Belkin F5D9231-4 v1



"P/N: 141700520007J", "R01", and "RoHS" within a triangle
 * is silkscreened on one F5D9231 v1's board.

Labels affixed to the device indicate it has an internal
 * Arcadyan model of WG7005D12 1-LF-AK.

This would seem to be another Arcadyan device using
 * the SuperTask! RTOS.

The default SSID follows the pattern of Belkin_G+MIMO_Wireless_XXXXXX
 * where XXXXXX is the last three octets of the wireless interface MAC
 * w/ upper case letters. OUIs may include 00:22:75.


 * On the DD-WRT forums (links to pictures)

Pinout
(GND)   > to RT2880 (TxD) (RxD) [  ]           J2

Info derived from
{{SCollapse|boot log • >> Ready Set Value = 0x0511FFA1

Setup FLASH_CS1_CFG = 0511FFA1

Disable all eth ports!!

=
========================================================== Wireless Gateway WG7005D Loader V0.13 build Sep 17 2007 16:56:36 Arcadyan Technology Corporation

=
========================================================== EON EN29LV160AB bottom boot 16-bit mode found

Copying boot params.....DONE

Press Space Bar 3 times to enter command mode ... Flash Checking Passed.

Unzipping firmware at 0x88002000 ... [ZIP 3] [ZIP 1] done Enable all eth ports!!

In c_entry function ... CPU : RT2880 Chip V1.4, CPU Speed 266 MHz, Interrups Status 00000000 install_exception Co config = 80240483 sys_irq_init ... mips_int_connect : intnum 2 hdl 88008d28 IrqEnable : IRQ = 8 [INIT] System Log Pool startup ... [INIT] MTinitialize .. [INIT] usrclk CPU Clock 266000000 Hz mips_counter_frequency:133000000 r4k_offset: 0x00020788(133000) init_US_counter : time1 = 208660, time2 = 32208706, diff 32000046 US_counter = 59 cnt1 32975574 cnt2 32976809, diff 1235 mips_int_enable: 7 mips_int_enable 1: s = 8401 mips_int_enable 2: s = 8401 mips_int_enable 3: s = 0 Runtime code version: 1.00.01 System startup... [INIT] Memory COLOR 0, 800000 bytes .. [INIT] Memory COLOR 1, 600000 bytes .. [INIT] Memory COLOR 2, 607200 bytes .. EON EN29LV160AB bottom boot 16-bit mode found Set flash memory layout to BRN-BOOT Boot Parameters found !!! Bootcode version: V0.13 Serial number: 12834923110139 Hardware version: 01 EON EN29LV160AB bottom boot 16-bit mode found
 * 1) _ftext      = 0x88002000
 * 2) _fdata      = 0x88392500
 * 3) __bss_start = 0x884074FC
 * 4) end         = 0x88DEC568
 * 5) Backup Data from 0x88392500 to 0x88DF4568~0x88E69564 len 479228
 * 6) Backup Data completed
 * 7) Backup Data verified

sizeof(struct III_Config_t) is 88048, nLen:88048, Magic:0xffffffff !![E-CFG-VER] Configuration data version mismatch!! !![E-CFG-VER] Adapting factory defaults!! !![E-CFG-VER] Reconfiguration required!! !!No configuration file present!! !!Cleanup configuration in flash memory!! EON EN29LV160AB bottom boot 16-bit mode found >>>>>No config, SKU=1 !!! Invalid wireless channel range 255 ~ 255 !!! Use default value 1 ~ 13 default route: 0.0.0.0 BufferInit: BUF_HDR_SZ=160 BUF_ALIGN_SZ=28 BUFFER_OFFSET=384 BUF_BUFSZ0=544 BUF_BUFSZ1=4320 NUM_OF_B0=0 NUM_OF_B1=900 BUF_POOL0_SZ=0 BUF_POOL1_SZ=4032000 sizeof(BUFFER0)=704,sizeof(BUFFER1)=4480 Altgn *BUF0=0x88b5a140 *BUF1=0x88781b20 End at BUF0:0x88b5a140, BUF1:0x88b5a120
 * BUF0=0x88b5a12c *BUF1=0x88781b0c

BUF0[0]=0x88b5a140 BUF1[0]=0x88781b20

buffer0 pointer init OK! buffer1 pointer init OK! ifno= 0, Link_Type= 4 time = 08/01/2003, 00:00:00 Interface 0 ip = 127.0.0.1

ifno= 1, Link_Type= 1 need to reset Ethernet switch???? MAC Address: 00:1c:df:e5:fa:25 debug: dev_raether irq is 3(eth2) dev->priv 8860cbd0 sb = 0 1C DF E5 FA 25 GDMA1_MAC_ADRH -- : 0x0000001c GDMA1_MAC_ADRL -- : 0xdfe5fa25 RA2880 Ethernet Driver Initilization. v1.01 128 rx/tx descriptors allocated! sb = 0 1C DF E5 FA 25 GDMA1_MAC_ADRH -- : 0x0000001c GDMA1_MAC_ADRL -- : 0xdfe5fa25 ra2880_setup_dev_fptableis called! ICPLUS 175C config LAN_WAN finished (demo board) IC-Plus PHY Init...ok DSP_EN OFF version driver

phy_tx_ring = 0840a640, tx_ring = a840a640, size: 16 bytes

phy_rx_ring = 0840aa40, rx_ring = a840aa40, size: 16 bytes should set VLAN ?????????????? @@@@@@@@@@@@@@@@@@ Set LAN and WAN VLAN.... mips_int_connect : intnum 5 hdl 88009974 mips_int_enable: 5 mips_int_enable 1: s = 8401 mips_int_enable 2: s = a401 mips_int_enable 3: s = 0 time = 08/01/2003, 00:00:00 Interface 1 ip = 192.168.2.1

ifno= 2, Link_Type= 1 hwlan_init(376): [HWLAN] ifno=2 irno=7 port=0x00000000 RT2860_init_module 2860 version : v1.6.0.0 (2007/10/12) --> RTMPAllocAdapterBlock RTMP_ADAPTER_mem : 884c6b84, sizeof(RTMP_ADAPTER) 465448

pAd = 884C6B84, size = 465448
<-- RTMPAllocAdapterBlock, Status=0 ra0: at CSR addr 0xa0480000. RUNTASK id=1 hwlan_light_isr... time = 08/01/2003, 00:00:00 Interface 2 ip = 192.168.2.1

ifno= 3, Link_Type= 1 WAN MAC Address: 00:1c:df:e5:fa:26 MAC Address: 00:1c:df:e5:fa:26 should set VLAN ?????????????? time = 08/01/2003, 00:00:00 iput_IpLinkUp(ifno=3)> ifp->add_default_route:1 Re-Init NAT data structure Init NAT data structure Interface 3 ip = 0.0.0.0

ifno= 4, Link_Type= 0 ifno= 5, Link_Type= 0 ifno= 6, Link_Type= 0 ifno= 7, Link_Type= 0 ifno= 8, Link_Type= 0 ifno= 9, Link_Type= 0 ifno= 10, Link_Type= 0 ifno= 11, Link_Type= 0 ifno= 12, Link_Type= 0 ifno= 13, Link_Type= 0 ifno= 14, Link_Type= 0 ifno= 15, Link_Type= 0 ifno= 16, Link_Type= 0 ruleCheck> Group: 0, Error: Useless rule index will be truncated ruleCheck> Group: 1, Error: Useless rule index will be truncated ruleCheck> Group: 2, Error: Useless rule index will be truncated ruleCheck> Group: 3, Error: Useless rule index will be truncated ruleCheck> Classify Rule: 1, Error: Protocol Field ruleCheck> Classify Rule: 2, Error: Protocol Field ruleCheck> Classify Rule: 3, Error: Protocol Field ruleCheck> Classify Rule: 4, Error: Protocol Field ruleCheck> Classify Rule: 5, Error: Protocol Field ruleCheck> Classify Rule: 6, Error: Protocol Field ruleCheck> Classify Rule: 7, Error: Protocol Field ruleCheck> Classify Rule: 8, Error: Protocol Field ruleCheck> Classify Rule: 9, Error: Protocol Field ruleCheck> Classify Rule: 10, Error: Protocol Field ruleCheck> Classify Rule: 11, Error: Protocol Field ruleCheck> Classify Rule: 12, Error: Protocol Field ruleCheck> Classify Rule: 13, Error: Protocol Field ruleCheck> Classify Rule: 14, Error: Protocol Field ruleCheck> Classify Rule: 15, Error: Protocol Field ruleCheck> Classify Rule: 16, Error: Protocol Field ruleCheck> Classify Rule: 17, Error: Protocol Field ruleCheck> Classify Rule: 18, Error: Protocol Field ruleCheck> Classify Rule: 19, Error: Protocol Field ruleCheck> Classify Rule: 20, Error: Protocol Field ruleCheck> Classify Rule: 21, Error: Protocol Field ruleCheck> Classify Rule: 22, Error: Protocol Field ruleCheck> Classify Rule: 23, Error: Protocol Field ruleCheck> Classify Rule: 24, Error: Protocol Field ruleCheck> Classify Rule: 25, Error: Protocol Field ruleCheck> Classify Rule: 26, Error: Protocol Field ruleCheck> Classify Rule: 27, Error: Protocol Field ruleCheck> Classify Rule: 28, Error: Protocol Field ruleCheck> Classify Rule: 29, Error: Protocol Field ruleCheck> Classify Rule: 30, Error: Protocol Field ruleCheck> Classify Rule: 31, Error: Protocol Field ruleCheck> Classify Rule: 32, Error: Protocol Field reqCBACBuf> init match pool, Have: 500 Memory Address: 0x88dc89b4 ~ 0x88dcc080 reqCBACBuf> init timeGap pool, Have: 5000 Memory Address: 0x88dcc080 ~ 0x88de4734 reqCBACBuf> init sameHost pool, Have: 1000 Memory Address: 0x88de4734 ~ 0x88dec454 [setClsfyEnable] clsfy_func=0 CBAC rule pool initialized !! [init_if] local_if_mask=0x7 [init_if] local_wiredif_mask=0x2 [init_if] local_wirelessif_mask=0x4 [init_if] localorVPN_if_mask=0x1dc07 Init NAT data structure No default route, no need to reinit the NAT data structure RUNTASK id=2 if_task if0... RUNTASK id=3 if_task if1... RUNTASK id=4 if_task if2... RUNTASK id=5 if_task if3... RUNTASK id=6 timer_task... RUNTASK id=7 conn_mgr... RUNTASK id=8 main_8021x... RUNTASK id=9 main_lltd... RUNTASK id=10 period_task... RUNTASK id=11 dhcp_daemon... RUNTASK id=12 dhcp_clt...on interface 3 RUNTASK id=13 pptp_callmgr... RUNTASK id=14 L2tpd... found signature: 78h 56h 34h 12h ulImgLens=997933, LENGTH[3]-12=1769460 length checking OK [0] find End at 0xBC133800 len=997933 ---[ LZMA head start in 0xBC133C00 ]--- found signature: 78h 56h 34h 12h ulImgLens=112590, LENGTH[3]-12=1769460 length checking OK [1] find End at 0xBC14F000 len=112590 Image[1] at 0xBC040000, len = 997933 Image[2] at 0xBC133C00, len = 112590 Unzipping from BC133C00 to 88EE2000 ... [ZIP 1] done Uncompressed size = 1051075 drive start addr[0]=88ee2000, [1]=88fe29d0 [HTTPD] flash_init: failed!! httpd: listen at 192.168.2.1:80 RUNTASK httpd... RUNTASK id=17 dnsproxy... RUNTASK id=18 rip... RUNTASK id=19 ripout... RUNTASK id=20 dhcpd_mgmt_task... UPnP is enabled UPNP Device initialize success! slot=21 gConfig.WSC_Mode:1 RUNTASK id=22 wscmain... RUNTASK id=23 wsc_Send_eap_packet... RUNTASK id=24 wsc_Send_UPNP_packet... RUNTASK id=25 WSC_WaitUserAction_Task... gConfig.WSC_Mode:1 RUNTASK id=26 led_task...

>>> belkin_wan_cfg task runs successfully, task_id = 27 UART RX Input Starting Multitask... run_project_task RUNTASK id=28 apAppInit... dot1x_build_if_mapping ifno2dot1x_if[2]=0 dot1x_build_if_mapping dot1x_wireless_if_mask=0x4 dot1x_build_if_mapping completed. init psock cnt=-805885241 mips_int_connect : intnum 6 hdl 880af3f0 mips_int_enable: 6 mips_int_enable 1: s = a400 mips_int_enable 2: s = e400 mips_int_enable 3: s = 0 rt2860_open : should call request_irq ???????????????????????? rt2860_open 1 rt2860_open 2 rt2860_init 1 rt2860_init 2 rt2860_init 3 rt2860_init 6 rt2860_init 8 RX DESC A8414640 size = 2048 <-- RTMPAllocDMAMemory, Status=0 rt2860_init 9 rt2860_init 10 sizeof(RT2860AP_DAT) : 1314 HT: Auto BA = Enable HT: MCS = AUTO HT: STBC = 1 gSetting.GTxRateBitmap=0 gSetting.NTxRateMCS=33 gSetting.WirelessMode=0 1. Phy Mode = 9 2. Phy Mode = 9 sould check E2PROM MAC ????????????????? EEPROM_NIC1 212 3. Phy Mode = 9 MCS Set = ff ff 00 00 01 CarrierDetect.Enable=0 Main bssid = 00:1c:df:e5:fa:25 <==== RTMPInitialize, Status=0 rt2860_open 3 should Set up the Mac address ????????? rt2860_open 4 rt2860_open 5 rt2860_open 6 0x1300 = 00064300 netif_carrier_on called ??? [dhcp_clt] enable dhcp client in interface WAN[3] Wi-Fi Simple Config Application - Intel Corp. Version: Build 1.02, Jul 17 2008 17:50:32 Initializing stack... -in wsc init-- --sizeof(uint32)=4 --sizeof(uint-long)=4 --sizeof(uint32)=2 @#*@#*@#*EAP-WSC: Entered eap_wsc_init *#@*#@*#@ wsc_Send_eap_packet:udpFdupnp_wcn:28;;udpFdupnp:2a WSC_WaitUserAction:wait user action:0 [HWLAN] [30] rapi_tmr_task running [22]pthread_cond_init: 0 [22]pthread_mutex_init: resource No. 34 [22]pthread_mutex_init: resource No. 35 [PORTABLITY]:WscCreateThread Entered udp_read WscCmd:ActualCBThreadProc: Started [htf_dbg]    - OnlineActiveWirless 1608 [ipriv]:[ipriv]:[ipriv]:[ipriv]:CarrierDetect.Enable=0 [22]pthread_cond_init: 1 [22]pthread_mutex_init: resource No. 36 [22]pthread_mutex_init: resource No. 37 [PORTABLITY]:WscCreateThread WscCmd:ActualUIThreadProc: Started. ActualUIThreadProc: wait q MasterControl constructor WscCmd::MC instantiated ok [22]pthread_cond_init: 2 [22]pthread_mutex_init: resource No. 38 [22]pthread_mutex_init: resource No. 39 [PORTABLITY]:WscCreateThread [22]pthread_mutex_init: resource No. 40 [PORTABLITY]:pthread_mutex_init CTransport Construction [22]pthread_cond_init: 3 [22]pthread_mutex_init: resource No. 41 [22]pthread_mutex_init: resource No. 42 [PORTABLITY]:WscCreateThread In CTransport::ActualCBThreadProc ActualCBThreadProc: Calling Dequeue MC::Init: Init complete ok WscCmd::MC intialized ok WscCmd::Init ok, starting stack... Info::ReadConfigFile: Called Info::ReadConfigFile: Info::ReadConfigFile:File open ok mp_deviceInfo->uuid[i]: 0-0-0-0-0-0-0-1-10-0-0-1c-df-e5-fa-25- mp_deviceInfo->macAddr:00:1C:DF:E5:FA:25 gSetting.dot1x.if_entry[0].enableWEP:0 temp_value=cff72ac7 authTypeFlags is 1 ,encrTypeFlags is 1 ,m_nwKey is, key len is 0 ssid is Belkin_G+MIMO_Wireless_E5FA25 S, cb7 E, fd1 RegistrarSM constructor [22]pthread_cond_init: 4 [22]pthread_mutex_init: resource No. 43 [22]pthread_mutex_init: resource No. 44 [PORTABLITY]:WscCreateThread [22]pthread_mutex_init: resource No. 45 [PORTABLITY]:pthread_mutex_init RegistrarSM constructor [22]pthread_cond_init: 5 [22]pthread_mutex_init: resource No. 46 [22]pthread_mutex_init: resource No. 47 [PORTABLITY]:WscCreateThread c_devPwd:org:22013026 Generated devPwd: X2i▒ in startMonitor.... CInbEap Construction Sizeof(WSC_NOTIFY_DATA) = -2006371712 ---test--sizeof(WSC_NOTIFY_DATA) = 36 [22]pthread_cond_init: 6 [PORTABLITY]:WscCreateEvent Entered udp_open Socket open successful, sd: -2006371728 Entered udp_open Socket open successful, sd: -2006371728 Entered udp_bind Binding successful for socket [-2006371744] [PORTABLITY]:WscCreateThread In CInbEap::StaticRecvThread CInbEap::ActualRecvThread Started Entered udp_read in startMonitor.... CInbUPnPDev Construction Entered udp_open Socket open successful, sd: -2006371728 Entered udp_open Socket open successful, sd: -2006371728 Entered udp_bind Binding successful for socket [-2006371744] CInbUPnPDev StartMonitor [PORTABLITY]:WscCreateThread MC::SwitchModeOn: Exit In CInbUPnPDev::StaticUPnPThread end UPnPCreateMicroStack Entered udp_read MC::StartStack: Informing app of mode -WscCmd::CallbackProc Enqueue done MC::SwitchModeOn: Done callback exit wscmain @@[31]pthread_mutex_unlock: the res is free 34-- -2007564804 WscCmd:ActualCBThreadProc: CB_MAIN_PUSH_MODE recd
 * uuid_p:0x00000000000000011000001cdfe5fa25*****
 * mcp_devPwd:22013026;;

-@@[28]pthread_mutex_unlock: the res is free 36-- -2007564924
 * MODE: Access Point *******
 * p_header->eType:1

Options: 0. Quit 1. Get configured 2. Get configured via push-button 3. Get configured using IEs Enter selection: ***gp_mc->mp_info->GetSwitchMode:1 mp_info->GetSwitchMode:1:e_currMode:1,,e_targetMode:3 mp_deviceInfo->authTypeFlags:1 mp_deviceInfo->encrTypeFlags:1 mp_deviceInfo->authTypeFlags:1 mp_deviceInfo->encrTypeFlags:1 MC::SetBeaconIE: call to trans->SetBeaconIE ok MC::SetProbeRespIE: call to trans->SetProbeRespIE ok Waiting for Registrar to connect... WscCmd::unconfig initiated ActualUIThreadProc: wait q [reset_802dot1x] wireless module ready [init_wpa] dot1x_ready[0]=1
 * cp_devPwd:22013026*****

AES Key Wrap Test #0 cipher data: 0x a8ba61f 0x47b41281 0xd84bf3ae 0x827b5afb 0x23863e9d 0xe5cfd271 AES Key wrap Test #0 passed AES Key UnWrap Test #0 returned with clear data: 0x33221100 0x77665544 0xbbaa9988 0xffeeddcc AES Key UnWrap Test #0 passed

AES Key Wrap Test #1 cipher data: 0x258b7796 0x35a46cae 0x975b2bf9 0xd2ae50c0 0xa1b88a46 0x5d4ed87a AES Key wrap Test #1 passed AES Key UnWrap Test #1 returned with clear data: 0x33221100 0x77665544 0xbbaa9988 0xffeeddcc AES Key UnWrap Test #1 passed

AES Key Wrap Test #2 cipher data: 0xf9c3e864 0xa25b0fce 0x7977e963 0x2a8a8105 0x1e19c893 0xe78a6e7d AES Key wrap Test #2 passed AES Key UnWrap Test #2 returned with clear data: 0x33221100 0x77665544 0xbbaa9988 0xffeeddcc AES Key UnWrap Test #2 passed

AES Key Wrap Test #3 cipher data: 0x26331d03 0x32d3154e 0xc24ef268 0xdc3e7460 0xddc7c6e1 0x935a72ee 0x9114a86b 0xd AES Key wrap Test #3 passed AES Key UnWrap Test #3 returned with clear data: 0x33221100 0x77665544 0xbbaa9988 0xffeeddcc 0x 3020100 0x 7060504 AES Key UnWrap Test #3 passed [reset_802dot1x] 802.1Xv2 ready upnp_Init: flag=0 SSDP Initialization completed... GenaInit : event_hook is NULL!! }} {{SCollapse|bootloader start, menu, boot params • >> Ready Set Value = 0x0511FFA1

Setup FLASH_CS1_CFG = 0511FFA1

Disable all eth ports!!

=
========================================================== Wireless Gateway WG7005D Loader V0.13 build Sep 17 2007 16:56:36 Arcadyan Technology Corporation

=
========================================================== EON EN29LV160AB bottom boot 16-bit mode found

Copying boot params.....DONE

Press Space Bar 3 times to enter command mode ...123 Yes, Enter command mode ...

[WG7005D Boot]:

=
========= [U] Upload to Flash [E] Erase Flash [G] Run Runtime Code [A] Set MAC Address [#] Set Serial Number [V] Set Board Version [H] Set Options [P] Print Boot Params [1] Set SKU Number [2] Set PIN Number

=
=========

[WG7005D Boot]:p

MAC address    : 00-1C-DF-E5-FA-25 Serial number  : 12834923110139 Hardware version: 01 Options        : FF-FF-FF-FF-FF-FF Country region : 1 SKU Num        : 1 PIN Num        : 22013026 }}