Sitecom WL-4001

Currently there is no support for this device.

Hardware info

Architecture: Lexra RLX5281
Vendor: Realtek
Bootloader: RTL-boot
System-On-Chip: Realtek RTL8198
CPU Speed: 620 MHz
Flash Chip:MXIC 25L3206E
Flash size: 4MB
RAM chip: V59C1512164QDJ25A
RAM size: 64M (?)
Wireless: Ralink RTL8192CE
Ethernet: Ralink RTL8198 Gigabit (integrated)
USB: No
Serial: Yes
JTAG: Yes
Power supply: 12V 1A

Note: Realtek RLX5281 core seems to be an improvement over Lexra LX5280.

Opening the case

  1. There are four screws, below the rubber feet of the device.

Board images

The pin header on the serial port J13 in the picture was soldered on, it did not ship with one.

Serial

Console port J13 uses 3.3 V signaling at speed 57600 8n1. Header is not installed.

1 2 3 4
Vcc GND TX RX
J13

JTAG

It seems there a a couple of tiny solder pads (TP3 - TP8) connected to the JTAG pins on the chip, but this has not been tried yet.

Stock firmware startup log

Booting...SDRAM CLOCK:78MHZ

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
@       0h  c22016h      c2h      20h      16h       0h      16h  400000h
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
@   10000h      40h    1000h     400h     100h      10h      27h MX25L3205D
@ 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

=======RTL-boot(RTL8198) Ver:1.0.5.5 2011/01/19=======
Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 

---(RTL8198)at 2011.01.19-14:47+0800 version v1.1g [16bit](620MHz)
New Header
Jump to image start=0x80500000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x800034e0
RTL8192C/RTL8188C driver version 1.4 (2011-02-16)
[PCIE_0] Device:Vender ID=819110ec
init started: BusyBox v1.7.5 (2011-05-19 17:58:26 CST)
starting pid 14, tty '/dev/console': '/sbin/config_init'
Config Init version: 1.0.0.22 date: 2011/05/19
starting pid 69, tty '/dev/ttyS0': '/sbin/config_term'
************************************************************************
*                                 WLR-4001                             *
************************************************************************

KernelApp/Ramdisk Ver:1.0.0.22                   Date:2011/05/19
console> cat: can't open '/apps/lib/modules/2.6.30/modulesApp.dep': No such file or directory
ln: /sbin/./apps_init: File exists
You are using 8192C

Serial console

After boot, you get the "console>" promt, from the config_term program. I'm not sure what this does but apparently it needs a password to give you terminal. Trying the "sn2450" password (taken from eap-9550) seems to work and gives a shell:

************************************************************************
*                                 WLR-4001                             *
************************************************************************

KernelApp/Ramdisk Ver:1.0.0.22			 Date:2011/05/19
console> sn2450


BusyBox v1.7.5 (2011-05-19 17:58:26 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# cat /proc/cpuinfo 
system type		: RTL8198
processor		: 0
cpu model		: 56322
BogoMIPS		: 619.31
tlb_entries		: 32
mips16 implemented	: yes

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00008000 00001000 "Bootloader"
mtd1: 00002000 00001000 "caldata"
mtd2: 00006000 00001000 "Config"
mtd3: 003c8000 00001000 "Kernel"
mtd4: 002bf000 00001000 "app"
mtd5: 0000c000 00001000 "manufacture"
mtd6: 00010000 00001000 "backup"
mtd7: 0000c000 00001000 "storage"

# cat /proc/devices 
Character devices:
  1 mem
  2 pty
  3 ttyp
  4 ttyS
  5 /dev/tty
  5 /dev/console
 10 misc
 90 mtd
108 ppp

Block devices:
259 blkext
  7 loop
 31 mtdblock

# burn
USAGE: burn [type]
       burn [type] [vendor]
       burn [type] [local IP] [server IP]
       burn [type] [vendor] [local IP] [server IP]
type :
     b:bootloader
     k:kernel
     a:app
     A:cb-app
     f:factory
vendor :
     ESR-9753, ESR-9753-SC ...
local IP :
     192.168.99.9
server IP :
     192.168.99.8

# uname -a
Linux localhost.localdomain 2.6.30.10 #2 Thu May 19 17:59:41 CST 2011 rlx unknown

# cd /proc/
# ls
597                   mounts                partitions
590                   net                   gpio
589                   sysvipc               gpio_info
583                   fs                    wps
575                   driver                wlan0
540                   tty                   wlan0-va0
533                   bus                   wlan0-va1
530                   sys                   wlan0-va2
526                   irq                   custom_Passthru_wlan
524                   misc                  eth0
418                   execdomains           eth1
416                   ioports               eth2
414                   iomem                 eth3
229                   timer_list            eth4
226                   buddyinfo             phyRegTest
224                   pagetypeinfo          rtk_vlan_support
167                   vmstat                br_mldsnoop
69                    zoneinfo              senao
50                    vmallocinfo           mtd
35                    slabinfo              hw_nat
11                    filesystems           qos
10                    cmdline               filter_table
9                     cpuinfo               fast_pptp
8                     devices               pptp_conn_ck
7                     interrupts            fast_l2tp
6                     loadavg               fast_nat
5                     meminfo               br_wlanblock
4                     stat                  br_igmpsnoop
3                     uptime                br_mCastFastFwd
2                     version               br_igmpquery
1                     crypto                br_mldquery
self                  diskstats             br_igmpProxy
# lsmod
lsmod: can't open '/proc/modules': No such file or directory
# cat /proc/meminfo 
MemTotal:          59044 kB
MemFree:           45952 kB
Buffers:            1020 kB
Cached:             4244 kB
SwapCached:            0 kB
Active:             2548 kB
Inactive:           3924 kB
Active(anon):       1208 kB
Inactive(anon):        0 kB
Active(file):       1340 kB
Inactive(file):     3924 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          1216 kB
Mapped:             1212 kB
Slab:               5324 kB
SReclaimable:        368 kB
SUnreclaim:         4956 kB
PageTables:          244 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       29520 kB
Committed_AS:       2832 kB
VmallocTotal:    1048404 kB
VmallocUsed:         864 kB
VmallocChunk:    1043096 kB

# cat /proc/mounts 
rootfs / rootfs rw 0 0
/proc /proc proc rw,relatime 0 0
/dev/mtdblock7 /storage jffs2 rw,relatime 0 0
/dev/mtdblock4 /apps squashfs ro,relatime 0 0
/dev/loop0 /appscore squashfs ro,relatime 0 0

# netsat -ln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:52881           0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      
udp        0      0 192.168.0.1:35744       0.0.0.0:*                           
udp        0      0 0.0.0.0:53              0.0.0.0:*                           
udp        0      0 0.0.0.0:67              0.0.0.0:*                           
udp        0      0 0.0.0.0:1900            0.0.0.0:*                           
raw        0      0 0.0.0.0:255             0.0.0.0:*               7           
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path
unix  2      [ ACC ]     STREAM     LISTENING     381    /tmp/log_socket
unix  2      [ ACC ]     STREAM     LISTENING     695    /tmp/wan_socket

# iptables -n -v -L
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  140 11410 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 synflood   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state 
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state 
    0     0 DROP       all  --  *      *       192.168.0.1          0.0.0.0/0           
    0     0 ACCEPT     udp  --  br0    *       0.0.0.0/0            0.0.0.0/0           udp 
    0     0 ACCEPT     tcp  --  br0    *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       all  --  br0    *       0.0.0.0/0            0.0.0.0             
    0     0 DROP      !udp  --  *      *       0.0.0.0/0            224.0.0.0/4         
    0     0 ACCEPT     tcp  --  br0    *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 ACCEPT     udp  --  br0    *       0.0.0.0/0            0.0.0.0/0           udp 
    0     0 ACCEPT     udp  --  br0    *       0.0.0.0/0            0.0.0.0/0           udp 
    0     0 ACCEPT     udp  --  br0    *       192.168.0.0/24       0.0.0.0/0           udp 
    0     0 DROP       icmp -f  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp 
    0     0 bad-ping   icmp --  br0    *       0.0.0.0/0            0.0.0.0/0           icmp 
    0     0 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp 
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state 
    0     0 DROP       all  --  *      *       192.168.0.1          0.0.0.0/0           
    0     0 DROP       all  --  br0    *      !192.168.0.0/24       0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            255.255.255.255     
    0     0 DROP      !udp  --  *      *       0.0.0.0/0            224.0.0.0/4         
    0     0 DROP       icmp -f  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp 
    0     0 ACCEPT     icmp --  *      br0     0.0.0.0/0            192.168.0.1         icmp 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp 
    0     0 ACCEPT     icmp --  *      br0     0.0.0.0/0            192.168.0.1         icmp 
    0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  140 11410 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state 
    0     0 DROP       all  --  *      br0    !192.168.0.1          0.0.0.0/0           
    0     0 ACCEPT     udp  --  *      br0     0.0.0.0              255.255.255.255     udp 
    0     0 DROP       icmp -f  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp 
    0     0 ACCEPT     icmp --  *      br0     0.0.0.0/0            192.168.0.1         icmp 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp 
    0     0 DROP       icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp state 
   18  5292 ACCEPT     all  --  *      br0     192.168.0.1          0.0.0.0/0           

Chain bad-ping (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp limit 
    0     0 DROP       icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp 

Chain synflood (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp limit 
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           

# iptables -t nat -n -v -L
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       tcp  --  br0    *       0.0.0.0/0            192.168.0.1         tcp 
    0     0 DNAT       tcp  --  br0    *       0.0.0.0/0            192.168.0.1         tcp 

Chain POSTROUTING (policy ACCEPT 17 packets, 988 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 17 packets, 988 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Bootloader

It seems the bootloader also has a commandline, but I'm not really sure if it's useful. You can get to the prompt by (repeatedly) pressing "1" during boot (though it seems other prompts also work).

Booting...SDRAM CLOCK:78MHZ

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
@       0h  c22016h      c2h      20h      16h       0h      16h  400000h
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
@   10000h      40h    1000h     400h     100h      10h      27h MX25L3205D
@ 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

=======RTL-boot(RTL8198) Ver:1.0.5.5 2011/01/19=======
Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 

---(RTL8198)at 2011.01.19-14:47+0800 version v1.1g [16bit](620MHz)
New Header
User Press [1]

---Escape booting by user
Set GPHY Parameter OK

---Ethernet init Okay!
<Senao Networks>11
Unknown command !
<Senao Networks>help
----------------- COMMAND MODE HELP ------------------
HELP (?)                                    : Print this help message
D <Address> <Len>
IPCONFIG:<TargetAddress>
EEE :Set EEE Patch 
<Senao Networks>ipconfig
 Target Address=192.168.99.9
   Http Address=192.168.99.9
<Senao Networks>eee
Writing EEE pattern 00001170 records 
<Senao Networks>d 0 1
80000000:       5A5AA5A5        3C1B8036        8F7B4000        001AD582
<Senao Networks>d 0 10
80000000:       5A5AA5A5        3C1B8036        8F7B4000        001AD582
80000010:       001AD080        037AD821        401A2000        8F7B0000
80000020:       335A0FFC        037AD821        8F7A0000        00000000

I'm not sure what the eee command does, it seems my firmware is still booting normally after I tried it (phew!).

Notes

The licensing documentation in the box promises that GPL sources are available on the Sitecom site (under driver downloads), but there are no downloads listed thereā€¦

Back to top

toh/sitecom/wl-4001.txt · Last modified: 2014/03/15 18:44 by pteridium