User Tools

Site Tools


toh:arcadyan:ar7516

Arcadyan AR7516

Also known as the Orange Bright Box or EE Bright Box 1 in the UK.

Status

Not officially supported, but Chaos Calmer for a similar device is fully functional and stable on this model.

DSL is not available on this or any other BCM63xx device (an effort was documented but got nowhere).

Hardware

Summary

Architecture: MIPS
Vendor: Broadcom
Bootloader: CFE
Board ID: AR7516AAW
System-On-Chip: Broadcom BCM6328
CPU/Speed BMIPS4350 v7.5 / 320 MHz
Flash-Chip: Macronix MX25L6406E
Flash size 8 MiB
RAM-Chip EM68B16CWQD-25H / DDR2-800
RAM 64 MiB
Wireless Broadcom BCM43227 (onboard)
Ethernet: BRCM6328 Switch (integrated on SoC)
USB Yes
Serial: Yes
JTAG: ?

More detail below. Table of Hardware data.

Installation

Outline:

  • Download stuff and gather info.
  • Use the stock bootloader's tiny web server to replace the manufacturer bootloader with a custom, more standard one.
  • Use the custom bootloader's tiny web server to upload an OpenWRT image.
  • Boot into OpenWrt and (optionally) fix the WiFi.

Preparation

  • Find a pen/pencil/paperclip that will let you get to the reset button by the DSL port.
  • Download the replacement bootloader image (button below).
  • Download the OpenWrt image; you want openwrt-15.05.1-brcm63xx-generic-A4001N-squashfs-cfe.bin or a newer version. (Not the similarly named A4001N1.)

CFE-AR7516-BrightBox.bin
md5sum=939f5aeff6b64b7d5e9d8caed39b0ba4

Replace bootloader

  • Connect via cable to the router (any port).
  • Set your IP address to 192.168.1.100.
  • Follow steps 1–7 of the "Using CFE web (http) server" instructions. This stock/manufacturer interface will offer you both firmware ("Software") upgrade and bootloader upgrade; be sure to use the bootloader section of the upload form.
  • There is no progress bar, so you just need to wait about a minute for flashing to finish and reboot into the new bootloader. You'll know it has worked when you can visit http://192.168.1.1/ and get similar but shorter firmware upload page which only offers you firmware ("Software") upload.

Upload OpenWRT

  • Switch the unit off, get a pen or paperclip, hold down the reset button by the DSL port, and keep it held down while switching the unit back on. (Be careful not to press the WPS button at the same time, since that would boot in a different mode.) You can release the reset button after two or three seconds.
  • Wait 5–10 more seconds then visit http://192.168.1.1/; you should be offered an upload form.
  • Again, follow steps 1–7 of the "Using CFE web (http) server" instructions. This custom bootloader's interface will offer you only firmware upgrade this time; give it the openwrt-15.05.1-brcm63xx-generic-A4001N-squashfs-cfe.bin image you downloaded before.
  • Wait about three minutes for flashing to finish. When it has, if you visit http://192.168.1.1/ you should see the familiar OpenWrt front page ready for first login.

If for some reason you prefer TFTP, don't hold the reset button at boot; the bootloader will spawn a TFTP server and wait for you to upload a firmware image (again a -cfe.bin). Use your brain and follow the generic TFTP guide, but you don't need to unplug/re-plug the router like those instructions may suggest; it's already sitting there waiting for a TFTP upload with no timeout.

Fix WiFi

You also need to set a MAC address on the WiFi interface, since without one it won't come up. Via ssh (or telnet), you can edit /etc/config/wireless; otherwise, you can grab the config via System → Backup, unpack the archive, edit the file, repack the archive, and restore it. The change you need to make is to add option macaddr '00:11:22:33:44:55' (use the real MAC on the label!) to the config wifi-iface section.

Install USB support

You need kmod-usb-ohci and/or kmod-usb2; see USB Essentials.

Troubleshooting

If you can at least get the custom CFE flashed, then buttons held at power-on decide how it gets new firmware, which might give you options:

  • If you don't press anything but there's no valid image flashed yet, the bootloader will spawn a TFTP server (described above). This is CFE's 'f' menu option.
  • If you hold just the reset button at boot, the tiny firmware upload web interface will start on 192.168.1.1 (described above).
  • If you hold just the WPS button at boot, the bootloader will request a kernel+initramfs (filename "vmlinux") from 192.168.1.100 and boot it from RAM. This is CFE's 'r' menu option.
  • If you hold both the reset and WPS buttons at boot, the bootloader will await a TFTP upload of a whole-flash image (allowing you to replace CFE, but misuse of this is a great way to brick your unit, and CFE upgrade is probably better done from within a working OpenWrt via mtdblockN when possible). This is CFE's 'w' menu option.

None of the NMRP code was removed from the CFE while customising it, so NMRP may also work.

If you can't get anywhere with those options, you'll probably need serial access.

Failing that, you'll probably need SPI access.

There may be JTAG access.

The generic failsafe behaviour works (there's no LED prompt, but just repeatedly pressing the WPS button during boot will work), as does holding reset for 5+ seconds to reset a hosed installation to defaults.

Hardware Detail

Case

Open with a little care, since the antenna that's connected via coax could be yanked off if too much force is used. The four rubber feet hide Torx screws (ugh). Both the top and bottom panels are held on by four clips, one at the centre of each edge. The clips holding the side edges can be released by pushing (gently!) on them through the side grilles.

Buttons

Reset (GPIO 23, active low) and WPS (GPIO 24, active low) are recognised and can be mapped to custom actions through the usual OpenWrt button system.

The unpopulated SW42 is also connected to GPIO 24, and seems to be an alternative position for the WPS button.

LEDs

There are 8 LEDs that might be controlled; most indicate what they should without needing configuring. The power light is not controllable. ​ WiFi state is probably wired directly to the BCM43227.

Ethernet port activity lights are owned by the switch by default, but can be used as GPIOs by writing to a register.

Name internet upgrade wifi state wifi activity eth1 eth2 eth3 eth4
GPIO 6 1 ? 7 25 26 27 28
Active low high ? low low low low low

GPIOs

The SoC supports 32 (0–31); those marked ??? have not been located. Bold numbers are probably spare (guesswork!), underlined numbers are relatively accessible. Directions (above/right) are mostly relative to a label.

GPIO Function/access/notes
0 ???
1 upgrade LED (active high); use /sys/class/leds/A4001N:red:inet/ for now
2 parallel flash pin 41 (SPI side, above the '2' of label C218)
3 parallel flash pin 17 (RJ45 side, below the label of R217
4 RHS of R206 and parallel flash pin 29 (SPI side)
5 LHS of R207 and parallel flash pin 32 (SPI side)
6 the SoC side of R208, near WiFi activity LED
7 WiFi activity LED (active low); accessible at SoC side of R209 nearby
8 parallel flash pin 43 (SPI side, above the '1' of label C218)
9 parallel flash pin 44 (above the '18' of label C218)
10 parallel flash pin 31 (SPI side, left of R207 label's top edge); also R214's LHS on underside
11 RHS of R215, and parallel flash pin 9 (RJ45 side)
12 ???
13 parallel flash pin 44 (SPI side, above the '8' of label C218)
14 RHS of R217, and parallel flash pin 18 (RJ45 side)
15 RHS of R233, and parallel flash pin 7 (RJ45 side)
16 RHS pads of WR712 and WR713, between WiFi and RAM
17 RHS pad of R218 (between SoC and the ethernet transformers)
18 RHS pad of R219 (between SoC and the ethernet transformers)
19 RHS of R83/R84 on underside of board, towards ethernet edge
20 SoC side of R150, near WiFi activity LED
21 parallel flash pin 16 (RJ45 side, below the C of C221)
22 ???
23 reset button, active low
24 WPS button, active low
25 eth port 1 activity LED; owned by switch by default
26 eth port 2 activity LED; owned by switch by default
27 eth port 3 activity LED; owned by switch by default
28 eth port 4 activity LED; owned by switch by default
29 ???
30 ???
31 SoC side of R138, near WiFi activity LED

USB

Quick superficial tests (hotplugging HID devices) show USB working to some extent, but it'd be nice to test something more demanding.

Serial

J3, between the CPU and the USB port; unpopulated through-holes (some early models may have been left populated?). 3V3, 115200/8/N/1 in stock stuff and CFEs. From the point of view of the router:

  • pin 2: TX
  • pin 3: RX
  • pin 4 (unlabelled): GND

SPI

With some careful soldering (or a SOIC clip), the right wires, a Raspberry Pi/BeagleBone Black/etc and a copy of flashrom, it is possible to flash an image directly to the SPI chip (has been done). Conveniently there are pads for a chip with a larger footprint, so you needn't solder directly to the chip, but the chip's VCC is connected to the rest of the board so you run the risk of drawing too much power and/or flashing while the CPU is awake; consider fitting an isolation jumper. You may find the chip gets enough power parasitically that it flashes OK without its VCC connected. Don't let any other pins float unless they're NC though.

JTAG

There's no JTAG header. There are five test pads between the SoC and the serial pins (see pic above) but the TG582n has test pads here too which aren't connected to its 8-pin header (customarily used by Thomson for JTAG) so it might be some other BCM6328 interface, or a JTAG interface to something else. Going clockwise around the serial header:

  • TPA25 pulled down, 4.7k, 0.6V
  • TPA28 pulled up, 1k, 3V3
  • TPA27 ??? roughly 100k to VCC and to ground, 1V
  • TPA29 pulled up, 1k, 3V3
  • TPA26 pulled up, 1k, 3V3

Manufacturer Firmware

Might be relevant if you want to take a backup of the original firmware or save config before installation.

These are the stock firmware's (not so) hidden config pages.

The stock Orange firmware is vulnerable to hacks by people given the WiFi password, at least, and (judging by the quality of the firmware) probably to remote hacks that aren't public yet.

Firmware update is available via holding the reset button for 8+ seconds. Also via the Admin menu.

Root access can be gained via serial access (on Orange-branded models not upgraded), or by entering 'Manufactory Mode' (on EE-branded models, or upgraded Orange models). Serial access can be used to start telnet too. Older Orange models can be upgraded with EE firmware.

'Manufactory' Mode/Telnet

In models with EE firmware it is possible to enable telnet access without opening the device. The process involves accessing a hidden settings page and resetting the box into the manufacturer's factory default mode. Please note: this is not the same page as the "factory default" page accessible from the Advanced Set-Up→Tools menu.

On some firmware versions this may reset all configuration, so save anything you need just in case.

The steps are as follows:

  1. Go to your router's configuration in your web browser, e.g. http://192.168.1.1/
  2. Log in using the user name and password
  3. Optionally, but recommended, visit Advanced Set-Up→Tools→Configuration and backup your current config
  4. Now, change the location of the current page in your browser to u132xzp32aai.htm, so that the full address is, for example, http://192.168.1.1/u132xzp32aai.htm
  5. Click the button that says "Manufactory Default"
  6. Reboot the router

Once the router finishes doing its thing, you can now telnet in using the user name root and the password password (on some firmware versions this might be admin:password instead). A significant drawback is that your router's normal functions may be impaired whilst in this mode. For instance, you may not be able to alter the wireless settings or use your broadband.

Other technical bits

CFE magic/signature

The bootloader image was built from sources released by Netgear for the DGN2200v2 (V1.0.0.21 + 1.7.21BEZEQ + toolchain, currently available on Sourceforge), by forum user zx82. To reproduce it you'll want the patch that enables web upload and boot method selection. (Forum user danitool built the CFE used in earlier versions of these instructions, but without customisation OpenWrt flashing still required opening the case and soldering or shorting pins.)

The reasons we replace the stock CFE at all are twofold:

  1. It departs from CFE conventions enough that mainline Linux might not boot on it. Specifically, on bcm63xx the kernel gets the MTD layout from a structure at the start of the CFE, after checking the structure has the right magic. The stock CFE uses custom magic (has abl-v instead of cfe-v at offset 0x570, and has no "CFE1" magic), meaning Linux's ''bcm63xx_detect_cfe()'' cannot be confident it's booting on CFE and may fail to find the rootfs.
  2. It imposes a non-standard signature requirement on replacement firmware/bootloaders; I think the last 128 bytes of the image must start with "ArcMagicSignature" and the last 32-bit word must contain a CRC32 over all but the last two words in the image. Once a CFE satisfying but not enforcing that requirement has been installed, the chain is broken and we can install standard imagetag-format firmware via CFE.

Potential improvements:

  • With patches, works fine for the user who built it, but at least one more report of success would be nice.
  • NMRP support seems like an unnecessary source of vulnerability. Unless there's some excellent tooling out there it should probably be dropped from the tree. Even if there is, it shouldn't be switched on unless buttons are pressed at boot.
  • A rebuild could make better use of the LEDs, e.g. as feedback/reassurance on boot mode selection, and/or indicating flashing activity.
  • If there's any code out there (or already in there? haven't looked) with a tiny DHCPd, that'd take the static IP chore out of the setup steps.
  • Kermit or xmodem or just dumb base64 serial upload would be nice.
  • Would be nice to be able to boot off USB. And to use U-Boot. And the moon on a stick.

ADSL PHY

So there are no open ADSL drivers. Fine, but the ADSL PHY is a MIPS core with at least a chunk of RAM shared between the two. It'd be fun to put it to some kind of use. It'd probably suffer from the same CMT/SMP issues as its dual-core bcm63xx siblings do, so is probably no use for SMP. But maybe it can see the GPIOs/SPI? If so maybe it could act as a really poor man's PRU like on the BeagleBone. It'd be slower and nowhere near as deterministic, but for some use cases perhaps that's still better than sharing the core that's running Linux. It'd be interesting to know whether it appears in the JTAG chain.

CFE replacement in stock firmware userspace

An alternative way to flash a replacement CFE is to boot to manufacturer userspace and write to the mtdblockN partitions, but since the manufacturer firmware gives 56KiB for CFE and the replacement is ~64KiB, the image has to be split (ideally before transfer on a USB stick) and the chunks written to the different contiguous partitions.

Bootlogs

OEM Bootlog

HELO CPUI L1CI DRAM ---- PHYS ZQDN PHYE DINT LSYN USYN MSYN LMBE PASS ---- ZBSS CODE DATA L12F ROMM ==== HELO ZBSS RAMM ==== Copyright (C) 2011 Arcadyan Technology. SPIFLASH: JEDEC ID: 0xc22017, size: 8192KB block: 64KB(64), sector: 4KB(1024) NVRAM(0) MAGIC checking passed! NVRAM(0) CRC checking passed! total 7 of NVRAM(0) entries loaded NVRAM(1) MAGIC checking passed! NVRAM(1) CRC checking passed! total 7 of NVRAM(1) entries loaded BOOTLOADER version 1.0.9 for BrightBox Build Date: Wed Nov 9 10:21:21 2011 (glen_lin@buildbed) Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz Memory Test Passed! Total Memory: 67108864 bytes (64MB) HW Version: 01 Board IP address 192.168.1.1 Board IP netmask 255.255.255.0 Gateway IP address 0.0.0.0 Server IP address 192.168.1.99 Boot image (1 or 2) 1 MAC address number 1 MAC address base xxxxxxxxxxxxxxxxx *** Press any key to stop auto run (3 seconds) *** Auto run second count down: 0 Loading primary image ... Finished loading 8257536 bytes DATE : Mon Nov 28 17:30:50 2011 VER : v0.09.82.0001 CRC : 3C15DF56 Code Address: 0x80002000, Entry Address: 0x801d8520 Decompression OK! Entry at 0x801d8520 Starting program at 0x801d8520 Linux version 2.6.30 (glen_lin@buildbed) (gcc version 4.1.2) #1 Mon Nov 28 17:16:00 CST 2011 Detected Broadcom 0x6328 CPU revision 10b0 CPU frequency is 320 MHz 64MB of RAM installed registering 32 GPIOs console [early0] enabled CPU revision is: 0002a075 (Broadcom BCM63281) board_bcm9632x: board name: AR7516AAW Determined physical RAM map: memory: 03f00000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00003f00 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00003f00 On node 0 totalpages: 16128 free_area_init_node: node 0, pgdat 8024bb30, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 94 pages used for memmap Normal zone: 11938 pages, LIFO batch:1 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16002 Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 ro rootfstype=squashfs wait instruction: enabled Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes NR_IRQS:80 PID hash table entries: 256 (order: 8, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 61368k/64512k available (1912k kernel code, 3124k reserved, 436k data, 120k init, 0k highmem) Calibrating delay loop... 318.46 BogoMIPS (lpj=159232) Mount-cache hash table entries: 512 --Kernel Config-- SMP=0 PREEMPT=0 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 net_namespace: 536 bytes /proc/net/netfilter/nf_cli_bw_mon created NET: Registered protocol family 16 registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 pci 0000:00:00.0: PME# supported from D0 D3hot pci 0000:00:00.0: PME# disabled pci 0000:01:00.0: reg 10 64bit mmio: [0x000000-0x003fff] pci 0000:01:00.0: supports D1 D2 pci 0000:00:00.0: PCI bridge, secondary bus 0000:01 pci 0000:00:00.0: IO window: disabled pci 0000:00:00.0: MEM window: 0x10f00000-0x10ffffff pci 0000:00:00.0: PREFETCH window: disabled PCI: Enabling device 0000:00:00.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:00.0 to 64 BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 Nov 28 2011 17:14:06 initialized NET: Registered protocol family 8 NET: Registered protocol family 20 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 Total # RxBds=848 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized squashfs: version 4.0 (2009/01/31) Phillip Lougher msgmni has been set to 119 io scheduler noop registered (default) PCI: Setting latency timer of device 0000:00:00.0 to 64 aer 0000:00:00.0:pcie02: service driver aer loaded bcm632x-uart.0: ttyS0 at MMIO 0xb0000100 (irq = 36) is a bcm632x-uart console handover: boot [early0] -> real [ttyS0] loop: module loaded PPP generic driver version 2.4.2 NET: Registered protocol family 24 PPPoL2TP kernel driver, V1.0 m25p80 spi0.0: mx25l6405d (8192 Kbytes) Creating 6 MTD partitions on "spi0.0": 0x00000000e000-0x00000000f000 : "manuf" 0x00000000f000-0x000000010000 : "nvram" 0x000000110000-0x0000007f0000 : "rootfs" 0x000000010000-0x0000007f0000 : "priimg" 0x0000007f0000-0x000000800000 : "pricfg" 0x000000000000-0x00000000e000 : "bootldr" bcm632x-hsspi bcm632x-hsspi.0: at 0xb0001000 (irq 37, FIFOs size 510) v1.0 Registered led device: dsl:sync Registered led device: dsl:data Registered led device: wps:green Registered led device: sys:a Registered led device: sys:b Registered led device: sys:c Registered led device: sys:d GACT probability on u32 classifier Actions configured TCP cubic registered NET: Registered protocol family 17 Bridge firewalling registered Initializing MCPD Module 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 120k freed gpio-buttons driver version 0.1.2 input: gpio-buttons as /devices/platform/gpio-buttons/input/input0 Button Hotplug driver version 0.4.1 arc_oshal: module license 'Propritary' taints kernel. Disabling lock debugging due to kernel taint oshal_init(1066) DRV: Created Successfully ARC_KERNEL_OSIX_init(396) DRV: Created Successfully Broadcom Logger v0.1 Nov 28 2011 17:16:27 Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 Nov 28 2011 17:16:29 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. Constructed Broadcom Packet Flow Cache v2.2 Nov 28 2011 17:16:29 Broadcom BCM6328B0 Ethernet Network Device v0.1 Nov 28 2011 17:16:31 ETH Init: Ch:0 - 180 tx BDs at 0xa3946000 ETH Init: Ch:0 - 400 rx BDs at 0xa3a21000 bcm632x-dg: register bcmsw eth0: MAC Address: xxxxxxxxxxxxxxxxx eth1: MAC Address: xxxxxxxxxxxxxxxxx eth2: MAC Address: xxxxxxxxxxxxxxxxx eth3: MAC Address: xxxxxxxxxxxxxxxxx Broadcom 802.1Q VLAN Interface, v0.1 bcmxtmrt: Broadcom BCM6328B0 ATM/PTM Network Device v0.4 Nov 28 2011 17:16:44 bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom Power Management v0.1 Nov 28 2011 17:18:42 Broadcom WLAN configuration service start PCI: Enabling device 0000:01:00.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:01:00.0 to 64 wl: passivemode=1 wl: napimode=0 wl: allocskbmode=1 wl:force using embedded data wlc_bmac_attach(2582): BpGetWirelessFlags NIY! wl0: Broadcom BCMa8dc 802.11 Wireless Controller 5.100.96.0.cpe4.10L01a.8 bcm632x-dg: register wl0 ip_tables: (C) 2000-2006 Netfilter Core Team Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (1008 buckets, 4032 max) ctnetlink v0.93: registering with nfnetlink. xt_time: kernel timezone is -0000 IMQ driver loaded successfully. Hooking IMQ after NAT on PREROUTING. Hooking IMQ before NAT on POSTROUTING. Osix_service_sys_cmd_thread_main[1302]: Osix Wait for Batch System Comand Processing... Osix Thread service system command started successfully ! ramdisk/etc/config/ ramdisk/etc/config/backup.bin ramdisk/etc/config/glbcfg.save MHDL_DB_WLAN_Init_Setting[118] MHDL_DB_LAN_Init_Setting[525] Password for 'admin' changed BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 BcmAdsl_Initialize(202): BpGetRj11InnerOuterPairGpios NIY pSdramPHY=0xA3FFFFF8, 0xD11BD1AB 0xD99AD3DB *** PhySdramSize got adjusted: 0x82CDC => 0x98878 *** AdslCoreSharedMemInit: shareMemAvailable=423776 AdslCoreHwReset: pLocSbSta=83120000 bkupThreshold=1600 AdslCoreHwReset: AdslOemDataAddr = 0xA3F77D28 EXECUTE "/bin/util_xdsl_cli mode auto" BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 EXECUTE "/bin/util_xdsl_cli bitswap enable" BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 EXECUTE "/bin/util_xdsl_cli sra enable" BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 devCtl_xtmInitiaXTM Init: Ch:0 - 400 rx BDs at 0xa3bc5000 lize(174): devCtXTM Init: Ch:1 - 16 rx BDs at 0xa29ad780 l_getSdramSize NIY! WAN Type is ADSL Success Success Success Success Success Success Power ON stage, no need to delete interface in advance. ioctl failed. check if wl0.1 exists MHDL_DB_SYS_DNS_UPDATE_RESOLV_CONF[1046]: cmd_buf (cp /tmp/tmpResolv_536.conf /etc/resolv.conf) dhcp IP compare: old () vs new (192.168.1.101). dhcp lease time compare: old (00000000) vs new (0002A300). mhdl_dn_lan_dhcpd_cfg_file_init[169]: Check_IP_Changed : (TRUE). Lease_Time_Changed (TRUE) dhcp IP compare: old () vs new (192.168.2.1). dhcp lease time compare: old (00000000) vs new (0000A8C0). mhdl_dn_lan_dhcpd_cfg_file_init[169]: Check_IP_Changed : (TRUE). Lease_Time_Changed (TRUE) dhcp IP compare: old () vs new (192.168.3.1). Restart Level is BR0_IPCHANGED BR0 IP Changed dhcp lease time compare: old (00000000) vs new (0000A8C0). mhdl_dn_lan_dhcpd_cfg_file_init[169]: Check_IP_Changed : (TRUE). Lease_Time_Changed (TRUE) Initializing WAN ioctl failed. check if wl0.1 exists XTM driver returns Not Found Error bcmxtmrt: MAC address: xxxxxxxxxxxxxxxxx [DoCreateDeviceReq.2998]: register_netdev [DoCreateDeviceReq.3000]: register_netdev done /bin/bcm_atmctl operate conn --add 1.0.38 aal5 vcmux_pppoa 1MHDL_DB_SYS_STOP_UPNPD[1322]: cmd (killall arc_upnp) killall: arc_upnp: no process killed MHDL_DB_SYS_RESTART_UPNPD[1306]: cmd_buf: /usr/sbin/arc_upnp & Success EXECUTE "/bin/pppd -c pppoa1 -a atm0.0.0.38 -H -k -R 30 -K 60 -M 1492 -u readytoconnect@fs -p mistyview &" Success Success Success Success ioctl failed. check if wl0.1 exists PPP: pppoa1 Start to connect ... netdev path : pppoa1 -> atm0 modprobe: can't open 'modules.dep': No such file or directory The kernel doesn't support the ebtables 'nat' table. ioctl failed. check if wl0.1 exists iptables v1.4.8: Couldn't find target `QOSUP' Try `iptables -h' or 'iptables --help' for more information. iptables v1.4.8: Couldn't find target `QOSUP' Try `iptables -h' or 'iptables --help' for more information. net.netfilter.nf_conntrack_acct = 1 ioctl failed. check if wl0.1 exists RTNETLINK answers: Invalid argument CLOCK_MONOTONIC, resolution=0.999848 System clock_res=999848, clock_hz=1000 config_httpd(517) LAN IP Address (192.168.1.101) Pre-init before any Application was started. config_httpd(526) LAN IP Mask (255.255.255.0) httpd: after config_httpd() httpd: listen at 192.168.1.101:5438 [HTTPD] httpd_main(): Not the 1st httpd_main task killall: dyndns: no process killed killall: tzoupdate: no process killed start httpd Success Success Success SSDP_SetRCVSocket(217): Recv SsdpSock 14 Success Success QueryEthernetLinkStatus[115]: WAN Interface Name (NULL) Port Number: eth3, PortStatus: 0 killall: bcm_mcpd: no process killed ioctl failed. check if wl0.1 exists killall arc_httpd start arc_httpd lease_init[65]: /etc/udhcpd/udhcpd_001.leases ! 1 Jan 00:00:27 sntp[982]: kod_init_kod_db(): Cannot open KoD db file /var/db/ntp-kod 1 Jan 00:00:27 sntp[982]: Error looking up (A) ntp.readytoconnect.co.uk: Name or service not known Unable to resolve hostname(s) HTTPD: main(1478) Restart Level is BR1_IPCHANGED BR1 IP Changed main(1570): I am child for HTTPD SVR 2 main(1582): Start HTTPD SVR 0 ioctl failed. check if wl0.1 exists killall: bcm_mcpd: no process killed lease_init[65]: /etc/udhcpd/udhcpd_002.leases ! Restart Level is BR2_IPCHANGED BR2 IP Changed please assign value for wl0.1_ssid please assign value for wl0.2_ssid killall: bcm_mcpd: no process killed iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. ioctl failed. check if wl0.1 exists iptables: No chain/target/match by that name. conntrack v1.0.0 (conntrack-tools): connection tracking table has been emptied. conntrack v1.0.0 (conntrack-tools): expectation table has been emptied. ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists rmmod: can't unload 'nf_nat_pt': unknown symbol in module, or unknown parameter ioctl failed. check if wl0.1 exists killall: urlfilterd: no process killed ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists conntrack v1.0.0 (conntrack-tools): connection tracking table has been emptied. conntrack v1.0.0 (conntrack-tools): expectation table has been emptied. ioctl failed. check if wl0.1 exists please assign value for wl0_radius_key please assign value for wl0_nas_id 1 Jan 00:00:50 sntp[2769]: Error looking up (A) ntp.readytoconnect.co.uk: Name or service not known Unable to resolve hostname(s) ioctl failed. check if wl0.1 exists please assign value for wl0.1_wpa_psk please assign value for wl0.2_wpa_psk start WLAN manager WLmngr Daemon is running ioctl failed. check if wl0.1 exists ifconfig: wl0.1: error fetching interface information: Device not found ifconfig: wl0.2: error fetching interface information: Device not found wlevt_init@157: opened loopback socket 6 wlevt is ready for new msg... nvram_commit NIY! ifconfig: wl0.1: error fetching interface information: Device not found ifconfig: wl0.2: error fetching interface information: Device not found ioctl failed. check if wl0.1 exists >>>>>Start Auto Channel search !!! >>>>> Setting SSID: "BrightBox-rc3bq3" Setting SSID: "ar7516aaw-guest" Setting SSID: "ar7516aaw-guest2" PPP: pppoa1 Start to connect ... netdev path : pppoa1 -> atm0 chanspec 0x2b01 selected bcm_wlctl: Unsupported bcm_wlctl: Not Permitted bcm_wlctl: Undefined error nvram_commit NIY! LLTD daemon is ready to run EAP daemon is ready to run NAS daemon is ready to run wlmngr_startWsc(1125): wait for WPSUI message timeout! dalQos_setDefaultWlQueuesLock NIY! dalQos_setDefaultWlQueuesLock NIY! dalQos_setDefaultWlQueuesLock NIY! read/write to TR69 configuration NIY! Starting to init bandwidth contrl of wifi!! /sbin/tctrl qdisc del dev wl0 ingress 2>/dev/null /usr/sbin/ebtables -X wl0_egress 2>/dev/null iptables: No chain/target/match by that name. /sbin/tctrl qdisc del dev wl0 root 2>/dev/null /usr/sbin/ebtables -X wl0_ingress 2>/dev/null /sbin/tctrl qdisc del dev wl0.1 ingress 2>/dev/null /usr/sbin/ebtables -X wl0.1_egress 2>/dev/null /sbin/tctrl qdisc del dev wl0.1 root 2>/dev/null /usr/sbin/ebtables -X wl0.1_ingress 2>/dev/null /sbin/tctrl qdisc del dev wl0.2 ingress 2>/dev/null /usr/sbin/ebtables -X wl0.2_egress 2>/dev/null /sbin/tctrl qdisc del dev wl0.2 root 2>/dev/null /usr/sbin/ebtables -X wl0.2_ingress 2>/dev/null start mcpd 1 Jan 00:01:15 sntp[3572]: Error looking up (A) ntp.readytoconnect.co.uk: Name or service not known Unable to resolve hostname(s) start USB service Password for 'user' changed Password for 'matt' changed bcm632x-usb-ohci bcm632x-usb-ohci.0: init err (c8300000 0000) bcm632x-usb-ohci bcm632x-usb-ohci.0: startup error -79 bcm632x-usb-ohci: probe of bcm632x-usb-ohci.0 failed with error -79 action name is add product name is 1d6b/2/206 Driver 'sd' needs updating - please use bus_type methods start UMTS service action name is add product name is 1d6b/2/206 start Power-Management service Host MIPS Clock divider pwrsaving is enabled DDR Self Refresh pwrsaving is enabled System Start with Normal Phase root@BrightBox:/ #


OpenWRT Bootlog

This is a boot using the older TG582n CFE and the D-Link DSL-2740B/DSL-2741B rev F1 image.

HELO CPUI L1CI DRAM ---- PHYS ZQDN PHYE DINT LSYN USYN MSYN LMBE PASS ---- ZBSS CODE DATA L12F MAIN CFE version 2.0.3 for DGN2200v2 (32bit,SP,BE) Build Date: s\0xc3\0xa1b may 9 21:45:47 CEST 2015 (dani@tool) Copyright (C) 2000-2009 Broadcom Corporation. HS Serial flash device: name MX25L64, id 0xc217 size 8192KB Total Flash size: 8192K with 2048 sectors ** HELLO ** Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz Main Thread: TP0 Memory Test Passed Total Memory: 67108864 bytes (64MB) Boot Address: 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-4) : 963281TAN Number of MAC Addresses (1-32) : 10 Base MAC Address : 00:00:00:00:00:01 PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1\0x081\0x080 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1\0x081\0x080 Booting from only image (0xb8010000) ... Code Address: 0x80A00000, Entry Address: 0x80a00000 LZMA: Prossible old LZMA format, trying to decompress.. Decompression OK! Entry at 0x80a00000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 2 buffers found. Closing DMA Channels. Starting program at 0x80a00000 [ 0.000000] Linux version 3.18.17 (buildbot@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r46018) ) #1 Fri Jul 3 16:32:38 CEST 2015 [ 0.000000] Detected Broadcom 0x6328 CPU revision b0 [ 0.000000] CPU frequency is 320 MHz [ 0.000000] 64MB of RAM installed [ 0.000000] board_bcm963xx: Boot address 0xb8000000 [ 0.000000] board_bcm963xx: CFE version: 1.0.37-106.24 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0002a075 (Broadcom BMIPS4350) [ 0.000000] board: board name: AW4339U [ 0.000000] MIPS: machine is D-Link DSL-2740B/DSL-2741B rev F1 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x00000000-0x03ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x03ffffff] [ 0.000000] Initmem setup node 0 [mem 0x00000000-0x03ffffff] [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Memory: 59716K/65536K available (2813K kernel code, 139K rwdata, 664K rodata, 1304K init, 192K bss, 5820K reserved) [ 0.000000] NR_IRQS:256 [ 0.000000] Calibrating delay loop... 319.74 BogoMIPS (lpj=639488) [ 0.040000] pid_max: default: 32768 minimum: 301 [ 0.044000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.048000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.060000] NET: Registered protocol family 16 [ 0.300000] registering PCI controller with io_map_base unset [ 0.324000] PCI host bridge to bus 0000:00 [ 0.328000] pci_bus 0000:00: root bus resource [mem 0x10f00000-0x10ffffff] [ 0.332000] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0] [ 0.336000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.340000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 0.344000] pci 0000:00:00.0: BAR 8: assigned [mem 0x10f00000-0x10ffffff] [ 0.348000] pci 0000:01:00.0: BAR 0: assigned [mem 0x10f00000-0x10f03fff 64bit] [ 0.352000] pci 0000:00:00.0: PCI bridge to [bus 01] [ 0.356000] pci 0000:00:00.0: bridge window [mem 0x10f00000-0x10ffffff] [ 0.360000] Switched to clocksource MIPS [ 0.364000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002) [ 0.372000] PCI: Enabling device 0000:01:00.0 (0000 -> 0002) [ 0.376000] bcma: bus0: Found chip with id 43227, rev 0x00 and package 0x08 [ 0.384000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x25, class 0x0) [ 0.392000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x1E, class 0x0) [ 0.404000] bcma: bus0: Core 2 found: PCIe (manuf 0x4BF, id 0x820, rev 0x12, class 0x0) [ 0.412000] bcma: bus0: Core 3 found: SDIO Device (manuf 0x4BF, id 0x829, rev 0x07, class 0x0) [ 0.420000] bcma: bus0: Using fallback SPROM failed (err -2) [ 0.424000] bcma: bus0: No SPROM available [ 0.440000] bcma: bus0: Bus registered [ 0.444000] NET: Registered protocol family 2 [ 0.452000] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.460000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.464000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.472000] TCP: reno registered [ 0.476000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.480000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.488000] NET: Registered protocol family 1 [ 0.496000] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.508000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.512000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.524000] msgmni has been set to 116 [ 0.528000] io scheduler noop registered [ 0.532000] io scheduler deadline registered (default) [ 0.540000] bcm63xx_uart.0: ttyS0 at MMIO 0xb0000100 (irq = 36, base_baud = 1562500) is a bcm63xx_uart [ 0.552000] console [ttyS0] enabled [ 0.552000] console [ttyS0] enabled [ 0.556000] bootconsole [early0] disabled [ 0.556000] bootconsole [early0] disabled [ 0.568000] m25p80 spi1.0: found mx25l6405d, expected m25p80 [ 0.576000] m25p80 spi1.0: mx25l6405d (8192 Kbytes) [ 0.580000] bcm63xxpart: CFE boot tag found with version 6 and board type AW4339U [ 0.588000] bcm63xxpart: Partition 0 is CFE offset 0 and length 10000 [ 0.596000] bcm63xxpart: Partition 1 is kernel offset 10100 and length 136008 [ 0.604000] bcm63xxpart: Partition 2 is rootfs offset 146108 and length 689ef8 [ 0.612000] bcm63xxpart: Partition 3 is cal_data offset 7d0000 and length 10000 [ 0.616000] bcm63xxpart: Partition 4 is nvram offset 7f0000 and length 10000 [ 0.624000] bcm63xxpart: Partition 5 is linux offset 10000 and length 7c0000 [ 0.632000] 6 bcm63xxpart partitions found on MTD device spi1.0 [ 0.640000] Creating 6 MTD partitions on "spi1.0": [ 0.644000] 0x000000000000-0x000000010000 : "CFE" [ 0.652000] 0x000000010100-0x000000146108 : "kernel" [ 0.656000] 0x000000146108-0x0000007d0000 : "rootfs" [ 0.664000] mtd: device 2 (rootfs) set to be root filesystem [ 0.676000] 1 squashfs-split partitions found on MTD device rootfs [ 0.684000] 0x000000360000-0x0000007d0000 : "rootfs_data" [ 0.692000] 0x0000007d0000-0x0000007e0000 : "cal_data" [ 0.700000] 0x0000007f0000-0x000000800000 : "nvram" [ 0.704000] 0x000000010000-0x0000007d0000 : "linux" [ 0.752000] b53_common: found switch: BCM63xx, rev 0 [ 0.756000] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.768000] TCP: cubic registered [ 0.768000] NET: Registered protocol family 17 [ 0.776000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this. [ 0.788000] Bridge firewalling registered [ 0.792000] 8021q: 802.1Q VLAN Support v1.8 [ 0.812000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.836000] Freeing unused kernel memory: 1304K (8039a000 - 804e0000) [ 2.508000] init: Console is alive [ 2.512000] init: - watchdog - [ 3.280000] random: nonblocking pool is initialized [ 4.648000] init: - preinit - [ 5.368000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on Port 3, 100Mbps, full-duplex Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 9.116000] jffs2: notice: (235) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 9.148000] mount_root: switching to jffs2 overlay [ 9.240000] procd: - early - [ 9.244000] procd: - watchdog - [ 10.260000] procd: - ubus - [ 11.268000] procd: - init - Please press Enter to activate this console. [ 13.884000] NET: Registered protocol family 10 [ 13.960000] usbcore: registered new interface driver usbfs [ 13.968000] usbcore: registered new interface driver hub [ 13.972000] usbcore: registered new device driver usb [ 13.988000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 14.000000] ehci-platform: EHCI generic platform driver [ 14.016000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 14.040000] ehci-pci: EHCI PCI platform driver [ 14.056000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 14.064000] ohci-platform: OHCI generic platform driver [ 14.076000] uhci_hcd: USB Universal Host Controller Interface driver [ 14.116000] hidraw: raw HID events driver (C) Jiri Kosina [ 14.128000] Loading modules backported from Linux version master-2015-03-09-0-g141f155 [ 14.136000] Backport generated by backports.git backports-20150129-0-gdd4a670 [ 14.156000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 14.184000] nf_conntrack version 0.5.0 (953 buckets, 3812 max) [ 14.264000] xt_time: kernel timezone is -0000 [ 14.332000] cfg80211: Calling CRDA to update world regulatory domain [ 14.340000] cfg80211: World regulatory domain updated: [ 14.344000] cfg80211: DFS Master region: unset [ 14.348000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time) [ 14.360000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 14.368000] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 14.376000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A) [ 14.384000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 14.392000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s) [ 14.404000] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s) [ 14.412000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 14.420000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A) [ 14.588000] PPP generic driver version 2.4.2 [ 14.596000] NET: Registered protocol family 24 [ 14.836000] b43-phy0: Broadcom 43227 WLAN found (core revision 30) [ 14.844000] b43-phy0: Found PHY: Analog 9, Type 4 (N), Revision 16 [ 14.852000] b43-phy0: Found Radio: Manuf 0x17F, ID 0x2057, Revision 9, Version 1 [ 14.860000] Broadcom 43xx driver loaded [ Features: PNL ] [ 20.516000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on Port 3, 100Mbps, full-duplex [ 26.560000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on Port 3, 100Mbps, full-duplex [ 26.568000] device eth0.1 entered promiscuous mode [ 26.576000] device eth0 entered promiscuous mode [ 26.588000] br-lan: port 1(eth0.1) entered forwarding state [ 26.592000] br-lan: port 1(eth0.1) entered forwarding state [ 28.596000] br-lan: port 1(eth0.1) entered forwarding state


Tags

toh/arcadyan/ar7516.txt · Last modified: 2016/04/08 11:51 by zx82