Work in progress

The AR7516 is branded in the UK as the Orange Brightbox router.

This is the AR7516 product page

These are the stock firmware's hidden config pages

Firmware update is available via holding the reset button for 8+ seconds. Also via the Admin menu.

Telnet can be enabled via popping the lid and serial connecting, or by entering 'Manufactory Mode' (see below).

HELO CPUI L1CI DRAM ---- PHYS ZQDN PHYE DINT LSYN USYN MSYN LMBE PASS ---- ZBSS CODE DATA L12F ROMM ==== HELO ZBSS RAMM ==== Copyright (C) 2011 Arcadyan Technology. SPIFLASH: JEDEC ID: 0xc22017, size: 8192KB block: 64KB(64), sector: 4KB(1024) NVRAM(0) MAGIC checking passed! NVRAM(0) CRC checking passed! total 7 of NVRAM(0) entries loaded NVRAM(1) MAGIC checking passed! NVRAM(1) CRC checking passed! total 7 of NVRAM(1) entries loaded BOOTLOADER version 1.0.9 for BrightBox Build Date: Wed Nov 9 10:21:21 2011 (glen_lin@buildbed) Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz Memory Test Passed! Total Memory: 67108864 bytes (64MB) HW Version: 01 Board IP address 192.168.1.1 Board IP netmask 255.255.255.0 Gateway IP address 0.0.0.0 Server IP address 192.168.1.99 Boot image (1 or 2) 1 MAC address number 1 MAC address base xxxxxxxxxxxxxxxxx *** Press any key to stop auto run (3 seconds) *** Auto run second count down: 0 Loading primary image ... Finished loading 8257536 bytes DATE : Mon Nov 28 17:30:50 2011 VER : v0.09.82.0001 CRC : 3C15DF56 Code Address: 0x80002000, Entry Address: 0x801d8520 Decompression OK! Entry at 0x801d8520 Starting program at 0x801d8520 Linux version 2.6.30 (glen_lin@buildbed) (gcc version 4.1.2) #1 Mon Nov 28 17:16:00 CST 2011 Detected Broadcom 0x6328 CPU revision 10b0 CPU frequency is 320 MHz 64MB of RAM installed registering 32 GPIOs console [early0] enabled CPU revision is: 0002a075 (Broadcom BCM63281) board_bcm9632x: board name: AR7516AAW Determined physical RAM map: memory: 03f00000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00003f00 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00003f00 On node 0 totalpages: 16128 free_area_init_node: node 0, pgdat 8024bb30, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 94 pages used for memmap Normal zone: 11938 pages, LIFO batch:1 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16002 Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 ro rootfstype=squashfs wait instruction: enabled Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes NR_IRQS:80 PID hash table entries: 256 (order: 8, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 61368k/64512k available (1912k kernel code, 3124k reserved, 436k data, 120k init, 0k highmem) Calibrating delay loop... 318.46 BogoMIPS (lpj=159232) Mount-cache hash table entries: 512 --Kernel Config-- SMP=0 PREEMPT=0 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 net_namespace: 536 bytes /proc/net/netfilter/nf_cli_bw_mon created NET: Registered protocol family 16 registering PCI controller with io_map_base unset bio: create slab at 0 pci 0000:00:00.0: PME# supported from D0 D3hot pci 0000:00:00.0: PME# disabled pci 0000:01:00.0: reg 10 64bit mmio: [0x000000-0x003fff] pci 0000:01:00.0: supports D1 D2 pci 0000:00:00.0: PCI bridge, secondary bus 0000:01 pci 0000:00:00.0: IO window: disabled pci 0000:00:00.0: MEM window: 0x10f00000-0x10ffffff pci 0000:00:00.0: PREFETCH window: disabled PCI: Enabling device 0000:00:00.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:00.0 to 64 BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 Nov 28 2011 17:14:06 initialized NET: Registered protocol family 8 NET: Registered protocol family 20 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 Total # RxBds=848 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized squashfs: version 4.0 (2009/01/31) Phillip Lougher msgmni has been set to 119 io scheduler noop registered (default) PCI: Setting latency timer of device 0000:00:00.0 to 64 aer 0000:00:00.0:pcie02: service driver aer loaded bcm632x-uart.0: ttyS0 at MMIO 0xb0000100 (irq = 36) is a bcm632x-uart console handover: boot [early0] -> real [ttyS0] loop: module loaded PPP generic driver version 2.4.2 NET: Registered protocol family 24 PPPoL2TP kernel driver, V1.0 m25p80 spi0.0: mx25l6405d (8192 Kbytes) Creating 6 MTD partitions on "spi0.0": 0x00000000e000-0x00000000f000 : "manuf" 0x00000000f000-0x000000010000 : "nvram" 0x000000110000-0x0000007f0000 : "rootfs" 0x000000010000-0x0000007f0000 : "priimg" 0x0000007f0000-0x000000800000 : "pricfg" 0x000000000000-0x00000000e000 : "bootldr" bcm632x-hsspi bcm632x-hsspi.0: at 0xb0001000 (irq 37, FIFOs size 510) v1.0 Registered led device: dsl:sync Registered led device: dsl:data Registered led device: wps:green Registered led device: sys:a Registered led device: sys:b Registered led device: sys:c Registered led device: sys:d GACT probability on u32 classifier Actions configured TCP cubic registered NET: Registered protocol family 17 Bridge firewalling registered Initializing MCPD Module 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 120k freed gpio-buttons driver version 0.1.2 input: gpio-buttons as /devices/platform/gpio-buttons/input/input0 Button Hotplug driver version 0.4.1 arc_oshal: module license 'Propritary' taints kernel. Disabling lock debugging due to kernel taint oshal_init(1066) DRV: Created Successfully ARC_KERNEL_OSIX_init(396) DRV: Created Successfully Broadcom Logger v0.1 Nov 28 2011 17:16:27 Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 Nov 28 2011 17:16:29 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. Constructed Broadcom Packet Flow Cache v2.2 Nov 28 2011 17:16:29 Broadcom BCM6328B0 Ethernet Network Device v0.1 Nov 28 2011 17:16:31 ETH Init: Ch:0 - 180 tx BDs at 0xa3946000 ETH Init: Ch:0 - 400 rx BDs at 0xa3a21000 bcm632x-dg: register bcmsw eth0: MAC Address: xxxxxxxxxxxxxxxxx eth1: MAC Address: xxxxxxxxxxxxxxxxx eth2: MAC Address: xxxxxxxxxxxxxxxxx eth3: MAC Address: xxxxxxxxxxxxxxxxx Broadcom 802.1Q VLAN Interface, v0.1 bcmxtmrt: Broadcom BCM6328B0 ATM/PTM Network Device v0.4 Nov 28 2011 17:16:44 bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom Power Management v0.1 Nov 28 2011 17:18:42 Broadcom WLAN configuration service start PCI: Enabling device 0000:01:00.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:01:00.0 to 64 wl: passivemode=1 wl: napimode=0 wl: allocskbmode=1 wl:force using embedded data wlc_bmac_attach(2582): BpGetWirelessFlags NIY! wl0: Broadcom BCMa8dc 802.11 Wireless Controller 5.100.96.0.cpe4.10L01a.8 bcm632x-dg: register wl0 ip_tables: (C) 2000-2006 Netfilter Core Team Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (1008 buckets, 4032 max) ctnetlink v0.93: registering with nfnetlink. xt_time: kernel timezone is -0000 IMQ driver loaded successfully. Hooking IMQ after NAT on PREROUTING. Hooking IMQ before NAT on POSTROUTING. Osix_service_sys_cmd_thread_main[1302]: Osix Wait for Batch System Comand Processing... Osix Thread service system command started successfully ! ramdisk/etc/config/ ramdisk/etc/config/backup.bin ramdisk/etc/config/glbcfg.save MHDL_DB_WLAN_Init_Setting[118] MHDL_DB_LAN_Init_Setting[525] Password for 'admin' changed BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 BcmAdsl_Initialize(202): BpGetRj11InnerOuterPairGpios NIY pSdramPHY=0xA3FFFFF8, 0xD11BD1AB 0xD99AD3DB *** PhySdramSize got adjusted: 0x82CDC => 0x98878 *** AdslCoreSharedMemInit: shareMemAvailable=423776 AdslCoreHwReset: pLocSbSta=83120000 bkupThreshold=1600 AdslCoreHwReset: AdslOemDataAddr = 0xA3F77D28 EXECUTE "/bin/util_xdsl_cli mode auto" BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 EXECUTE "/bin/util_xdsl_cli bitswap enable" BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 EXECUTE "/bin/util_xdsl_cli sra enable" BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 devCtl_xtmInitiaXTM Init: Ch:0 - 400 rx BDs at 0xa3bc5000 lize(174): devCtXTM Init: Ch:1 - 16 rx BDs at 0xa29ad780 l_getSdramSize NIY! WAN Type is ADSL Success Success Success Success Success Success Power ON stage, no need to delete interface in advance. ioctl failed. check if wl0.1 exists MHDL_DB_SYS_DNS_UPDATE_RESOLV_CONF[1046]: cmd_buf (cp /tmp/tmpResolv_536.conf /etc/resolv.conf) dhcp IP compare: old () vs new (192.168.1.101). dhcp lease time compare: old (00000000) vs new (0002A300). mhdl_dn_lan_dhcpd_cfg_file_init[169]: Check_IP_Changed : (TRUE). Lease_Time_Changed (TRUE) dhcp IP compare: old () vs new (192.168.2.1). dhcp lease time compare: old (00000000) vs new (0000A8C0). mhdl_dn_lan_dhcpd_cfg_file_init[169]: Check_IP_Changed : (TRUE). Lease_Time_Changed (TRUE) dhcp IP compare: old () vs new (192.168.3.1). Restart Level is BR0_IPCHANGED BR0 IP Changed dhcp lease time compare: old (00000000) vs new (0000A8C0). mhdl_dn_lan_dhcpd_cfg_file_init[169]: Check_IP_Changed : (TRUE). Lease_Time_Changed (TRUE) Initializing WAN ioctl failed. check if wl0.1 exists XTM driver returns Not Found Error bcmxtmrt: MAC address: xxxxxxxxxxxxxxxxx [DoCreateDeviceReq.2998]: register_netdev [DoCreateDeviceReq.3000]: register_netdev done /bin/bcm_atmctl operate conn --add 1.0.38 aal5 vcmux_pppoa 1MHDL_DB_SYS_STOP_UPNPD[1322]: cmd (killall arc_upnp) killall: arc_upnp: no process killed MHDL_DB_SYS_RESTART_UPNPD[1306]: cmd_buf: /usr/sbin/arc_upnp & Success EXECUTE "/bin/pppd -c pppoa1 -a atm0.0.0.38 -H -k -R 30 -K 60 -M 1492 -u readytoconnect@fs -p mistyview &" Success Success Success Success ioctl failed. check if wl0.1 exists PPP: pppoa1 Start to connect ... netdev path : pppoa1 -> atm0 modprobe: can't open 'modules.dep': No such file or directory The kernel doesn't support the ebtables 'nat' table. ioctl failed. check if wl0.1 exists iptables v1.4.8: Couldn't find target `QOSUP' Try `iptables -h' or 'iptables --help' for more information. iptables v1.4.8: Couldn't find target `QOSUP' Try `iptables -h' or 'iptables --help' for more information. net.netfilter.nf_conntrack_acct = 1 ioctl failed. check if wl0.1 exists RTNETLINK answers: Invalid argument CLOCK_MONOTONIC, resolution=0.999848 System clock_res=999848, clock_hz=1000 config_httpd(517) LAN IP Address (192.168.1.101) Pre-init before any Application was started. config_httpd(526) LAN IP Mask (255.255.255.0) httpd: after config_httpd() httpd: listen at 192.168.1.101:5438 [HTTPD] httpd_main(): Not the 1st httpd_main task killall: dyndns: no process killed killall: tzoupdate: no process killed start httpd Success Success Success SSDP_SetRCVSocket(217): Recv SsdpSock 14 Success Success QueryEthernetLinkStatus[115]: WAN Interface Name (NULL) Port Number: eth3, PortStatus: 0 killall: bcm_mcpd: no process killed ioctl failed. check if wl0.1 exists killall arc_httpd start arc_httpd lease_init[65]: /etc/udhcpd/udhcpd_001.leases ! 1 Jan 00:00:27 sntp[982]: kod_init_kod_db(): Cannot open KoD db file /var/db/ntp-kod 1 Jan 00:00:27 sntp[982]: Error looking up (A) ntp.readytoconnect.co.uk: Name or service not known Unable to resolve hostname(s) HTTPD: main(1478) Restart Level is BR1_IPCHANGED BR1 IP Changed main(1570): I am child for HTTPD SVR 2 main(1582): Start HTTPD SVR 0 ioctl failed. check if wl0.1 exists killall: bcm_mcpd: no process killed lease_init[65]: /etc/udhcpd/udhcpd_002.leases ! Restart Level is BR2_IPCHANGED BR2 IP Changed please assign value for wl0.1_ssid please assign value for wl0.2_ssid killall: bcm_mcpd: no process killed iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. ioctl failed. check if wl0.1 exists iptables: No chain/target/match by that name. conntrack v1.0.0 (conntrack-tools): connection tracking table has been emptied. conntrack v1.0.0 (conntrack-tools): expectation table has been emptied. ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists rmmod: can't unload 'nf_nat_pt': unknown symbol in module, or unknown parameter ioctl failed. check if wl0.1 exists killall: urlfilterd: no process killed ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists conntrack v1.0.0 (conntrack-tools): connection tracking table has been emptied. conntrack v1.0.0 (conntrack-tools): expectation table has been emptied. ioctl failed. check if wl0.1 exists please assign value for wl0_radius_key please assign value for wl0_nas_id 1 Jan 00:00:50 sntp[2769]: Error looking up (A) ntp.readytoconnect.co.uk: Name or service not known Unable to resolve hostname(s) ioctl failed. check if wl0.1 exists please assign value for wl0.1_wpa_psk please assign value for wl0.2_wpa_psk start WLAN manager WLmngr Daemon is running ioctl failed. check if wl0.1 exists ifconfig: wl0.1: error fetching interface information: Device not found ifconfig: wl0.2: error fetching interface information: Device not found wlevt_init@157: opened loopback socket 6 wlevt is ready for new msg... nvram_commit NIY! ifconfig: wl0.1: error fetching interface information: Device not found ifconfig: wl0.2: error fetching interface information: Device not found ioctl failed. check if wl0.1 exists >>>>>Start Auto Channel search !!! >>>>> Setting SSID: "BrightBox-rc3bq3" Setting SSID: "ar7516aaw-guest" Setting SSID: "ar7516aaw-guest2" PPP: pppoa1 Start to connect ... netdev path : pppoa1 -> atm0 chanspec 0x2b01 selected bcm_wlctl: Unsupported bcm_wlctl: Not Permitted bcm_wlctl: Undefined error nvram_commit NIY! LLTD daemon is ready to run EAP daemon is ready to run NAS daemon is ready to run wlmngr_startWsc(1125): wait for WPSUI message timeout! dalQos_setDefaultWlQueuesLock NIY! dalQos_setDefaultWlQueuesLock NIY! dalQos_setDefaultWlQueuesLock NIY! read/write to TR69 configuration NIY! Starting to init bandwidth contrl of wifi!! /sbin/tctrl qdisc del dev wl0 ingress 2>/dev/null /usr/sbin/ebtables -X wl0_egress 2>/dev/null iptables: No chain/target/match by that name. /sbin/tctrl qdisc del dev wl0 root 2>/dev/null /usr/sbin/ebtables -X wl0_ingress 2>/dev/null /sbin/tctrl qdisc del dev wl0.1 ingress 2>/dev/null /usr/sbin/ebtables -X wl0.1_egress 2>/dev/null /sbin/tctrl qdisc del dev wl0.1 root 2>/dev/null /usr/sbin/ebtables -X wl0.1_ingress 2>/dev/null /sbin/tctrl qdisc del dev wl0.2 ingress 2>/dev/null /usr/sbin/ebtables -X wl0.2_egress 2>/dev/null /sbin/tctrl qdisc del dev wl0.2 root 2>/dev/null /usr/sbin/ebtables -X wl0.2_ingress 2>/dev/null start mcpd 1 Jan 00:01:15 sntp[3572]: Error looking up (A) ntp.readytoconnect.co.uk: Name or service not known Unable to resolve hostname(s) start USB service Password for 'user' changed Password for 'matt' changed bcm632x-usb-ohci bcm632x-usb-ohci.0: init err (c8300000 0000) bcm632x-usb-ohci bcm632x-usb-ohci.0: startup error -79 bcm632x-usb-ohci: probe of bcm632x-usb-ohci.0 failed with error -79 action name is add product name is 1d6b/2/206 Driver 'sd' needs updating - please use bus_type methods start UMTS service action name is add product name is 1d6b/2/206 start Power-Management service Host MIPS Clock divider pwrsaving is enabled DDR Self Refresh pwrsaving is enabled System Start with Normal Phase root@BrightBox:/ #

It is possible to enable telnet access without opening the device. The process involves accessing a hidden settings page and resetting the box into the manufacturer's factory default mode. Please note: this is not the same page as the "factory default" page accessible from the Advanced Set-Up→Tools menu.

The steps are as follows:

1. Go to your router's configuration in your web browser, e.g. http://192.168.1.1/
2. Log in using the user name and password
3. Optionally, but recommended, visit Advanced Set-Up→Tools→Configuration and backup your current config
4. Now, change the location of the current page in your browser to u132xzp32aai.htm, so that the full address is, for example, http://192.168.1.1/u132xzp32aai.htm
5. Click the button that says "Manufactory Default"

Once the router finishes doing its thing, you can now telnet in using the user name root and the password password. A significant drawback is that your router's normal functions may be impaired whilst in this mode. For instance, you may not be able to alter the wireless settings or use your broadband.