openWRT on the Sitecom WL-559 / WL-173 54g Turbo ?

09Jan2014

Doing some reseach on getting openWRT working on the Sitecome WL-559 from Ziggo (I found mine while dumster diving ;) ) and doing so i can confirm, the WL-559 is just a relabeled WL-173 Sitecom just for Ziggo (NL (BE? FR?))

This is based and hopefully helps the openWRT pages : http://wiki.openwrt.org/oldwiki/openwrtdocs/hardware/sitecom/wl_173?s[]=wl&s[]=173

This router runs on the Realtek RTL8650/RTL8651(B): http://www.realtek.com.tw/products/productsView.aspx?Langid=1&PFid=11&Level=4&Conn=3&ProdID=70

I found so far:

• Serial com (TTL Rx Tx)
• Posible JTAG (some people already found out, and got memory access)
• USB 1.0 !! its not populated but datasheets and other family members of the RTL8650B has USB !
• Sources availeble
• Telnet ?

And some guy who build some of them? https://web.archive.org/web/20130606111447/http://www.csie.nctu.edu.tw/~cfliu/work/8650.htm

Please click readmore for all the research ive done sofar and ill update this article when im finding more.

Serial

there is an easy availeble serial port on the WL-559/WL173.

left leds jp1[TX | GND | RX | VCC] Main cpu

or look at the picture:

Jtag

As you may have noticed in the above picture, I think I identified the potencial JTAG pins on the cpu.
This is based on the following website:http://www.linux-mips.org/wiki/Realtek_SOC#Realtek_RTL8650.2FRTL8651.28B.29
browse a bit lower toward Jtag

and somewhat on (archive): archive.org>>>>/http://flyrouter.info/beerouter:processor

USB and other hardware

Just look at the board, you see 2 wires going from the unpopulated JP2 towards the CPU. This is USB 1.0 according to me, the CPU data says that it supports usb and some routers based on the RTL8650B have a PCI connector and USB port.

Look here: http://www.linux-mips.org/wiki/Realtek_SOC

Firmware and sourcetree

Its posible to download a few firmwares and sourcecode from the Sitecom website, i got em to. but you can download them from the internet archive.

Email me if the Archive ever go down... ive got some backups. link is at Archive, all files are availeble aswell:

http://www.sitecom.com/drivers_result.php?groupid=5&productid=528

Booting

Here is the the boot output:

!@#$^&*()-+|abcdefghijklmnopqrstuvwxyz.[?8l[?3l[?5l(c)Copyright Realtek, Inc. 2003
Project ROME LOADER
Version 00.00.20(uClinux) (Feb  1 2007 15:23:29)
[865xB] CPU Clock Rate: 200MHz, Memory Clock Rate: 130MHz
Detected flash size: total 2MB.
SDRAM size: 8MB
+TFTP +Auto UART +Bank1:ROM +GZIP +LZMA 

--== Loader Menu ==--
'r' to update run image
'a' to change config
'l' to update loader
'g' to load run image without updating Flash
'h' to enter hub mode
'o' to update flash with ROM file
's' to test SDRAM memory
't' to test flash memory
'e' to erase flash memory
'p' to enter ping mode


Loading runtime image ...

Unzip image from address: 0xbe020000
Start GZIP Decompression: Failed
Start LZMA Decompression:

Start runtime image at 80080000.

And then the image is run (Directly after the startup above here):

************************************
Powered by Realtek RTL8650B SoC, rev 1
************************************
SDRAM size: 16MB
CPU revision is: 0000ff00
Init MMU (16 entries)
Primary instruction cache 0kB, linesize 0 bytes.
Primary data cache 0kB, linesize 0 bytes.
Linux version 2.4.26-uc0 (root@Fedora) (gcc version 3.2) #1642 Thu Mar 20 10:41:07 CST 2008
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
NOFS reserved @ 0x803376c0
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock4
IRR(0)=c0000000
Calibrating delay loop... 199.06 BogoMIPS
Memory: 12904k/16384k available (2301k kernel code, 3480k reserved, 100k data, 92k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
NEW PCI Driver...isLinuxCompliantEndianMode=False(Big Endian)
[PCI] Reset Bridge ..... Finish!
Memory Space 0 data=0xffff8000 size=0x8000
PCI device exists: slot 0 function 0 VendorID 1814 DeviceID 301 bbd40000
Memory Space 0 data=0xffff8000 size=0x8000
PCI device exists: slot 0 function 1 VendorID 1814 DeviceID 301 bbd40100
Memory Space 0 data=0xffff8000 size=0x8000
PCI device exists: slot 0 function 2 VendorID 1814 DeviceID 301 bbd40200
Memory Space 0 data=0xffff8000 size=0x8000
PCI device exists: slot 0 function 3 VendorID 1814 DeviceID 301 bbd40300
Memory Space 0 data=0xffff8000 size=0x8000
PCI device exists: slot 0 function 4 VendorID 1814 DeviceID 301 bbd40400
Memory Space 0 data=0xffff8000 size=0x8000
PCI device exists: slot 0 function 5 VendorID 1814 DeviceID 301 bbd40500
Memory Space 0 data=0xffff8000 size=0x8000
PCI device exists: slot 0 function 6 VendorID 1814 DeviceID 301 bbd40600
Memory Space 0 data=0xffff8000 size=0x8000
PCI device exists: slot 0 function 7 VendorID 1814 DeviceID 301 bbd40700
memory mapping BAnum=0 slot=0 func=0
memory mapping BAnum=0 slot=0 func=1
memory mapping BAnum=0 slot=0 func=2
memory mapping BAnum=0 slot=0 func=3
memory mapping BAnum=0 slot=0 func=4
memory mapping BAnum=0 slot=0 func=5
memory mapping BAnum=0 slot=0 func=6
memory mapping BAnum=0 slot=0 func=7
assign mem base 1bf00000~1bf07fff at bbd40010 size=32768
assign mem base 1bf08000~1bf0ffff at bbd40110 size=32768
assign mem base 1bf10000~1bf17fff at bbd40210 size=32768
assign mem base 1bf18000~1bf1ffff at bbd40310 size=32768
assign mem base 1bf20000~1bf27fff at bbd40410 size=32768
assign mem base 1bf28000~1bf2ffff at bbd40510 size=32768
assign mem base 1bf30000~1bf37fff at bbd40610 size=32768
assign mem base 1bf38000~1bf3ffff at bbd40710 size=32768
Find Total 8 PCI functions
Found 00:00 [1814/0301] 000280 00
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Squashfs 2.1-r2 (released 2004/12/15) (C) 2002-2004 Phillip Lougher
LZMA decompressor support based on LZMA SDK 4.05 by Oleg I.Vdovikin
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SERIAL_PCI enabled
Probing RTL8651 home gateway controller...
Initialize RTL865x ASIC and driver
chip name: 8650B, chip revid: 1
Initialize mbuf...
creating default 2 interfaces...eth0 IRR(6)=c0040000
===> Request IRQ 6 for eth0, ret=0
IRR(7)=c0070000
===> Request IRQ 7 for eth0, ret=0
eth1 ...OK
PPP generic driver version 2.4.2
PPP BSD Compression module registered
flash device: 200000 at be000000
Amd/Fujitsu Extended Query Table v1.0 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00004000 : "boot1"
0x00010000-0x00018000 : "boot2"
0x00018000-0x00020000 : "boot3"
0x00020000-0x000e8000 : "kernel"
0x000e8000-0x00200000 : "rootfs"
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
GRE over IPv4 tunneling driver
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 92k freed
IRR(3)=c3070000
===> Request IRQ 3 for serial, ret=0
initial console created on /dev/ttyS1


BusyBox v1.00-pre2 (2006.02.23-02:24+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

# __flash_base=0x2abd6000
__crmr_addr=0x2aaaf104
System initializing...
rtl8651_user_pid set to 19
Bring up ext  port 6..
Rx shift=10002
cfg wan to dhcp client ...

Set IGMP Default Upstream interface (eth0) ... SUCCESS!!
info, client (v0.9.9-pre) started
__flash_base=0x2abd6000
__crmr_addr=0x2aaaf104
dhcpc client deconfig
PPPoE Passthru disabled.
Drop Unknown PPPoE PADT disabled.
IPv6 Passthru disabled.
IPX Passthru disabled.
NETBIOS Passthru disabled.
Wlan initializing...
LAN MAC = 000cf644d144
xxxReserved -> 1
Using /lib/modules/rt61ap.o
Warning: loading rt61ap will taint the kernel: no license
See http://www.tux.org/lkml/#export-tainted for information about tainted modules
pcibios_enable_resources: already enabled when device probed.
pci_request_regions: PCI regions already reserved
pcibios_set_master: already done when device probed.
IRR(5)=c3070000
===> Request IRQ 5 for ra0, ret=0
Sleep at ch#14 to collect RX=0, RSSI=-121, CRC error=0, False CCA=31
Sleep at ch#13 to collect RX=0, RSSI=-121, CRC error=1, False CCA=30
Sleep at ch#12 to collect RX=0, RSSI=-121, CRC error=4, False CCA=44
Sleep at ch#11 to collect RX=5, RSSI=-77, CRC error=1, False CCA=12
Sleep at ch#10 to collect RX=0, RSSI=-121, CRC error=3, False CCA=7
Sleep at ch#9 to collect RX=0, RSSI=-121, CRC error=0, False CCA=16
Sleep at ch#8 to collect RX=0, RSSI=-121, CRC error=0, False CCA=31
Sleep at ch#7 to collect RX=0, RSSI=-121, CRC error=0, False CCA=12
Sleep at ch#6 to collect RX=3, RSSI=-77, CRC error=0, False CCA=147
Sleep at ch#5 to collect RX=0, RSSI=-121, CRC error=1, False CCA=9
Sleep at ch#4 to collect RX=0, RSSI=-121, CRC error=0, False CCA=79
Sleep at ch#3 to collect RX=0, RSSI=-121, CRC error=2, False CCA=69
Sleep at ch#2 to collect RX=0, RSSI=-121, CRC error=5, False CCA=102
Sleep at ch#1 to collect RX=4, RSSI=-61, CRC error=5, False CCA=120
Dirtyness = 10.2.2.2 - 2.10.2.2 - 2.2.10.1 - 1.1
3.APAutoSelectChannel pick up ch#6
Register External Device (ra0) vid (9) extPortNum (6)
Reserve port 6 for peripheral device use. (0x40)
Total WLAN/WDS links: 1
register external ra0 device on extPort 6, id  1
ra0 -- (rtl865x_extDev_registerUcastTxDev [660]) Register Unicast Tx Device [80f1c800].
(rtl865x_extDev_regCallBack [845]) Register CallBack function -- Ucast Tx (c00488cc) Free (c0048b60).
Algorithmics/MIPS FPU Emulator v1.5
info, server (v0.9.9-pre) started
error, max_leases value (254) not sane, setting to 100 instead
error, Unable to open /var/udhcpd.leases for reading
ifCfgParam[0].ipAddr: 0.0.0.0
ifCfgParam[0].ipMask: 0.0.0.0
ifCfgParam[0].gwAddr: 0.0.0.0
ifCfgParam[0].dnsPrimaryAddr: 0.0.0.0
ifCfgParam[0].dnsSecondaryAddr: 0.0.0.0
ifCfgParam[0].winsPrimaryAddr: 0.0.0.0
ifCfgParam[0].winsSecondaryAddr: 0.0.0.0
rtl8651_delNaptMapping: ret -6
rtl8651_delRoute(default): ret -3
rtl8651_delIpIntf: ret -2710
target 239.0.0.0
SIOCDELRT: No such process

And now we can type whatever we want :D

Realtek official information:

RTL8650B/RTL8651B

Advanced Home Gateway Controller General Description The RTL8650B/RTL8651B is a highly integrated multi-layer switching gateway controller designed to provide the best performance at a competitive price for broadband and wireless gateway applications. The RTL8650B/RTL8651B integrates the following key components and technologies: 6-port layer 2/3/4 switch MAC, 5 Fast Ethernet transceivers, and an MII interface Hardware Access Control List (ACL) for firewall applications A 32-bit RISC CPU with a 4K I-Cache, a 4K D-Cache, an 8K I-MEM, and a 4K D-MEM A powerful protocol engine to support auto L3/L4 checksum check and re-generation, auto VLAN tagging, and auto PPPoE encapsulation Rich set of peripherals for value-added services: two UART ports, a USB 1.1 host controller, a PCM interface, and 22 GPIOs The RTL8650B/RTL8651B is embedded with a PCI host interface to access high-speed devices, providing enhanced application capabilities. With the built-in layer 2/3/4 switching architecture, the RTL8650B/RTL8651B provides wire-speed performance for not only layer 2 switching, but also IP and NAT switching. This unique architecture frees the embedded CPU from software routing cycles so that the CPU horsepower can be fully utilized to provide the most efficient services. Features System Processor LX5280 32-bit RISC CPU, clock rates up to 200MHz Embedded 4K I-Cache, 4K D-Cache, 8K I-MEM, 4K D-MEM Integrated Switch 6-port integrated MAC switch with 5-port physical layer and transceiver for 10Base-T and 100Base-TX Automatic MDI/MDX crossover on all ports Supports sixth Port 5, MAC interface with 3 configurations to connect to external MAC or PHY PHY mode MII (also known as Reverse MII) for router application PHY mode SNI (also known as GPSI or 7 wires) for router application MAC mode MII for HomePNA or other PHY application L2 Capabilities 1024-entry 4-way hash look-up table and 16-entry CAM Supports source and destination MAC address filtering Supports 8 active VLANs with 4096 VID number spaces to distinguish IP interfaces Supports port-based and packet-tagged VLANs Supports VLAN-based spanning tree forwarding Non-blocking wire-speed reception and transmission and non-head-of-line-blocking forwarding Complies with IEEE 802.3, 802.3u, 802.1D, and 802.1Q Flexible full-duplex 802.3x flow control and optional half-duplex backpressure flow control L3 Capabilities Supports 8-entry IPv4 hardware routing table and longest-prefix-matching table lookup Supports hardware ARP table for host IP addresses L4 Capabilities Supports hardware-switched Network Address Port Translation (NAPT) for TCP, UDP, and ICMP protocols Supports hardware-switched 1-1 Network Address Translation (NAT) for IP protocol Supports hardware-switched server ports (virtual servers) Supports Application Level Gateway (ALG) tables for packets that should be further processed by software QoS Support Supports 2-level QoS based on port, VLAN tag, TCP/IP TOS/DS, L2/L3 table entry, and firewall rule Supports policy-based QoS PPPoE Support Supports configurable automatic PPPoE encapsulation and decapsulation Up to 8 PPPoE sessions Firewall Capabilities Supports 128 hardware Access Control List (ACL) rules for packet filtering Supports both ingress and egress filtering Supports field filtering for Ethernet, PPPoE, IP, TCP, UDP, ICMP, and IGMP protocols Supports Stateful Packet inspection (SPI) firewall Supports whole packet inspection function to scan contents of incoming packets Supports policy-based routing function Supports policy-based QoS function Supports policy-based mirroring function Peripherals USB v1.1 host controller 33MHz PCI v2.2 host interface for glueless connection of up to two devices Two 16C550-compatible UARTs 22 GPIOs System Design 208-pin PQFP package for RTL8650B 292-pin TFBGA package for RTL8651B 3.3V power supply Applications Broadband IP-sharing gateways Wireless gateways L3 switches High-performance FTTx routers Firewall and VPN appliances Residential gateways