Table of Contents
Planex MZK-W04N-XX
CPU: Ralink RT2880F RAM: 32MB Flash: 8MB Wi-Fi: Ralink RT2860 (maybe RT2820 - hard to see) 802.11N, 3 antennas look to be non-removable Switch: IC+ IP175C 4LAN+1WAN 10/100
Serial console
Serial console is available at 57600 8n1 on J1 (I had to desolder / solder a 0.1" pin header), pinout:
1: VCC (closest to edge of board) (?) 2: RXD (data from PC to router) 3: GND 4: TXD (Data from router to PC)
Bootlog
U-Boot 1.1.3 (Nov 15 2007 - 14:37:24)
Board: RT2880 DRAM: 32 MB
twe0 set to <NULL>
toe0 set to <NULL>
flash_protect ON: from 0xBC400000 to 0xBC42B097
protect on 0
protect on 1-------------------------------------------------------------------
protect on 2 <ESC> Exit <Enter> Enter
flash_protect ON: from 0xBC430000 to 0xBC43FFFF
protect on 3
*** Warning - bad CRC, using default environment
============================================
ASIC -VerB/C (MAC to Phy Mode)
DRAM COMPONENT=128Mbits
DRAM BUS=32BIT
Total memory = 32Mbytes
Date:Nov 15 2007 Time:14:37:24
============================================
D-CACHE set to 4 way
I-CACHE set to 4 way
##### The CPU freq = 266 MHZ ####
SDRAM bus set to 32 bit
SDRAM size =32 Mbytes
Please choose the operation:
0: Load ucos code to SDRAM via TFTP Client.
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
5: Load ucos code to SDRAM via TFTP. 0
3: System Boot system code via Flash.
## Booting image at bc450014 ...
Image Name: Linux Kernel Image
Created: 2008-01-30 8:40:50 UTC
System Control Status = 0x02110084
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2531244 Bytes = 2.4 MB
Load Address: 8a000000
Entry Point: 881b0040
Verifying Checksum ... OK
Uncompressing Kernel Image ...
No initrd
## Transferring control to Linux (at address 881b0040) ...
## Giving linux memsize in MB, 32
Starting kernel ...
THIS IS ASIC
ramsize = 32 MBytes
rambase not set, set to default (0x08000000)
MEMORY DESCRIPTOR dump:
[0,88239940]: base<08000000> size<02000000> type<Free RAM memory>
The CPU feqenuce set to 266 MHz
CPU revision is: 0001906c
icache: sets:256, ways:4, linesz:16 ,total:16384, waybit:12, flags:0x0
dcache: sets:256, ways:4, linesz:16 ,total:16384, waybit:12, flags:0x0
i waysize = 4096, d waysize = 4096, i sets= 256, d sets=256
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 4-way, linesize 16 bytes.
[setup_scache]:1032
Linux version 2.4.30 (root@localhost.localdomain) (gcc version 3.3.6) #636 ä¸ 1æ 30 16:40:47 CST 2008
Determined physical RAM map:
memory: 02000000 @ 08000000 (usable)
On node 0 totalpages: 40960
zone(0): 40960 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4
cause = c0c08268, status = 1000e700
calculating r4koff... 00144b50(1330000)
CPU frequency 133.00 MHz
Using 133.000 MHz high precision timer.
Calibrating delay loop... 265.42 BogoMIPS
Memory: 28712k/32768k available (1713k kernel code, 4056k reserved, 112k data, 96k init, 0k highmem)
Dentry cache hash table entries: 32768 (order: 6, 262144 bytes)
Inode cache hash table entries: 16384 (order: 5, 131072 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 8192 (order: 3, 32768 bytes)
Page-cache hash table entries: 65536 (order: 6, 262144 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
pci.c pcibios_init():840
BAR0 at slot 0 = 8
pci.c pcibios_fixup_resources():640
bus = 0, dev = 0, fun = 0
dev= 0x883fcc00
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
pty: 256 Unix98 ptys configured
LED & GPIO & LAN Status Driver LED_VERSION
spidrv_major = 217
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0x300500 (irq = 9) is a 16550A
ttyS01 at 0x300c00 (irq = 8) is a 16550A
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
RA2880 Ethernet Driver Initilization. v1.01 256 rx/tx descriptors allocated!
Netlink init ok!
PROC INIT OK!
ICPLUS 175C config LAN_WAN finished (evaluation board)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
FLASH_API: MAN_ID=C2 DEV_ID=22A8 SIZE=4MB
physmap flash device: 800000 at 1c400000
Amd/Fujitsu Extended Query Table v1.1 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Using physmap partition definition
Creating 7 MTD partitions on "RT2880 SOC Physically mapped flash":
0x00000000-0x00030000 : "Bootloader"
mtd: Giving out device 0 to Bootloader
0x00030000-0x00040000 : "Config "
mtd: Giving out device 1 to Config
0x00040000-0x00050000 : "Factory"
mtd: Giving out device 2 to Factory
0x00050000-0x00110000 : "Kernel"
mtd: Giving out device 3 to Kernel
0x00110000-0x003e0000 : "RootFS"
mtd: Giving out device 4 to RootFS
0x003e0000-0x00400000 : "Cimage"
mtd: Giving out device 5 to Cimage
0x00050000-0x003e0000 : "Uimage"
mtd: Giving out device 6 to Uimage
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 1024 buckets, 8Kbytes
TCP: Hash tables configured (established 16384 bind 32768)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (1280 buckets, 10240 max) - 316 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team, Type=Restricted Cone
ipt_random match loaded
netfilter PSD loaded - (c) astaro AG
ipt_recent v0.3.1: Stephen Frost <sfrost@snowman.net>. http://snowman.net/projects/ipt_recent/
ipt_IPV4OPTSSTRIP loaded
arp_tables: (C) 2002 David S. Miller
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Load RT2880 Timer Module(Wdg/Soft)
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing prom memory: 0kb freed
Freeing unused kernel memory: 96k freed
console started
trying to start /sbin/init
Algorithmics/MIPS FPU Emulator v1.5
insmod: /lib/modules/2.4.30: No such file or
Please press Enter to activate this console. Sat Jan 1 00:00:00 UTC 2000
mount: Mounting /proc on /proc failed: Device or resource busy
IC-Plus PHY Init...ok
GDMA1_FWD_CFG = 10000
DSP_EN OFF version driver
phy_tx_ring = 09afe000, tx_ring = a9afe000, size: 16 bytes
phy_rx_ring = 09afd000, rx_ring = a9afd000, size: 16 bytes
ra2880stop()...Done
Free TX/RX Ring Memory!
IC-Plus PHY Init...ok
GDMA1_FWD_CFG = 10000
DSP_EN OFF version driver
phy_tx_ring = 09afc000, tx_ring = a9afc000, size: 16 bytes
phy_rx_ring = 09afb000, rx_ring = a9afb000, size: 16 bytes
eth2.1: Setting MAC address to 00 90 cc f7 6d 04.
VLAN (eth2.1): Underlying device (eth2) has same MAC, not checking promiscious mode.
eth2.2: Setting MAC address to 00 90 cc f7 6d 05.
device eth2 entered promiscuous mode
VLAN (eth2.2): Setting underlying device (eth2) to promiscious mode.
killall: pptp.sh: no process killed
killall: pppoe.sh: no process killed
Initialize WLAN interface
Using /bin/rt2860ap.o
2860 version : v1.6.0.0 (2007/10/12)
=== pAd = c00ff000, size = 465104 ===
<-- RTMPAllocAdapterBlock, Status=0
RX DESC a9876000 size = 2048
<-- RTMPAllocDMAMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff ff 00 00 00
Main bssid = 00:90:cc:f7:6d:04
The UUID Hex string is:2880288028801880a8800090ccf76d04
The UUID ASCII string is:28802880-2880-1880-a880-0090ccf76d04!
<==== RTMPInitialize, Status=0
0x1300 = 00064300
Setup BRIDGE interface
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
bridge br0 doesn't exist; can't delete it
Setup bridge...
device eth2.1 entered promiscuous mode
eth2.1: dev_set_promiscuity(master, 1)
SIOCDELRT: No such process
device ra0 entered promiscuous mode
ra0: attempt to add interface with same source address.
SIOCDELRT: No such process
br0: port 2(ra0) entering learning state
br0: port 1(eth2.1) entering learning state
br0: port 2(ra0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth2.1) entering forwarding state
br0: topology change detected, propagating
SIOCDELRT: No such process
SIOCDELRT: No such process
------> 802.1x--------->Enter
------> 802.1x------>Exit
Static DHCP Leases disable!
SIOCDELRT: No such process
udhcpd (v0.9.9-pre) started
Setup WAN interface
device eth2 is not a slave of br0
device eth2.1 is already a member of a bridge; can't enslave it to bridge br0.
Set: phy[29].reg[23] = 07c2
Set: phy[29].reg[22] = 8420
Set: phy[29].reg[24] = 0001
Set: phy[29].reg[25] = 0001
Set: phy[29].reg[26] = 0001
Set: phy[29].reg[27] = 0001
Set: phy[29].reg[28] = 0002
Set: phy[30].reg[9] = 1089
Set: phy[30].reg[1] = 2f00
Set: phy[30].reg[2] = 0030
don't create flash.inc
********** run Diagd **********
********** run GaTest **********
=================Enable WSC_UPNP===================
=================Enable WSC_UPNP===================
udhcp client (v0.9.9-pre) started
don't create flash.inc
=================Enable LLTD===================
into eth2.2.deconfig
killall: lld2d: no process killed
killall: snmpd: no process killed
=================END LLTD===================
=================Enable GPIO Interrupt================
gPassiveMsgQ Init success! gPassiveMsgID=0x386d4390!
gActiveMsgQ Init success!
ralink_gpio:ioctl GPIO REG
ralink_gpio:ioctl GPIO REG
=================END GPIO Interrupt===================
rm: cannot remove `/tmp/agentenabledflag': No such file or directory
/bin/init.sh: 484: /bin/agent: not found
sock=5!(0x0x7fff7d00)
Create netlink socket thread success!
Create ioctl socket(6) success!
Pthread(wscDevNLHandle)Now waiting for the netlink socket incoming message!
ip_table: set wan_name=eth2.2
Using /lib/modules/2.4.18-MIPS/RT2880/sw_nat.o
insmod: unresolved symbol ra_sw_nat_hook_tx
insmod: unresolved symbol ra_sw_nat_hook_rx
@@@@@@ SSDP_PORT = 1900
UPnP Initialized
IP-Addr: 192.168.1.1 Port: 49152
HW-Addr: 00:90:cc:f7:6d:04!
Specifying the webserver root directory -- /etc/xml
UUID Str=uuid:28802880-2880-1880-a880-0090ccf76d04!
alloc memory size=1050!
<?xml version="1.0" encoding="utf-8"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">
<specVersion>
<major>1</major>
<minor>0</minor>
</specVersion>
<device>
<deviceType>urn:schemas-wifialliance-org:device:WFADevice:1</deviceType>
<friendlyName>11N_Router</friendlyName>
<manufacturer>.</manufacturer>
<manufacturerURL>.</manufacturerURL>
<modelDescription>AP WSC device</modelDescription>
<modelName>Wireless Router</modelName>
<modelNumber>BR6524N</modelNumber>
<modelURL>.</modelURL>
<serialNumber>12345678</serialNumber>
<UDN>uuid:28802880-2880-1880-a880-0090ccf76d04</UDN>
<serviceList>
<service>
<serviceType>urn:schemas-wifialliance-org:service:WFAWLANConfig:1</serviceType>
<serviceId>urn:wifialliance-org:serviceId:WFAWLANConfig1</serviceId>
<SCPDURL>WFAWLANConfigSCPD.xml</SCPDURL>
<controlURL>control</controlURL>
<eventSubURL>event</eventSubURL>
</service>
</serviceList>
</device>
</root>
Registering the RootDevice
with descDocUrl: http://192.168.1.1:49152/description.xml
RootDevice Registered
WscLocalDevice:
Device:
FriendlyName=11N_Router!
DescDocURL=http://192.168.1.1:49152/description.xml!
UDN=uuid:28802880-2880-1880-a880-0090ccf76d04!
PresURL=!
Service:
servIdStr=urn:wifialliance-org:serviceId:WFAWLANConfig1!
servTypeStr=urn:schemas-wifialliance-org:service:WFAWLANConfig:1!
scpdURL=http://192.168.1.1:49152/WFAWLANConfigSCPD.xml!
eventURL=http://192.168.1.1:49152/event!
controlURL=http://192.168.1.1:49152/control!
WscLocalDeviceInit Initialized
killall: radiusd: no process killed
RADIUS server disable !!
And then boots to some lame GUI-ish login program…
Discussion
So I ordered a MZK-W04N instead of the USB equipped MZK-W04NU … The MZK-W04N is a totally different beast. Oops.
I haven't been able to find GPL source for this thing, but it def is running U-Boot and Linux. Seems similar to the Asus RT-N15, Belkin F5D8235-4, Linksys WRT-160N, etc.
===== UPDATE 10/jun/2010 ======
Planex (PCi) W04n-XX is IDENTICAL to Edimax 6524N router. The only difference is ROM & RAM sizes.
How to flash without serial cable: Configure your PC with static IP address between 192.168.1.2 and 192.168.1.5 (ex. 192.168.1.2). Connect your pc to mzk-w04n-xx port 1. Remove the power cable from the router. Press and hold reset button, while inserting the power cable, hold pressing the reset for 10 seconds. Now w04n-xx is accepting tftp flashing on fixed IP 192.168.1.6.
Enjoy. By RyLoS (you can reach me on rylos78@gmail.com) Press and keep pressed th
inbox/mzk-w04n.txt · Last modified: 2012/07/29 10:51 by orca