User Tools

Site Tools


toh:comtrend:ct5361

Comtrend CT-5361

The CT-5361 is an adsl wifi router distributed by some Spanish ISP's like Movistar (white enclosure) or Jazztel (dark blue enclosure).

Internal ADSL modem isn't supported

Hardware Highlights

SoC CPU speed Ram Flash Network USB Serial JTag
Broadcom 6348 256MHz 16MiB 4MiB 4 x 1 Yes Yes Yes

generic.overview

Installation

Flash Layout

Please check out the article Flash.Layout. It contains an example and a couple of explanations.

OEM easy installation

Get the firmware openwrt-CT536_CT5621-squashfs-cfe.bin

  • Set a static IP on your computer, compatible with 192.168.1.1, i.e 192.168.1.100
  • Conect the ethernet cable from your computer to the CT-5361
  • Unplug the power cord
  • Press the reset button, don't release it yet!
  • Plug the power cord
  • Wait 10 seconds or more
  • Release the reset button
  • Select .bin file
  • Upgrade the image
  • Wait for it to reboot
  • Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.

OEM installation using the TFTP method

If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.

Upgrading OpenWrt

generic.sysupgrade

If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

LuCI Web Upgrade Process

Terminal Upgrade Process

  • Login as root via SSH on 192.168.1.1
  • Use the following commands to upgrade.

cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-96348GW-generic-squashfs-cfe.bin
sysupgrade /tmp/openwrt-96348GW-generic-squashfs-cfe.bin

  • If sysupgrade does not support this router, use the following commands.

cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-96348GW-generic-squashfs-cfe.bin
mtd write /tmp/openwrt-96348GW-generic-squashfs-cfe.bin linux && reboot

Basic configuration

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

Specific Configuration

Interfaces

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi 192.168.1.1/24
eth0 LAN ports (1 to 4) bridged
wlan0 WiFi Disabled (bridged)

Switch Ports (for VLANs)

This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 will be the Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on.

Port Switch port Mode
LAN 1 0 lan
LAN 2 1 lan
LAN 3 2 lan
LAN 4 3 Internet (WAN)

# path: /etc/config/network # port 4 = WAN config interface loopback option ifname lo option proto static option ipaddr 127.0.0.1 option netmask 255.0.0.0 config interface lan option type bridge option ifname eth0.0 option proto static option ipaddr 192.168.1.1 option netmask 255.255.255.0 option nat 1 config interface wan option ifname eth0.1 option macaddr 00:11:22:33:44:55 option proto dhcp option defaultroute 1 config switch eth0 option enable 1 option reset 1 option enable_vlan 1 config switch_vlan option device eth0 option vlan 0 option ports "0 1 2 5t" config switch_vlan option device eth0 option vlan 1 option ports "3 5t"

Failsafe mode

Buttons

hardware.button on howto use and configure the hardware button(s).

The Comtrend 5361 has one button. It is the Reset.

BUTTON Event
Reset reset

Hardware

Info

Architecture: MIPS
Vendor: Broadcom
Bootloader: CFE
Board ID: 96348GW-11
System-On-Chip: BCM6348
CPU/Speed BMIPS3300 V0.7 / 256 MHz
Flash-Chip: MX29LV320AB
Flash size: 4 MiB
RAM-Chip: EM638165TS-7 / SDR-143
RAM size: 2x8 MiB
Wireless: Broadcom 4318 rev9, 802.11b/g (miniPCI)
Ethernet: Broadcom BCM5325 w/ vlan support swconfig
Internet: ADSL2+
USB: possible with mod
PSU: 16.5V DC 850mA / EVER GLOW ADV165085
Serial: Yes
JTAG: Yes

Photos

Model Number

Photo of front of the casing

Photo of back of the casing
FIXME

Opening the case

Note: This will void your warranty!

  • To remove the cover do a/b/c

Photo of PCB

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Photo of PCB with markings

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

Debricking

Bootloader Mods

→ you could read about bootloader in general

Hardware mods

→ as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

USB Mod

64MiB RAM Mod

Possible using a custom CFE bootloader.

Bootlogs

OEM bootlog

CFE version 1.0.37-0.7-1 for BCM96348 (32bit,SP,BE) Build Date: Thu Apr 28 12:04:28 CST 2005 (root@jyang.linux.comtrend.com) Copyright (C) 2000,2001,2002,2003 Broadcom Corporation. Initializing Arena. Initializing Devices. CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz Total memory used by CFE: 0x80401000 - 0x80522DF0 (1187312) Initialized Data: 0x8041AF10 - 0x8041C790 (6272) BSS Area: 0x8041C790 - 0x80420DF0 (18016) Local Heap: 0x80420DF0 - 0x80520DF0 (1048576) Stack Area: 0x80520DF0 - 0x80522DF0 (8192) Text (code) segment: 0x80401000 - 0x8041AF0C (106252) Boot area (physical): 0x00523000 - 0x00563000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : 96348GW-11 Psi size in KB : 24 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:1d:20:40:c5:96 Ethernet PHY Type : Internal Memory size in MB : 16 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 Code Address: 0x80010000, Entry Address: 0x801ab018 Decompression OK! Entry at 0x801ab018 Closing network. Starting program at 0x801ab018 Linux version 2.6.8.1 (wenxing@broadcom.comtrend.com) (gcc version 3.4.2) #1 Wed Nov 28 13:50:37 CST 2007 Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB Total Flash size: 4096K with 71 sectors 96348GW-11 prom init CPU revision is: 00029107 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 DMA zone: 4000 pages, LIFO batch:1 Normal zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=31:0 ro noinitrd brcm mips: enabling icache and dcache... Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 8kB 2-way, linesize 16 bytes. PID hash table entries: 64 (order 6: 512 bytes) Using 128.000 MHz high precision timer. Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 13940k/16000k available (1431k kernel code, 2040k reserved, 208k data, 72k init, 0k highmem) Calibrating delay loop... 255.59 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... unavailable. NET: Registered protocol family 16 MPI: No Card is in the PCMCIA slot Can't analyze prologue code at 80174694 Initializing Cryptographic API PPP generic driver version 2.4.2 NET: Registered protocol family 24 Using noop io scheduler bcm963xx_mtd driver v1.0 brcmboard: brcm_board_init entry bcm963xx_serial driver v2.0 NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) Initializing IPsec netlink socket NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 Ebtables v2.0 registered NET: Registered protocol family 8 NET: Registered protocol family 20 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 72k freed init started: BusyBox v1.00 (2007.11.28-05:55+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 BusyBox v1.00 (2007.11.28-05:55+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... atmapi: module license 'Proprietary' taints kernel. blaadd: blaa_detect entry adsl: adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6348B0 Ethernet Network Device v0.3 Nov 28 2007 13:49:01 Config Ethernet Switch Through SPI Slave Select 1 dgasp: kerSysRegisterDyingGaspHandler: eth0 registered eth0: MAC Address: 00:1D:20:40:C5:96 PCI: Setting latency timer of device 0000:00:01.0 to 64 PCI: Enabling device 0000:00:01.0 (0004 -> 0006) wl0: Broadcom BCM4318 802.11 Wireless Controller 3.131.35.4.cpe2.0 dgasp: kerSysRegisterDyingGaspHandler: wl0 registered #frank#BcmDb_getSysFlagInfo:2195 PSI status != PSI_STS_OK# #frank#BcmDb_getSysFlagInfo:2203 DefaultValue enblEnhancedIgmp# eth0 Link UP. BcmAdsl_Initialize=0xC00663F8, g_pFnNotifyCallback=0xC007F204 AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00000980 adsl2=0x00000000 pSdramPHY=0xA0FFFFF8, 0x17F2F 0xDEADBEEF AdslCoreHwReset: AdslOemDataAddr = 0xA0FFA724 AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00000980 adsl2=0x00000000 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered ATM proc init !!! ip_tables: (C) 2000-2002 Netfilter core team ip_conntrack version 2.1 (125 buckets, 0 max) - 368 bytes per conntrack ip_conntrack_pptp version 2.1 loaded ip_nat_pptp version 2.0 loaded ip_conntrack_h323: init ip_nat_h323: initialize the module! ip_conntrack_rtsp v0.01 loading ip_nat_rtsp v0.01 loading ==> Comtrend Router Software Version: A111-306FPT-C01_R02 <== device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state glbDnsRelDhcpEnable=TRUE Setting SSID "Comtrend" Setting SSID "Guest" eth0 Link DOWN. br0: port 1(eth0) entering disabled state eth0 Link UP. br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state Setting country code using abbreviation: "VN" wl0: current channel 6 device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state device wl0.1 entered promiscuous mode pvc2684d: Interface "nas_0_33" created sucessfully pvc2684d: Communicating over ATM 0.0.33, encapsulation: LLC Starting BcmNtwk_startDefDhcpSrv with leasedTime=60 dns1=192.168.1.1, dns2=192.168.1.1 dns1=192.168.1.1 dns2=192.168.1.1 pvc2684d: Interface "nas_8_35" created sucessfully pvc2684d: Communicating over ATM 0.8.35, encapsulation: LLC device nas_8_35 entered promiscuous mode br0: port 4(nas_8_35) entering learning state br0: topology change detected, propagating br0: port 4(nas_8_35) entering forwarding state device eth0 left promiscuous mode br0: port 1(eth0) entering disabled state device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state device wl0 left promiscuous mode br0: port 2(wl0) entering disabled state device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state device wl0.1 left promiscuous mode br0: port 3(wl0.1) entering disabled state device wl0.1 entered promiscuous mode device nas_8_35 left promiscuous mode br0: port 4(nas_8_35) entering disabled state device nas_8_35 entered promiscuous mode br0: port 4(nas_8_35) entering learning state br0: topology change detected, propagating br0: port 4(nas_8_35) entering forwarding state Login: root Password: >

OpenWrt bootlog

CFE version 1.0.37-0.7-1 for BCM96348 (32bit,SP,BE) Build Date: Thu Apr 28 12:04:28 CST 2005 (root@jyang.linux.comtrend.com) Copyright (C) 2000,2001,2002,2003 Broadcom Corporation. Initializing Arena. Initializing Devices. CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz Total memory used by CFE: 0x80401000 - 0x80522DF0 (1187312) Initialized Data: 0x8041AF10 - 0x8041C790 (6272) BSS Area: 0x8041C790 - 0x80420DF0 (18016) Local Heap: 0x80420DF0 - 0x80520DF0 (1048576) Stack Area: 0x80520DF0 - 0x80522DF0 (8192) Text (code) segment: 0x80401000 - 0x8041AF0C (106252) Boot area (physical): 0x00523000 - 0x00563000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : 96348GW-11 Psi size in KB : 24 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:1d:20:40:c5:96 Ethernet PHY Type : Internal Memory size in MB : 16 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 Code Address: 0x80010000, Entry Address: 0x80010000 Decompression OK! Entry at 0x80010000 Closing network. Starting program at 0x80010000 Linux version 2.6.32.27 (jow@nd-build-02.linux-appliance.net) (gcc version 4.3.3 (GCC) ) #5 Wed Dec 21 05:51:40 CET 2011 Detected Broadcom 0x6348 CPU revision b0 CPU frequency is 256 MHz 16MB of RAM installed registering 37 GPIOs board_bcm963xx: CFE version: 1.0.37-0.7 bootconsole [early0] enabled CPU revision is: 00029107 (Broadcom BCM6348) board_bcm963xx: board name: 96348GW-11 Determined physical RAM map: memory: 01000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00001000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00001000 Built 1 zonelists in Zone order, mobility grouping off. Total pages: 4064 Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 PID hash table entries: 64 (order: -4, 256 bytes) Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes. Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes Memory: 13284k/16384k available (2140k kernel code, 3100k reserved, 453k data, 140k init, 0k highmem) Hierarchical RCU implementation. NR_IRQS:128 Calibrating delay loop... 254.97 BogoMIPS (lpj=509952) Mount-cache hash table entries: 512 NET: Registered protocol family 16 registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab at 0 pci 0000:01:1e.0: CardBus bridge, secondary bus 0000:02 pci 0000:01:1e.0: IO window: 0x8008000-0x80080ff pci 0000:01:1e.0: IO window: 0x8008400-0x80084ff pci 0000:01:1e.0: MEM window: 0x38000000-0x3fffffff PCI: Enabling device 0000:01:1e.0 (0000 -> 0003) Switching to clocksource MIPS PCI: Enabling device 0000:00:01.0 (0000 -> 0002) ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP reno registered NET: Registered protocol family 1 audit: initializing netlink socket (disabled) type=2000 audit(0.330:1): initialized squashfs: version 4.0 (2009/01/31) Phillip Lougher Registering mini_fo version $Id$ JFFS2 version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. msgmni has been set to 25 io scheduler noop registered io scheduler deadline registered (default) gpiodev: gpio device registered with major 254 gpiodev: gpio platform device registered with access mask FFFFFFFF bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart console [ttyS0] enabled, bootconsole disabled console [ttyS0] enabled, bootconsole disabled bcm963xx_flash: 0x00400000 at 0x1fc00000 bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank CFI mfr 0x000000c2 CFI id 0x000022a8 Amd/Fujitsu Extended Query Table at 0x0040 Amd/Fujitsu Extended Query version 1.1. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. bcm963xx_flash: Read Signature value of CFE1CFE1 bcm963xx_flash: CFE bootloader detected bcm963xx_flash: CFE boot tag found with version 6 and board type 96348GW-11 bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000 bcm963xx_flash: Partition 1 is kernel offset 10100 and length dff00 bcm963xx_flash: Partition 2 is rootfs offset f0000 and length 300000 bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000 bcm963xx_flash: Partition 4 is linux offset 10000 and length 3e0000 bcm963xx_flash: Spare partition is 2b0000 offset and length 140000 Creating 5 MTD partitions on "bcm963xx": 0x000000000000-0x000000010000 : "CFE" 0x000000010100-0x0000000f0000 : "kernel" mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only 0x0000000f0000-0x0000003f0000 : "rootfs" mtd: partition "rootfs" set to be root filesystem mtd: partition "rootfs_data" created automatically, ofs=2B0000, len=140000 0x0000002b0000-0x0000003f0000 : "rootfs_data" 0x0000003f0000-0x000000400000 : "nvram" 0x000000010000-0x0000003f0000 : "linux" bcm63xx_enet MII bus: probed bcm63xx_wdt started, timer margin: 30 sec Registered led device: adsl-fail Registered led device: ppp Registered led device: ppp-fail Registered led device: power Registered led device: stop TCP westwood registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 140k freed Please be patient, while OpenWrt loads ... - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - switching to jffs2 mini_fo: using base directory: / mini_fo: using storage directory: /overlay - init - Please press Enter to activate this console. bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)] eth1: link forced UP - 100/full - flow control off/off device eth1 entered promiscuous mode br-lan: port 1(eth1) entering forwarding state Compat-wireless backport release: compat-wireless-2011-11-08-1-g4ab9b62 Backport based on wireless-testing.git master-2011-11-15 cfg80211: Calling CRDA to update world regulatory domain cfg80211: World regulatory domain updated: cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) roboswitch: Probing device eth0: Failed to enable switch roboswitch: Probing device eth1: found a 5325! It's a 5350. b43-phy0: Broadcom 4318 WLAN found (core revision 9) Registered led device: b43-phy0::tx Registered led device: b43-phy0::rx Registered led device: b43-phy0::radio Broadcom 43xx driver loaded [ Features: PL ] PPP generic driver version 2.4.2 ip_tables: (C) 2000-2006 Netfilter Core Team NET: Registered protocol family 24 nf_conntrack version 0.5.0 (209 buckets, 836 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. BusyBox v1.15.3 (2011-11-24 04:32:28 CET) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M Backfire (10.03.1, r29592) ------------------------ * 1/3 shot Kahlua In a shot glass, layer Kahlua * 1/3 shot Bailey's on the bottom, then Bailey's, * 1/3 shot Vodka then Vodka. --------------------------------------------------- root@OpenWrt:/# free total used free shared buffers Mem: 13424 12112 1312 0 1432 Swap: 0 0 0 Total: 13424 12112 1312 root@OpenWrt:/#

Notes

Tags

For some Help with the Tags, please have a look here: tags

toh/comtrend/ct5361.txt · Last modified: 2015/03/24 20:17 by danitool