Pacific Network PN-RT150M

150 Mbps Wireless Router; 4 LAN, 1 WAN ports. Made by Pacific Network. Based on JCG's JIR-N604R1.

Manual

Specs

SoC: Ralink 3052F
RAM: 16 Mb (EtronTech EM639165TS-6G)
Flash: 4 Mb SPI Flash (Macronix MX25L3205D)

Teardown

Click the image below.

Interfaces

Serial

Just for rx purposes, no login attached. 57600n8.

RX | GND | TX | +3.3 V

Telnet

There is a telnetd binary on it, but it's not running. You can run it by leveraging an unsanitized form input on Ping host address. To run it, open the web interface, go to:

Management > Tools

Select the “PING” from the System Command, and input this line at “Host Name or IP Address”:

; telnetd &

Click OK. The telnet daemon will start:

$ telnet 192.168.1.1

Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.

PACIFIC-96196F login: admin
Password:

BusyBox v1.12.1 (2012-04-10 15:51:43 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

#

Use the web login (default: admin:admin).

Info

# cat /proc/cpuinfo 
system type             : Ralink SoC
processor               : 0
cpu model               : MIPS 24K V4.12
BogoMIPS                : 212.99
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes
ASEs implemented        : mips16 dsp
VCED exceptions         : not available
VCEI exceptions         : not available

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00400000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 000cec8d 00010000 "Kernel"
mtd5: 002e1373 00010000 "RootFS"
mtd6: 003b0000 00010000 "Kernel_RootFS"

# cat /proc/meminfo 
MemTotal:        13556 kB
MemFree:          1128 kB
Buffers:          1440 kB
Cached:           4432 kB
SwapCached:          0 kB
Active:           2476 kB
Inactive:         4212 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               0 kB
Writeback:           0 kB
AnonPages:         844 kB
Mapped:            876 kB
Slab:             3296 kB
SReclaimable:      244 kB
SUnreclaim:       3052 kB
PageTables:        128 kB
NFS_Unstable:        0 kB
Bounce:              0 kB
CommitLimit:      6776 kB
Committed_AS:     1792 kB
VmallocTotal:  1048404 kB
VmallocUsed:      2192 kB
VmallocChunk:  1045412 kB

# cat /etc_ro/sysinfo.txt 
model=JIR-N604R1
modelDisp=PN-RT150M
vendor=PACIFIC

Bootlog

U-Boot 1.1.3 (Apr 10 2012 - 15:53:37)

Board: Ralink APSoC DRAM:  16 MB
relocate_code Pointer at: 80fb4000
config usb..*** Error: D+/D- is 1/1, config usb failed.
..*** Error: D+/D- is 1/1, config usb failed.

spi_wait_nsec: 4b 
spi device id: c2 20 16 c2 20 (2016c220)
find flash: MX25L3205D
raspi_read: from:30000 len:1000 
.*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 3.6.0.0
-------------------------------------------- 
ASIC 3052_MP2 (Port5<->None)
DRAM component: 128 Mbits SDR
DRAM bus: 16 bit
Total memory: 16 MBytes
Flash component: SPI Flash
Date:Apr 10 2012  Time:15:53:37
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 320 MHZ #### 
 estimate memory size =16 Mbytes
## Booting image at bf050000 ...
raspi_read: from:50000 len:40 
.   Image Name:   Linux Kernel Image
   Created:      2012-04-10   7:53:32 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2952269 Bytes =  2.8 MB
   Load Address: 80000000
   Entry Point:  80288000
raspi_read: from:50040 len:2d0c4d 
..............................................   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80288000) ...
## Giving linux memsize in MB, 16

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.21 (root@localhost.localdomain) (gcc version 3.4.2) #108 Tue Apr 10 15:53:26 CST 2012

 The CPU frequency set to 320 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 4064
Kernel command line: console=ttyS1,57600n8 root=1f05
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = d0808040, status = 11000000
PID hash table entries: 64 (order: 6, 256 bytes)
calculating r4koff... 00138800(1280000)
CPU frequency 320.00 MHz
Using 160.000 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13440k/16384k available (2308k kernel code, 2944k reserved, 279k data, 116k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
deice id : c2 20 16 c2 20 (2016c220)
MX25L3205D(c2 2016c220) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 7 MTD partitions on "raspi":
0x00000000-0x00400000 : "ALL"
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x0011ec8d : "Kernel"
mtd: partition "Kernel" doesn't end on an erase block -- force read-only
0x0011ec8d-0x01000000 : "RootFS"
mtd: partition "RootFS" extends beyond the end of device "raspi" -- size truncated to 0x2e1373
mtd: partition "RootFS" doesn't start on an erase block boundary -- force read-only
0x00050000-0x01000000 : "Kernel_RootFS"
mtd: partition "Kernel_RootFS" extends beyond the end of device "raspi" -- size truncated to 0x3b0000
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered (default)
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.8 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
rdm_major = 253

eth2 mii.o query= phy_id:0, address:1 retval:7849
Ralink APSoC Ethernet Driver Initilization. v2.1  256 rx/tx descriptors allocated, mtu = 1500!
MAC_ADRH -- : 0x000000e0
MAC_ADRL -- : 0x4b96196f
PROC INIT OK!
IMQ starting with 4 devices...
IMQ driver loaded successfully.
	Hooking IMQ before NAT on PREROUTING.
	Hooking IMQ after NAT on POSTROUTING.
PPP generic driver version 2.4.2
PPP BSD Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
PPTP driver version 0.8.1
block2mtd: version $Revision: 1.1.1.1 $
GACT probability NOT on
netem: version 1.2
u32 classifier
    Performance counters on
    input device check on 
    Actions configured 
nf_conntrack version 0.5.0 (128 buckets, 1024 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
ipt_time loading
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 116k freed
init started: BusyBox v1.12.1 (2012-04-10 15:51:43 CST)
Bad inittab entry at line 2
Algorithmics/MIPS FPU Emulator v1.5
mount: mounting devpts: called with bogus options
none on /sys failed: No such device
mount: mounting none on /proc/bus/usb failed: No such file or directory
-------------------------------------------------
Password for 'admin' changed

phy_tx_ring = 0x00f09000, tx_ring = 0xa0f09000

phy_rx_ring0 = 0x00f0a000, rx_ring0 = 0xa0f0a000
MAC_ADRH -- : 0x000000e0
MAC_ADRL -- : 0x4b96196f
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 710000
jcc: waiting for nvram_daemon switchTableDel: done!
switchTableDel: done!

eth2 mii.o query= phy_id:1, address:4 retval:5e1

eth2 mii.o query= phy_id:1, address:0 retval:3100

eth2 mii.o query= phy_id:1, address:5 retval:0
eth2.1: dev_set_promiscuity(master, 1)
device eth2 entered promiscuous mode
device eth2.1 entered promiscuous mode
rt2860v2_ap: module license 'unspecified' taints kernel.


=== pAd = c0046000, size = 805064 ===

<-- RTMPAllocAdapterBlock, Status=0
RX DESC a08d9000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff 00 00 00 01
Main bssid = 00:e0:4b:96:19:70
<==== rt28xx_init, Status=0
0x1300 = 00064380
device ra0 entered promiscuous mode
br0: port 2(ra0) entering learning state
br0: port 1(eth2.1) entering learning state
eth2.2: Setting MAC address to  00 e0 4b 96 19 6e.