Table of Contents
Sitecom WL-4001
Currently there is no support for this device.
Hardware info
| Architecture: MIPS (RLX?) |
| Vendor: Realtek |
| Bootloader: RTL-boot |
| System-On-Chip: Realtek RTL8198 |
| CPU Speed: ? |
| Flash Chip:MXIC 25L3206E |
| Flash size: 4MB |
| RAM chip: V59C1512164QDJ25A |
| RAM size: 64M (?) |
| Wireless: Ralink RTL8192CE |
| Ethernet: Ralink RTL8198 Gigabit (integrated) |
| USB: No |
| Serial: Yes |
| JTAG: Yes |
| Power supply: 12V 1A |
Opening the case
- There are four screws, below the rubber feet of the device.
Board images
The pin header on the serial port J13 in the picture was soldered on, it did not ship with one.
Serial
Console port J13 uses 3.3 V signaling at speed 57600 8n1. Header is not installed.
| 1 | 2 | 3 | 4 | ||
| Vcc | GND | TX | RX | ||
| J13 | |||||
JTAG
It seems there a a couple of tiny solder pads (TP3 - TP8) connected to the JTAG pins on the chip, but this has not been tried yet.
Stock firmware startup log
Booting...SDRAM CLOCK:78MHZ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize @ 0h c22016h c2h 20h 16h 0h 16h 400000h @ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName @ 10000h 40h 1000h 400h 100h 10h 27h MX25L3205D @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ =======RTL-boot(RTL8198) Ver:1.0.5.5 2011/01/19======= Please choose the operation: 1: Load system code to SDRAM via TFTP. ---(RTL8198)at 2011.01.19-14:47+0800 version v1.1g [16bit](620MHz) New Header Jump to image start=0x80500000... decompressing kernel: Uncompressing Linux... done, booting the kernel. done decompressing kernel. start address: 0x800034e0 RTL8192C/RTL8188C driver version 1.4 (2011-02-16) [PCIE_0] Device:Vender ID=819110ec init started: BusyBox v1.7.5 (2011-05-19 17:58:26 CST) starting pid 14, tty '/dev/console': '/sbin/config_init' Config Init version: 1.0.0.22 date: 2011/05/19 starting pid 69, tty '/dev/ttyS0': '/sbin/config_term' ************************************************************************ * WLR-4001 * ************************************************************************ KernelApp/Ramdisk Ver:1.0.0.22 Date:2011/05/19 console> cat: can't open '/apps/lib/modules/2.6.30/modulesApp.dep': No such file or directory ln: /sbin/./apps_init: File exists You are using 8192C |
Serial console
After boot, you get the "console>" promt, from the config_term program. I'm not sure what this does but apparently it needs a password to give you terminal. Trying the "sn2450" password (taken from eap-9550) seems to work and gives a shell:
************************************************************************
* WLR-4001 *
************************************************************************
KernelApp/Ramdisk Ver:1.0.0.22 Date:2011/05/19
console> sn2450
BusyBox v1.7.5 (2011-05-19 17:58:26 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
# cat /proc/cpuinfo
system type : RTL8198
processor : 0
cpu model : 56322
BogoMIPS : 619.31
tlb_entries : 32
mips16 implemented : yes
# cat /proc/mtd
dev: size erasesize name
mtd0: 00008000 00001000 "Bootloader"
mtd1: 00002000 00001000 "caldata"
mtd2: 00006000 00001000 "Config"
mtd3: 003c8000 00001000 "Kernel"
mtd4: 002bf000 00001000 "app"
mtd5: 0000c000 00001000 "manufacture"
mtd6: 00010000 00001000 "backup"
mtd7: 0000c000 00001000 "storage"
# cat /proc/devices
Character devices:
1 mem
2 pty
3 ttyp
4 ttyS
5 /dev/tty
5 /dev/console
10 misc
90 mtd
108 ppp
Block devices:
259 blkext
7 loop
31 mtdblock
# burn
USAGE: burn [type]
burn [type] [vendor]
burn [type] [local IP] [server IP]
burn [type] [vendor] [local IP] [server IP]
type :
b:bootloader
k:kernel
a:app
A:cb-app
f:factory
vendor :
ESR-9753, ESR-9753-SC ...
local IP :
192.168.99.9
server IP :
192.168.99.8
# uname -a
Linux localhost.localdomain 2.6.30.10 #2 Thu May 19 17:59:41 CST 2011 rlx unknown
# cd /proc/
# ls
597 mounts partitions
590 net gpio
589 sysvipc gpio_info
583 fs wps
575 driver wlan0
540 tty wlan0-va0
533 bus wlan0-va1
530 sys wlan0-va2
526 irq custom_Passthru_wlan
524 misc eth0
418 execdomains eth1
416 ioports eth2
414 iomem eth3
229 timer_list eth4
226 buddyinfo phyRegTest
224 pagetypeinfo rtk_vlan_support
167 vmstat br_mldsnoop
69 zoneinfo senao
50 vmallocinfo mtd
35 slabinfo hw_nat
11 filesystems qos
10 cmdline filter_table
9 cpuinfo fast_pptp
8 devices pptp_conn_ck
7 interrupts fast_l2tp
6 loadavg fast_nat
5 meminfo br_wlanblock
4 stat br_igmpsnoop
3 uptime br_mCastFastFwd
2 version br_igmpquery
1 crypto br_mldquery
self diskstats br_igmpProxy
# lsmod
lsmod: can't open '/proc/modules': No such file or directory
# cat /proc/meminfo
MemTotal: 59044 kB
MemFree: 45952 kB
Buffers: 1020 kB
Cached: 4244 kB
SwapCached: 0 kB
Active: 2548 kB
Inactive: 3924 kB
Active(anon): 1208 kB
Inactive(anon): 0 kB
Active(file): 1340 kB
Inactive(file): 3924 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 1216 kB
Mapped: 1212 kB
Slab: 5324 kB
SReclaimable: 368 kB
SUnreclaim: 4956 kB
PageTables: 244 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 29520 kB
Committed_AS: 2832 kB
VmallocTotal: 1048404 kB
VmallocUsed: 864 kB
VmallocChunk: 1043096 kB
# cat /proc/mounts
rootfs / rootfs rw 0 0
/proc /proc proc rw,relatime 0 0
/dev/mtdblock7 /storage jffs2 rw,relatime 0 0
/dev/mtdblock4 /apps squashfs ro,relatime 0 0
/dev/loop0 /appscore squashfs ro,relatime 0 0
# netsat -ln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:52881 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN
udp 0 0 192.168.0.1:35744 0.0.0.0:*
udp 0 0 0.0.0.0:53 0.0.0.0:*
udp 0 0 0.0.0.0:67 0.0.0.0:*
udp 0 0 0.0.0.0:1900 0.0.0.0:*
raw 0 0 0.0.0.0:255 0.0.0.0:* 7
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 381 /tmp/log_socket
unix 2 [ ACC ] STREAM LISTENING 695 /tmp/wan_socket
# iptables -n -v -L
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
140 11410 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 synflood tcp -- * * 0.0.0.0/0 0.0.0.0/0 state
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state
0 0 DROP all -- * * 192.168.0.1 0.0.0.0/0
0 0 ACCEPT udp -- br0 * 0.0.0.0/0 0.0.0.0/0 udp
0 0 ACCEPT tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP all -- br0 * 0.0.0.0/0 0.0.0.0
0 0 DROP !udp -- * * 0.0.0.0/0 224.0.0.0/4
0 0 ACCEPT tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 ACCEPT udp -- br0 * 0.0.0.0/0 0.0.0.0/0 udp
0 0 ACCEPT udp -- br0 * 0.0.0.0/0 0.0.0.0/0 udp
0 0 ACCEPT udp -- br0 * 192.168.0.0/24 0.0.0.0/0 udp
0 0 DROP icmp -f * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp
0 0 bad-ping icmp -- br0 * 0.0.0.0/0 0.0.0.0/0 icmp
0 0 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state
0 0 DROP all -- * * 192.168.0.1 0.0.0.0/0
0 0 DROP all -- br0 * !192.168.0.0/24 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 255.255.255.255
0 0 DROP !udp -- * * 0.0.0.0/0 224.0.0.0/4
0 0 DROP icmp -f * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp
0 0 ACCEPT icmp -- * br0 0.0.0.0/0 192.168.0.1 icmp
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp
0 0 ACCEPT icmp -- * br0 0.0.0.0/0 192.168.0.1 icmp
0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
140 11410 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state
0 0 DROP all -- * br0 !192.168.0.1 0.0.0.0/0
0 0 ACCEPT udp -- * br0 0.0.0.0 255.255.255.255 udp
0 0 DROP icmp -f * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp
0 0 ACCEPT icmp -- * br0 0.0.0.0/0 192.168.0.1 icmp
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp state
18 5292 ACCEPT all -- * br0 192.168.0.1 0.0.0.0/0
Chain bad-ping (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp limit
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp
Chain synflood (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp limit
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0
# iptables -t nat -n -v -L
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- br0 * 0.0.0.0/0 192.168.0.1 tcp
0 0 DNAT tcp -- br0 * 0.0.0.0/0 192.168.0.1 tcp
Chain POSTROUTING (policy ACCEPT 17 packets, 988 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 17 packets, 988 bytes)
pkts bytes target prot opt in out source destination
Bootloader
It seems the bootloader also has a commandline, but I'm not really sure if it's useful. You can get to the prompt by (repeatedly) pressing "1" during boot (though it seems other prompts also work).
Booting...SDRAM CLOCK:78MHZ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize @ 0h c22016h c2h 20h 16h 0h 16h 400000h @ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName @ 10000h 40h 1000h 400h 100h 10h 27h MX25L3205D @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ =======RTL-boot(RTL8198) Ver:1.0.5.5 2011/01/19======= Please choose the operation: 1: Load system code to SDRAM via TFTP. ---(RTL8198)at 2011.01.19-14:47+0800 version v1.1g [16bit](620MHz) New Header User Press [1] ---Escape booting by user Set GPHY Parameter OK ---Ethernet init Okay! <Senao Networks>11 Unknown command ! <Senao Networks>help ----------------- COMMAND MODE HELP ------------------ HELP (?) : Print this help message D <Address> <Len> IPCONFIG:<TargetAddress> EEE :Set EEE Patch <Senao Networks>ipconfig Target Address=192.168.99.9 Http Address=192.168.99.9 <Senao Networks>eee Writing EEE pattern 00001170 records <Senao Networks>d 0 1 80000000: 5A5AA5A5 3C1B8036 8F7B4000 001AD582 <Senao Networks>d 0 10 80000000: 5A5AA5A5 3C1B8036 8F7B4000 001AD582 80000010: 001AD080 037AD821 401A2000 8F7B0000 80000020: 335A0FFC 037AD821 8F7A0000 00000000
I'm not sure what the eee command does, it seems my firmware is still booting normally after I tried it (phew!).
Notes
The licensing documentation in the box promises that GPL sources are available on the Sitecom site (under driver downloads), but there are no downloads listed there…
toh/sitecom/wl-4001.txt · Last modified: 2012/11/30 17:11 by matthijs