Sitecom WLR-7100

Manufacturer's site: http://www.sitecom.com/en/wi-fi-router-x7-ac1200/wlr-7100/p/1619

Supported, both variants (v1 001 and v1 002), since 1bc921f419df508c57dc07cd3e43cdf0408c17dd with errata 474aa3237c1bac86b475c3b2955e9501353a87f5.

Front:

Side:

Note: This will void your warranty!

• To remove the cover, unscrew four screws found under the rubber feet on the backside of the device.
• Then, on the frontside (the side with the indicator lights) pull the (long) side outward slightly to release four catches and pull off the front cover.

Cover (both sides shown in edited image):

Main PCB:

Backside of PCB:

→ port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Serial Port is labeled JP1 on the board and is a standard 2.54mm pin header footprint without connector soldered.

Pin 1 has 3.3V, but the signal on the TxD pin is 2.65V, so the processor probably runs at 2.65V. Putting 3.3V on the RxD pin (i.e. using a 3.3V serial adapter) might be problematic (there also seems to be a footprint on the PCB for a resistor divider, but it had a 0Ω), so add a resistor divider or level shifter to be sure.

When TxD line on UART is connected on power-on, the DDR memory training may fail (you will see some output on serial, but booting does not continue). A workaround is to disconnect TxD, power on and then directly connect TxD to catch most of the output and/or interact with uboot.

After the original firmware has booted, you can login to the shell using password: SitecomSenao

The original source code for firmware version 1.1.2 can be found at http://www.sitecomlearningcentre.com/download/firmware/gnu_gpl_source_code/626 (be patient, it can take few moments for file to be prepared).

Original:

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00800000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00750000 00010000 "Kernel"
mtd4: 00590000 00010000 "apps"
mtd5: 00040000 00010000 "manufacture"
mtd6: 00010000 00010000 "backup"
mtd7: 00050000 00010000 "storage"
mtd8: 00010000 00010000 "caldata"

Partition placement was deduced by localizing each partition's data in a backup. mtd5 manufacture 256KiB is not listed, since it contained only 0xff bytes and was impossible to exactly locate. The only place with enough 0xff bytes to accomodate it was mtd4, so mtd5 likely overlaps with the end of mtd4.

→ generic.backup general information about backups.

If you have serial access, you can create a backup of the original flash contents (see above for instructions and the login password). However, the stock firmware is very limited (it has no cut, ssh, dd and read requires an explicit argument), so the backup script in the generic backup article does not work here.

So to make a backup while running the stock firmware, insert an USB stick, login to serial and run the below script to write backup files to the USB stick:

cat /proc/mtd | tail -n+2 | while read REPLY; do
  MTD_DEV=$(echo ${REPLY} | awk -F':' '{print $1}')
  MTD_NAME=$(echo ${REPLY} | awk -F'"' '{print $2}')
  echo "Backing up ${MTD_DEV} (${MTD_NAME})"
  cat /dev/${MTD_DEV} > /tmp/usb/sda1/${MTD_DEV}_${MTD_NAME}.backup
done

1. Download original fw from http://www.sitecomlearningcentre.com/download/firmware/2739
2. SSH into device
3. mtd erase “kernel”
4. reboot
5. now the device hangs at boot with ip 192.168.99.9, set any other 192.168.99.0/24 and then access via web to 192.168.99.9.
6. upload the .dlf from sitecom site and wait

Full bootlog can be obtained by keeping TX disconnected at poweron, connecting it, entering the u-boot console with “4” and then giving a “reset” command to reset the MCU (skipping the DRAM check that reportedly prevents boot from completing when TX is connected at poweron).

U-Boot 2.0.0 (May 22 2013 - 13:25:23)
Board:MI124

sri
Wasp 1.1
wasp_ddr_initial_config(276): Wasp (16bit) ddr1 init
wasp_ddr_initial_config(426): Wasp ddr init done
DRAM: 4 MB
Top of RAM usable for U-Boot at: 80400000
Reserving 236k for U-Boot at: 803c4000
Reserving 192k for malloc() at: 80394000
Reserving 44 Bytes for Board Info at: 80393fd4
Reserving 36 Bytes for Global Data at: 80393fb0
Reserving 128k for boot params() at: 80373fb0
Stack Pointer at: 80373f98
Now running in RAM - U-Boot at: 83fc4000
id read 0xc216
venid=c2,devid=16
SPI Flash [MXIC-MX25L 6406E/6405D]: Size: 0x800000 bytes.
flash size 8388608, sector count = 128
Flash:  8 MB
BOARD IS NOT CALIBRATED!!!
In:    serial
Out:   serial
Err:   serial
Net:   ag934x_enet_initialize...
No valid address in Flash. Using fixed address
 wasp  reset mask:c03300 
WASP  ----> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs17_reg_init: complete
eth0 up
eth0
ag934x_enet_initialize...
No valid address in Flash. Using fixed address
 wasp  reset mask:c03300 
WASP  ----> S17 PHY *
: cfg1 0xf cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
 0 
   
3: System Boot system code via Flash.
## Booting image at 9f040000 ...
   Image Name:   Linux Kernel Image
   Created:      2015-12-09   9:35:22 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1834635 Bytes =  1.7 MB
   Load Address: 80002000
   Entry Point:  80006110
   Verifying Checksum at 0x9f040040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80006110) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

Booting Atheros AR934x
init started: BusyBox v1.7.5 (2015-12-09 17:30:42 CST)
starting pid 809, tty '/dev/console': '/sbin/config_init'
mknod: /dev/ttyS0: File exists
mknod: /dev/ttyS1: File exists
Config Init version: 1.8.0.1 date: 2015/12/09
Thu Jan  1 00:00:00 UTC 2015
ln: /lib/./modules: File exists
insmod: can't open '/lib/ar8327_drv.ko': No such file or directory
starting pid 864, tty '/dev/ttyS0': '/sbin/config_term'
************************************************************************
*                                 WLR-7100                             *
************************************************************************

KernelApp/Ramdisk Ver:1.8.0.1                    Date:2015/12/09

U-Boot 2.0.0 (May 22 2013 - 13:25:23)
ar7240> printenv
bootdelay=4
baudrate=115200
ethaddr="64:D1:A3:3C:98:F5"
sn=167245176
hw_ver=1.0.0
hw_id=02261055
pro_id=000
country=000
domain=1
op_mode=0
wanaddr=64:D1:A3:3C:98:F7
wlanaddr=00:AA:BB:CC:DD:12
snextra=167245176***********
bootfile=uImage
dir=
bc=mi124_f1e
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize;cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}${bc}-jffs2&&erase 0x9f050000 +$filesize;cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux_${bc}.lzma.uImage&&erase 0x9f300000 +$filesize;cp.b $fileaddr 0x9f300000 $filesize
ethact=eth0
bootargs=console=ttyS0,115200 root=31:03 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:192k(u-boot),64k(u-boot-env),896k(uImage),6912k(rootfs),64k(NVRAM),64k(ART)
ipaddr=192.168.99.9
serverip=192.168.99.8
uboot_ver=2.0.0.3
stdin=serial
stdout=serial
stderr=serial

Environment size: 855/65532 bytes
ar7240> imls
Image at 9F040000:
   Image Name:   Linux Kernel Image
   Created:      2015-12-09   9:35:22 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1834635 Bytes =  1.7 MB
   Load Address: 80002000
   Entry Point:  80006110
   Verifying Checksum ... OK

How to add tags