Belkin F5D8231-4 v3


 * Manual, Firmware, GPL Source Code

"WRTR-203GN_V02", "190-c04-6701R", and "RoHS" is silkscreened
 * on the board of the sample unit shown in this entry.

The SSID is Belkin_N1_Wireless_XXXXXX where XXXXXX
 * is the last 3 octets of the MAC address (upper-case letters).

Probable included PSU(s)
The power adapter included with the device is
 * probably a DVE DSA-12R-12 AUS 120120.
 * ID/OD/Len measurements are approximate.

Pinout
The pinout seems to be the same as is used by the Belkin F5D8235-4 v1. (GND) (RxD) (GND) (VCC) (VCC) [TxD] J6

Info derived from
{{SCollapse|boot log U-Boot 1.1.9-Gemtek 2007/01/09 (Jan 9 2007 - 17:39:08)

U-Boot code: 40780000 -> 4079AF44 BSS: -> 407B0000 System Memory Map: 0x00000000-0x01FFFFFF: SDRAM Bank 0 0x19C00000-0x1E7FFFFF: Memory Mapped IO Space-AHB 0x19C00000-0x19C1FFFF: Static/SDRAM Memory Controller 0x19C40000-0x19C5FFFF: Interrupt Controller 0x19C60000-0x19C7FFFF: AHB Arbiter 0x19C80000-0x19C9FFFF: MAC 0 0x19CA0000-0x19CBFFFF: MA1 0 0x1E700000-0x1E71FFFF: HDMA 0x1E800000-0x1EFFFFFF: Memory Mapped IO Space-APB 0x1E800000-0x1E81FFFF: Timer 0/1/2/3 0x1E840000-0x1E85FFFF: UART 0 0x1E880000-0x1E89FFFF: SPI 0x1E8A0000-0x1E8BFFFF: GPIO 0 0x1E8C0000-0x1E8DFFFF: WDT 0x1E8E0000-0x1E8FFFFF: SCU 0x1E940000-0x1E95FFFF: ACI0(PL040) 0x1E960000-0x1E97FFFF: ACI1(PL040) 0x1F000000-0x1F7FFFFF: Flash Bank 0 0x40000000-0x41FFFFFF: SDRAM Bank 1 RAM Configuration: Bank #0: 40000000 16 MB Board: 5VT1310-EVB-V1.4 (CPU Speed 297 MHz) MXIC-MX29LV320CB = 4MB;  start at 0x1F000000; Flash: 4 MB
 * Warning - bad CRC, using default environment

In:   serial Out:  serial Err:  serial Hit any key to stop autoboot: 0 Image Name:  Linux-2.6.17 Image Type:  ARM Linux Kernel Image (lzma compressed) Data Size:   711055 Bytes = 694.4 kB   Load Address: 40008000 Entry Point: 40008000 Verifying Checksum ... OK  Uncompressing Kernel Image ... OK
 * 1) Booting image at 1f010000 ...

Starting kernel @40008000...

Linux version 2.6.17 (terence@cvs2) (gcc version 4.1.1) #477 Fri Apr 27 15:20:38 CST 2007 CPU: ARM926EJ-Sid(wb) [41069265] revision 5 (ARMv5TEJ) Machine: 5VT13XX Ignoring unrecognised tag 0x00000000 Memory policy: ECC disabled, Data cache writeback CPU0: D VIVT write-back cache CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets Built 1 zonelists Kernel command line: root=/dev/mtdblock2 ro noinitrd cpufreq=300M rootfstype=squashfs mem=16M console=ttyS0,38400 mtdparts=5VT13XX_mapped_flash:0x10000@0x0(U-Boot),0x3D0000@0x10000(kernel), 0x310000@0xD0000(romfs),0x10000@0x3F0000(nvram),0x10000@0x3E0000(factory_default),4M@0x0(flash) PID hash table entries: 128 (order: 7, 512 bytes) Timer1 load register: 743423(0x000B57FF) Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Memory: 16MB = 16MB total Memory: 14036KB available (1572K code, 345K data, 92K init) Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok NET: Registered protocol family 16 PCI: Scanning bus... PCI: FV Host Bridge - header fixup PCI: bus0: Fast back to back transfers disabled NET: Registered protocol family 2 IP route cache hash table entries: 128 (order: -3, 512 bytes) TCP established hash table entries: 512 (order: -1, 2048 bytes) TCP bind hash table entries: 256 (order: -2, 1024 bytes) TCP: Hash tables configured (established 512 bind 256) TCP reno registered NetWinder Floating Point Emulator V0.97 (double precision) squashfs: version 3.1 includes LZMA decompression support (2006/08/29) Phillip Lougher Initializing Cryptographic API io scheduler noop registered io scheduler deadline registered (default) PCI: FV Host Bridge - final fixup Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x1e840000 (irq = 1) is a 16550A serial8250: ttyS1 at MMIO 0x1e860000 (irq = 2) is a 16550A RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize loop: loaded (max 8 devices) PPP generic driver version 2.4.2 PPP Deflate Compression module registered NET: Registered protocol family 24 physmap flash device: 400000 at 1f000000 5VT13XX_mapped_flash: Found 1 x16 devices at 0x0 in 8-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. 6 cmdlinepart partitions found on MTD device 5VT13XX_mapped_flash Creating 6 MTD partitions on "5VT13XX_mapped_flash": 0x00000000-0x00010000 : "U-Boot" 0x00010000-0x003e0000 : "kernel" 0x000d0000-0x003e0000 : "romfs" 0x003f0000-0x00400000 : "nvram" 0x003e0000-0x003f0000 : "factory_default" 0x00000000-0x00400000 : "flash" ip_conntrack version 2.4 (8192 buckets, 8192 max) - 252 bytes per conntrack ip_conntrack_pptp version 3.1 loaded ip_nat_pptp version 3.0 loaded ip_tables: (C) 2000-2006 Netfilter Core Team ipt_recent v0.3.1: Stephen Frost . http://snowman.net/projects/ipt_recent/ ClusterIP Version 0.8 loaded successfully ipt_time loading arp_tables: (C) 2002 David S. Miller TCP bic registered NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 5 VFS: Mounted root (squashfs filesystem) readonly. Freeing init memory: 92K /sbin/init exit code: -2 /etc/init exit code: -2 fvmac: module license '5VT' taints kernel. FVMAC version: 1.07, date: 2007/03/05 (compiled at 18:19:38, Mar 27 2007) FVMAC 0: FVMAC core w/AMBA at 0xf0080000 IRQ 7 Randomize lower 3 bytes of the MAC address. FVMAC 0: MAC address < 00:35:56:4A:5D:06 > FVMAC 0: registered_netdev as eth1. FVMAC 1: FVMAC core w/AMBA at 0xf00a0000 IRQ 8 Randomize lower 3 bytes of the MAC address. FVMAC 1: MAC address < 00:35:56:29:0A:73 > FVMAC 1: registered_netdev as eth0. fv_watch_dog_init

BusyBox v1.1.0 (2007.01.19-13:35+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands.

insmod: reset_btn.ko: no module by that name found no factory default number Done Setting ra0 configuration.... Bring up ra0 interface.... ===> rt2860_init_one PCI: enabling device 0000:00:01.0 (0140 -> 0142) Driver version-1.1.0.0-20070227-20070307 --> RTMPAllocAdapterBlock
 * 1) #sysinit: [sysinit]
 * 1) update nvram with default list!
 * 2) interfaces_init......

pAd = c1c31000, size = 346420
<-- RTMPAllocAdapterBlock, Status=0 PCI: Setting latency timer of device 0000:00:01.0 to 64 ra0: at 0x19ce0000, VA 0xc1c20000, IRQ 18. <=== rt2860_init_one <--> NICInitTxRxRingAndBacklogQueue Allocate 8192 memory for BA reordering MAC_CSR0 [ Ver:Rev=0x28600101] <=== NICLoadFirmware (status=0) --> RTMPAllocDMAMemory TxRing[0]: total 64 entry allocated TxRing[1]: total 64 entry allocated TxRing[2]: total 64 entry allocated TxRing[3]: total 64 entry allocated TxRing[4]: total 64 entry allocated MGMT Ring: total 32 entry allocated RX DESC ffc1a000 size = 2048 Rx Ring: total 128 entry allocated <-- RTMPAllocDMAMemory, Status=0 --> MLME Initialize <-- MLME Initialize --> UserCfgInit --> UserCfgInit. BACapability = 0x3024040 <-- UserCfgInit ---> APInitialize <--- APInitialize --> NICInitializeAdapter <== DMA offset 0x208 = 0x60 --> NICInitializeAsic BBP version = 51 <-- NICInitializeAsic --> TX_BASE_PTR1 : 0x40ec3000 --> TX_BASE_PTR0 : 0x40ec2000 --> TX_BASE_PTR2 : 0x40ec8000 --> TX_BASE_PTR3 : 0x40ec9000 --> TX_BASE_PTR4 : 0x40ece000 --> TX_BASE_PTR5 : 0x40ecf000 --> RX_BASE_PTR : 0x408b2000 <-- NICInitializeAdapter CountryRegion=5 CountryRegionABand=1 BssidNum=1 SSID[0]=Belkin_N1_Wireless_91934D Channel=6 PhyMode=9 BasicRate=15 BeaconPeriod=100 DtimPeriod=1 TxPower=100 BGProtection=2 OLBCDetection=1 TxPreamble=0 RTSThreshold=2312 FragThreshold=2346 TxBurst=1 PktAggregate=0 I/F(ra0) WmmCapable=0 APAifsn[0]=3 APAifsn[1]=7 APAifsn[2]=1 APAifsn[3]=1 APCwmin[0]=4 APCwmin[1]=4 APCwmin[2]=3 APCwmin[3]=2 APCwmax[0]=6 APCwmax[1]=10 APCwmax[2]=4 APCwmax[3]=3 APTxop[0]=0 APTxop[1]=0 APTxop[2]=94 APTxop[3]=47 APACM[0]=0 APACM[1]=0 APACM[2]=0 APACM[3]=0 BSSAifsn[0]=3 BSSAifsn[1]=7 BSSAifsn[2]=2 BSSAifsn[3]=2 BSSCwmin[0]=4 BSSCwmin[1]=4 BSSCwmin[2]=3 BSSCwmin[3]=2 BSSCwmax[0]=10 BSSCwmax[1]=10 BSSCwmax[2]=4 BSSCwmax[3]=3 BSSTxop[0]=0 BSSTxop[1]=0 BSSTxop[2]=94 BSSTxop[3]=47 BSSACM[0]=0 BSSACM[1]=0 BSSACM[2]=0 BSSACM[3]=0 AckPolicy[0]=0 AckPolicy[1]=0 AckPolicy[2]=0 AckPolicy[3]=0 I/F(ra0) NoForwarding=0 NoForwardingBTNBSSID=0 I/F(ra0) HideSSID=0 ShortSlot=1 AutoChannelAtBootup=0 IEEE8021X=0 I/F(ra0) AuthMode=2 I/F(ra0) EncrypType=1 ReKeyInterval=2000 I/F(ra0) DefaultKeyID(0~3)=0 AccessPolicy0=0 AccessControlList0=Get 0 Mac Address HT: Auto BA = Enable HT: Tx +HTC frame = Disable HT: Link Adaptation Control = Disable HT: RDG = Enable(+HTC) HT: Tx A-MSDU = Disable HT: MPDU Density = 3 HT: BA Windw Size = 64 HT: Guard Interval = 400 HT: Operate Mode = Mixed Mode HT: Channel Width = 40 MHz HT: Ext Channel = BELOW HT: MCS = AUTO HT: STBC = 1 1. Phy Mode = 9 2. Phy Mode = 9 --> NICReadEEPROMParameters --> E2PROM_CSR = 0x18 --> EEPROMAddressNum = 8 E2PROM MAC: =00:17:3f:91:93:4d E2PROM MAC: =00:17:3f:91:93:4d E2PROM: Version = 1, FAE release #1 Antenna RxPath = 3, TxPath = 2 E2PROM: G Tssi[-4 .. +4] = 240 208 181 160 - 136 -69 37 21 0, step=1, tuning=1 E2PROM: A Tssi[-4 .. +4] = 255 255 255 255 - 255 -255 255 255 255, step=255, tuning=0 E2PROM: RF FreqOffset=0x19 RTMPSetPhyMode(=9)HTPhyMode.MODE=0, channel=6 country code=133/133, RFIC=1, PHY mode=9, support 14 channels BuildChannel # 1 :: Pwr0 = 16, Pwr1 =9, BuildChannel # 2 :: Pwr0 = 16, Pwr1 =9, BuildChannel # 3 :: Pwr0 = 17, Pwr1 =8, BuildChannel # 4 :: Pwr0 = 17, Pwr1 =8, BuildChannel # 5 :: Pwr0 = 17, Pwr1 =7, BuildChannel # 6 :: Pwr0 = 18, Pwr1 =7, BuildChannel # 7 :: Pwr0 = 18, Pwr1 =6, BuildChannel # 8 :: Pwr0 = 18, Pwr1 =6, BuildChannel # 9 :: Pwr0 = 19, Pwr1 =6, BuildChannel # 10 :: Pwr0 = 19, Pwr1 =6, BuildChannel # 11 :: Pwr0 = 19, Pwr1 =6, BuildChannel # 12 :: Pwr0 = 16, Pwr1 =4, BuildChannel # 13 :: Pwr0 = 16, Pwr1 =4, BuildChannel # 14 :: Pwr0 = 16, Pwr1 =4, MlmeUpdateTxRates[MaxSupport = 54] = MaxDesire 54 Mbps MlmeUpdateTxRates (MaxDesire=54, MaxSupport=54, MaxTxRate=54, MinRate=1, Rate Switching =1) MlmeUpdateTxRates (TxRate=54, RtsRate=1, BasicRateBitmap=0x015f) MlmeUpdateTxRates (MlmeTransmit=0x0, MinHTPhyMode=0, MaxHTPhyMode=0x0, HTPhyMode=0x0) MlmeUpdateHtTxRates===> Txpower per Rate Gpwrdelta = 2, Apwrdelta = 2. 66666666, Adata40M = 44444444,  Gdata40M = 44444444 44446666, Adata40M = 22224444,  Gdata40M = 22224444 44444444, Adata40M = 22222222,  Gdata40M = 22222222 66664444, Adata40M = 44442222,  Gdata40M = 44442222 ffff6666, Adata40M = dddd4444,  Gdata40M = dddd4444

<-- NICReadEEPROMParameters 3. Phy Mode = 9 RTMPSetPhyMode(=9)HTPhyMode.MODE=1, channel=6 country code=133/133, RFIC=1, PHY mode=9, support 14 channels BuildChannel # 1 :: Pwr0 = 16, Pwr1 =9, BuildChannel # 2 :: Pwr0 = 16, Pwr1 =9, BuildChannel # 3 :: Pwr0 = 17, Pwr1 =8, BuildChannel # 4 :: Pwr0 = 17, Pwr1 =8, BuildChannel # 5 :: Pwr0 = 17, Pwr1 =7, BuildChannel # 6 :: Pwr0 = 18, Pwr1 =7, BuildChannel # 7 :: Pwr0 = 18, Pwr1 =6, BuildChannel # 8 :: Pwr0 = 18, Pwr1 =6, BuildChannel # 9 :: Pwr0 = 19, Pwr1 =6, BuildChannel # 10 :: Pwr0 = 19, Pwr1 =6, BuildChannel # 11 :: Pwr0 = 19, Pwr1 =6, BuildChannel # 12 :: Pwr0 = 16, Pwr1 =4, BuildChannel # 13 :: Pwr0 = 16, Pwr1 =4, BuildChannel # 14 :: Pwr0 = 16, Pwr1 =4, MlmeUpdateTxRates[MaxSupport = 54] = MaxDesire 54 Mbps MlmeUpdateTxRates (MaxDesire=54, MaxSupport=54, MaxTxRate=54, MinRate=1, Rate Switching =1) MlmeUpdateTxRates (TxRate=54, RtsRate=1, BasicRateBitmap=0x015f) MlmeUpdateTxRates (MlmeTransmit=0x0, MinHTPhyMode=0, MaxHTPhyMode=0x0, HTPhyMode=0x0) MlmeUpdateHtTxRates===>

=
>RTMPSetHT RTMPSetHT -(RxBAWinLimit= 64), (MaxRAmpduFactor=1)... RTMPSetHT-> AMsduSize = 0 (MimoPs = 3) (RxBAWinLimit = 64) RTMPSetHT<---BW = 1, STBC = 1, SHORTGI = 1,>MCS = 33,ExtOffset = 3

EDCA [#0]: AIFSN CWmin CWmax TXOP(us)  ACM AC_BE      3      4      6         0     0 AC_BK      7      4     10         0     0 AC_VI      1      3      4      3072     0 AC_VO      1      2      3      1536     0 MlmeUpdateHtTxRates===> MlmeUpdateHtTxRates<---.AMsduSize = 0 TX: MCS[0] = ff (choose 15), BW = 1, ShortGI = 1, MODE = 2, MlmeUpdateHtTxRates<=== MCS Set = ff ff 00 00 01 --> NICInitAsicFromEEPROM SW interrupt MCU (cmd=0x52, token=0xff, arg1,arg0=0x05,0x05) SW interrupt MCU (cmd=0x53, token=0xff, arg1,arg0=0x9a,0xa9) SW interrupt MCU (cmd=0x54, token=0xff, arg1,arg0=0x8d,0x98) TxPath = 2, RxPath = 3, RFIC=1, Polar+LED mode=1 <-- NICInitAsicFromEEPROM SwitchChannel#6(RF=1, Pwr0=18, Pwr1=7, 2T) to , R1=0x98402ecc, R2=0x984c078e, R3=0x9816a455, R4=0x982cd1df NDIS_STATUS_MEDIA_DISCONNECT Event B! ===> APStartUp EDCA [#0]: AIFSN CWmin CWmax TXOP(us)  ACM AC_BE      3      4      6         0     0 AC_BK      7      4     10         0     0 AC_VI      1      3      4      3072     0 AC_VO      1      2      3      1536     0
 * 1) Use STBC ###

=
=> AsicSetBssid 0:17:3f:91:93:4d ApStartUp : ExtBlow, ChannelWidth=1, Channel=6, ExtChanOffset=3 SwitchChannel#4(RF=1, Pwr0=17, Pwr1=8, 2T) to, R1=0x98402ecc, R2=0x984c078a, R3=0x9816a255, R4=0x982cd21f MlmeSetTxPreamble (= LONG PREAMBLE) MlmeUpdateTxRates[MaxSupport = 54] = MaxDesire 54 Mbps MlmeUpdateTxRates (MaxDesire=54, MaxSupport=54, MaxTxRate=54, MinRate=1, Rate Switching =1) MlmeUpdateTxRates (TxRate=54, RtsRate=1, BasicRateBitmap=0x015f) MlmeUpdateTxRates (MlmeTransmit=0x0, MinHTPhyMode=0, MaxHTPhyMode=0x0, HTPhyMode=0x0) MlmeUpdateHtTxRates===> MlmeUpdateHtTxRates<---.AMsduSize = 0 TX: MCS[0] = ff (choose 15), BW = 1, ShortGI = 1, MODE = 2, MlmeUpdateHtTxRates<=== --->AsicEnableBssSync(INFRA mode) SW interrupt MCU (cmd=0x50, token=0xff, arg1,arg0=0x60,0x01) APStartUp : Group rekey method= 0, interval = 0x7d0 LOG#0 00:17:3f:91:93:4d restart access point <=== APStartUp Main bssid = 00:17:3f:91:93:4d <==== RTMPInitialize, Status=0 ==> RTMPEnableRxTx <== WRITE DMA offset 0x208 = 0x65 <== RTMPEnableRxTx 0x1300 = 00064320 interface ra0 does not exist! No need to change ra0 to Nintendo NDS capable No need to change ra0 to Nintendo NDS capable...Complete killall: rt2860apd: no process killed eth1: set media mode 100M/full-duplex device eth1 entered promiscuous mode device ra0 entered promiscuous mode br0: port 2(ra0) entering listening state br0: port 1(eth1) entering listening state killall: rt2860apd: no process killed route: resolving gw route: resolving gw route: resolving gw route: resolving gw route: resolving gw Set country code - No target country!!! coutry = us * coutry = uk coutry = au coutry = ca * coutry = sg coutry = tw * coutry = cn coutry = fr coutry = de coutry = it coutry = du coutry = jp coutry = kr saveCurrentChannel: not found httpd : This is httpd...ssl_enabled is 0 }}
 * 1) BSS(0) AuthMode(2)=AUTOWEP, WepStatus(1)=NONE, AccessControlList.Policy=0
 * 1) lan services init......
 * 1) wan_init......

cat /proc/mtd
dev:   size   erasesize  name mtd0: 00010000 00002000 "U-Boot" mtd1: 003d0000 00010000 "kernel" mtd2: 00310000 00010000 "romfs" mtd3: 00010000 00010000 "nvram" mtd4: 00010000 00010000 "factory_default" mtd5: 00400000 00010000 "flash"
 * 1) cat mtd

cat /proc/meminfo
MemTotal:       14128 kB MemFree:          4360 kB Buffers:           768 kB Cached:           2784 kB SwapCached:          0 kB Active:           3400 kB Inactive:         1264 kB HighTotal:           0 kB HighFree:            0 kB LowTotal:        14128 kB LowFree:          4360 kB SwapTotal:           0 kB SwapFree:            0 kB Dirty:               0 kB Writeback:           0 kB Mapped:           2368 kB Slab:             3128 kB CommitLimit:      7064 kB Committed_AS:     4256 kB PageTables:        216 kB VmallocTotal:   303104 kB VmallocUsed:      4604 kB VmallocChunk:   298468 kB
 * 1) cat meminfo

cat /proc/cmdline
root=/dev/mtdblock2 ro noinitrd cpufreq=300M rootfstype=squashfs mem=16M console=ttyS0,38400 mtdparts=5VT13XX_mapped_flash:0x10000@0x0(U-Boot),0x3D0000@0x10000(kernel),0x310000@0xD0000(romfs), 0x10000@0x3F0000(nvram),0x10000@0x3E0000(factory_default),4M@0x0(flash)
 * 1) cat cmdline

cat /proc/version
Linux version 2.6.17 (terence@cvs2) (gcc version 4.1.1) #477 Fri Apr 27 15:20:38 CST 2007
 * 1) cat /proc/version

ps aux
PID Uid     VmSize Stat Command 1 0          240 S   /bin/init noinitrd 2 0              SW  [ksoftirqd/0] 3 0              SW< [events/0] 4 0              SW< [khelper] 5 0              SW< [kthread] 10 0              SW< [kblockd/0] 46 0              SW  [pdflush] 47 0              SW  [pdflush] 48 0              SW  [kswapd0] 49 0              SW< [aio/0] 83 0              SW  [mtdblockd] 112 0          960 S   sysinit 113 0          380 S   /bin/sh 128 0          280 S   resetC 131 0          760 S < gpio_ctrl 133 0          360 S   psmon 176 0              Z   [syslogd] 179 0          264 S   syslogd 184 0          360 S < httpd 190 0          868 S   /usr/sbin/udhcpd /tmp/udhcpd.conf 191 0          212 S   easyconf 192.168.2.1 234.2.2.9 14675 192 0          248 S   easytest 192.168.2.1 234.2.2.9 14675 205 0          296 S   dnsmasq -Z br0 -n -o -u root -r /var/resolv.conf -h & 207 0          856 S   ledctrl 218 0          800 S   wan_connect 227 0          252 S   lld2d br0 3721 0          328 S   sh -c arping -qfc 1 -I br0 49.170.2.0 3722 0          268 S   arping -qfc 1 -I br0 49.170.2.0 3723 0          308 R   ps aux
 * 1) ps aux

lsmod
Module                 Size  Used by    Tainted: P rt2860ap              485736  1 fv_watch_dog           1656  0 fv_led                 4108  0 fvmac                 51796  2 rt2860ap
 * 1) lsmod