Just got the Asus RT-N16 and started exploring it.
The board has populated serial pins with markings (TX, RX, GND), nice. Just connect your favorite 3.3v serial adapter. You can access the bootloader and the console of the original firmware.
Bootloader (CFE): To break into CFE use CTRL-C
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: ¤T 5¤ë 27 16:47:24 CST 2009 (root@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.3
CPU type 0x19740: 480MHz
Tot mem: 131072 KBytes
CFE mem: 0x80700000 - 0x8079B310 (635664)
Data: 0x80731B30 - 0x80734880 (11600)
BSS: 0x80734880 - 0x80735310 (2704)
Heap: 0x80735310 - 0x80799310 (409600)
Stack: 0x80799310 - 0x8079B310 (8192)
Text: 0x80700000 - 0x80731B30 (203568)
Device eth0: hwaddr 90-E6-BA-xx-xx-xx, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: TFTP Server.
Failed.
Could not load :: Interrupted
CFE> ^C
CFE> ^C
CFE> help
Available commands:
et Broadcom Ethernet utility.
nvram NVRAM utility.
reboot Reboot.
flash Update a flash memory device
batch Load a batch file into memory and execute it
go Verify and boot OS image.
boot Load an executable file into memory and execute it
load Load an executable file into memory without executing it
save Save a region of memory to a remote file via TFTP
ping Ping a remote IP host.
arp Display or modify the ARP Table
ifconfig Configure the Ethernet interface
help Obtain help for CFE commandsNormal boot:
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: ¤T 5¤ë 27 16:47:24 CST 2009 (root@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.3
CPU type 0x19740: 480MHz
Tot mem: 131072 KBytes
CFE mem: 0x80700000 - 0x8079B310 (635664)
Data: 0x80731B30 - 0x80734880 (11600)
BSS: 0x80734880 - 0x80735310 (2704)
Heap: 0x80735310 - 0x80799310 (409600)
Stack: 0x80799310 - 0x8079B310 (8192)
Text: 0x80700000 - 0x80731B30 (203568)
Device eth0: hwaddr 90-E6-BA-xx-xx-xx, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: TFTP Server.
Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ...... 3543440 bytes read
Entry at 0x80001000
Starting program at 0x80001000
Linux version 2.6.22 (root@localhost.localdomain) (gcc version 4.1.2) #153 Tue Jun 23 16:25:53 CST 2009
CPU revision is: 00019740
Determined physical RAM map:
memory: 07fff000 @ 00000000 (usable)
Built 1 zonelists. Total pages: 32512
Kernel command line: root=/dev/mtdblock2 console=ttyS0,115200 init=/sbin/preinit
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 512 (order: 9, 2048 bytes)
CPU: BCM4716 rev 1 at 480 MHz
Using 240.000 MHz high precision timer.
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 126064k/131068k available (2771k kernel code, 4856k reserved, 564k data, 124k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI: Using membase 8000000
PCI: Initializing host
PCI: Reset RC
PCI: Fixing up bus 0
PCI: Fixing up bridge
PCI: Fixing up bridge
PCI: Enabling device 0000:01:00.1 (0004 -> 0006)
PCI: Fixing up bus 1
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 3.4 (2008/08/26) Phillip Lougher
NTFS driver 2.1.28 [Flags: R/O].
fuse init (API version 7.8)
io scheduler noop registered (default)
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a 16550A
loop: module loaded
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
PPTP driver version 0.8.2
Physically mapped flash: Found 1 x16 devices at 0x0 in 8-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
Physically mapped flash: CFI does not contain boot bank location. Assuming top.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Flash device: 0x2000000 at 0x1c000000
Physically mapped flash: squashfs filesystem found at block 1816
Creating 4 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "boot"
0x00040000-0x01fe0000 : "linux"
0x001c63f8-0x01fe0000 : "rootfs"
0x01fe0000-0x02000000 : "nvram"
Found a 0MB serial flash
sflash: found no supported devices
GACT probability NOT on
Mirror/redirect action on
netem: version 1.2
u32 classifier
Performance counters on
input device check on
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1023 buckets, 8184 max)
ctnetlink v0.93: registering with nfnetlink.
ipt_time loading
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ipgre init: can't add protocol
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 124k freed
Warning: unable to open an initial console.
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
read from nvram
insmod: ip_nat_starcraft.ko: no module by that name found
insmod: ipt_NETMAP.ko: no module by that name found
emf: module license 'unspecified' taints kernel.
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.27
eth1: Broadcom BCM4329 802.11 Wireless Controller 5.10.56.27
insmod: nls_utf8.ko: no module by that name found
Hit enter to continue...read from nvram
waitpid: No child processes
insmod: ip_nat_starcraft.ko: no module by that name found
insmod: ipt_NETMAP.ko: no module by that name found
waitpid: No child processes
waitpid: No child processes
waitpid: No child processes
waitpid: No child processes
waitpid: No child processes
waitpid: No child processes
waitpid: No child processes
waitpid: No child processes
Algorithmics/MIPS FPU Emulator v1.5
vlan1: Operation not supported
vlan1: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
device vlan1 entered promiscuous mode
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Invalid argument
eth1: Invalid argument
eth1: Operation not supported
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Operation not supported
device eth1 entered promiscuous mode
waitpid: No child processes
br0: port 2(eth1) entering learning state
br0: port 1(vlan1) entering learning state
br0: topology change detected, propagating
br0: port 2(eth1) entering forwarding state
br0: topology change detected, propagating
br0: port 1(vlan1) entering forwarding state
info, udhcp server (v0.9.8) started
killall: upnp: no process killed
UPnP::upnp_device_attach:br0: attach InternetGatewayDevice.xml
dbg: usb init
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
USB20H mdio control register : 0x80000008
ehci_hcd 0000:00:04.1: EHCI Host Controller
ehci_hcd 0000:00:04.1: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:04.1: irq 5, io mem 0x18004000
ehci_hcd 0000:00:04.1: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
USB20H mdio control register : 0x80000008
ohci_hcd 0000:00:04.0: OHCI Host Controller
ohci_hcd 0000:00:04.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:04.0: irq 5, io mem 0x18009000
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
ufsd: no version for "struct_module" found: kernel tainted.
ufsd: driver loaded at c024d000 built on Mar 5 2009 13:51:35
UFSD version 7.02 (Mar 5 2009, 13:50:00)
NTFS read/write support included
$Id: ufsdvfs.c,v 1.195 2009/02/02 15:38:06 shura Exp $
waitpid: No child processes
U2EC start ...
UPnP::upnp_init:UPnP daemon is ready to run
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
SCSI subsystem initialized
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
The inherited fd(3) is closed.
cannot get proto entry: No such file or directory
cannot get proto entry: No such file or directory
br0: port 1(vlan1) entering disabled state
vlan1: dev_set_promiscuity(master, 1)
br0: port 1(vlan1) entering learning state
br0: topology change detected, propagating
br0: port 1(vlan1) entering forwarding state
waitpid: No child processes
info, udhcp client (v0.9.8) started
eth0: No such process
waitpid: No child processes
killall: wps_monitor: no process killed
killall: wps_ap: no process killed
killall: wps_enr: no process killed
Debug::sharedkeystr=(null)
time.nist.gov: Unknown host
# Enable direct rule
track test:[101][k] track_flag=0, clean_flag=101, ipaddr=0
track set ok
**** clean ip_conntrack 1 time. ****
**** clean ip_conntrack 2 time. ****
echo for PaN ::: &&&PaN
Hit enter to continue...Starting full scan!
**** clean ip_conntrack 3 time. ****
track test:[100][k] track_flag=0, clean_flag=100, ipaddr=0
track set ok
killall: ntpclient: no process killed
time.nist.gov: Unknown host
killall: ntpclient: no process killed
time.nist.gov: Unknown host
BusyBox v1.7.2 (2009-05-07 18:57:22 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
#Basic info:
# cat /proc/cpuinfo
system type: Broadcom BCM4716 chip rev 1
processor: 0
cpu model: MIPS 74K V4.0
BogoMIPS: 238.59
wait instruction: no
microsecond timers: yes
tlb_entries: 64
extra interrupt vector: no
hardware watchpoint: yes
ASEs implemented: mips16 dsp
VCED exceptions: not available
VCEI exceptions: not available
unaligned_instructions: 1
dcache hits: 2147483648
dcache misses: 2386336506
icache hits: 2147483648
icache misses: 2342451182
instructions: 2147483648
# cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00020000 "boot"
mtd1: 01fa0000 00020000 "linux"
mtd2: 01e19c08 00020000 "rootfs"
mtd3: 00020000 00020000 "nvram"
# mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro)
devfs on /dev type tmpfs (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
ramfs on /tmp type ramfs (rw)
none on /proc/bus/usb type usbfs (rw)
# df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/mtdblock2 8320 8320 0 100% /
devfs 63168 0 63168 0% /dev
# ifconfig -a
br0 Link encap:Ethernet HWaddr 90:E6:BA:xx:xx:xx
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: xxxx::xxxx:xxxx:xxxx:xxxx/64 Scope:Link
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:773 errors:0 dropped:0 overruns:0 frame:0
TX packets:340 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:85522 (83.5 KiB) TX bytes:38547 (37.6 KiB)
eth0 Link encap:Ethernet HWaddr 90:E6:BA:xx:xx:xx
inet6 addr: xxxx::xxxx:xxxx:xxxx:xxxx/64 Scope:Link
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:630 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:200299 (195.6 KiB)
Interrupt:4 Base address:0x2000
eth1 Link encap:Ethernet HWaddr 90:E6:BA:xx:xx:xx
inet6 addr: xxxx::xxxx:xxxx:xxxx:xxxx/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:122080
TX packets:310 errors:36 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:32892 (32.1 KiB)
Interrupt:3 Base address:0x1000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MULTICAST MTU:16436 Metric:1
RX packets:775 errors:0 dropped:0 overruns:0 frame:0
TX packets:775 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:119484 (116.6 KiB) TX bytes:119484 (116.6 KiB)
sit0 Link encap:IPv6-in-IPv4
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
tunl0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
vlan1 Link encap:Ethernet HWaddr 90:E6:BA:xx:xx:xx
inet6 addr: xxxx::xxxx:xxxx:xxxx:xxxx/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:350 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:40723 (39.7 KiB)
# lsmod
Module Size Used by Tainted: PF
usb_storage 92144 0
sd_mod 29136 0
scsi_mod 124864 2 usb_storage,sd_mod
usblp 18896 0
ufsd 297968 0
ohci_hcd 20976 0
ehci_hcd 35696 0
usbcore 150864 5 usb_storage,usblp,ohci_hcd,ehci_hcd
nls_euc_jp 5872 0
nls_cp950 103872 0
nls_cp949 148832 0
nls_cp936 127040 0
nls_cp932 81248 1
wl 1962368 0
et 45216 0
igs 20848 1 wl
emf 25568 2 wl,igs