headers onto to the console pins at j2, and building a console cable. In my prior post to skyone I go into more detail and provide a web link on building the cable.

I've have not tried to upload my modified software via the web interface but I assume it would work. You would probably need to ensure that you use the .bin file that contains the 19 bytes of additional version information. This is produced in the build. However if it does not boot correctly you may bricked your router and still need to add a console cable to reload from uboot.

Regards

Herb Swasnon

I picked up one of these for use on a robot. I got the stock firmware to compile, but I can't seem to get the .bin file to tftp to the router. I timeout wtih tftp and get an error message saying

source port mismatch, check bypassedtimeout: retrying...

with atftp. I have no idea what is going wrong. The router and computer can ping each other and I get a message when the router times out waiting that prints back my computer's MAC address so I know ARP must be working. I have all my firewalls disables and the network manager is off. I don't see why this isn't working. Is anyone else having this problem and how did you fix it if you are?

thanks in advance

EDIT:  I realize what I did wrong. I needed to be using a tftp server rather than trying to use tftp put. I am coming from ddwrt where everything is done with clients instead of servers. Sorry

(Last edited by dpeterson3 on 5 Jan 2010, 20:01)

I compiled the stock firmware and a version of my own with an upgraded version of busybox and wireless tools upgraded. Whenever I boot with option 1, my firmware boots and then hits a point where it says RESET BUTTON and then reboots shortly. I did not press the button and I know it isn't stuck down because it will reboot fine after that. I have no clue where to even start looking for this problem. Below is a copy of what my terminal says.

U-Boot 1.1.3 (Nov  7 2008 - 00:24:27)



Board: Ralink APSoC DRAM:  32 MB

relocate_code Pointer at: 81fa0000

=====config_usbotg =====

flash_protect ON: from 0xBF000000 to 0xBF02F0F7

protect on 0

protect on 1

protect on 2

protect on 3

protect on 4

protect on 5

protect on 6

protect on 7

protect on 8

protect on 9

flash_protect ON: from 0xBF030000 to 0xBF03FFFF

protect on 10

============================================ 

Ralink UBoot Version: 3.2

-------------------------------------------- 

ASIC 3052_MP2 (Port5<->GigaSW)

DRAM COMPONENT: 128Mbits 

DRAM BUS: 32BIT 

Total memory: 32 MBytes

Date:Nov  7 2008  Time:00:24:27

============================================ 

icache: sets:256, ways:4, linesz:32 ,total:32768

dcache: sets:128, ways:4, linesz:32 ,total:16384 



 ##### The CPU freq = 384 MHZ #### 



 SDRAM bus set to 32 bit 

 SDRAM size =32 Mbytes



Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   9: Load Boot Loader code then write to Flash via TFTP. 




You choosed 1



 0 



 eth_register  

Eth0 (10/100-M)

 enetvar=ethaddr,Eth addr:00:AA:BB:CC:DD:10

 00:AA:BB:CC:DD:10:



 eth_current->name = Eth0 (10/100-M)



   

1: System Load Linux to SDRAM via TFTP. 

 Please Input new ones /or Ctrl-C to discard

    Input device IP (192.168.2.1) ==:q2  




    Input server IP (192.168.2.2) ==:




    Input Linux Kernel filename (f5d8235v2_ww_2.01.07.bin) ==:firmware_2.01.07_jab n0810.bin




 netboot_common, argc= 3 

 *************buf = 0x81fcf260

 **********NexTxPacket = 81fe7340



 NetTxPacket = 0x81FE7340 



 NetRxPackets[0] = 0x81FE7940



 NetRxPackets[1] = 0x81FE7F40



 NetRxPackets[2] = 0x81FE8540



 NetRxPackets[3] = 0x81FE8B40



 NetRxPackets[4] = 0x81FE9140



 NetRxPackets[5] = 0x81FE9740



 NetRxPackets[6] = 0x81FE9D40



 NetRxPackets[7] = 0x81FEA340



 NetRxPackets[8] = 0x81FEA940



 NetRxPackets[9] = 0x81FEAF40



 NetRxPackets[10] = 0x81FEB540



 NetRxPackets[11] = 0x81FEBB40



 NetRxPackets[12] = 0x81FEC140



 NetRxPackets[13] = 0x81FEC740



 NetRxPackets[14] = 0x81FECD40



 NetRxPackets[15] = 0x81FED340



 NetRxPackets[16] = 0x81FED940



 NetRxPackets[17] = 0x81FEDF40



 NetRxPackets[18] = 0x81FEE540



 NetRxPackets[19] = 0x81FEEB40



 KSEG1ADDR(NetTxPacket) = 0xA1FE7340 



 NetLoop,call eth_halt ! 



 NetLoop,call eth_init ! 

Trying Eth0 (10/100-M)



 Waitting for RX_DMA_BUSY status Start... done

0 smi_init check[0x0509]=0x5937

0 smi_init check[0x0509]=0x5937



 Header Payload scatter function is Disable !! 



 ETH_STATE_ACTIVE!! 

Using Eth0 (10/100-M) device

TFTP from server 192.168.2.2; our IP address is 192.168.2.1

Filename 'firmware_2.01.07_jan0810.bin'.



 TIMEOUT_COUNT=10,Load address: 0x80800000

Loading: *

ArpTimeoutCheck 

T T Got ARP REPLY, set server/gtwy eth addr (00:11:25:2d:59:ab)

Got it

T #

 first block received  

################################################################

     #################################################################

     #################################################################

     #################################################################

     #################################################################

     #################################################################

     #################################################################

     #################################################################

     #################################Got ARP REQUEST, return our IP

################################

     #################################################################

     #################################################################

     #################################################################

     #################################################################

     #################################################################

     #################################################################

     #################################################################

     ###############################################################

done

Bytes transferred = 5644288 (562000 hex)

NetBootFileXferSize= 00562000

File: env_flash.c, Func: saveenv, Line: 300

Protect off BF030000 ... BF03FFFF



 b_end =BF7FFFFF

Un-Protecting sectors 10..10 in bank 1

Un-Protected 1 sectors

Erasing Flash...

 b_end =BF7FFFFF

Erase Flash from 0xbf030000 to 0xbf03ffff in Bank # 1 



 erase sector  = 10 

sect = 10,s_last = 10,erase poll = 653768

 done

Erased 1 sectors

Writing to Flash... done



 b_end =BF7FFFFF

Protecting sectors 10..10 in bank 1

Protected 1 sectors

Automatic boot of image at addr 0x80800000 ...

## Booting image at 80800000 ...

   Image Name:   Linux Kernel Image

   Created:      2010-01-08  15:15:39 UTC



 System Control Status = 0x10440000 

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    1210744 Bytes =  1.2 MB

   Load Address: 80000000

   Entry Point:  8037c000

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 8037c000) ...

## Giving linux memsize in MB, 32



Starting kernel ...





LINUX started...



 THIS IS ASIC

Linux version 2.6.21 (root@frankenstein) (gcc version 3.4.2) #91 Fri Jan 8 09:06:21 CST 2010



 The CPU feqenuce set to 384 MHz

CPU revision is: 0001964c

Determined physical RAM map:

 memory: 02000000 @ 00000000 (usable)

Built 1 zonelists.  Total pages: 8128

Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock2

Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.

Primary data cache 16kB, 4-way, linesize 32 bytes.

Synthesized TLB refill handler (20 instructions).

Synthesized TLB load handler fastpath (32 instructions).

Synthesized TLB store handler fastpath (32 instructions).

Synthesized TLB modify handler fastpath (31 instructions).

Cache parity protection disabled

cause = 800060, status = 1100ff00

PID hash table entries: 128 (order: 7, 512 bytes)

calculating r4koff... 00177000(1536000)

CPU frequency 384.00 MHz

Using 192.000 MHz high precision timer.

Console: colour dummy device 80x25

Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)

Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)

Memory: 28644k/32768k available (2914k kernel code, 4124k reserved, 649k data, 132k init, 0k highmem)

Mount-cache hash table entries: 512

NET: Registered protocol family 16

SCSI subsystem initialized

usbcore: registered new interface driver usbfs

usbcore: registered new interface driver hub

usbcore: registered new device driver usb

NET: Registered protocol family 2

Time: MIPS clocksource has been installed.

IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

TCP established hash table entries: 1024 (order: 1, 8192 bytes)

TCP bind hash table entries: 1024 (order: 0, 4096 bytes)

TCP: Hash tables configured (established 1024 bind 1024)

TCP reno registered

squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher

squashfs: LZMA suppport for slax.org by jro

fuse init (API version 7.8)

io scheduler noop registered (default)

FLASH_API: MAN_ID=C2 DEV_ID=22CB SIZE=8MB

Ralink RT2880 gpio driver initialized

Gemtek LED init...

Ralink gpio driver initialized

HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096

N_HDLC line discipline registered.

Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled

serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A

serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A

loop: loaded (max 8 devices)

rdm_major = 254

GDMA1_MAC_ADRH -- : 0x00000000

GDMA1_MAC_ADRL -- : 0x00000000

Ralink APSoC Ethernet Driver Initilization. v1.60  128 rx/tx descriptors allocated, mtu = 1500!

NAPI enable, weight = 0, Tx Ring = 128, Rx Ring = 128

GDMA1_MAC_ADRH -- : 0x0000000c

GDMA1_MAC_ADRL -- : 0x43305277

PROC INIT OK!

PPP generic driver version 2.4.2

PPP Deflate Compression module registered

PPP BSD Compression module registered

PPP MPPE Compression module registered

NET: Registered protocol family 24

ralink flash device: 0x1000000 at 0xbf000000

Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank

 Amd/Fujitsu Extended Query Table at 0x0040

number of CFI chips: 1

cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.

Creating 5 MTD partitions on "Ralink SoC physically mapped flash":

0x00000000-0x00050000 : "uboot"

0x00050000-0x007e0000 : "Kernel and Rootfs"

0x001d0000-0x007e0000 : "Rootfs"

0x007e0000-0x007f0000 : "Nvram"

0x007f0000-0x00800000 : "Factory"

block2mtd: version $Revision: 1.1.1.1 $

Initializing USB Mass Storage driver...

usbcore: registered new interface driver usb-storage

USB Mass Storage support registered.

nf_conntrack version 0.5.0 (256 buckets, 2048 max)

IPv4 over IPv4 tunneling driver

GRE over IPv4 tunneling driver

ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Fully Cone

TCP cubic registered

NET: Registered protocol family 1

NET: Registered protocol family 10

lo: Disabled Privacy Extensions

tunl0: Disabled Privacy Extensions

Mobile IPv6

IPv6 over IPv4 tunneling driver

sit0: Disabled Privacy Extensions

NET: Registered protocol family 17

create_proc_read_write_entry: fail

802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>

All bugs added by David S. Miller <davem@redhat.com>

ieee80211: 802.11 data/management/control stack, git-1.1.13

ieee80211: Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>

VFS: Mounted root (squashfs filesystem) readonly.

Freeing unused kernel memory: 132k freed

Algorithmics/MIPS FPU Emulator v1.5

reset_btn : reset_btn is 1...press



phy_tx_ring = 0x01cbb000, tx_ring = 0xa1cbb000



phy_rx_ring = 0x00000000, rx_ring = 0x00000000

RT305x_ESW: Link Status Changed

CDMA_CSG_CFG = 81000007

GDMA1_FWD_CFG = 790000

#sysinit: [sysinit]





BusyBox v1.1.0 (2009.04.29-12:31+0000) Built-in shell (msh)

Enter 'help' for a list of built-in commands.



# ftok: No such file or directory

msgget: No such file or directory

[sighandler]: No more events to be processed, quitting.

[cleanup]: Waiting for children.

[cleanup]: All children terminated.

Creat rmain device for LED and insmod it.

insmod: reset_btn.ko: no module by that name found

-- BUTTON: REBOOT --

Starting Watchdog function !!!!!!!

cat: /proc/watchdog_ctrl_folder/watchdog_ctrl_run: No such file or directory

Done

Clean storage nvram value!!

# update nvram with default list!

Do 'echo 0 > /proc/USB_BLINK;echo 1 > /proc/GPIO23;echo 1 > /proc/GPIO22;' in ixp4xx_gpio.h   

# interfaces_init......

Can't open /dev/rtl8366_detect: No such device or address

RTL8366 reg 0x5C=[0x0000]

Can't detect RTL8366 !!: No such device or address

Setting ra0 configuration....

CountryRegionABand=1

WirelessMode=9

TxRate=0

Channel=0

BeaconPeriod=100

DtimPeriod=1

TxPower=100

BGProtection=2

RTSThreshold=2347

FragThreshold=2346

TxBurst=1

ShortSlot=1

PktAggregate=0

NoForwarding=0

NoForwardingBTNBSSID=0

HideSSID=0

Key1Type=0

Key2Type=0

Key3Type=0

Key4Type=0

WdsEnable=0

WdsList=

WdsKey=

WdsEncrypType=NONE

AutoChannelSelect=1

RekeyInterval=2000

AccessPolicy0=0

AccessPolicy1=0

RADIUS_Server=0.0.0.0

RADIUS_Port=1812

RADIUS_Key=

Ethifname=vlan1

own_ip_addr=192.168.2.1

session_timeout_interval=0

DisableOLBC=0

TxPreamble=0

WmmCapable=1

AckPolicy=0;0;0;0

APAifsn=3;7;1;1

APCwmin=4;4;3;2

APCwmax=6;10;4;3

APTxop=0;0;94;47

APACM=0;0;0;0

BSSAifsn=3;7;2;2

BSSCwmin=4;4;3;2

BSSCwmax=10;10;4;3

BSSTxop=0;0;94;47

BSSACM=0;0;0;0

BasicRate=15

IEEE8021X=0

Set N mode parameter...

Bring up ra0 interface....

rt2860v2_ap: module license 'unspecified' taints kernel.

killall: smbd: no proce2860 version : 2.0.0.0-Win7-20090331 (Apr 29 2009)

ss killed





=== pAd = c1009000, size = 486296 ===



<-- RTMPAllocAdapterBlock, Status=0

killall: nmbd: no process killed

killall: ntfs-3g: no process killed




The system is going down NOW !!


Sending SIGTERM to all processes.

Quit resetC
Sending SIGKILL



BusyBox v1.1.0 (2009.04.29-12:31+0000) Built-in shell (msh)

Enter 'help' for a list of built-in commands.



#

Did anyone else have this problem. Did you every get the wireless working with openWRT? If so, I would probably change.

Hi all,

My first post on this board. I have a router like Herb's (Belkin F5D8235-4) and am going to try to get the fonera firmware running on it as well. I do have a couple of questions though, since I'm not familiar with embedded applications:

- When I do a make kernel_menuconfig on the svn trunk, I don't have the option to set the RAM size. I checked the .config file, no RAM option present either. Is this something no longer needed (as in autodetected for instance)?
- If I testrun the firmware image, is there also risk of bricking the router (say because of the above maybe), or can I only brick it when I put it onto the flash memory?
- Herb: to open the router (I still have to attach the serial link) you removed 2 screws. I don't have holes in those locations - did you drill them to get to the screws? I want to limit breakage to the case as much as possible).

FYI: I'm doing this on an Arch GNU/Linux installation.

Thanks in advance already, and I'll keep everyone posted here with any progress I make. I noticed my build just failed so I'm gonna check that out and get back.

- Michael

What version do you have. Look on the bottom and there will be either a V1xxx or V2xxx. I know V1 is a little different. In the V2's anyway, the screws are under the front cover. The cover is some kind of sticky backed vynal I believe, so you can not feel the screws under it. I would suggest just pulling the cover back. Take a thin blade knife and peal up one of the corners. Keep pulling until you see the screw and repeat on the other end.

hope this helps

It's a V2000 I believe. Thanks for the hints, I still didn't get around to it because of real life issues, but hope to be able to somewhere next month.

- Michael

herbswanson wrote:

An extraneous "-e" was added to the bb_config.h file. Deleted these characters from line 1.

This only appears after an attempted make, the real culprit is the busybox Makefile.

user/busybox/Makefile

# line 321
@echo -e "#ifndef BB_CONFIG_H\n#define BB_CONFIG_H" > $@
# change to
@echo "#ifndef BB_CONFIG_H\n#define BB_CONFIG_H" > $@

Another Makefile with problems is user/rt2880_wsc_upnp_SDK3000/libupnp-1.3.1/Makefile

# line 98
ACLOCAL = ${SHELL} /home/terence/Belkin_F5D8235-4_v2000_20081113_SDK3200/Belkin_F5D8235-4_v2000_20081112_SDK3200/user/rt2880_wsc_upnp_SDK3000/libupnp-1.3.1/config.aux/missing --run aclocal-1.9
# can be changed to
ACLOCAL = ${SHELL} $(srcdir)/config.aux/missing --run aclocal-1.9

# line 101
AMTAR = ${SHELL} /home/terence/Belkin_F5D8235-4_v2000_20081113_SDK3200/Belkin_F5D8235-4_v2000_20081112_SDK3200/user/rt2880_wsc_upnp_SDK3000/libupnp-1.3.1/config.aux/missing --run tar
# to
AMTAR = ${SHELL} $(srcdir)/config.aux/missing --run tar

# line 103
AUTOCONF = ${SHELL} /home/terence/Belkin_F5D8235-4_v2000_20081113_SDK3200/Belkin_F5D8235-4_v2000_20081112_SDK3200/user/rt2880_wsc_upnp_SDK3000/libupnp-1.3.1/config.aux/missing --run autoconf
# to
AUTOCONF = ${SHELL} $(srcdir)/config.aux/missing --run autoconf

# line 104
AUTOHEADER = ${SHELL} /home/terence/Belkin_F5D8235-4_v2000_20081113_SDK3200/Belkin_F5D8235-4_v2000_20081112_SDK3200/user/rt2880_wsc_upnp_SDK3000/libupnp-1.3.1/config.aux/missing --run autoheader
# to
AUTOHEADER = ${SHELL} $(srcdir)/config.aux/missing --run autoheader

# line 105
AUTOMAKE = ${SHELL} /home/terence/Belkin_F5D8235-4_v2000_20081113_SDK3200/Belkin_F5D8235-4_v2000_20081112_SDK3200/user/rt2880_wsc_upnp_SDK3000/libupnp-1.3.1/config.aux/missing --run automake-1.9
# to
AUTOMAKE = ${SHELL} $(srcdir)/config.aux/missing --run automake-1.9

# line 150
MAKEINFO = ${SHELL} /home/terence/Belkin_F5D8235-4_v2000_20081113_SDK3200/Belkin_F5D8235-4_v2000_20081112_SDK3200/user/rt2880_wsc_upnp_SDK3000/libupnp-1.3.1/config.aux/missing --run makeinfo
# to
MAKEINFO = ${SHELL} $(srcdir)/config.aux/missing --run makeinfo

# line 199
install_sh = /home/terence/Belkin_F5D8235-4_v2000_20081113_SDK3200/Belkin_F5D8235-4_v2000_20081112_SDK3200/user/rt2880_wsc_upnp_SDK3000/libupnp-1.3.1/config.aux/install-sh
# to
install_sh = $(srcdir)/config.aux/install-sh

on ubuntu 10.04LTS desktop 32bit, using the 2.01.07 firmware source code (as described above) for v2xxx hardware
full how to compile this: http://sleclire.blogspot.com/2010/09/co … elkin.html
EDIT7: I did do these before all that follows:

I created a virtual machine for my build using sun's virtualbox. Unpacked the tar bar into the "/" partition as instructed. Build required following fixes to run to completion. The "make" will find them for you.


modified sumversion.c  added a missing include
      /linux/scripts/mod/sumversion.c
      10a11
      > #include <limits.h>

changed HOSTCFLAGS  and CFLAGS in the linux/Makefile   allowed warning messages on compile

      197c197
      < HOSTCFLAGS = -Werror -Wstrict-prototypes -O2 -fomit-frame-pointer
      > HOSTCFLAGS = -Wall -O2 -fomit-frame-pointer
      312c312
      < CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
      > CFLAGS := -Wall -Wundef -Wno-trigraphs \

EDIT3: so my fix to that is to leave it as is (with the "-e") and replace the /bin/sh symlink on your system which points to /bin/dash and make it point to /bin/bash  so all the future -e issues would be solved (no need to read below, unless you want the details)

# line 321
@echo -e "#ifndef BB_CONFIG_H\n#define BB_CONFIG_H" > $@
# change to
@echo "#ifndef BB_CONFIG_H\n#define BB_CONFIG_H" > $@

I found the problem with this, with ubuntu (currently 10.04LTS) as described here https://wiki.ubuntu.com/DashAsBinSh the /bin/sh shell is a link to dash which doesn't know "echo -e" However before this dash becoming /bin/sh, the /bin/sh was a link to /bin/bash which knows "echo -e"
in detail:

root@john-desktop:~# mkdir 3
root@john-desktop:~# cd 3
root@john-desktop:~/3# type sh
sh is hashed (/bin/sh)
root@john-desktop:~/3# ls -l /bin/sh
lrwxrwxrwx 1 root root 4 2010-08-29 06:03 /bin/sh -> dash
root@john-desktop:~/3# sh
# echo -e "1\n2"
-e 1
2
# 
root@john-desktop:~/3# ln -s /bin/bash sh
root@john-desktop:~/3# ./sh
sh-4.1# echo -e "1\n2"
1
2
sh-4.1# exit
root@john-desktop:~/3#

So, bash acting like sh accepts echo -e, but dash acting like sh doesn't and instead it echoes "-e " too

Now, could someone tell me how to regenerate the include/bb_config.h file please (EDIT2: make menuconfig then exit with save and do a make)
I tried the make menuconfig (I wonder if that's the way) however I got an error message probably the same dash issue but says I'm missing ncurses which I think it's installed by default

make -C scripts/config ncurses conf mconf
make[2]: Entering directory `/home/john/2/Belkin_F5D8235-4_v2000_v2.01.07/user/busybox/scripts/config'
/usr/bin/ld: cannot find -lncurses
collect2: ld returned 1 exit status
-e 
>> Unable to find the Ncurses libraries.
>>
>> You must have Ncurses installed in order
>> to use 'make menuconfig'

make[2]: *** [ncurses] Error 1
make[2]: Leaving directory `/home/john/2/Belkin_F5D8235-4_v2000_v2.01.07/user/busybox/scripts/config'
make[1]: *** [scripts/config/mconf] Error 2
make[1]: Leaving directory `/home/john/2/Belkin_F5D8235-4_v2000_v2.01.07/user/busybox'
make: *** [menuconfig] Error 2
root@john-desktop:~/2/Belkin_F5D8235-4_v2000_v2.01.07/user/busybox#

as you can see there's an "-e" there, so I'll have to replace the /bin/sh symlink to point to /bin/bash just to make sure other echo -e out there don't mess up, since there's no SHELL= in the Makefile, it uses /bin/sh I assume although my SHELL is /bin/bash in terminal

EDIT: so I needed an

apt-get install libncurses-dev

anyway though the -e dissapeared
I did an exit and save but the include/bb_config.h didn't get auto generated, I'm guessing I need ./configure or something which doesn't exist in current folder
EDIT2: nevermind I forgot to do a make, EDIT4: note that I was in the ./user/busybox/ folder while doing make menuconfig and make

By the way, if you're using /bin/bash as /bin/sh instead of /bin/dash then echo "1\n2" won't work as with dash, meaning you'll have to edit the Makefile again and add the "-e" back, or it won't show "1" on one line and "2" on the next line, instead it'll just show "1\n2" on one line - where \n is interpreted as the new line
To summarize:
echo -e "1\n2" works well on bash or a symlink sh pointing to bash, but it doesn't work well with dash or a symlink sh pointing to dash because it shows an extra "-e"
echo "1\n2" doesn't work on bash or a symlink sh pointing to bash in the sense that there won't be interpretation of \n However it works well on dash or on a symlink named sh pointing to dash in the sense that there will be two lines - interpretation of backslash escapes occurs

=================================================================
EDIT5: continued doing make from the normal folder

dos2unix /home/john/2/Belkin_F5D8235-4_v2000_v2.01.07/romfs/www/*.htm
/bin/sh: dos2unix: command not found

got that error so I had to

sudo apt-get install tofrodos
sudo ln -s /usr/bin/todos /usr/bin/unix2dos
sudo ln -s /usr/bin/fromdos /usr/bin/dos2unix

EDIT6: hit another error

#Create firmware
bin/mksquashfs_lzma-3.2 romfs /home/john/2/Belkin_F5D8235-4_v2000_v2.01.07/images/romfs.sqsh.lzma
bin/mksquashfs_lzma-3.2: error while loading shared libraries: libstdc++.so.5: cannot open shared object file: No such file or directory
make: *** [firmware] Error 127

due to non-existance of that lib version on ubuntu 10.04 here I had to get it from one of the mirrors here http://packages.ubuntu.com/jaunty/i386/ … 5/download
then as root do
    dpkg -i libstdc++5_3.3.6-17ubuntu1_i386.deb

then did a make again (no cleaning)

Kernel: [/home/john/2/Belkin_F5D8235-4_v2000_v2.01.07/images/linux_uImage]
Rootfs: [/home/john/2/Belkin_F5D8235-4_v2000_v2.01.07/images/romfs.sqsh.lzma]
Output: [/home/john/2/Belkin_F5D8235-4_v2000_v2.01.07/images/firmware.bin]
bin/fw_crc_hdr /home/john/2/Belkin_F5D8235-4_v2000_v2.01.07/images/firmware.bin /home/john/2/Belkin_F5D8235-4_v2000_v2.01.07/images/F5D8235v2_WW_2.01.07.bin
------- Belkin - 11n draft firmware signature system -------

PeterChen_Debug: B
PeterChen_Debug: 1
PeterChen_Debug: 1
PeterChen_Debug: N
PeterChen_Debug: 8
PeterChen_Debug: 2
PeterChen_Debug: 3
PeterChen_Debug: 5
PeterChen_Debug: A
PeterChen_Debug: 2
PeterChen_Debug: 0
PeterChen_Debug: 0
PeterChen_Debug: 0
PeterChen_Debug: X
PeterChen_Debug: src_fp size = 6385679
PeterChen_Debug: GeneratingCHKSUM = 0xf46202d8
PeterChen_Debug: Belkin - 11n draft Header = 0xf46202d82e31316e
root@john-desktop:~/2/Belkin_F5D8235-4_v2000_v2.01.07#

the entire folder after compile was 925MB
I cannot test this on my router due to not having a cable and not having the router opened, but I'm currently running 2.01.08 which is not yet available as source code but I'm hoping they will update soon
source should be here: https://www.belkin.com/support/opensource/
firmware bin is here: http://en-us-support.belkin.com/app/ans … /304/p/336

now comparing the just compiled firmware bin file (size 6,385,683 bytes)
459b3a4f270c4ce7fbae8a6fddb24556  F5D8235v2_WW_2.01.07.bin
with the original from belkin firmware (size 6,447,123 bytes)
abfcc818e0cca1d5750d92dd9e22ee29 *f5d8235v2_ww_2.01.07.bin

I can say different md5sum which means different contents which I'm guessing it's not good
Ok ok, nevermind, so I'm guessing since they are compressed images that they somehow compressed differently? so they can be different because of that - still, not sure about this...

(Last edited by DorianGrey on 15 Sep 2010, 14:29)

UPDATE: Note on port 10101/tcp: "bkserver process listens to port 10101, the process is used for router quick setup procedure from Belkin's installation CD." (found that here: http://www.seattlewireless.net/Belkin_F5D7230-4 )
I used wireshark software to sniff the packets while running setupassistant.exe from belkin CD that came with the router. And I had to choose  UK or else it wouldn't do the checks(maybe it was trying on a different network than 192.168.2.1) and so I saw that it communicated with the router on router port tcp 10101 and it can get/set administrative stuffs even while I had a password set in the webinterface(port 80). And if this port gets closed due to port scanning or maybe when I tried to 'nc' or telnet to it, it will reopen upon router reboot.

OLD stuff: port 10101/tcp is open, does anyone know why? and for what? is it in use by Setup Assistant or does it use the web port 80/tcp instead to configure the router first time ? meantime I contacted a Support Assistant (that's a person that you can chat with online on belkin's site) and they know nothing about ports being open other than http ports, they said. I'll contact customer service next...

Could you maybe, herbswanson, check with a netstat -pant (assuming it's available) to see which program has that port open on router? assuming you still have the router flashed with the original belkin firmware with telnet on
And by the way herb, big thank yous and greets go your way for the amazing tutorial you made here in these posts!
UPDATE: I found some post somewhere ok here http://www.dslreports.com/forum/remark,12908414 it's not the same type of router but it's a belkin, and you can see the open port
tcp        0      0 192.168.1.253:10101     *:*                     LISTEN
34 root         20 S   bkserver
and I guess netstat (symlink to busybox ?) didn't know the -p switch to show which program had that port opened (I wonder if it can be selected in make menuconfig)

On another note, I realized that I don't need the modified CA-42 nokia cable which is usb to serial cable, instead I can just use my serial port on my PC to connect to the router(WRONG: "Levels are not RS232 voltage levels, but +3.3V TTL logic. Use an interface converter chip (Max232/Max3232/DS275 etc.) to connect to standard RS-232. "), as soon as I figure out the pins and I guess it's supposed to be wired just like a null modem cable with RX from one side to TX on the other side and also with TX on one side to the RX on the other side , in other words RX/TX wires swapped on route to the router. And could anyone confirm that the voltages are the same? maybe 3.3 volts? so there's no need for 5v to 3.3v shifter as with the CA42 cable UPDATE: got some good info here http://wiki.openwrt.org/oldwiki/openwrt … al_console
more info about serial to serial http://www.beyondlogic.org/serial/serial.htm
UPDATE: so as I understand it RS-232 aka com port on the PC side can do like +-12V which would be bad to directly connect to router's J2 without "an interface converter chip (Max232/Max3232/DS275 etc.)" to reduce the voltage - else I may brick the router's serial port at least heh

Serial RS-232 (V.24) communication works with voltages (between -15V ... -3V are used to transmit a binary '1' and +3V ... +15V to transmit a binary '0') which are not compatible with today's computer logic voltages. On the other hand, classic TTL computer logic operates between 0V ... +5V (roughly 0V ... +0.8V referred to as low for binary '0', +2V ... +5V for high binary '1' ). Modern low-power logic operates in the range of 0V ... +3.3V or even lower.

So, the maximum RS-232 signal levels are far too high for today's computer logic electronics, and the negative RS-232 voltage can't be grokked at all by the computer logic. Therefore, to receive serial data from an RS-232 interface the voltage has to be reduced, and the 0 and 1 voltage levels inverted. In the other direction (sending data from some logic over RS-232) the low logic voltage has to be "bumped up", and a negative voltage has to be generated, too.

     RS-232              TTL             Logic
-----------------------------------------------
-15V ...  -3V  <->  +2V ... +5V    <->  1
  +3V ... +15V  <->   0V ... +0.8V  <->  0

from here http://en.wikibooks.org/wiki/Serial_Pro … r_Receiver

EDIT: About serving the firmware with a tftp server running on virtualbox and the router requesting it, Herb, how did you manage to port forward the udp port 69 on the virtualbox, so that the router could access it while your computer was connected to the router's lan port? I'm trying to test if it's opened right by having my router (when it works normally and it's on internet) port forward to my local computer the port 69, and on my computer I'm using Smart Port Forwarding program which says listen on localhost:69 and forward to the local IP of my eth3 interface inside virtualbox to port 69, udp (Type standard). However, while I can indeed detect from within virtualbox with watch -n 1 netstat -pant  that some external IP (where I'm ssh-ed to) is connected to my port here (ESTABLISHED), while using tftp my-inet-router-IP from an external location IP on the internet, to get the firmware.bin file (command: tftp IP then get firmware.bin) I get "Transfer timed out." I did test if port forwarding works well but with a tcp port and ssh or httpd server, so it works well for tcp. On virtualbox I tried both NAT and Host-Only adapter. And I even stopped my firewall (not the one on router -if any).
I can only try one thing, get a laptop and try to get the firmware from there, while both laptop and the computer with the virtualbox are connected to the router switch, and also make sure they're in the same network ie. 192.168.2.0/24

EDIT: I'm kind of getting a hint from here https://forum.openwrt.org/viewtopic.php … 589#p23589 "Please, don't waste our time with problems caused by other firmwares."
So I'm not sure if I should continue posting since I'm not talking about openwrt firmware (yet) although I may not be far from flashing it eventually, and I also have almost zero experience with fora (aka forums)

On another note, I found that accessing http://192.168.2.1/ver.htm  which is a hidden page (sort of, nothing links to it that is) you can see something like:

Check Firmware Header   :  1
Start telnetd for debug   :  0
Force dhcp to use this gateway   : 
[Apply]
Customer Firmware Version : 2.01.08
My Firmware Verion : 2.01.08 PPTP 2009_1119

So naturally I changed the telnetd to 1 and hit apply, it remained to 1 because as I figure it, it got written into nvram (which I'm also guessing it's powered by a battery? so it's not flash, it's like CMOS - update: ok I guess it's not, instead it's in flash too ie. in /dev/mtd4 anyway the utility called nvram can read/write there), so nothing happened no telnetd started because I'm guessing (and I explored the filesystem on 2.01.07 firmware that I compiled above) there is no telnetd anywhere in the filesystem but if it will be, it probably need to be a symlink to busybox and also made sure busybox was compiled with telnetd support (too lazy atm to check if it was or not and that then only the symlink would be missing)
UPDATE: confirmed to work on 2.01.07 firmware if you make menuconfig in user/busybox/ folder and select telnetd and the remake the whole firmware, and this ver.htm page allows you to enable/disable telnetd and also does a reboot for changes to take effect but beware it listens on all interfaces (tcp        0      0 :::23                   :::*                    LISTEN)
but as Herb said, you need to give root a password(even if empty) before you can login (don't yet know which script to edit for that, using the ca-42 on ttyS1 atm)
and also more importantly

mkdir /dev/pts
mount -t devpts none /dev/pts

those must be run before or after telnetd is run, and the autorunning above doesn't do all that - so I put them in user/sysinit/rc  script before "sysinit&" line. Now, I can't yet set the password for root except via serial console, but I can login as guest which has no password. It seems sysinit is creating the /tmp/shadow file with no password for root set, but empty pass for guest set! and /tmp is a ramfs
And in 2.01.07 telnetd will listen on all interfaces (if you mod busybox to include telnetd that is and also in ver.htm set it to 1) which means someone can log from WAN as guest.

more info here: http://sleclire.blogspot.com/2010/09/in … v2000.html

(Last edited by DorianGrey on 14 Sep 2010, 10:06)

FD58235-4 V2000 firmware 2.01.08 (no source code exists yet although the firmware was compiled on oct 2009)
console=ttyS1,57600n8 root=/dev/mtdblock2


# reboot
killall: ntfs-3g: no process killed


The system is going down NOW !!

Sending SIGTERM to all processes.

Sending SIGKILL

BusyBox v1.1.0 (2009.11.12-11:16+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# Restarting system.


U-Boot 1.1.3 (Nov  7 2008 - 00:24:27)

Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81fa0000
=====config_usbotg =====
flash_protect ON: from 0xBF000000 to 0xBF02F0F7
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
============================================ 
Ralink UBoot Version: 3.2
-------------------------------------------- 
ASIC 3052_MP2 (Port5<->GigaSW)
DRAM COMPONENT: 128Mbits 
DRAM BUS: 32BIT 
Total memory: 32 MBytes
Date:Nov  7 2008  Time:00:24:27
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 384 MHZ #### 

 SDRAM bus set to 32 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
 0 
   
3: System Boot system code via Flash.
## Booting image at bf050000 ...
   Image Name:   Linux Kernel Image
   Created:      2009-11-23   9:20:42 UTC

 System Control Status = 0x10440000 
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1178700 Bytes =  1.1 MB
   Load Address: 80000000
   Entry Point:  80364000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80364000) ...
## Giving linux memsize in MB, 32

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.21 (root@localhost.localdomain) (gcc version 3.4.2) #10 Thu Nov 12 19:16:47 CST 2009

 The CPU feqenuce set to 384 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock2
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 800008, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 00177000(1536000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 28756k/32768k available (2833k kernel code, 4012k reserved, 634k data, 132k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.8)
io scheduler noop registered (default)
FLASH_API: MAN_ID=C2 DEV_ID=22CB SIZE=8MB
Ralink RT2880 gpio driver initialized
Gemtek LED init...
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
smi_major=249
0 smi_init check[0x05c]1=0x5937
rdm_major = 254
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v1.60  128 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 128, Rx Ring = 128
GDMA1_MAC_ADRH -- : 0x0000000c
GDMA1_MAC_ADRL -- : 0x43305277
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
ralink flash device: 0x1000000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 5 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00050000 : "uboot"
0x00050000-0x007e0000 : "Kernel and Rootfs"
0x00190000-0x007e0000 : "Rootfs"
0x007e0000-0x007f0000 : "Nvram"
0x007f0000-0x00800000 : "Factory"
block2mtd: version $Revision: 1.1.1.1 $
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Fully Cone
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
tunl0: Disabled Privacy Extensions
Mobile IPv6
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
NET: Registered protocol family 17
create_proc_read_write_entry: fail
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 132k freed
Algorithmics/MIPS FPU Emulator v1.5

phy_tx_ring = 0x01c8d000, tx_ring = 0xa1c8d000

phy_rx_ring = 0x00000000, rx_ring = 0x00000000
RT305x_ESW: Link Status Changed
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 790000


BusyBox v1.1.0 (2009.11.12-11:16+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# #sysinit: [sysinit]
ftok: No such file or directory
msgget: No such file or directory
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
Creat rmain device for LED and insmod it.
insmod: reset_btn.ko: no module by that name found
Starting Watchdog function !!!!!!!
cat: /proc/watchdog_ctrl_folder/watchdog_ctrl_run: No such file or directory
Done
Clean storage nvram value!!
# update nvram with default list!
Do 'echo 0 > /proc/USB_BLINK;echo 1 > /proc/GPIO23;echo 1 > /proc/GPIO22;' in ixp4xx_gpio.h   
# interfaces_init......
RTL8366 reg 0x5C=[0x5937]
Init RTL8366RB!!
switch reg write offset=98, value=7f40
switch reg write offset=e4, value=20
rmmod: rtl8366RB: Success
rtl_major = 253
0 smi_init check[0x0105]=0x0000
0 smi_init check[0x0105]=0x0000
0 smi_init check[0x0509]=0x5937
verid is 3
0 rtl8366rb_initChip
0 smi_init check[0x0509]1=0x5937
0 smi_init check[0x050a]1=0x0003
Gemtek Link status init.
verid is 3
rtl8366rb_initChip() initialized!
rtl8366rb_setMac5ForceLink() initialized!
verid is 3
[0]phy_abilityAutoNegotiation : 1
[0]phy_abilityHalf_10 : 1
[0]phy_abilityFull_10 : 1
[0]phy_abilityHalf_100 : 1
[0]phy_abilityFull_100 : 1
[0]phy_abilityFull_1000 : 1
[0]phy_abilityFC : 1
[0]phy_abilityAsyFC : 1
[1]phy_abilityAutoNegotiation : 1
[1]phy_abilityHalf_10 : 1
[1]phy_abilityFull_10 : 1
[1]phy_abilityHalf_100 : 1
[1]phy_abilityFull_100 : 1
[1]phy_abilityFull_1000 : 1
[1]phy_abilityFC : 1
[1]phy_abilityAsyFC : 1
[2]phy_abilityAutoNegotiation : 1
[2]phy_abilityHalf_10 : 1
[2]phy_abilityFull_10 : 1
[2]phy_abilityHalf_100 : 1
[2]phy_abilityFull_100 : 1
[2]phy_abilityFull_1000 : 1
[2]phy_abilityFC : 1
[2]phy_abilityAsyFC : 1
[3]phy_abilityAutoNegotiation : 1
[3]phy_abilityHalf_10 : 1
[3]phy_abilityFull_10 : 1
[3]phy_abilityHalf_100 : 1
[3]phy_abilityFull_100 : 1
[3]phy_abilityFull_1000 : 1
[3]phy_abilityFC : 1
[3]phy_abilityAsyFC : 1
ityAsyFC : 1ityAsyFC : 1tyAutoNegotiation : 1
[4]phy_abilityHalf_10 : 1
[4]phy_abilityFull_10 : 1
[4]phy_abilityHalf_100 : 1
[4]phy_abilityFull_100 : 1
[4]phy_abilityFull_1000 : 1
[4]phy_abilityFC : 1
[4]phy_abil
rtl8366s_getEthernetPHY fail for 5!!!!
rtl8366s_getEthernetPHY fail for 6!!!!
rtl8366s_getEthernetPHY fail for 7!!!!
rtl8366s_getEthernetPHY fail for 8!!!!
rtl8366s_getEthernetPHY fail for 9!!!!
rtl8366s_getEthernetPHY fail for 10!!!!
rtl8366s_getEthernetPHY fail for 11!!!!
rtl8366s_getEthernetPHY fail for 12!!!!
rtl8366s_getEthernetPHY fail for 13!!!!
rtl8366s_getEthernetPHY fail for 14!!!!
rtl8366s_getEthernetPHY fail for 15!!!!
gemtek_switch_reset failed
RTL_GET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET : tx is 0, rx is -2115356448
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
rtl:rtl_ge_read : 0
RTL_SET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET Success!!!
RTL_GET_GREEN_ETHERNET : tx is 1, rx is -2130260576
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
rtl:rtl_ge_read : 0
Wireless drvier is disable...
rt2860v2_ap: module license 'unspecified' taints kernel.
2860 version : 2.0.0.0-Win7-20090331 (Nov 12 2009)


=== pAd = c103c000, size = 486296 ===

<-- RTMPAllocAdapterBlock, Status=0
RX DESC a1b75000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 0
2. Phy Mode = 0
3. Phy Mode = 0
MCS Set = 00 00 00 00 00
Main bssid = 94:44:52:11:22:33
The UUID Hex string is:11111111111111111111944452112233
The UUID ASCII string is:11111111-1111-1111-1111-944452112233!
<==== RTMPInitialize, Status=0
0x1300 = 00064220
ra0       mac:
[0x0000102c]:7f031e46  
ERROR!!! RTMPCancelTimer failed, Timer hasn't been initialize!
ERROR!!! RTMPCancelTimer failed, Timer hasn't been initialize!
ERROR!!! RTMPCancelTimer failed, Timer hasn't been initialize!
ERROR!!! RTMPCancelTimer failed, Timer hasn't been initialize!
ERROR!!! RTMPCancelTimer failed, Timer hasn't been initialize!
ERROR!!! RTMPCancelTimer failed, Timer hasn't been initialize!
ERROR!!! RTMPCancelTimer failed, Timer hasn't been initialize!
The FW is NOT for WIN 7 LOGO TEST 
can't get macaddr of ra0
can't get macaddr of ra1
vlan1: Setting MAC address to  94 44 52 11 22 33.
device eth2 entered promiscuous mode
VLAN (vlan1):  Setting underlying device (eth2) to promiscious mode.
vlan1: dev_set_promiscuity(master, 1)
device vlan1 entered promiscuous mode
SIOCSIFADDR: No such device
SIOCGIFFLAGS: No such device
interface ra0 does not exist!
br0: port 1(vlan1) entering listening state
dwc_otg: version 2.60a 22-NOV-2006
DWC_otg: Using DMA mode
dwc_otg lm0: DWC OTG Controller
dwc_otg lm0: new USB bus registered, assigned bus number 1
dwc_otg lm0: irq 18, io mem 0x00000000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
# lan services init......
killall: rt2860apd: no process killed
rt2860apd: No such file or directory
easyconf: start 20080820
easyconf: Waiting for client to connect...
route: resolving gw
route: resolving gw
route: resolving gw
route: resolving gw
route: resolving gw
mknod: /dev/pts/0: No such file or directory
br0: port 1(vlan1) entering learning state
telnetd: not found
killall : No such file or directory
WPS BUTTON press!!
ra0       no private ioctls.

br0: topology change detected, propagating
br0: port 1(vlan1) entering forwarding state
killall: wscd: no process killed
(2148)Service enable wireless
# wan_init......
Set country code to nt!!!
done.
vlan2: Setting MAC address to  00 11 22 33 44 55.
readChannel: ioctl() failed !!!
Close speed boot up led...
Changing password for guest
Bad password: too short.

Warning: weak password (continuing).
Jan  1 00:00:21 passwd[3442]: password for `guest' changed by user `root'

Password changed.
Can't load /etc/smb.conf - run testparm to debug it
httpd : This is httpd...ssl_enabled is 0
(easystorage.c->main(201)) Easystorage Start 20080820

# ls
bin       etc       hotplug2  proc      sys       usr       www
dev       etc_ro    lib       sbin      tmp       var
# ps axul
  PID  Uid     VmSize Stat Command
    1 root        276 S   /bin/init 
    2 root            SWN [ksoftirqd/0]
    3 root            SW< [events/0]
    4 root            SW< [khelper]
    5 root            SW< [kthread]
   30 root            SW< [kblockd/0]
   31 root            SW< [cqueue/0]
   34 root            SW< [khubd]
   46 root            SW< [kswapd0]
   47 root            SW  [pdflush]
   48 root            SW  [pdflush]
   49 root            SW< [aio/0]
  648 root            SW  [mtdblockd]
  673 root        448 S   /bin/sh 
 1942 root        272 S   /bin/usb_storage_hotplug 
 1944 root        576 S   /hotplug2/sbin/hotplug2 --persistent 
 3242 root        516 S   resetC 
 3245 root        376 S   psmon 
 3370 root        288 S   syslogd 
 3376 root        436 S < httpd 
 3381 root        264 S   easyconf 
 3382 root        284 S   easytest 192.168.218.155 234.2.2.9 14675 
 3384 root        332 S   easystorage 
 3386 root        924 S   /usr/sbin/udhcpd /tmp/udhcpd.conf 
 3405 root        344 S   dnsmasq -z br0 -n -o -u root -r /var/resolv.conf -H /
 3414 root        628 S   ledctrl 
 3425 root        300 S   if_traffic 
 3427 root        916 S   wan_connect 
 3438 root        264 S   lld2d br0 
 3506 root       1240 S   /usr/local/samba/sbin/nmbd 
 3510 root       1224 S   /usr/local/samba/sbin/smbd 
 3686 root        380 R   ps axul 
# netstat
netstat: not found
# cat /proc/cpuinfo
system type        : Ralink SoC
processor        : 0
cpu model        : MIPS 24K V4.12
BogoMIPS        : 255.48
wait instruction    : yes
microsecond timers    : yes
tlb_entries        : 32
extra interrupt vector    : yes
hardware watchpoint    : yes
ASEs implemented    : mips16 dsp
VCED exceptions        : not available
VCEI exceptions        : not available

# cd proc
# ls
1                  673                GPIO5              kallsyms
1942               ADD_LAN_IP         GPIO6              kcore
1944               ADD_LAN_MAC        GPIO7              kmsg
2                  ADD_MAC            GPIO8              lanLink
3                  CHECK_MSSID_MODE   GPIO9              loadavg
30                 CLIENT_GPIO        MODEM_GPIO         locks
31                 CLIENT_GPIO_STOP0  NET_GPIO           meminfo
3242               CLIENT_GPIO_STOP1  POWER_BOOT_UP      misc
3245               CLIENT_GPIO_STOP2  SHOW_LOG_MAC       modules
3370               CLIENT_GPIO_STOP3  SHOW_MAC           mounts
3376               DEL_MAC            SHOW_REMOVED_MAC   mtd
3381               GEMTEK_BTN_TEST    SPEED              net
3382               GPIO0              SPEED_BOOT_UP      partitions
3384               GPIO1              USB_BLINK          resetDefault
3386               GPIO10             WPS_LED            rt2880
34                 GPIO11             buddyinfo          scsi
3405               GPIO12             bus                self
3414               GPIO13             cmdline            slabinfo
3425               GPIO14             cpuinfo            stat
3427               GPIO15             crypto             swaps
3438               GPIO16             devices            sys
3506               GPIO17             diskstats          sysvipc
3510               GPIO18             driver             timer_list
4                  GPIO19             easylink           tty
46                 GPIO2              execdomains        uptime
47                 GPIO20             filesystems        version
48                 GPIO21             fs                 vmstat
4893               GPIO22             interrupts         wanLink
49                 GPIO23             iomem              zoneinfo
5                  GPIO3              ioports
648                GPIO4              irq
# cat devices
Character devices:
  1 mem
  2 pty
  3 ttyp
  4 /dev/vc/0
  4 tty
  4 ttyS
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
  7 vcs
 10 misc
 13 input
 21 sg
 23 ledctrl
 90 mtd
108 ppp
128 ptm
136 pts
180 usb
189 usb_device
200 flash0
249 rtl8366_detect
251 usb_endpoint
252 gpio
253 rtl
254 rdm0

Block devices:
  7 loop
  8 sd
 31 mtdblock
 65 sd
 66 sd
 67 sd
 68 sd
 69 sd
 70 sd
 71 sd
128 sd
129 sd
130 sd
131 sd
132 sd
133 sd
134 sd
135 sd
# lsmod
Module                  Size  Used by    Tainted: P  
dwc_otg                74224  0 
lm                      2720  1 dwc_otg,[permanent]
rtl8366RB              85440  0 
# ifconfig
br0       Link encap:Ethernet  HWaddr 94:44:52:11:22:33  
          inet addr:192.168.218.155  Bcast:192.168.218.255  Mask:255.255.255.0
          inet6 addr: fe80::9644:52ff:fe11:2233/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1520  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:62 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:8292 (8.0 KiB)

eth2      Link encap:Ethernet  HWaddr 00:11:22:33:44:55  
          inet6 addr: fe80::20c:43ff:fe30:5277/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1520  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:107 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:11578 (11.3 KiB)
          Interrupt:3 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vlan1     Link encap:Ethernet  HWaddr 94:44:52:11:22:33  
          inet6 addr: fe80::9644:52ff:fe11:2233/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1520  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:101 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:10788 (10.5 KiB)

used a CA-42 cable with XP Mode (VirtualPC) 'cause it was an ARK3116 chip which didn't have windows 7 64bit drivers, and virtualbox and vmware failed to work(with ubuntu and xp), so the win xp inside VirualPC works fine with those drivers.

Had a few bumps with tftp, because uboot was ignoring the ARP reply from my PC and kept asking ... and the solution was to unplug the router from power and hit ke "1" like mad while plugging the router, with the purpose of not allowing uboot to boot from flash and boot from tftp instead; if it did boot from flash, a "reboot" command and hitting "1" key would make uboot again ignore ARP until unplugged... you get the idea.

Failed to load 2.01.07 bin (after manually stripping the 19 bytes from the beginning of the original bin file from belkin's site) due to kernel panic and unable to mount root fs, and I was unable to (didn't know how to) give it root= param so it defaulted to /dev/mtdblock2 (Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock2) and didn't even know what root= param to give it when loaded from tftp, /dev/ram ? well I don't know where exactly would the rootfs from inside the bin  would be in ram ... anyway

I loaded 2.01.08 bin (without the first 19bytes of course) and it worked ok but for some reason it rebooted as soon as it almost loaded as I saw above in Herb's post when he flashed it, it also started it and rebooted ... I supposed it's some kind of safety measure ? to not remain in the firmware that you are testing from tftp (in my case since I chose option "1").
Is it supposed to reboot? How to disable autoreboot? (when using option "1") I didn't try to flash anything yet, but I wonder , after flashing will it reboot again? I figure not, but what makes it reboot ?

I'm thinking of flashing the 2.01.07 firmware via web interface and then try to boot the 2.01.07 bin from tftp and I'm guessing it will boot the rootfs (from flash) correctly (cause earlier it was 2.01.08 rootfs in flash, supposedly different format? not squashfs?)

I wonder, flashing the bin via web interface or whatever, does that also flash the uboot loader? I'm guessing not? because uboot.bin or whatever is not included inside the bin, right?

I wonder if ttyS1 is this serial, where is the ttyS0 physically on the board I mean, if any...

eventually I may try to flash openwrt but I need to understand things first smile

Rite now I'm kinda waiting for belkin to release the sources for 2.01.08 but meanwhile I may flash 2.01.07 and mess with the sources...
Is anyone interested in more progress reports? else I won't try to post again unless I've some questions
Peace.

(Last edited by DorianGrey on 29 Sep 2010, 23:02)

I've noticed some strange behavior.
I am receiving extra packets near the normal download traffic, these packets seem to be the normal download traffic encapsulated in Ethernet II frames protocol 0x8899 (realtek layer 2 protocol - unavailable but apparently it adds 4 extra bytes 0x8899 and 0xA200 and some padding[at least that's what I saw for an arp-reply packet padded to 64 bytes(includes +4) from 42 original bytes).

Basically if you have a 10Mbps NIC in full-duplex mode, you can only download with a max of 5Mbps, because the router sends those 5Mbps and another 5Mbps extra (which are the first 5Mbs encapsulated) which equates with your 10Mbps.

Too many details you may find here: http://sites.google.com/site/sleclire/b … col-0x8899

So erm, not only your download speed is a maximum of half of what it should be, but if you put your interface in promisc mode (ie. wireshark with defaults capture) you are getting all traffic sent from internet-gateway's NIC (say iMAC) and the router's vlan2 interface (ie. WAN mac , say wMAC) - that's what those packets are: traffic from iMAC to wMAC which is encapsulated in 0x8899 protocol and also sent on all of 4 LAN ports.
If anyone knows what /bin/switch or /bin/rtl commands need to be given to set that switch to stop forwarding those, let me know smile
'cause for example, if you stop the router at uboot commandline (ie. choose option 4) then WAN and LAN ports act like a hub, you can connect a computer on wan port and one on any of LAN ports and you can ping each other, but as soon as the router enters in linux some commands are executed and the switch no longer acts like a hub or so.
these commands:

# interfaces_init......
RTL8366 reg 0x5C=[0x5937]
Init RTL8366RB!!
switch reg write offset=98, value=7f40
switch reg write offset=e4, value=20
rmmod: rtl8366RB: Success
[17179582.176000] rtl_major = 253
[17179582.180000] 0 smi_init check[0x0105]=0x0000
[17179582.184000] 0 smi_init check[0x0105]=0x0000
[17179582.188000] 0 smi_init check[0x0509]=0x5937
[17179582.320000] verid is 3
[17179582.332000] 0 rtl8366rb_initChip
[17179582.336000] 0 smi_init check[0x0509]1=0x5937
[17179582.340000] 0 smi_init check[0x050a]1=0x0003
[17179582.344000] Gemtek Link status init.
[17179582.484000] verid is 3
[17179582.496000] rtl8366rb_initChip() initialized!
[17179582.504000] rtl8366rb_setMac5ForceLink() initialized!
[17179582.640000] verid is 3
[17179582.680000] [0]phy_abilityAutoNegotiation : 1
[17179582.684000] [0]phy_abilityHalf_10 : 1
[17179582.688000] [0]phy_abilityFull_10 : 1
[17179582.692000] [0]phy_abilityHalf_100 : 1
[17179582.696000] [0]phy_abilityFull_100 : 1
[17179582.700000] [0]phy_abilityFull_1000 : 1
[17179582.704000] [0]phy_abilityFC : 1
[17179582.708000] [0]phy_abilityAsyFC : 1
[17179582.760000] [1]phy_abilityAutoNegotiation : 1
[17179582.764000] [1]phy_abilityHalf_10 : 1
[17179582.768000] [1]phy_abilityFull_10 : 1
[17179582.772000] [1]phy_abilityHalf_100 : 1
[17179582.776000] [1]phy_abilityFull_100 : 1
[17179582.780000] [1]phy_abilityFull_1000 : 1
[17179582.784000] [1]phy_abilityFC : 1
[17179582.788000] [1]phy_abilityAsyFC : 1
[17179582.840000] [2]phy_abilityAutoNegotiation : 1
[17179582.844000] [2]phy_abilityHalf_10 : 1
[17179582.848000] [2]phy_abilityFull_10 : 1
[17179582.852000] [2]phy_abilityHalf_100 : 1
[17179582.856000] [2]phy_abilityFull_100 : 1
[17179582.860000] [2]phy_abilityFull_1000 : 1
[17179582.864000] [2]phy_abilityFC : 1
[17179582.868000] [2]phy_abilityAsyFC : 1
[17179582.920000] [3]phy_abilityAutoNegotiation : 1
[17179582.924000] [3]phy_abilityHalf_10 : 1
[17179582.928000] [3]phy_abilityFull_10 : 1
[17179582.932000] [3]phy_abilityHalf_100 : 1
[17179582.936000] [3]phy_abilityFull_100 : 1
[17179582.940000] [3]phy_abilityFull_1000 : 1
[17179582.944000] [3]phy_abilityFC : 1
[17179582.948000] [3]phy_abilityAsyFC : 1
[17179583.000000] [4]phy_abilityAutoNegotiation : 1
[17179583.004000] [4]phy_abilityHalf_10 : 1
[17179583.008000] [4]phy_abilityFull_10 : 1
[17179583.012000] [4]phy_abilityHalf_100 : 1
[17179583.016000] [4]phy_abilityFull_100 : 1
[17179583.020000] [4]phy_abilityFull_1000 : 1
[17179583.024000] [4]phy_abilityFC : 1
[17179583.028000] [4]phy_abilityAsyFC : 1
[17179583.068000] rtl8366s_getEthernetPHY fail for 5!!!!
[17179583.072000] rtl8366s_getEthernetPHY fail for 6!!!!
[17179583.076000] rtl8366s_getEthernetPHY fail for 7!!!!
[17179583.080000] rtl8366s_getEthernetPHY fail for 8!!!!
[17179583.084000] rtl8366s_getEthernetPHY fail for 9!!!!
[17179583.088000] rtl8366s_getEthernetPHY fail for 10!!!!
[17179583.092000] rtl8366s_getEthernetPHY fail for 11!!!!
[17179583.096000] rtl8366s_getEthernetPHY fail for 12!!!!
[17179583.100000] rtl8366s_getEthernetPHY fail for 13!!!!
[17179583.104000] rtl8366s_getEthernetPHY fail for 14!!!!
[17179583.108000] rtl8366s_getEthernetPHY fail for 15!!!!
[17179583.320000] gemtek_switch_reset failed
[17179583.340000] RTL_GET_GREEN_ETHERNET Success!!!
[17179583.344000] RTL_GET_GREEN_ETHERNET : tx is 0, rx is -2143922016
[17179583.348000] RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
[17179583.352000] RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
[17179583.356000] RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
[17179583.360000] RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
[17179583.364000] RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
rtl:rtl_ge_read : 0
[17179583.432000] RTL_SET_GREEN_ETHERNET Success!!!
[17179583.440000] RTL_GET_GREEN_ETHERNET Success!!!
[17179583.444000] RTL_GET_GREEN_ETHERNET : tx is 1, rx is -2143464768
[17179583.448000] RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
[17179583.452000] RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
[17179583.456000] RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
[17179583.460000] RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
[17179583.464000] RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
rtl:rtl_ge_read : 0

EDIT: so it's likely some kind of vlan tagging leaking
http://oldwiki.openwrt.org/OpenWrtDocs% … faces.html
http://en.wikipedia.org/wiki/Virtual_LAN
http://en.wikipedia.org/wiki/IEEE_802.1Q
switch datasheet http://realtek.info/pdf/rtl8326.pdf

(Last edited by DorianGrey on 30 Sep 2010, 01:26)

Herbswanson, DorianGrey, keep up the good work! I cannot help 'hacking', since I am just a user but I sincerely hope that the router will be able to host openwrt some day, since the factory-software is awkward.

If there is anything I can do speak up!

Thomas

TMildenberger wrote:

Herbswanson, DorianGrey, keep up the good work! I cannot help 'hacking', since I am just a user but I sincerely hope that the router will be able to host openwrt some day, since the factory-software is awkward.

If there is anything I can do speak up!

Thomas

Hey Thomas. I didn't try openwrt yet, I am trying to understand what belkin does to init their hardware ie. the switch and others. For example I see uboot is doing some inits for this switch (RTL8366RB chip) and as I read somewhere openwrt may not support wireless and what other stuffs, although I am willing to try to make openwrt work(but not before understanding what current firmware does special when compared to standard/normal)

I'm posting my schematics for CA-42 cable to F5D8235-4 v2000 router that I used to get console access. (huge png pic, sorry?:P)
http://img195.imageshack.us/img195/3185/nokiaca42usbtottlserial.png
I am now kind of waiting for Belkin to release new firmware, they said so I should check for that in the next coming weeks. So maybe I won't try anything openwrt related. I am also reluctant to try openwrt because I believe it need to overwrite uboot and I can't risk it not being able to properly init network/console and thus me being unable to flash again.
Herb is probably doing something else, since his posts are about 1 year old now smile

I am posting all my findings and related info or mods whatever here: https://sites.google.com/site/sleclire/
or you can just google for "sleclire" [no quotes needed]

Indeed openwrt would be nice, so if anyone from openwrt wants me to test something or so, let me know... as long as it doesn't involve flashing uboot yet(unless I'm sure it will not brick).

So far the most annoying issue is the one in my previous post, with the download traffic. I haven't yet checked what makes the router send extra traffic on LAN ports which shouldn't be sent to those and how to make it stop spamming like that, effectively reducing the download speed of any client to half(less than half) of the NIC's down link speed. So maybe they will fix this in next firmware or not, still awaiting their answer.

I still have to look into what vlans are  ie. vlan1 and vlan2 on router, some virtual LANs or so, no idea how exactly they work .. maybe these would explain how the above traffic situation happens.

Some belkin made binaries like sysinit that do most of the init and firewall stuff as I see inside the binary, are supplied in just binary format with no source code, which sort of makes sense, but this prevents me from knowing exactly what the firmware does extra..

Oh well..