Sitecom WLR-4100 V1 002
The V1 001 variant is equipped with different HW: Ralink 3352F + RTL8367RB
Supported Versions
Hardware Highlights
Installation
- Connect to one of LAN (yellow) ethernet ports,
- Open router configuration interface, go to Toolbox > Firmware
- Browse for OpenWrt factory image with dlf extension and hit Apply
- Wait few minutes, after the Power LED will stop blinking, the router is ready for configuration.
Reverting to OEM firmware
Download OEM WLR-4100v1002-firmware-v27.dlf firmware file to /tmp on your PC.
Decode OEM firmware
Decode .dlf via mkseanofw found in staging_dir/host/bin of OpenWrt buildroot
./mksenaofw -d /tmp/WLR-4100v1002-firmware-v27.dlf -o /srv/tftp/uImageWLR-5100v1002.bin
The file name matches the TFTP name stored in boot-env (bootfile=uImageWLR-5100v1002.bin).
binwalk of the resulting file:
binwalk /srv/tftp/uImageWLR-5100v1002.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 uImage header, header size: 64 bytes, header CRC: 0x3CACD51F, created: 2015-12-15 03:17:56, image size: 1828528 bytes, Data Address: 0x80000000, Entry Point: 0x8000C110, data CRC: 0xF7AB3F67, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image" 64 0x40 LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 4662392 bytes 1830912 0x1BF000 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3313008 bytes, 359 inodes, blocksize: 131072 bytes, created: 2015-12-15 03:17:40
Option 1 serial console
- Boot Serial Console and Press Key 2
- Use TFTP server with Image oem.bin
Option 2 CLI
Copy decoded firmware to the device and access in it
scp /srv/tftp/uImageWLR-5100v1002.bin root@192.168.1.1:/tmp ssh root@192.168.1.1
Force sysupgrade:
-F because factory firmware does not match openwrt standard
-n clearing configuration
sysupgrade -n -v -F /tmp/uImageWLR-5100v1002.bin
Hardware
Info
| Architecture | mipsel_24kc |
|---|---|
| Vendor | MediaTek |
| Bootloader | U-Boot |
| System-On-Chip | MediaTek MT7620A - MIPS 24K |
| CPU/Speed | 580 MHz but OpenWrt log shows 600 MHz. |
| Flash-Chip | MX25L6406E |
| Flash size | 8 MiB |
| RAM | 64 MiB |
| Wireless | MT7620A 2.4GHz 802.11bgn |
| Ethernet | 1 Gbit/s with VLAN support |
| Switch | Qualcomm Atheros QCA8337 |
| USB | 1x 2.0 |
| Serial | Yes |
| JTAG | Not populated |
Flash Layout
| Layer0 | raw flash | |||||||
|---|---|---|---|---|---|---|---|---|
| Layer1 | bootloader (192K) | Config (64K) | Factory (64K) | OpenWrt firmware partition | Backup (64K) | Storage (64K) |
||
| Layer2 | Linux Kernel | rootfs mounted: “ /”, OverlayFS with /overlay |
||||||
| Layer3 | /dev/root mounted: “ /rom”, SquashFS size depends on selected packages | rootfs_data mounted: “ /overlay”, JFFS2 “free” space |
||||||
Photos
The external case is like some others Sitecom switches (i.e. wlr-7100 except for the 5GHz WiFi led)
In fact behind the cover we can see a kind of selector:
The blue Ethernet RJ45 connector (WAN) is connected to port 5 of QCA 8337 then we have other 4 yellow RJ45 connector below:
- LAN 1 connected to port 4 of QCA8337
- LAN 2 connected to port 3 of QCA8337
- LAN 3 connected to port 2 of QCA8337
- LAN 4 connected to port 1 of QCA8337
PCB
The PCB looks the same as WLR-5100 with missing 5GHz WiFi chip.
Opening the case
Remove the 4 rubber adhesive feet:
Unscrew the screws behind. Then pull on the 2 teeth on the long side:
and on a single tooth on the short side
Serial
→ port.serial general information about the serial port, serial port cable, etc.
| Serial connection parameters | 115200, 8N1 |
|---|
Serial port is labeled J2 on the board and is a standard 2.54mm pin header footprint with connector.
| Pin Out | ||||
|---|---|---|---|---|
| Pin | 1 | 2 | 3 | 4 |
| Function | 3v3 | GND | TxD | RxD |
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
No connector on JTAG pads :
Bootlogs
OEM bootlog
U-boot Ver:1.0.0.1 2013/05/23 14:40:54 Board: Ralink APSoC DRAM: 64 MB spi_wait_nsec: 28 spi device id: c2 20 17 c2 20 (2017c220) find flash: MX25L6405D Flash size 8MB, sector count = 128 ============================================ ASIC 7620_MP (Port5<->GigaSW) Product Name: WLR-4100v1002 Please choose the operation: 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 9: Load Boot Loader code then write to Flash via TFTP. You choosed 3 0 3: System Boot system code via Flash. ## Booting image at bc050000 ... Image Name: Linux Kernel Image Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1826190 Bytes = 1.7 MB Load Address: 80000000 Entry Point: 8000c110 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... LINUX started... THIS IS ASIC init started: BusyBox v1.13.3 (2014-02-21 19:07:17 CST) starting pid 746, tty '/dev/console': '/sbin/config_init' mknod: /dev/ttyS0: File exists mknod: /dev/ttyS1: File exists Config Init version: 1.4.1.24 date: 2014/02/21 Wed Jan 1 00:00:00 UTC 2014 ln: /lib/./modules: File exists starting pid 795, tty '/dev/ttyS1': '/sbin/config_term' ************************************************************************ * WLR-4100v1002 * ************************************************************************ KernelApp/Ramdisk Ver:1.4.1.24 Date:2014/02/21 password:
After the original firmware has booted, you can login to the shell using password: SitecomSenao
The U-Boot menu has some extra unlisted option like:
0: System Load Linux then write to Flash via Serial.
1: System Load Linux to SDRAM via TFTP.
4: System Enter Boot Command Line Interface.
8: System Load UBoot to SDRAM via TFTP.
Allowing the execution of the code in RAM without touching the Flash
The TFTP client (192.168.99.9) looks for a uImageWLR-5100v1002.bin file on Server (192.168.99.8).
I played with option 4:
U-boot commands
MT7620 # help ? - alias for 'help' bootm - boot application image from memory cp - memory copy erase - erase SPI FLASH memory go - start application at address 'addr' help - print online help loadb - load binary file over serial line (kermit mode) md - memory display mdio - Ralink PHY register R/W command !! mm - memory modify (auto-incrementing) nm - memory modify (constant address) printenv- print environment variables reset - Perform RESET of the CPU rf - read/write rf register saveenv - save environment variables to persistent storage setenv - set environment variables tftpboot- boot image via network using TFTP protocol version - print monitor version MT7620 # bootm ## Booting image at 80100000 ... Bad Magic Number,FFBFFBFF MT7620 # printenv bootcmd=tftp bootdelay=1 baddrate=115200 ethaddr="xx:xx:xx:xx:xx:xx" ipaddr=192.168.99.9 serverip=192.168.99.8 sn=xxxxxxxxx hw_ver=1.0.0 hw_id=0222104A pro_id=000 country=000 domain=1 op_mode=0 wanaddr=xx:xx:xx:xx:xx:xx wlanaddr=xx:xx:xx:xx:xx:xx iNICaddr=xx:xx:xx:xx:xx:xx eth_en=0 snextra=********* bootfile=uImageWLR-5100v1002 uboot_ver=1.0.0.1 sku_table=0 language_code=uk stdin=serial stdout=serial stderr=serial Environment size: 429/4092 bytes MT7620 # version U-Boot 1.1.3 (May 23 2013 - 14:40:54)
OpenWrt bootlog
Starting kernel ... [ 0.000000] Linux version 4.14.180 (andrea@tubo-wd) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11063-85e04e9f46)) #0 Sat May 16 18:32:20 2020 [ 0.000000] Board has DDR2 [ 0.000000] Analog PMU set to hw control [ 0.000000] Digital PMU set to hw control [ 0.000000] SoC Type: MediaTek MT7620A ver:2 eco:3 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019650 (MIPS 24KEc) [ 0.000000] MIPS: machine is Sitecom sw48 WLR-4100 v1 002 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] random: get_random_bytes called from start_kernel+0x90/0x478 with crng_init=0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Writing ErrCtl register=0006f7fa [ 0.000000] Readback ErrCtl register=0006f7fa [ 0.000000] Memory: 58684K/65536K available (3709K kernel code, 174K rwdata, 864K rodata, 1196K init, 208K bss, 6852K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 256 [ 0.000000] CPU Clock: 600MHz [ 0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns [ 0.000000] systick: enable autosleep mode [ 0.000000] systick: running - mult: 214748, shift: 32 [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6370868154 ns [ 0.000011] sched_clock: 32 bits at 300MHz, resolution 3ns, wraps every 7158278654ns [ 0.007588] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656) [ 0.073573] pid_max: default: 32768 minimum: 301 [ 0.078295] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.084657] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.097595] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.107154] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.113114] pinctrl core: initialized pinctrl subsystem [ 0.118684] NET: Registered protocol family 16 [ 0.148974] rt2880_gpio 10000600.gpio: registering 24 gpios [ 0.154370] rt2880_gpio 10000600.gpio: registering 24 irq handlers [ 0.160768] rt2880_gpio 10000638.gpio: registering 16 gpios [ 0.166144] rt2880_gpio 10000638.gpio: registering 16 irq handlers [ 0.172502] rt2880_gpio 10000660.gpio: registering 32 gpios [ 0.177876] rt2880_gpio 10000660.gpio: registering 32 irq handlers [ 0.184248] rt2880_gpio 10000688.gpio: registering 1 gpios [ 0.189538] rt2880_gpio 10000688.gpio: registering 1 irq handlers [ 0.200542] clocksource: Switched to clocksource systick [ 0.206840] NET: Registered protocol family 2 [ 0.211865] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.218586] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.224813] TCP: Hash tables configured (established 1024 bind 1024) [ 0.231096] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.236722] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.243101] NET: Registered protocol family 1 [ 0.249977] rt-timer 10000100.timer: maximum frequency is 1220Hz [ 0.256661] Crashlog allocated RAM at address 0x3f00000 [ 0.263468] workingset: timestamp_bits=30 max_order=14 bucket_order=0 [ 0.275355] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.281003] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.300378] io scheduler noop registered [ 0.304186] io scheduler deadline registered (default) [ 0.309997] gpio-export gpio_export: 1 gpio(s) exported [ 0.315299] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 0.322571] console [ttyS0] disabled [ 0.326022] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103 [ 0.335695] console [ttyS0] enabled [ 0.335695] console [ttyS0] enabled [ 0.342726] bootconsole [early0] disabled [ 0.342726] bootconsole [early0] disabled [ 0.356307] spi spi0.0: force spi mode3 [ 0.361061] m25p80 spi0.0: mx25l6405d (8192 Kbytes) [ 0.366096] 6 fixed-partitions partitions found on MTD device spi0.0 [ 0.372631] Creating 6 MTD partitions on "spi0.0": [ 0.377529] 0x000000000000-0x000000030000 : "uboot" [ 0.383423] 0x000000030000-0x000000040000 : "config" [ 0.389309] 0x000000040000-0x000000050000 : "factory" [ 0.395350] 0x000000050000-0x0000007e0000 : "firmware" [ 0.404366] 2 uimage-fw partitions found on MTD device firmware [ 0.410419] Creating 2 MTD partitions on "firmware": [ 0.415558] 0x000000000000-0x000000185d40 : "kernel" [ 0.421513] 0x000000185d40-0x000000790000 : "rootfs" [ 0.427341] mtd: device 5 (rootfs) set to be root filesystem [ 0.434718] 1 squashfs-split partitions found on MTD device rootfs [ 0.441102] 0x000000398000-0x000000790000 : "rootfs_data" [ 0.447481] 0x0000007e0000-0x0000007f0000 : "backup" [ 0.453447] 0x0000007f0000-0x000000800000 : "storage" [ 0.460173] libphy: Fixed MDIO Bus: probed [ 0.473613] libphy: mdio: probed [ 0.477681] Probe mdio address:0 [ 0.482441] Phy probe: switch0: Atheros AR8337 rev. 2 switch registered on mdio-bus [ 0.490962] ar8327_phy_fixup phy:0 chip_rev2 [ 0.495795] ar8327_phy_fixup phy:1 chip_rev2 [ 0.500623] ar8327_phy_fixup phy:2 chip_rev2 [ 0.505452] ar8327_phy_fixup phy:3 chip_rev2 [ 0.510278] ar8327_phy_fixup phy:4 chip_rev2 [ 0.736201] mtk_soc_eth 10100000.ethernet: using fixed link parameters [ 0.743051] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver [ 0.749764] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5 [ 0.758688] rt2880_wdt 10000120.watchdog: Initialized [ 0.765169] NET: Registered protocol family 10 [ 0.773735] Segment Routing with IPv6 [ 0.777585] NET: Registered protocol family 17 [ 0.782246] 8021q: 802.1Q VLAN Support v1.8 [ 0.803226] VFS: Mounted root (squashfs filesystem) readonly on device 31:5. [ 0.816781] Freeing unused kernel memory: 1196K [ 0.821444] This architecture does not have kernel memory protection. [ 2.059378] random: fast init done [ 2.240486] init: Console is alive [ 2.244197] init: - watchdog - [ 4.381977] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 4.642174] usbcore: registered new interface driver usbfs [ 4.647861] usbcore: registered new interface driver hub [ 4.653465] usbcore: registered new device driver usb [ 4.664656] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 4.679636] SCSI subsystem initialized [ 4.688647] ehci-platform: EHCI generic platform driver [ 4.697161] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 4.704896] ohci-platform: OHCI generic platform driver [ 4.720570] phy phy-usbphy.0: remote usb device wakeup disabled [ 4.726617] phy phy-usbphy.0: UTMI 16bit 30MHz [ 4.731180] ohci-platform 101c1000.ohci: Generic Platform OHCI controller [ 4.738140] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 1 [ 4.746323] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000 [ 4.780338] hub 1-0:1.0: USB hub found [ 4.784563] hub 1-0:1.0: 1 port detected [ 4.796336] usbcore: registered new interface driver usb-storage [ 4.803211] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 4.812069] init: - preinit - [ 6.176894] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex) [ 6.185655] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 6.191616] 8021q: adding VLAN 0 to HW filter on device eth0 [ 6.197687] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 6.346075] random: procd: uninitialized urandom read (4 bytes read) [ 8.131767] jffs2: notice: (407) jffs2_build_xattr_subsystem: complete building xattr subsystem, 3 of xdatum (2 unchecked, 1 orphan) and 10 of xref (1 dead, 0 orphan) found. [ 8.150126] mount_root: switching to jffs2 overlay [ 8.192042] overlayfs: upper fs does not support tmpfile. [ 8.210023] urandom-seed: Seeding with /etc/urandom.seed [ 8.326614] mtk_soc_eth 10100000.ethernet eth0: port 5 link down [ 8.343646] procd: - early - [ 8.347505] procd: - watchdog - [ 8.782988] procd: - watchdog - [ 8.786562] procd: - ubus - [ 8.862486] random: ubusd: uninitialized urandom read (4 bytes read) [ 8.872753] random: ubusd: uninitialized urandom read (4 bytes read) [ 8.879839] random: ubusd: uninitialized urandom read (4 bytes read) [ 8.887310] procd: - init - Please press Enter to activate this console. [ 9.819185] kmodloader: loading kernel modules from /etc/modules.d/* [ 9.843413] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 9.873554] Loading modules backported from Linux version v4.19.120-0-gfdc072324f3c [ 9.881451] Backport generated by backports.git v4.19.120-1-0-g60c3a249 [ 9.911594] hso: drivers/net/usb/hso.c: Option Wireless [ 9.917074] usbcore: registered new interface driver hso [ 9.939673] ip_tables: (C) 2000-2006 Netfilter Core Team [ 9.966010] nf_conntrack version 0.5.0 (1024 buckets, 4096 max) [ 10.113440] xt_time: kernel timezone is -0000 [ 10.129949] usbcore: registered new interface driver cdc_ether [ 10.334088] PPP generic driver version 2.4.2 [ 10.349197] NET: Registered protocol family 24 [ 10.356330] usbcore: registered new interface driver rndis_host [ 10.395991] urngd: jent-rng init failed, err: 2 [ 10.421112] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "factory" [ 10.428567] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected [ 10.436483] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 7620 detected [ 10.458359] kmodloader: done loading kernel modules from /etc/modules.d/* [ 19.695128] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex) [ 19.704072] 8021q: adding VLAN 0 to HW filter on device eth0 [ 19.764875] br-lan: port 1(eth0.1) entered blocking state [ 19.770468] br-lan: port 1(eth0.1) entered disabled state [ 19.776359] device eth0.1 entered promiscuous mode [ 19.781253] device eth0 entered promiscuous mode [ 19.838690] br-lan: port 1(eth0.1) entered blocking state [ 19.844217] br-lan: port 1(eth0.1) entered forwarding state [ 19.850196] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 20.706562] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready [ 24.788417] ieee80211 phy0: rt2800_rf_self_txdc_cal: Info - RF Tx self calibration start [ 24.797232] ieee80211 phy0: rt2800_rf_self_txdc_cal: Info - RF Tx self calibration end [ 27.034836] ieee80211 phy0: rt2800_loft_iq_calibration: Info - LOFT Calibration Done! [ 27.046812] ieee80211 phy0: rt2800_iq_search: Info - IQCalibration Start! [ 27.068102] ieee80211 phy0: rt2800_iq_search: Info - IQCalibration Done! CH = 0, (gain= 1, phase=3d) [ 27.078344] ieee80211 phy0: rt2800_iq_search: Info - IQCalibration Start! [ 27.099617] ieee80211 phy0: rt2800_iq_search: Info - IQCalibration Done! CH = 1, (gain= 0, phase=3e) [ 27.108973] ieee80211 phy0: rt2800_loft_iq_calibration: Info - TX IQ Calibration Done! [ 27.157457] ieee80211 phy0: rt2800_rxiq_calibration: Info - RXIQ G_imb=0, Ph_rx=2 [ 27.177768] ieee80211 phy0: rt2800_rxiq_calibration: Info - RXIQ G_imb=0, Ph_rx=4 [ 27.195241] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 27.208881] br-lan: port 2(wlan0) entered blocking state [ 27.214467] br-lan: port 2(wlan0) entered disabled state [ 27.220295] device wlan0 entered promiscuous mode [ 27.845603] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 27.852337] br-lan: port 2(wlan0) entered blocking state [ 27.857763] br-lan: port 2(wlan0) entered forwarding state [ 51.617053] random: crng init done [ 51.620544] random: 6 urandom warning(s) missed due to ratelimiting