Belkin F5D8230-4 v1xxx

One of Belkin's “Pre-N” routers. This page is specifically about the v1xxx units with Broadcom BCM4704KPB SoC, and research is based on a v1002 unit.

→ Install OpenWrt (generic explanation)

1. Best practice is to have 2 network connections. One for the router LAN Port 1 and second to wifi or live connection, so that this will ensure there is an active connection.
2. Statically set the machine's network connection LAN Port 1 on the router to IP address 192.168.2.* (not .1) and net mask to 255.255.255.0
3. Then enter this TFTP command in terminal ...$ echo -en “rexmt 1\ntrace\nbinary\nput [File]\nquit\n” | tftp 192.168.2.1
   Note: Make sure you change the [File] to the correct information.
4. Power up the router.

A successful flash will look like this:

...$echo -en "rexmt 1\ntrace\nbinary\nput openwrt-brcm47xx-squashfs.trx\nquit\n" | tftp 192.168.2.1
Packet tracing on. 
sent WRQ <file=openwrt-brcm-2.4-squashfs.trx, mode=octet>
sent WRQ <file=openwrt-brcm-2.4-squashfs.trx, mode=octet>
sent WRQ <file=openwrt-brcm-2.4-squashfs.trx, mode=octet>
...
received ACK <block=0>
sent DATA <block=1, 512 bytes>
received ACK <block=1>
sent DATA <block=2, 512 bytes>
...
sent DATA <block=2953, 0 bytes>
received ACK <block=2953>
Sent 1511424 bytes in 12.7 seconds

Note: If the script times out the first time, turn the router off and go back to step 3.

Note: If the script fails multiple times, try running an infinite ping of 192.168.2.1 as you power on the router to confirm network cabling and settings are correct.

Note: The original Belkin firmware is configured to use 192.168.2.1.

1. Using a Hex Editor change the signature on the firmware file to 00-2f-01-02. It is only the first 4 keys.
2. In Belkin Router's web GUI upload the image file as any other update.

                     .-OpenWrt---------------------.
                     | .-----.                     |
                     | | br0 |--------------.      |
                     | '-----'              |      |
                     |    |                 |      |
                     | .------. .------. .-------. |
                     '-| eth0 |-| eth1 |-| wlan0 |-'
                       '------' '------' '-------'
                          |        |        |
                          |        '---.    |
    .-switch--------------|----------. |    |
    | .-vlan0-------------|--.       | |    |
    | |                .--|--+-vlan1 | |    |
    | |[0] [1] [2] [3] | [5] | [4] | | |    |
    | '-|---|---|---|--+-----'     | | |    |
    |   |   |   |   |  '-----------' | |    |
    '---|---|---|---|----------------' |    |
        |   |   |   |      .-----------'    |
        |   |   |   |      |       .--------'
        |   |   |   |      |       |
    .---|---|---|---|------|-------|----.
    |  [1] [2] [3] [4]   [wan]   [wifi] |
    '-case------------------------------'

This design is different from many units which use a single interface to handle both LAN & WAN traffic, so performance should be better.

Note: that internal switch port 4 is not externally available.

Model Number v1002

Note: This will void your warranty! If that matters now....

• There are 4 cross head #1 screws holding the case closed
• There are 4 cross head #1 screws holding the board to the top case

There is a 4-pin white header (“JP1”) inside the system can which is the serial port. This is the confirmed pinout, and the terminal settings are 115200 8N1:

Direction here is relative the device. So, “output” would connect to the PC “input” so you could see the console data and “input” would connect to the PC “output” so you could enter commands. All the usual Tx and Rx stuff gets confusing so I went with this more descriptive method.

→ port.serial general information about the serial port, serial port cable, etc.

→ See port.jtag for more JTAG details.

→ See port.gpio for more GPIO details.

Note: Keep the Firmware size below 3.5 MB even though it is a 4 MB Flash the CFE takes 500 KB

• Mathew Handau Posting

1. Download modified OpenWrt firmware with a web browser from http://www.box.net/shared/nvjez74rj9

2. Download Belkin GPL tarball (containing not-GPL binary drivers) wget http://www.belkin.com/support/opensource/files/F5D8230v1_1.00.06_GPL.tar.gz

3. Configure your PC wired network interface so it is on the same subnet as 192.168.2.1 ifconfig eth0 inet 192.168.2.2

4. Wire your your PC wired network interface to one of the LAN network interfaces of the router using either a switch, a cross-over cable, or a PC network interface that does the cross-over for you.

5. Use tftp procedures to flash the router 7. Configure your PC wired network interface so it is on the same subnet as 192.168.1.1 ifconfig eth0 inet 192.168.1.2 8. Telnet to the router telnet 192.168.1.1 9. On the router; set a password for root (this will enable ssh access). You will be prompted to type the password twice. passwd 10. On the PC; extract Belkin GPL tarball tar zxvf MIMO_GPL_1.00.06.tgz 11. On the PC; rename and copy the relevant files to the router (router password will be required for each scp)

cd MIMO_GPL_1.00.06/src/askey/Airgo/linux/
mv ccd ccd.o
mv wns_mod wns_mod.o
mv mac-asic.out mac-asic.o
scp rtai_sched.o ccd.o wns_mod.o mac-asic.o poldrv.o root@192.168.1.1:/lib/modules/2.4.20/airgo/
scp wsm aniSdkTool ani8021x_aa root@192.168.1.1:/usr/sbin/
scp 1x* wni* wsmC* wsmD* root@192.168.1.1:/etc/airgo/

Note: If prompted to continue connecting type yes. Note: If this is the second time you have flashed the router, or you've previously used ssh to connect to a different router, then to scp you may need to remove the 192.168.1.1 entry from ~/.ssh/known_hosts, or just delete ~/.ssh/known_hosts.

12. On the router; run the airgo script sh -x /etc/rc.common /etc/init.d/airgo start 13. On the router; Configure the newly created wlan0 interface (alternatively this can be persisted by configuring /etc/config/network and rebooting) ifconfig wlan0 inet 192.168.3.1 14. On the PC; disconnect the wire, join the OpenWrt wireless network, configure your wireless network interface settings and ping the router.

ifconfig wlan0 inet 192.168.3.2
ping 192.168.3.1

So at this point you should have the Airgo up and running as an access point (with no bridging). You probably wish to change some of the wifi settings such as specifying the wifi channel and enabling WPA. For now this has to be done by editing the /etc/init.d/airgo script, specifically the aniSdkTool commands. Here's the lines you're looking for:

/usr/sbin/aniSdkTool -s ndn 0 2 # network density?
  /usr/sbin/aniSdkTool -s ssid OpenWrt
  /usr/sbin/aniSdkTool -s open 1 # no security
  #/usr/sbin/aniSdkTool -s open 0
  #/usr/sbin/aniSdkTool -s wpa 1 1 0
  #/usr/sbin/aniSdkTool -s psk yourpassphrase
  /usr/sbin/aniSdkTool -s chn 0 1 # channel 1 on radio 0
  /usr/sbin/aniSdkTool -s cga

Every time you run the aniSdkTool command it will update config files in /var/, which are symlinked back to /etc/airgo/. The original config files from the MIMO tgz have useful comments which are lost so check the original files for information on parameters. Run the aniSdkTool command with no parameters for more information. The final aniSdkTool command (-cga) commits the settings. Commit works well the first time, but if you try to commit a second time it will attempt to unload mac-asic.out (which fails because it had to be renamed mac-asic.o), so you must rmmod mac-asic.o, but first terminate the wsm or ani8021x_aa processes else things will crash and the router reboots. Work left to be done is writing up a /lib/wifi/airgo.sh script to integrate with /etc/config/wireless. But I've got other projects going on so anyone interested should go ahead and write that script. Good luck. update: It looks like the Belkin GPL tarball doesn't decompress with standard linux gzip. I'm not sure what sort of gzip they used, or perhaps the files are just corrupt. If anyone succeeds in decompressing a Belkin tarball then perhaps you can share what utility you used? update2: I've opened a question on the Belkin website informing them of the corrupt GPL files and asking for them to fix said files. In the mean time, contact me via email and I will send you the relevant modules and utilties from the original MIMO_GPL_1.00.06.tgz.

Currently Create a standard build

 System  BCM947xx/953xx
 Profile   Broadcom SoC, b44 Ethernet, NO Wifi

Download

git clone git://git.sipsolutions.net/agnx.git

Build-able source code is available

• For 1.00.06 firmware - http://web.belkin.com/r.asp?url=/support/gpl/MIMO_GPL_1.00.06.tgz

• Finding mixed reports about vLANs and 5325A2KQM chipset so for now, I disabled vLANs.
• The most interesting thing about this chipset is that it has 2 ethernet connections ...

5325A2KQM Fact Sheet

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan'
        option ifname 'eth0'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'

config interface 'wan'
        option ifname 'eth1'
        option proto 'dhcp'

• Found Matthew Handau Posting

config 'interface' 'loopback'
    option 'ifname' 'lo'
    option 'proto' 'static'
    option 'ipaddr' '127.0.0.1'
    option 'netmask' '255.0.0.0'

config 'switch' 'eth0'
    option 'vlan0' '0 1 2 3 5*'
    option 'vlan1' '0 5'
    
config 'interface' 'wan'
        option 'ifname'   'eth1'
        option 'proto'    'dhcp'
               
config 'interface' 'lan'
    option 'ifname' 'eth0'
    option 'proto' 'static'
    option 'netmask' '255.255.255.0'
    option 'ipaddr' '192.168.1.1'

• I set use rc.local in the /etc to correct the NVRAM issues

nvram set et0phyaddr=0
nvram set boardflags=0x0388
nvram commit

Note: For some reason the b44/b53 driver finds the eth0 phy address at 0 instead of Belkin firmware's 30 and setting it to 0 also crashes the probe.

Stack Trace

b44: Broadcom 44xx/47xx 10/100 PCI ethernet driver version 2.0
[    5.660000] ------------[ cut here ]------------
[    5.670000] WARNING: at drivers/net/phy/b53/b53_mdio.c:69 b53_mdio_op+0xf0/0xf8()
[    5.680000] Modules linked in: b44(+)
[    5.680000] CPU: 0 PID: 149 Comm: kmodloader Not tainted 3.10.28 #1
[    5.690000] Stack : 00000006 00000000 00000000 00000000 00000000 00000000 8033d18e 00000037
[    5.690000]    80921290 8027616c 8031d104 802c525b 00000095 00000030 8087bd80 00000000
[    5.690000]    80c4c204 8002672c 00000003 8002406c 00000000 00000000 802784e0 80c61894
[    5.690000]    80c61800 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    5.690000]    00000000 00000000 00000000 00000000 00000000 00000000 00000000 80c61820
[    5.690000]    ...
[    5.720000] Call Trace:
[    5.720000] [<80010dd4>] show_stack+0x48/0x70
[    5.730000] [<80024168>] warn_slowpath_common+0x78/0xa8
[    5.730000] [<800241b0>] warn_slowpath_null+0x18/0x24
[    5.740000] [<80193cf8>] b53_mdio_op+0xf0/0xf8
[    5.740000] [<80194224>] b53_mdio_read8+0x2c/0x64
[    5.750000] [<801920f4>] b53_switch_detect+0x40/0x22c
[    5.750000] [<80193bc4>] b53_phy_probe+0x64/0xa8
[    5.760000] [<8018dbb4>] phy_probe+0x7c/0xa8
[    5.760000] [<8016515c>] driver_probe_device+0xd0/0x1f4
[    5.770000] [<80163690>] bus_for_each_drv+0x5c/0xac
[    5.770000] [<8016504c>] device_attach+0x78/0xa0
[    5.780000] [<801644f0>] bus_probe_device+0x3c/0xcc
[    5.780000] [<80162978>] device_add+0x3f8/0x568
[    5.790000] [<8018e98c>] phy_device_register+0x44/0x8c
[    5.790000] [<8018eee0>] mdiobus_scan+0xb8/0xe8
[    5.800000] [<8018f0cc>] mdiobus_register+0x11c/0x1c0
[    5.800000] [<80ee2a24>] 0x80ee2a24
[    5.810000] 
[    5.810000] ---[ end trace 62d2a2b23d969f94 ]---
[    5.810000] Broadcom B53 (3): probe of 1:00 failed with error -5
[    5.820000] libphy: b44_eth_mii: probed
[    5.820000] b44 ssb0:0: attached PHY driver [Generic PHY] (mii_bus:phy_addr=1:00)
[    5.830000] b44 ssb0:0 eth0: Broadcom 44xx/47xx 10/100 PCI ethernet driver 00:90:96:00:00:00
[    5.850000] libphy: b44_eth_mii: probed
[    5.860000] adm6996: adm6996_gpio: ADM6996L model PHY found.
[    5.890000] b44 ssb0:1: could not find PHY at 0, use fixed one
[    5.890000] b44 ssb0:1: attached PHY driver [Generic PHY] (mii_bus:phy_addr=fixed-0:00)
[    5.900000] b44 ssb0:1 eth1: Broadcom 44xx/47xx 10/100 PCI ethernet driver 00:90:96:00:00:01
[    6.700000] b44 ssb0:0 eth0: Link is up at 100 Mbps, half duplex
[    6.710000] b44 ssb0:0 eth0: Flow control is off for TX and off for RX
[   11.650000] b44 ssb0:0 eth0: powering down PHY

belkin_router=1
boardflags=0x0388
boardtype=0x0100
boot_flash_addr=bfc00000
boot_wait=on
bpa_manual_enable=
bpa_server=
bpa_state=
bpa_username=
BridgeFlag=0
burnin=0
ceb_email_enable=1
ceb_expire=0
ceb_nag=1
ceb_subsc=2
ceb_timeout=10
ceb_unavail_block=1
clkfreq=264
console_loglevel=1
cpu_type=0x4704
def_et1macaddr=00:90:96:00:00:01
default_lan_dhcp_client_br=0
default_lan_dhcp_client_nat=0
default_lan_gateway=192.168.2.1
default_lan_ipaddr=192.168.2.1
default_lan_ipaddr_br=192.168.2.254
default_lan_netmask=255.255.255.0
default_lan_netmask_br=255.255.255.0
default_lan_proto_br=static
default_lan_proto_nat=dhcp
default_policy=0
device_type=1
dhcp_autodns=1
dhcp_dns=
dhcp_end=192.168.2.100
dhcp_lease=0
dhcp_start=192.168.2.2
dl_ram_addr=a0001000
dmz_ipaddr=
dos_enable=1
dumpfilename=gram_capture.txt
dyndns_auto=1
dyndns_hostname=
dyndns_password=
dyndns_username=
epi_ttcp_host=192.168.2.100
et0macaddr=00:90:96:00:00:00
et0mdcport=0
et0phyaddr=30
et1macaddr=00:90:96:00:00:01
et1macaddr_copy=
et1mdcport=1
et1phyaddr=0
fg=
fi=
filter_enable=1
firewall_enable=1
fj=
fm=
ft=
fu=
fw_auto_detect=0
fw_id=   
fw_magic=0x02012200
fw_reset=0
fw_src=http://networking.belkin.com/update/files/usa/mimo/g_router.html
fwi=
fwi_des=
fwt=
fwu=
gain=d
http_lanport=80
http_passwd=
http_username=
http_wan_enable=0
http_wanport=80
hw_model=F5D8230-4
iappd_oid=00:30:bd
init_done=1
internal_policy=1
ip_filter=0
kernel_mods=et
lan_dhcp_client=0
lan_dns=
lan_gateway=192.168.2.1
lan_hwaddr=00:90:96:00:00:00
lan_hwnames=et0 il0 wl0 wl1
lan_ifname=br0
lan_ifnames=eth0 eth2
lan_ipaddr=192.168.2.1
lan_netmask=255.255.255.0
lan_proto=dhcp
lan_stp=0
language=English
log_level=0
log_tftp=0
log_tftp_server=
login_timeout=10
m_autodns=1
m_lan_ipaddr=192.168.2.1
m_lan_netmask=255.255.255.0
m_wan_aliasip=
m_wan_dns=
m_wan_domain=Belkin
m_wan_gateway=
m_wan_hostname=
m_wan_ipaddr=
m_wan_moreip=
m_wan_netmask=
m_wan_wins=
mac_filter=0
NatFlag=1
ntp_dst_enabled=1
ntp_enable=1
ntp_server=192.43.244.18
ntp_sync_interval=1
ntp_timezone=5
opo=0x0
os_flash_addr=bfc40000
os_name=linux
os_ram_addr=80001000
os_server=
os_version=1.01.03
pa0maxpwr=60
pmon_ver=2.02.00
pppoe_auth_mode=auto
pppoe_autodns=1
pppoe_demand=0
pppoe_dns=
pppoe_idletime=300
pppoe_idletime_min=5
pppoe_ifname=eth1
pppoe_keepalive=1
pppoe_mtu=1454
pppoe_passwd=
pppoe_servicename=
pppoe_username=
pptp_conn_id=
pptp_idle_disconnect=
pptp_idle_interval=
pptp_ipaddr=
pptp_netmask=
pptp_password=
pptp_server_ipaddr=
pptp_username=
RADIO_MODULE=airgo
radioID=0
remote_config_ip=
reset_gpio=7=0
restore_defaults=0
route_check_host=heartbeat.belkin.com
scratch=a0180000
sdram_config=0x0000
sdram_init=0x0419
sdram_ncdl=0x5
sdram_refresh=0x8040
size: 4098 bytes (28670 left)
ssid_updated=0
static_route=
stats_server=
tcp_filter=0
test_delay=0
tftpServer=192.168.2.100
tftp_ipaddr=192.168.2.1
time_zone=PST8PDT
timer_interval=3600
udp_filter=0
upgrade_country_code_done=1
upnp_enable=0
user_conf_ver=1.01
user_time_dd=1
user_time_hr=0
user_time_mn=0
user_time_mo=1
user_time_update=0
user_time_yr=1970
wan_dns=
wan_domain=
wan_gateway=
wan_hostname=
wan_hwname=et1
wan_ifname=eth1
wan_ifnames=
wan_ipaddr=192.168.10.32
wan_lease=21600
wan_netmask=255.255.255.0
wan_ping=1
wan_proto=dhcp
wan_wins=
wl0_ifname=wlan0
wl_afterburner=auto
wl_auth=0
wl_auth_mode=disabled
wl_bcn=100
wl_channel=0
wl_closed=0
wl_country=USA
wl_country_code=US
wl_crypto=tkip
wl_density=0
wl_dtim=1
wl_frag=2346
wl_frameburst=off
wl_gmode=1
wl_gmode_protection=auto
wl_hwaddr=
wl_ibss=1
wl_ifname=eth2
wl_key1=F
wl_key2=
wl_key3=
wl_key4=
wl_key=1
wl_lazywds=0
wl_mac=
wl_mac=
wl_maclist=
wl_macmode=disabled
wl_mode=ap
wl_phytype=g
wl_phytypes=g
wl_plcphdr=long
wl_proximity=0
wl_psk_obscure=
wl_qos=1
wl_radio=1
wl_radius_ipaddr=
wl_radius_key=
wl_radius_maxtries=3
wl_radius_port=1812
wl_radius_timeout=30
wl_rate=0
wl_rateset=set2
wl_rts=2347
wl_ssid=Belkin_Pre-N_000000
wl_ssid_d=Belkin_Pre-N_
wl_unit=0
wl_wds=
wl_wep128_manual=1
wl_wep64_manual=1
wl_wep=off
wl_wep_mode=0
wl_wme=1
wl_wpa_gtk_rekey=900
wl_wpa_psk=

How to add tags