Tenda W311R v2

From TechInfoDepot
Jump to navigationJump to search
multiple revisions of this device, use caution
bgn (N150)
150Mbps Wireless N Router
Tenda W311R.jpg
InfoDepot Wiki
3rd Party Firmware
dd-wrt
OpenWrt
Incompatible
Tomato any flavor
Incompatible
Platform
BrandModelRev
Tenda W311R V2.0
FCC ID
Type
wireless router
Series
W311
CPU1
Ralink RT3050
CPU1 Type
MIPS 24KEc
CPU1 Speed
320 MHz 16-bit
Flash1 Chip
KH KH29LV320CBTC-70G
Flash1 Size
4 MiB4,194,304 B <br />32,768 Kib <br />4,096 KiB <br />32 Mib <br />0.00391 GiB <br /> (Parallel)
RAM1 Size
32 MiB33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br />
RAM1 Chip
SK hynix HY57V281620FTP-H x 2
ETH chip1
Ralink RT3050
Switch
Ralink RT3050
Ethernet Port Count
1-100MbE-WAN
4-100MbE-LAN
Wired Standard
IEEE 802.3i/3u

802dot11 OUI: none specified

Stock bootloader
U-Boot 1.1.3
Stock FW OS
Linux 2.6.21
Expansion IF types
none specified
Power
9 VAC ~ 50/60 Hz, 0.6 A
Connector type
barrel
Other

Default IP address: 192.168.0.1
the IP 192.168.0.1 is used by 799 additional devices
of which 57 are Tenda devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1342 additional devices
of which 33 are Tenda devices

Manuf/OEM/ODM
Retail
End of Life date 13 August 2009
Country of manuf China
Radio 1
Chip1
Ralink RT3050
Wireless interface OUI
none specified
Antenna Connector Type
none specified
MIMO status
1x1:1
Wireless Standard
IEEE 802.11b/g/n
802.11n
up to 150 Mbps
802.11g
up to 54 Mbps
802.11b
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz
 FCC ID
Nexxt Solutions Nebula 150 (ARN01154U1)X4Y311
V7TW311R
 CPU1 brandRadio1 chip1 brandRadio1 chip2 brand
Tenda W311R v1
Tenda W311R v2RalinkRalink
Tenda W311R v3BroadcomBroadcom
Tenda W311R+Broadcom

For a list of all currently documented Ralink chipsets with specifications, see Ralink.

For a list of all currently documented Tenda device with specifications, see Tenda.

150 Mbps - 1SS 2.4GHz 802.11n (40MHz chan.) = N150 class

Overview

Manuf: SHENZHEN TENDA TECHNOLOGY CO., LTD.

Links of Interest

JTAG-Serial Info

Serial

Serial Pinouts

TENDA W311R RXD and TXD are (LV)TTL signals (0V/3.3V)

TFTP Tools

Output from Serial:

boot log
... netboot_common, argc= 3
 **********buf = 0x81fcc120
 **********NexTxPacket = 81fe4200

 NetTxPacket = 0x81FE4200
 NetRxPackets[0] = 0x81FE4800
 NetRxPackets[1] = 0x81FE4E00
 NetRxPackets[2] = 0x81FE5400
 NetRxPackets[3] = 0x81FE5A00
 NetRxPackets[4] = 0x81FE6000
 NetRxPackets[5] = 0x81FE6600
 NetRxPackets[6] = 0x81FE6C00
 NetRxPackets[7] = 0x81FE7200
 NetRxPackets[8] = 0x81FE7800
 NetRxPackets[9] = 0x81FE7E00
 NetRxPackets[10] = 0x81FE8400
 NetRxPackets[11] = 0x81FE8A00
 NetRxPackets[12] = 0x81FE9000
 NetRxPackets[13] = 0x81FE9600
 NetRxPackets[14] = 0x81FE9C00
 NetRxPackets[15] = 0x81FEA200
 NetRxPackets[16] = 0x81FEA800
 NetRxPackets[17] = 0x81FEAE00
 NetRxPackets[18] = 0x81FEB400
 NetRxPackets[19] = 0x81FEBA00

 KSEG1ADDR(NetTxPacket) = 0xA1FE4200

 NetLoop,call eth_halt !
 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done
 Header Payload scatter function is Disable !!

 ETH_STATE_ACTIVE!!
Using Eth0 (10/100-M) device
TFTP from server 192.168.0.2; our IP address is 192.168.0.1
Filename 'new_firmware.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (xx:xx:xx:xx:xx:xx)
Got it
T #
 first block received
#####################
done

Bytes transferred = 2263332 (228924 hex)
NetBootFileXferSize= 00228924
Erase linux kernel block !!
From 0xBF050000 To 0xBF27FFFF
 b_end =BF3FFFFF

Erase Flash from 0xbf050000 to 0xbf27ffff in Bank # 1
 erase sector  = 12
sect = 12,s_last = 46,erase poll = 1162313
 erase sector  = 13
*sect = 13,s_last = 46,erase poll = 1129504
 erase sector  = 14
sect = 14,s_last = 46,erase poll = 1140228
 erase sector  = 15
*sect = 15,s_last = 46,erase poll = 1157035
 erase sector  = 16
sect = 16,s_last = 46,erase poll = 1139250
 erase sector  = 17
*sect = 17,s_last = 46,erase poll = 1129126
 erase sector  = 18
sect = 18,s_last = 46,erase poll = 1139748
 erase sector  = 19
*sect = 19,s_last = 46,erase poll = 1129480
 erase sector  = 20
sect = 20,s_last = 46,erase poll = 1139490
 erase sector  = 21
*sect = 21,s_last = 46,erase poll = 1143826
 erase sector  = 22
*sect = 22,s_last = 46,erase poll = 1162855
 erase sector  = 23
sect = 23,s_last = 46,erase poll = 1128879
 erase sector  = 24
*sect = 24,s_last = 46,erase poll = 1139675
 erase sector  = 25
sect = 25,s_last = 46,erase poll = 1129157
 erase sector  = 26
*sect = 26,s_last = 46,erase poll = 1139747
 erase sector  = 27
sect = 27,s_last = 46,erase poll = 1129426
 erase sector  = 28
*sect = 28,s_last = 46,erase poll = 1166804
 erase sector  = 29
sect = 29,s_last = 46,erase poll = 1129289
 erase sector  = 30
*sect = 30,s_last = 46,erase poll = 1139221
 erase sector  = 31
sect = 31,s_last = 46,erase poll = 1129088
 erase sector  = 32
*sect = 32,s_last = 46,erase poll = 1139862
 erase sector  = 33
*sect = 33,s_last = 46,erase poll = 1129024
 erase sector  = 34
sect = 34,s_last = 46,erase poll = 1140403
 erase sector  = 35
*sect = 35,s_last = 46,erase poll = 1129116
 erase sector  = 36
sect = 36,s_last = 46,erase poll = 1155807
 erase sector  = 37
*sect = 37,s_last = 46,erase poll = 1152082
 erase sector  = 38
sect = 38,s_last = 46,erase poll = 1157580
 erase sector  = 39
*sect = 39,s_last = 46,erase poll = 1134264
 erase sector  = 40
sect = 40,s_last = 46,erase poll = 1130220
 erase sector  = 41
*sect = 41,s_last = 46,erase poll = 1130296
 erase sector  = 42
sect = 42,s_last = 46,erase poll = 1130919
 erase sector  = 43
*sect = 43,s_last = 46,erase poll = 1118854
 erase sector  = 44
*sect = 44,s_last = 46,erase poll = 1130192
 erase sector  = 45
sect = 45,s_last = 46,erase poll = 1118694
 erase sector  = 46
*sect = 46,s_last = 46,erase poll = 1185088
 done
Erased 35 sectors

 Copy linux image[2263332 byte] to Flash[0xBF050000]....
Copy to Flash...
 Copy 2263332 byte to Flash...
 addr = 0xBF0A33B6 ,cnt=1922414
 addr = 0xBF0F6762 ,cnt=1581506
 addr = 0xBF149AE6 ,cnt=1240638
 addr = 0xBF19CE7E ,cnt=899750
 addr = 0xBF1F01F8 ,cnt=558892
 addr = 0xBF243588 ,cnt=218012 done
## Booting image at bf050000 ...
   Image Name:   linkn Kernel Image
   Created:      2009-02-09  13:26:01 UTC

 System Control Status = 0x20440000
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2263268 Bytes =  2.2 MB
   Load Address: 80000000
   Entry Point:  803cd000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 803cd000) ...
## Giving linux memsize in MB, 32

Starting kernel ...
LINUX started...

 THIS IS ASIC
Linux version 2.6.21 (root@linux-6091) (gcc version 3.4.2) 
 #452 Mon Feb 9 21:25:31 CST 2009

 The CPU feqenuce set to 384 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 800068, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 00177000(1536000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 27328k/32768k available (3378k kernel code, 
 5440k reserved, 510k data, 1116k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
detected lzma initramfs
detected lzma initramfs
initramfs: LZMA lc=3,lp=0,pb=2,dictSize=1048576,origSize=3976704
LZMA initramfs by Ming-Ching Tiew <mctiew@yahoo.com>
Load RT2880 Timer Module(Wdg/Soft)
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered (default)
FLASH_API: MAN_ID=C2 DEV_ID=22A8 SIZE=4MB
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
loop: loaded (max 8 devices)
rdm_major = 254
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v1.60  
 256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 256, Rx Ring = 256
GDMA1_MAC_ADRH -- : 0x00000100
GDMA1_MAC_ADRL -- : 0x000c4330
PROC INIT OK!
PPP generic driver version 2.4.2
PPP BSD Compression module registered
NET: Registered protocol family 24
2860 version : 2.0.0.0 (Feb  9 2009)

=== pAd = c0000000, size = 485320 ===
<-- RTMPAllocAdapterBlock, Status=0
ralink flash device: 0x1000000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.

Creating 4 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x00400000 : "Kernel"
block2mtd: version $Revision: 1.1.1.1 $
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
arp_tables: (C) 2002 David S. Miller
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Fully Cone
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Freeing unused kernel memory: 1116k freed
init started: BusyBox v1.12.1 (2009-02-09 21:19Algorithmics/MIPS FPU Emulator v1.5
:29 CST)
starting pid 14, tty '': '/etc_ro/rcS'
devpts: called with bogus options
mount: mounting none on /proc/bus/usb failed: No such file or directory
Yes: kernel reg pid 21 success
Welcome to
     _______  _______  ___     __  ____   _  _   ___
    |  ___  \|   __  ||   |   |__||    \ | || | /  /
    | |___| ||  |__| ||   |__  __ |     \| || |/  /
    |   _   /|   _   ||      ||  || |\     ||     \
    |__| \__\|__| |__||______||__||_| \____||_|\___\

                     =System Architecture Department=
                        ****** WeLoveLinux ******
 Welcome to ...
httpd Reg gpio hook success .
starting pid 25, tty '/dev/ttyS1': '/bin/sh'

BusyBox v1.12.1 (2009-02-09 21:19:29 RX DESC a04ad000  size = 2048
CST) built-in shell (ash)
Enter<-- RTMPAllocTxRxRingMemory, Status=0
 'help' for a list of built-in commands.

# 1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff 00 00 00 01
Main bssid = 00:b0:0c:01:45:78
The UUID Hex string is:2880288028801880a88000b00c014578
The UUID ASCII string is:28802880-2880-1880-a880-00b00c014578!
<==== RTMPInitialize, Status=0
0x1300 = 00064380
getIfLive: device eth2.1 not found.
Commit crc = d253c90f
maclist:
WLan[00:B0:0C:01:45:78]
Lan[00:B0:0C:01:45:78]
Wan[00:B0:0C:GDMA1_MAC_ADRH -- : 0x00000100
01:45:7d]
GDMA1_MAC_ADRL -- : 0x00b00c01

phy_tx_ring = 0x01d81000, tx_ring = 0xa1d81000, size: 16 bytes
phy_rx_ring = 0x01d82000, rx_ring = 0xa1d82000, size: 16 bytes
GDMA1_FWD_CFG = 10000
eth2.1: Setting MAC address to  xx xx xx xx xx xx.
VLAN (eth2.1):  Underlying device (eth2) has same MAC, not checking promiscious mode.
eth2.2: Setting MAC address to  xx xx xx xx xx xx.
device eth2 entered promiscuous mode
VLAN (eth2.2):  Setting underlying device (eth2) to promiscious mode.
getIfLive: device br0 not found.
eth2.1: dev_set_promiscuity(master, 1)
device eth2.1 entered promiscuous mode
Router ip address config success.
br0: port 1(eth2.1) entering learning state
device ra0 entered promiscuous mode
br0: port 2(ra0) entering learning state
libupnp: using UDP SSDP_PORT = 1900
br0: topology change detected, propagating
br0: port 1(eth2.1) entering forwarding state
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
killall: udhcpd: no process killed
ND -> Bad_Sig_entry [18]...
httpd listen ip = 192.168.0.1 port = 80
MfgThread start loop.
TendaLog -> ok rtn.
macBcast uses obsolete (PF_INET,SOCK_PACKET)
IsSameNET [192.168.0.1/255.255.255.0][192.168.1.1/255.255.255.0]
sntp: host not found
killall: dnrd: no process killed
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
route: ioctl 0x890b failed: File exists
libupnp: using UDP SSDP_PORT = 1900
upnpd[289]: UPnP SDK Successfully Initialized.
Mar 29 09:36:22 upnpd[289]: UPnP SDK Successfully Initialized.
upnpd[289]: Succesfully set the Web Server Root Directory.
Mar 29 09:36:22 upnpd[289]: Succesfully set the Web Server Root Directory.
upnpd[289]: IGD root device successfully registered.
Mar 29 09:36:23 upnpd[289]: IGD root device successfully registered.
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
Startnat end.
upnpd[289]: Advertisements Sent.  Listening for requests ...
Mar 29 09:36:25 upnpd[289]: Advertisements Sent.  Listening for requests ...
............ wan unlink ..4.
............ wan unlink ..5.


Pictures

User Images