T-Mobile PCI Express Router

P/N: 1C010002
(AMIT BDW463AM/CDW463AM)

  • CPU: Realtek RTL8196 (integrated switch, USB, PCI-E host)
  • RAM: EtronTech EM6AA160TSA-5G (256Mb = 32MB)
  • Flash: cFeon EN25Q32A (32Mb = 4MB) – Firmware dump (V0.03d1)
  • Wifi: Realtek RTL8192SE (PCI-E)
  • RTC: PCF8563T

t-mobile_pcie_outsidet-mobile_pcie_back t-mobile_pcie_inside

Telnetd listening on port 2300, username: root, password: amittima

Quick start guide: https://www.telekom.sk/swift_data/source/podpora/ovladace/Expresscard_router_SK-QSG.pdf

Manual: https://www.telekom.sk/swift_data/source/podpora/ovladace/Expresscard_router_SK-UM.pdf

Supported devices in firmware V0.03d1:

4G SYSTEMS XS Stick W12 USB
4G SYSTEMS XS Stick W14 USB
A-Link 3GU USB
AIKO 81D USB
AIKO 82D USB
Alcatel X060 USB
Alcatel X200 USB
Amoi V870 USB
AnyData ADU-500A USB
AnyData ADU-635WA USB
AnyData ADU-635WA USB
AnyData APE-540H PCI-Express
APBW WH200II USB
Asus T500 PCI-Express
ASUS T600 USB
AT&T Quick Silver USB
Axesstel MV140B USB
BandRich BandLuxe C100 PCI-Express
BandRich BandLuxe C120 USB
BandRich BandLuxe C170 USB
BandRich BandLuxe C180 USB
BandRich BandLuxe C270 USB
BandRich BandLuxe C321 USB
BES WM61 USB
BlackBerry 9000 Mobile Phone
C-Motech CDC-680 USB
C-Motech CCU-550 USB
C-Motech CCU-700 USB
C-Motech CDU-550 USB
C-Motech CGU-628A USB
C-Motech CGU-629 USB
C-Motech CGU-629C USB
C-Motech CHU-629S USB
C-Motech CMU-301 USB
C-Motech CNU-680 USB
C-Motech CNU-680E USB
C-Motech U680 USB
Cricket A600 USB
Datang AC901 USB
Datang DTM5731E USB
D-Link DWM-151 USB
D-Link DWM-152 USB
D-Link DWM-156 USB
D-Link DWM-162 USB
D-Link DWN-162-U5 USB
D-Link DWM-168 USB
E-Tel ET230U USB
EpiValley SEC-7089 USB
EpiValley Model 220 USB
ESTON EST-638U USB
FLY Card FLY-HU1 USB
Franklin CDU-550 USB
Franklin CDU680 USB
Franklin CGU-628A USB
Franklin CGU-629 USB
Giant D301 USB
Gigabyte MD800 PCI-Express
Haier CE100 USB
Haier CE310 USB
Haier CM200 USB
Haier EM100 USB
Haier HT-DM300 USB
Haier WM100 USB
Haier WM200 USB
Haier WM500 USB
Haier VME110 USB
Haier VMW310 USB
Hisense E6801 USB
Hojy 733 USB
Hojy ET128 USB
Hojy TD368 USB
Honest UC128 USB
Huawei D01HW USB
Huawei D02HW USB
Huawei D12HW USB
Huawei D21HW USB
Huawei D22HW USB
Huawei D23HW USB
Huawei D31HW USB
Huawei E122 USB
Huawei E1260 USB
Huawei E1550 USB
Huawei E1552 USB
Huawei E1556 USB
Huawei E156G USB
Huawei E160 USB
Huawei E161 USB
Huawei E160G USB
Huawei E169 USB
Huawei E169U USB
Huawei E170 USB
Huawei E172 USB
Huawei E1750 USB
Huawei E1762 USB
Huawei E180 USB
Huawei E1820 USB
Huawei E182E USB
Huawei E220 USB
Huawei E226 USB
Huawei E270 USB
Huawei E510 USB
Huawei EC122 USB
Huawei EC1260 USB
Huawei EC168 USB
Huawei EC169 USB
Haweiu EC189 USB
Huawei EC226 USB
Huawei EC228 USB
Huawei ET128 USB
Huawei K3520 USB
Huawei K3715 USB
Huawei K3765 USB
Huawei UGM181 USB
IPWireless IPWireless USB USB
KPT WM66 USB
Lenovo SPRD-8800 USB
LG L-05A USB
LightSpeed EDGE-180M USB
LightSpeed HSDPA-180C USB
LightSpeed HSUPA-380P USB
LongCheer 71_11 USB
LongCheer C01LC USB
LongCheer C02LC USB
LongCheer D11LC USB
LongCheer D12LC USB
LongCheer D21LC USB
Matrix MTX-H25 USB
Maxon USB3-8521 USB
MLW Telecom SU-6200 USB
MLW Telecom SU-8100U USB
MLW Telecom SU-8200U USB
MLW Telecom SU-8300U USB
MLW Telecom SU-8500U USB
MLW Telecom SU-8600 USB
MLW Telecom SU-9000U USB
Motorola Q9 Mobile Phone
MTC FLY-HU01 USB
Nokia CS-10 USB
Nokia CS-15 USB
Nokia N95 Mobile Phone
Novatel ES720 USB
Novatel MC727 USB
Novatel MC760 USB
Novatel MC930D USB
Novatel MC935D USB
Novatel MC950D USB
Novatel MC990D USB
Novatel U720 USB
Novatel U727 USB
Novatel U760 USB
Novatel X950D PCI-Express
ONDA MSA405HS USB
ONDA DT515HS USB
Option GE0201 PCI-Express
Option GE0301 PCI-Express
Option GI0322 USB
Option Globe Trotter PCI-Express
Option GT Express 7.2 PCI-Express
Option GTM378/GI0201 USB
Option GTM382 USB
Option ICON 031 USB
Option ICON 225 USB
Option ICON 322 USB
Option ICON 401 USB
Option ICON 431 USB
Option ICON 451 USB
Option ICON 452 USB
Option ICON 505 USB
Option ICON 515 USB
Option HSUPA-380P USB
Pantech UM150 USB
Pantech UM175 USB
Pantech UM185AL USB
Pinsu EU930 USB
Prolink PHS-100 USB
Prolink PHS-300 USB
Promate E-G03 USB
Quanta GKD USB
Quanta GQR USB
Quanta MU-Q101 USB
Quanta Q110 USB
QuickTel HM405 USB
Qsida H21 USB
Samsung SGH-H128 USB
SHber E750 USB
SHber E751 USB
SHber E751+ USB
SHber E752 USB
SHber E753+ USB
SHber H951 USB
SHber H955 USB
SHber H956 USB
Sierra Wireless 595U USB
Sierra Wireless 598U USB
Sierra Wireless 875U USB
Sierra Wireless AC501 PCI-Express
Sierra Wireless AC503 PCI-Express
Sierra Wireless AC595U USB
Sierra Wireless AC597 USB
Sierra Wireless AC597U USB
Sierra Wireless AC880E PCI-Express
Sierra Wireless AC881U USB
Sierra Wireless AC885 USB
Sierra Wireless Compass 597 USB
Sierra Wireless Compass 885U USB
Sierra Wireless Compass 888U USB
Sierra Wireless Compass 889 USB
Sierra Wireless USB306 USB
Sierra Wireless USB307 USB
Sierra Wireless USB308 USB
Sierra Wireless USB309 USB
SIMCOM SIM5218A USB
SIMCOM U6-T USB
SIMCOM U9R-T USB
Solomon D12LC USB
Solomon S3GM-646 USB
Solomon S3GM-660 USB
Solomon S3GM-690 USB
Solomon SEGM-520C USB
Sony Ericsson MD300 USB
Sony Ericsson MD400 USB
Sony Ericsson EC400 PCI-Express
Sprint U598 USB
Sprint U760 USB
T&W W1U100 USB
Tacito MD72U USB
Telit UC864 USB
UTSTARCOM C6805 USB
UTStarcom CU186 USB
UTStarcom CU189(Q6085) USB
UTStarcom UM100 USB
Verizon ES720 USB
Verizon UM150VW USB
Verizon UM175A USB
Verizon UM175B/VW USB
Vodafone EasyBox USB
Vodafone K4505 USB
Vtion V1810 USB
Vtion E1916 USB
Webee Modem Configuration USB
ZOOM 4593 USB
ZOOM 72TRI USB
ZTE AC2710 USB
ZTE AC2726 USB
ZTE AC2736 USB
ZTE AC560 USB
ZTE AC580 USB
ZTE AC8710 USB
ZTE K3520 USB
ZTE K3565-Z USB
ZTE MF100 USB
ZTE MF620 USB
ZTE MF622 USB
ZTE MF626 USB
ZTE MF627 USB
ZTE MF633 USB
ZTE MF633BP USB
ZTE MF636 USB
ZTE MF636+ USB
ZTE MF636-BKIC USB
ZTE MF636BP USB
ZTE MF637 USB
ZTE MF637U USB
ZTE MF668 USB
ZTE MU-318 USB
ZTE MU-350 USB
ZTE MU-351 USB

Boot log:

Jboot B291
JRecovery Version R1.1 2010/10/01 12:04
LED is Scan mode.LAN bind on port1~4
DDCR->0x4E700000, DQS0=7,DQS1=7
SPI flash probe....
===========(SPI FLASH0)===========
Manufacturer=EON, Device ID=0x3016, Size=4096KB, Sector size=4kB, Sector Count=1024
===========(SPI FLASH1)===========
Flash not found!
...............
Starting kernel @80000000...
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 25180k/32768k available (3041k kernel code, 7588k reserved, 462k data, 136k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
PCIE:525800
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI: Bridge: 0000:00:00.0
  IO window: 18e00000-18e00fff
  MEM window: 1a000000-1a0fffff
  PREFETCH window: disabled.
NET: Registered protocol family 2
IP route cache hash table entries: 256 (order: -2, 1024 bytes)
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 1024 bind 512)
TCP reno registered
Squashfs 2.2-r2 (released 2005/09/08) (C) 2002-2005 Phillip Lougher
io scheduler noop registered
io scheduler anticipatory registered (default)
Skipping PCI bus scan due to resource conflict
PCI: Bridge: 0000:00:00.0
  IO window: 18e00000-18e00fff
  MEM window: 1a000000-1a0fffff
  PREFETCH window: disabled.
pci_hotplug: PCI Hot Plug PCI Core version: 0.5
fakephp: Fake PCI Hot Plug Controller Driver
pciehp: PCI Express Hot Plug Controller Driver version: 0.4
GPIO Driver initial
I2C RTC Driver initial
AMIT Networking Info initial
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 12) is a 16550A
Probing RTL8186 10/100 NIC...
chip name: 8196B, chip revid: 0
NOT YET
Set threshould idx 0
eth0 added. vid=9 Member port 0x11e...
eth1 added. vid=8 Member port 0x1...
PPP generic driver version 2.4.2
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
RTL8192SE driver version 1.15 (2009-09-08)
PCI: Enabling device 0000:01:00.0 (0000 -> 0003)
correcting to 32
SPI Flash Initial...
flash device: 0x400000 at 0xbfc00000
SPI Flash Probe...
EON-EN25Q32 device detect.
Physically mapped flash: Found an alies 0x400000 for the chip at 0x0.
 <5>Creating 3 MTD partitions on "Physically mapped flash":
0x00000000-0x00400000 : "WholeImage"
0x00111000-0x003a1000 : "root fs"
0x003a0010-0x003f0000 : "UI fs"
mtd: partition "UI fs" doesn't start on an erase block boundary -- force read-only
Netfilter messages via NETLINK v0.30.
ip_conntrack version 2.4 (256 buckets, 2048 max) - 240 bytes per conntrack
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_time loading
SPAP: Module loaded.
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Realtek FastPath v1.02
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 136k freed
mount /proc file system ok!
mount /var  file system ok!
Thu Jan  1 00:00:00 UTC 2009
 flash_open: flash_fd=3
 flash_open: flash_fd=9
device eth0 entered promiscuous mode
br0: port 1(eth0) entering learning state
==== Wireless AP START ====
device wlan0 entered promiscuous mode
fw_version: 7030(48.11), fw_EMEM_len: 43848, fw_IMEM_len: 36872, fw_DMEM_len: 48
br0: port 2(wlan0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating
br0: port 2(wlan0) entering forwarding state
IEEE 802.11f (IAPP) using interface br0 (v1.7)
==== NAT START ====
fwd_adjust_mss setup
start_mac_control
/var/nat-draft.uyg start ok
udhcpd (v0.9.9-pre) started
Unable to open /var/run/udhcpd.leases for reading
============= AMIT UPNP Start =============
eth1 br0
iptables: Chain already exists
WAN_IF=eth1,LAN_IF=br0
iptables: Chain already exists
 flash_open: flash_fd=9
BOOT VER: 291
AGP Server Linux Version 1 (c) 2008/10/3
rtl8652-ohci rtl8652-ohci.0: RTL8652 OHCI
rtl8652-ohci rtl8652-ohci.0: new USB bus registered, assigned bus number 1
rtl8652-ohci rtl8652-ohci.0: irq 10, io mem 0xb8020000
 flash_open: flash_fd=3
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
rtl8652-ehci rtl8652-ehci.0: RTL8652 On-Chip EHCI Host Controller
rtl8652-ehci rtl8652-ehci.0: new USB bus registered, assigned bus number 2
read synopsys=0
read synopsys2=0
rtl8652-ehci rtl8652-ehci.0: irq 10, io base 0xb8021000
rtl8652-ehci rtl8652-ehci.0: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
br0: port 2(wlan0) entering disabled state
fw_version: 7030(48.11), fw_EMEM_len: 43848, fw_IMEM_len: 36872, fw_DMEM_len: 48
PHY_to1T1R
br0: port 2(wlan0) entering learning state
br0: topology change detected, propagating
br0: port 2(wlan0) entering forwarding state

# uname -a
Linux (none) 2.6.19 #9 Fri Oct 8 08:47:46 CEST 2010 mips unknown
# cat /proc/cpuinfo
system type             : RTL8652
processor               : 0
cpu model               : R3000 V0.0
BogoMIPS                : 389.12
wait instruction        : yes
microsecond timers      : no
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
VCED exceptions         : not available
VCEI exceptions         : not available
# busybox
BusyBox v1.3.2 (2010-10-08 05:29:38 CEST) multi-call binary
Copyright (C) 1998-2006  Erik Andersen, Rob Landley, and others.
Licensed under GPLv2. �ࠠSee source distribution for full notice.

Usage: busybox [function] [arguments]...
   or: [function] [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use and BusyBox
        will act like whatever it was invoked as!

Currently defined functions:
        [, [[, ash, awk, busybox, cat, chmod, cp, cut, date, echo,
        egrep, ether-wake, expr, fgrep, getty, grep, halt, ifconfig,
        init, insmod, ip, kill, killall, klogd, ln, logger, login,
        ls, lsmod, mkdir, modprobe, mount, mv, ping, poweroff,
        printf, ps, rdate, reboot, rm, rmmod, route, sh, sleep,
        syslogd, telnetd, test, touch, tr, traceroute, umount,
        uname, uptime, usleep, wget