Belkin F9K1102 v2

multiple revisions of this device, use caution

abgn (AN600)
N600 DB Wireless Dual-Band N+ Router
Support	Support page
Wikipedia	Belkin
WikiDevi.wi-cat.ru	Belkin F9K1102 v2
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Status Unknown
Tomato any flavor	Incompatible
Platform
Brand • Model • Rev	Belkin F9K1102 v1
FCC ID	K7SF9K1102V2
IC ID	3623A-F9K1102V2
Board ID	AD210A-1.6
Type	wireless router
Series	F9K1102
CPU1	Realtek RTL8197D
CPU1 Type	Lexra RLX5281
CPU1 Speed	not specified
Flash1 Chip	Macronix MX25L6406EM2I-12G
Flash1 Size	8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
RAM1 Size	64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br />
RAM1 Chip	EtronTech EM6AB160TSD-5G
ETH chip1	Realtek RTL8197D
Switch	Realtek RTL8197D
Ethernet Port Count	1-100MbE-WAN 4-100MbE-LAN
Wired Standard	IEEE 802.3i/3u
802dot11 OUI: none specified
Expansion IF types	USB 2.0
USB ports	1
USB Hub Compatible	Untested
Power	12 VDC, 1 A
Connector type	barrel
Other
Manuf/OEM/ODM	SerComm
Retail
FCC approval date	02 July 2012
Country of manuf	China
Radio 1
Chip1	Realtek RTL8192CE
Wireless interface OUI	none specified
Antenna Connector Type	U.FL
MIMO status	2x2:2
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio 2
Chip1	Realtek RTL8192DR
Wireless interface OUI	none specified
Antenna Connector Type	U.FL
MIMO status	2x2:2
Wireless Standard	IEEE 802.11a/n
802.11n	up to 300 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz
CPU1 brand Radio1 chip1 brand Radio2 chip1 brand Belkin F9K1102 v1 Broadcom Broadcom Broadcom Belkin F9K1102 v2 Realtek Realtek Realtek Belkin F9K1102 v3 Broadcom Broadcom Broadcom

For a list of all currently documented Realtek chipsets with specifications, see Realtek.

For a list of all currently documented Belkin device with specifications, see Belkin.

• 300 Mbps - 2SS 5GHz 802.11n (40MHz chan.),

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = AN600 class

Overview

"AD210A-1.6" is silkscreened on the board in the FCC photos.

This is the same board ID as the Belkin F9K1105 v2.

See also: Beeline SmartBox One and SerComm

The Flash chip appears to be a MX25L6406EM2I-12G,

but this could be incorrect.

JTAG-Serial Info

Serial

Serial Pinouts

Serial speed: 38400 (8N1)

 < J22
1 - GND
2 - Tx
3 - Vcc
4 - Rx<
(38400 8N1)

Boot log

boot log

Booting... @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize @ 0000000h 0c22017h 00000c2h 0000020h 0000017h 0000000h 0000017h 0800000h @ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName @ 0010000h 0000080h 0001000h 0000800h 0000100h 0000010h 000004eh MX25L6405D @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ---RealTek(RTL8196D)at 2012.05.10-16:31+0800 v0.1 [16bit](620MHz) no sys signature at 00010000! [check_system_image] addred [0x05010000] ret [0]!!!!!!!!!!!!!! [check_system_image] addred [0x05020000] ret [2]!!!!!!!!!!!!!! no rootfs signature at 000F0000! no rootfs signature at 00130000! no rootfs signature at 00170000! no rootfs signature at 00110000! no rootfs signature at 00111000! no rootfs signature at 00112000! no rootfs signature at 00113000! no rootfs signature at 00114000! no rootfs signature at 00115000! no rootfs signature at 00116000! no rootfs signature at 00117000! no rootfs signature at 00118000! no rootfs signature at 00119000! no rootfs signature at 0011A000! no rootfs signature at 0011B000! no rootfs signature at 0011C000! no rootfs signature at 0011D000! no rootfs signature at 0011E000! no rootfs signature at 0011F000! no rootfs signature at 00120000! no rootfs signature at 00121000! no rootfs signature at 00122000! no rootfs signature at 00123000! no rootfs signature at 00124000! no rootfs signature at 00125000! no rootfs signature at 00126000! no rootfs signature at 00127000! no rootfs signature at 00128000! no rootfs signature at 00129000! no rootfs signature at 0012A000! no rootfs signature at 0012B000! no rootfs signature at 0012C000! no rootfs signature at 0012D000! no rootfs signature at 0012E000! no rootfs signature at 0012F000! no rootfs signature at 00131000! no rootfs signature at 00132000! no rootfs signature at 00133000! no rootfs signature at 00134000! no rootfs signature at 00135000! no rootfs signature at 00136000! no rootfs signature at 00137000! no rootfs signature at 00138000! no rootfs signature at 00139000! no rootfs signature at 0013A000! no rootfs signature at 0013B000! no rootfs signature at 0013C000! no rootfs signature at 0013D000! no rootfs signature at 0013E000! no rootfs signature at 0013F000! no rootfs signature at 00140000! no rootfs signature at 00141000! no rootfs signature at 00142000! no rootfs signature at 00143000! no rootfs signature at 00144000! no rootfs signature at 00145000! no rootfs signature at 00146000! no rootfs signature at 00147000! no rootfs signature at 00148000! no rootfs signature at 00149000! no rootfs signature at 0014A000! no rootfs signature at 0014B000! no rootfs signature at 0014C000! no rootfs signature at 0014D000! no rootfs signature at 0014E000! no rootfs signature at 0014F000! no rootfs signature at 00150000! no rootfs signature at 00151000! no rootfs signature at 00152000! no rootfs signature at 00153000! no rootfs signature at 00154000! no rootfs signature at 00155000! no rootfs signature at 00156000! no rootfs signature at 00157000! no rootfs signature at 00158000! no rootfs signature at 00159000! no rootfs signature at 0015A000! no rootfs signature at 0015B000! no rootfs signature at 0015C000! no rootfs signature at 0015D000! no rootfs signature at 0015E000! no rootfs signature at 0015F000! Scanning Flash Section 0... Scanning Flash Section 1... Flash Sector Number : 128. *************************************************** Sercomm Boot Version 0.0.7.0 *************************************************** Entering Firmware : Everything is OK. Jump to image start=0x80500000... decompressing kernel: Uncompressing Linux... done, booting the kernel. done decompressing kernel. start address: 0x80003470 CPU revision is: 0000dc02 Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS0,38400 root=/dev/mtdblock2 icache: 64kB/32B, dcache: 32kB/32B, scache: 0kB/0B NR_IRQS:48 PID hash table entries: 256 (order: 8, 1024 bytes) console handover: boot [early0] -> real [ttyS0] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 55568k/65536k available (2705k kernel code, 9896k reserved, 704k data, 108k init, 0k highmem) Calibrating delay loop... 616.44 BogoMIPS (lpj=308224) Mount-cache hash table entries: 512 net_namespace: 528 bytes NET: Registered protocol family 16 bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher fuse init (API version 7.11) msgmni has been set to 108 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) io scheduler noop registered io scheduler cfq registered (default) Realtek GPIO Driver for Flash Reload Default Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x18002000 (irq = 8) is a 16550A Driver 'sd' needs updating - please use bus_type methods PPP generic driver version 2.4.2 MPPE/MPPC encryption/compression module registered NET: Registered protocol family 24 RTL8192C/RTL8188C driver version 1.4 (2010-12-22) =====>>INSIDE rtl8192cd_init_one <<===== PCIE reset (0) Do MDIO_RESET 98 - 40MHz Clock Source Find Port=1 Device:Vender ID=819310ec vendor_deivce_id=819310ec =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== PCIE reset (0) Do MDIO_RESET 98 - 40MHz Clock Source Find Port=0 Device:Vender ID=819110ec vendor_deivce_id=819110ec =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== Probing RTL8186 10/100 NIC-kenel stack size order[3]... chip name: 8196C, chip revid: 0 NOT YET eth0 added. vid=9 Member port 0x1... eth1 added. vid=8 Member port 0x10... eth2 added. vid=9 Member port 0x2... eth3 added. vid=9 Member port 0x4... eth4 added. vid=9 Member port 0x8... [peth0] added, mapping to [eth1]... SPI INIT ------------------------- Force into Single IO Mode ------------------------ |No chipID Sft chipSize blkSize secSize pageSize sdCk opCk chipName | | 0 c22017h 0h 800000h 10000h 1000h 100h 86 0 MX6405D/05E/45E| ---------------------------------------------------------------------------- SPI flash(MX6405D/05E/45E) was found at CS0, size 0x800000 Creating 7 MTD partitions on "flash_bank_1": 0x000000000000-0x000000020000 : "bootloader" 0x000000020000-0x000000160000 : "Kernel" 0x000000160000-0x0000007c0000 : "rootfs" 0x0000007c0000-0x0000007d0000 : "nvram" 0x0000007d0000-0x0000007e0000 : "nv_default" 0x0000007e0000-0x0000007f0000 : "crash_log" 0x0000007f0000-0x000000800000 : "reserve" usbmon: debugfs is not available ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver b8021000=10000001 b8021054=200000 reg e0=99 reg e1=ac reg e2=98 reg e3=c1 reg e4=1 reg e5=89 reg e6=98 reg e7=1d reg f0=fc reg f1=8c reg f2=0 reg f3=11 reg f4=fb reg f5=d2 reg f6=0 rtl8652-ehci rtl8652-ehci.0: RTL8652 On-Chip EHCI Host Controller rtl8652-ehci rtl8652-ehci.0: new USB bus registered, assigned bus number 1 read synopsys=0 read synopsys2=0 rtl8652-ehci rtl8652-ehci.0: irq 10, io base 0x18021000 rtl8652-ehci rtl8652-ehci.0: USB 0.0 started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver rtl8652-ohci rtl8652-ohci.0: RTL8652 OHCI rtl8652-ohci rtl8652-ohci.0: new USB bus registered, assigned bus number 2 rtl8652-ohci rtl8652-ohci.0: irq 10, io mem 0x18020000 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected nf_conntrack version 0.5.0 (1024 buckets, 4096 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. ip_tables: (C) 2000-2006 Netfilter Core Team TCP cubic registered NET: Registered protocol family 17 Netlink[Kernel] create socket for igmp ok. VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 108k freed init started: BusyBox v1.1.0 (2013.08.23-06:43+0000) multi-call binary Starting pid 685, console /dev/console: '/etc/rcS' led_pb_api: module license 'Sercomm' taints kernel. Disabling lock debugging due to kernel taint Register LED ID <40> Register LED ID <41> Register LED ID <45> Register LED ID <46> Register LED ID <50> Register LED ID <51> Register LED ID <55> Register LED ID <60> Register LED ID <91> Register LED ID <90> min_time=1,max_time=10, device wlan1-va0 entered promiscuous mode device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state sh: cannot create /proc/dnrk_ctl: Directory nonexistent sh: cannot create /proc/dnrk_cfg: Directory nonexistent sh: cannot create /proc/dnrk_ctl: Directory nonexistent iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. start dhcpd... Starting sxuptpd br0: port 1(eth0) entering forwarding state killall: twonkyserver: no process killed USB port mode selector has been enabled Initializing USB port mode: port1 = NAS port2 = NAS usbcore: registered new interface driver sxuptp_driver Starting usbjcpd Initialize Hotplug Mount SysFS Starting HotPlug: sxhotplugd insmod USB Storage Module Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. Initialize SX NAS Plus Starting SX NAS Plus FSS Daemon: /sbin/sxnas-fssd Starting SX NAS Plus NS Daemon: /sbin/sxnas-nsd Starting jcpd Daemonizing... device wlan0 entered promiscuous mode device wlan1 entered promiscuous mode [PHY_ConfigMACWithParaFile][MACPHY_REG] >>> 92D load PHYREG ********************************** ** NOTE!! RTL8192D INTERNAL PA! ** ********************************** [phy_RF6052_Config_ParaFile][radio_a_intPA] [phy_RF6052_Config_ParaFile][radio_b_intPA] ===> Load_92D_Firmware Firmware check 8005(0) [Load_92D_Firmware][rtl8192dfw_n] <=== Load_92D_Firmware >> IQK_92D_5G_n br0: port 2(wlan0) entering learning state [PHY_ConfigMACWithParaFile][MACPHY_REG_92C] ===> Load_92C_Firmware <=== Load_92C_Firmware br0: port 3(wlan1) entering learning state br1: port 1(wlan1-va0) entering learning state br0: port 2(wlan0) entering forwarding state br0: port 3(wlan1) entering forwarding state br1: port 1(wlan1-va0) entering forwarding state killall: iwcontrol: no process killed killall: wscd: no process killed >> IQK_92D_5G_n WiFi Simple Config v2.9-wps2.0 (2013.08.26-04:11+0000). Register to wlan0 Register to wlan1 iwcontrol RegisterPID to (wlan0) iwcontrol RegisterPID to (wlan1) Register to wlan0 Register to wlan1 iwcontrol RegisterPID to (wlan0) iwcontrol RegisterPID to (wlan1) start_crond config = /tmp/cron.cfg start httpd... success. killall: igd_upnpd: no process killed start printk... success. read root xml mod file OK success. success. kill udhcpc ................. Received SIGUSR2,will release IPping: sendto: Network is unreachable ping: sendto: Network is unreachable Starting pid 3697, console /dev/console: '/bin/sh' BusyBox v1.1.0 (2013.08.23-06:43+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. ~ #

Bootloader options

bootloader options

----------------- COMMAND MODE HELP ------------------ HELP (?) : Print this help message DB <Address> <Len> DW <Address> <Len> EB <Address> <Value1> <Value2>... EW <Address> <Value1> <Value2>... CMP: CMP <dst><src><length> IPCONFIG:<TargetAddress> AUTOBURN: 0/1 LOADADDR: <Load Address> J: Jump to <TargetAddress> FLR: FLR <dst><src><length> FLW <dst_ROM_offset><src_RAM_addr><length_Byte> <SPI cnt#>: Write offset-data to SPI from RAM MDIOR: MDIOR <phyid> <reg> MDIOW: MDIOW <phyid> <reg> <data> PHYR: PHYR <PHYID><reg> PHYW: PHYW <PHYID><reg><data> PORT1: port 1 patch for FT2 SC_DL :Enter Sercomm download mode SCTFTP :RTL TFTP Server SCHTTP :Enter Sercomm http upgrade mode SC_LP :Enter Sercomm loopback test sample mode SC_RAMTEST :Enter Sercomm ram test SC_NOR_RD : sc flash read debug command SC_NOR_WR : sc flash write byte debug command SC_NOR_ER : sc flash erase debug command SC_FL_MAP: sc flash print flash map out comand SC_PHY : sc phy debug command SC_SW : sc read/write switch register commamd SC_BTVER : sc show bootloader version,with build timestamp SC_CPUREG: sc cpu register debug command SC_MP: do booting 97d_92c_92d_nfjrom SC_LED: sc led test debug command SC_GPIO: sc gpio test debug command SCLED_BLINK: sc led blink debug cmd

Partition layout (on stock firmware)

~ # cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00020000 00001000 "bootloader"
mtd1: 00140000 00001000 "Kernel"
mtd2: 00660000 00001000 "rootfs"
mtd3: 00010000 00001000 "nvram"
mtd4: 00010000 00001000 "nv_default"
mtd5: 00010000 00001000 "crash_log"
mtd6: 00010000 00001000 "reserve"