SMC SMCWEBS-N

  • 802.11bgn
  • integrated 4 port 10/100 MBit/s switch

Supported Versions

Unsupported at the moment

Hardware Highlights

CPU Ram Flash Network USB Serial JTag
RT3052 @ 384 MHz 16 MiB 4 MiB (?) 4x 10/100 MBit/s Optional (?) Yes ?

Flash Layout

0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x00120000 : "Kernel"
0x00120000-0x00400000 : "RootFS"

Installation

Should be possible via OEM web interface, it does not check for any vendor specific. Or via TFTP and serial console (u-boot, press 2 and enter the requested informations).

Specific Configuration

Interfaces

The default network configuration is:

Interface Name Description Default configuration
eth2 LAN ports (1 to 4) 192.168.2.10/24
eth2.1 (VLAN for router setup ?) None
eth2.2 (VLAN for router setup ?) None
ra0 WiFi Disabled

Hardware

Info

Architecture: MIPS
Vendor: Ralink
Bootloader: U-Boot
System-On-Chip: RT3052 - Ralink SoC - MIPS 24K V4.12
CPU/Speed 384 Mhz
Flash-Chip: unkown
Flash size: 4096 KiB (?)
RAM: 16 MiB
Wireless: rt2860v2 2.4ghz 802.11bgn
Ethernet: 10/100 Mbit/s w/ vlan support
USB: Not populated
Serial: Yes
JTAG: Not populated

Photos

Model Number

Front:

Back:

**Photo of back of the casing**

Opening the case

Note: This will void your warranty!

  • To remove the cover remove the 4 rubber feets, below you will find the screws.

Bottom

Main PCB

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

**Photo of PCB with markings**

Configure your RS-232 to 115200,8,N,1. I have used an old telephone USB adapter cable WITHOUT TTL level converter. With Maxim 3232 TTL to RS-232 and a real RS-232 on my computer it did NOT work.

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

I think that the unpopulated pins on the right could be a JTAG, but I don't know.

U-Boot (original)

RT3052 # version

U-Boot 1.1.3 (Feb 10 2010 - 17:15:24)


RT3052 # printenv
bootcmd=tftp
bootdelay=5
baudrate=115200
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=10.10.10.123
serverip=10.10.10.3
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
kernel_addr=BFC40000
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
stdin=serial
stdout=serial
stderr=serial
ethact=Eth0 (10/100-M)


RT3052 # printenv
bootcmd=tftp
bootdelay=5
baudrate=115200
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=10.10.10.123
serverip=10.10.10.3
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
kernel_addr=BFC40000
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
stdin=serial
stdout=serial
stderr=serial
ethact=Eth0 (10/100-M)

Device Boot (original)

Total memory: 16 MBytes
Flash component: NOR Flash
Date:Feb 10 2010  Time:17:15:24
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384

 ##### The CPU freq = 384 MHZ ####

SDRAM bus set to 16 bit
 SDRAM size =16 Mbytes

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 3
                                                                                                                           0

3: System Boot system code via Flash.
## Booting image at bf050000 ...
   Image Name:   Linux Kernel Image-V0.0.0.9
   Created:      2010-02-10  10:13:23 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3329984 Bytes =  3.2 MB
   Load Address: 80000000
   Entry Point:  8025c000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8025c000) ...
## Giving linux memsize in MB, 16

Starting kernel ...


LINUX started...

 THIS IS ASIC - AWB
Linux version 2.6.21 (root@FedoraCore4) (gcc version 3.4.2) #1 Wed Feb 10 17:24:16 CST 2010

 The CPU feqenuce set to 384 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 4064
Kernel command line: console=ttyS1,115200n8 root=/dev/mtdblock4
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 8080003c, status = 1100ff00
PID hash table entries: 64 (order: 6, 256 bytes)
calculating r4koff... 00177000(1536000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13612k/16384k available (2147k kernel code, 2772k reserved, 265k data, 116k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered (default)
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
rdm_major = 254
PPP generic driver version 2.4.2
PPP BSD Compression module registered
NET: Registered protocol family 24
ralink flash device: 0x400000 at 0x1fc00000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 5 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x00120000 : "Kernel"
0x00120000-0x00400000 : "RootFS"
block2mtd: version $Revision: 1.1.1.1 $
nf_conntrack version 0.5.0 (128 buckets, 1024 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Fully Cone
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.00  256 rx/tx descriptors allocated, mtu = 1500!
GDMA1_MAC_ADRH -- : 0x00000022
GDMA1_MAC_ADRL -- : 0x2dcc05fa
PROC INIT OK!
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 116k freed
init started: BusyBox v1.12.1 (2010-02-10 18:11:48 CST)
starting pid 13, tty '': '/etc_ro/rcS'
Algorithmics/MIPS FPU Emulator v1.5
devpts: called with bogus options
mount: mounting none on /proc/bus/usb failed: No such file or directory
starting pid 21, tty '/dev/ttyS1': '/bin/sh'


BusyBox v1.12.1 (2010-02-10 18:11:48 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# echo "uuid=75802409-bccb-40e7-0c43-00222dcc05fb" > /etc/uuid.dat
echo "serial=75802409" > /etc/serial.dat
internet.sh
Password for 'admin' changed
insmod: bridge.ko: module not found
insmod: mii.ko: module not found
insmod: raeth.ko: module not found

phy_tx_ring = 0x00818000, tx_ring = 0xa0818000

phy_rx_ring = 0x00000000, rx_ring = 0x00000000
RT305x_ESW: Link Status Changed
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 710000
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
rmmod: rt2860v2_ap: No such file or directory
rmmod: rt2860v2_sta: No such file or directory
Commit crc = e18879af
rt2860v2_ap: module license 'unspecified' taints kernel.


=== pAd = c0002000, size = 494240 ===

<-- RTMPAllocAdapterBlock, Status=0
rmmod: nf_nat_pptp: No such file or directory
rmmod: nf_conntrack_pptp: No such file or directory
rmmod: nf_nat_proto_gre: No such file or directory
rmmod: nf_conntrack_proto_gre: No such file or directory
RX DESC a0b09000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff ff 00 00 00
Main bssid = 00:00:00:00:00:00
<==== rt28xx_init, Status=0
0x1300 = 00064380
insmod: 8021q.ko: module not found
eth2.2: Setting MAC address to  00 00 00 00 00 00.
device eth2 entered promiscuous mode
VLAN (eth2.2):  Setting underlying device (eth2) to promiscious mode.
ifconfig: ioctl 0x8913 failed: No such device
brctl: bridge br0: No such device or address
device ra0 entered promiscuous mode
##### restore RT3052 to dump switch #####
switch reg write offset=14, value=5555
switch reg write offset=40, value=1001
switch reg write offset=44, value=1001
switch reg write offset=48, value=1001
switch reg write offset=4c, value=1
switch reg write offset=50, value=2001
switch reg write offset=70, value=ffffffff
switch reg write offset=98, value=7f7f
switch reg write offset=e4, value=7f
br0: port 2(eth2) entering learning state
br0: port 1(ra0) entering learning state
route: ioctl 0x890c failed: No such process
br0: port 2(eth2) entering disabled state
br0: port 1(ra0) entering disabled state
br0: port 2(eth2) entering learning state
br0: port 1(ra0) entering learning state
route: ioctl 0x890c failed: No such process
BusyBox v1.12.1 (2010-02-10 18:11:48 CST) multi-call binary

Usage: route [{add|del|delete}]

ifconfig: ioctl 0x8914 failed: Cannot assign requested address
ifconfig: ioctl 0x8914 failed: Cannot assign requested address
ifconfig: ioctl 0x8913 failed: No such device
Interface br0 specified more than once.
EU
Commit crc = e18879af
echo "1024 65000" >/proc/sys/net/ipv4/ip_local_port_range
echo "4096" > /proc/sys/net/ipv4/netfilter/ip_conntrack_max
echo "600" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established
echo "10" > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout_stream
killall rt2860apd 1>/dev/null 2>&1
ddns.sh
route delete 239.255.255.250 1>/dev/null 2>&1
killall wscd 1>/dev/null 2>&1
killall -9 wscd 1>/dev/null 2>&1
iwpriv ra0 set WscConfMode=0 1>/dev/null 2>&1
killall -q klogd
killall -q syslogd
syslogd -C8 1>/dev/null 2>&1
klogd 1>/dev/null 2>&1
killall -q zebra
killall -q ripd
/bin/qos_run
killall -q ntpclient
echo GMT-1 > /etc/TZ
ntpclient -s -c 0 -h ntp2.ptb.de -i 259200 &
ntp2.ptb.de: Unknown host
webs: Listening for HTTP requests at address 192.168.100.119
br0: topology change detected, propagating
br0: port 2(eth2) entering forwarding state
br0: topology change detected, propagating
br0: port 1(ra0) entering forwarding state

Other Info

With the original firmware you have access to a limited Linux shell (root privileges).

# cat cpuinfo
system type             : Ralink SoC
processor               : 0
cpu model               : MIPS 24K V4.12
BogoMIPS                : 255.48
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes
ASEs implemented        : mips16 dsp
VCED exceptions         : not available
VCEI exceptions         : not available

# cat mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "Bootloader"
mtd1: 00010000 00010000 "Config"
mtd2: 00010000 00010000 "Factory"
mtd3: 000d0000 00010000 "Kernel"
mtd4: 002e0000 00010000 "RootFS"

Just a try to boot OpenWrt

## Booting image at bf050000 ...
   Image Name:   MIPS OpenWrt Linux-2.6.39.2
   Created:      2011-08-14  19:48:37 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    805038 Bytes = 786.2 kB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 16

Starting kernel ...

Linux version 2.6.39.2 (user@tux) (gcc version 4.5.4 20110526 (prerelease) (Linaro GCC 4.5-2011.06-0) ) #2 Sun Aug 14 21:47:22 CEST 2011
bootconsole [early0] enabled
CPU revision is: 0001964c (MIPS 24Kc)
Ralink RT3052   id:1 rev:3 running at 384.00 MHz
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00001000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00001000
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
Kernel command line:  board=smcwebs-n mtdparts=physmap-flash.0:192k(u-boot)ro,64k(u-boot-env)ro,64k(factory)ro,832k(kernel),7040k(rootfs),7872k@0x50000(firmware) console=ttyS1,115200 rootfstype=squashfs,jffs2
PID hash table entries: 64 (order: -4, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=00073c2f
Readback ErrCtl register=00073c2f
Memory: 13780k/16384k available (1849k kernel code, 2604k reserved, 315k data, 152k init, 0k highmem)
SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:48
console [ttyS1] enabled, bootconsole disabled
console [ttyS1] enabled, bootconsole disabled
Calibrating delay loop... 255.59 BogoMIPS (lpj=1277952)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
MIPS: machine is La Fonera 2.0N
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 26
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 13) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
physmap platform flash device: 00800000 at bf000000
physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022a8
Amd/Fujitsu Extended Query Table at 0x0040
  Amd/Fujitsu Extended Query version 1.1.
number of CFI chips: 1
mtd: physmap-flash.0: partitioning exceeds flash size, truncating
4 cmdlinepart partitions found on MTD device physmap-flash.0
Creating 4 MTD partitions on "physmap-flash.0":
0x000000000000-0x000000030000 : "u-boot"
0x000000030000-0x000000040000 : "u-boot-env"
0x000000040000-0x000000050000 : "factory"
0x000000050000-0x000000120000 : "kernel"
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Cannot open root device "(null)" or unknown-block(0,0)
Please append a correct "root=" boot option; here are the available partitions:
1f00             192 mtdblock0  (driver?)
1f01              64 mtdblock1  (driver?)
1f02              64 mtdblock2  (driver?)
1f03             832 mtdblock3  (driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

Back to top

inbox/smc.smcwebs-n.txt · Last modified: 2011/08/23 21:33 (external edit)