User Tools

Site Tools


toh:comtrend:ct5621

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Previous revision
toh:comtrend:ct5621 [2013/04/13 10:37]
toh:comtrend:ct5621 [2016/02/15 14:21] (current)
danitool clarify some differences about the two versions
Line 1: Line 1:
 +====== Comtrend CT-5621 / CT-5621T======
  
 +CT-5621 is almost identical to CT-5621T. But the CT-5621 comes with a "​Console"​ rj45 style port wired to the internal serial port at the board.
 +
 +//CT-5621T Front://\\
 +{{media:​comtrend:​ct-5621:​ct-5621_case_front.jpg?​500|}}
 +
 +//CT-5621T Back (with aftermarket serial port and sticky note)://\\
 +{{media:​comtrend:​ct-5621:​ct-5621_case_back.jpg?​500|}}
 +
 +//CT-5621 Back//\\
 +{{:​media:​comtrend:​ct-5621:​ct-5621-case-back.jpg?​500|}}
 +
 +
 +This is an ADSL2+ Modem + 4-port Switch with USB (it can act as a USB network device). It is manufactured by Comtrend who, 
 +as best I can determine from their voice prompts for assistance, only sell their equipment to ISP's and Telcos, thus bypassing ​
 +regular users as customers and therefore recipients of source code.
 +
 +===== Hardware Highlights =====
 +^ SoC             ^ CPU speed   ^ Ram     ^ Flash   ^ Network ​  ^ USB Client ^ USB Host ^ Serial ​  ^ JTag   ^
 +| Broadcom 6348   | 256MHz ​     | 16MiB   | 4MiB    | 4 x 1     | Yes         | Yes*    | Yes    |   ​Yes ​   |
 +(*requires hardware modifications)
 +
 +Note: currently OpenWrt does not support the Broadcom ADSL modem in this device, so it can be used as a router only.
 +
 +[[doc/​howto/​generic.overview]]
 +
 +===== Installation =====
 +  - -> [[doc:​howto:​obtain.firmware]]
 +  - -> [[doc:​howto:​generic.flashing|Install OpenWrt]]
 +
 +On some models it may be necessary to connect to the internal serial port and use the CFE prompt to change the board ID, or else the OpenWrt kernel will panic shortly after startup due to not recognizing the board. (If this happens and you don't want to wire a serial port, you can still hold Reset during startup to get into CFE - recognizable by red power LED - and upload another firmware via the web interface.)
 +
 +==== Flash Layout ====
 +Please check out the article [[doc:​techref:​Flash.Layout]]. It contains an example and a couple of explanations.
 +
 +==== OEM easy installation ====
 +
 +  *Get the firmware [[http://​downloads.openwrt.org/​backfire/​10.03.1/​brcm63xx/​openwrt-CT536_CT5621-squashfs-cfe.bin|openwrt-CT536_CT5621-squashfs-cfe.bin]].
 +  *Unplug the power cord (or use the on/off switch if one is present).
 +  *Press the **//​reset//​** button, don't release it yet!
 +  *Plug the power cord.
 +  *Wait 10 seconds.
 +  *Release the //reset// button.
 +  *Browse to [[http://​192.168.1.1]].
 +  *Upload **<color green>​.bin</​color>​** file to router.
 +  *Upgrade the image.
 +  *Wait for it to reboot.
 +  *Telnet to 192.168.1.1 and set a root password, or browse to http://​192.168.1.1 if LuCI is installed.
 +
 +==== OEM installation using the TFTP method ====
 +
 +If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.
 +
 +==== Upgrading OpenWrt ====
 +->  [[doc:​howto:​generic.sysupgrade]]
 +
 +If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
 +
 +=== LuCI Web Upgrade Process ===
 +
 +  * Browse to http://​192.168.1.1/​cgi-bin/​luci/​mini/​system/​upgrade/​ LuCI Upgrade URL
 +  * Upload image file for sysupgrade to LuCI
 +  * Wait for reboot
 +
 +=== Terminal Upgrade Process ===
 +
 +  * Login as root via SSH on 192.168.1.1
 +  * Use the following commands to upgrade.
 +
 +<​code>​
 +cd /tmp/
 +wget http://​downloads.openwrt.org/​snapshots/​trunk/​XXX/​xxx.abc
 +sysupgrade /​tmp/​xxx.abc
 +</​code>​
 +
 +  *If sysupgrade does not support this router, use the following commands.
 +
 +<​code>​
 +cd /tmp/
 +wget http://​downloads.openwrt.org/​snapshots/​trunk/​XXX/​xxx.abc
 +mtd write /​tmp/​xxx.abc linux && reboot</​code>​
 +
 +===== Basic configuration =====
 +-> [[doc:​howto:​basic.config|Basic configuration]] After flashing, proceed with this.\\
 +Set up your Internet connection, configure wireless, configure USB port, etc.
 +
 +
 +===== Specific Configuration =====
 +==== Interfaces ====
 +
 +The default network configuration is:
 +^ Interface Name ^ Description ^ Default configuration ^
 +| br-lan | LAN & WiFi | 192.168.1.1/​24 | 
 +| eth0 | LAN ports (1 to 4) | None | 
 +
 +==== Switch Ports (for VLANs) ====
 +This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 will be the 
 +Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on.
 +^ Port ^ Switch port ^ Mode ^
 +| LAN 1 | 0 | lan |
 +| LAN 2 | 1 | lan |
 +| LAN 3 | 2 | lan | 
 +| LAN 4 | 3 | Internet (WAN) |
 +
 +<​code>​
 +# path: /​etc/​config/​network
 +# port 4 = WAN
 +
 +config interface loopback
 +        option ifname ​  lo
 +        option proto    static
 +        option ipaddr ​  ​127.0.0.1
 +        option netmask ​ 255.0.0.0
 +
 +config interface lan
 +        option type     ​bridge
 +        option ifname ​  ​eth0.0
 +        option proto    static
 +        option ipaddr ​  ​192.168.1.1
 +        option netmask ​ 255.255.255.0
 +        option nat      1
 +
 +config interface wan
 +        option ifname eth0.1
 +        option macaddr 00:​11:​22:​33:​44:​55
 +        option proto dhcp 
 +        option defaultroute 1
 +
 +
 +config switch eth0
 + option enable 1
 + option reset 1
 + option enable_vlan 1
 +
 +config switch_vlan
 + option device eth0
 + option vlan 0
 + option ports "0 1 2 5t"
 +
 +config switch_vlan
 + option device eth0
 + option vlan 1
 + option ports "3 5t"
 +</​code>​
 +
 +==== Failsafe mode ====
 +-> [[doc:​howto:​generic.failsafe]]
 +
 +==== Buttons ====
 +-> [[doc:​howto:​hardware.button]] on howto use and configure the hardware button(s).
 +
 +The Comtrend 5621 has one button. It is the Reset.
 +^ BUTTON ​  ^ Event   ^
 +| Reset    | reset   |
 +
 +
 +===== Bootlogs =====
 +==== Stock firmware (2.4.17 kernel) ====
 +
 +<WRAP bootlog>
 +<​nowiki>​CFE version 1.0.37-5.17 for BCM96348 (32bit,​SP,​BE)
 +Build Date: Tue, 19 Oct 2004 12:02:54 +0800 (root@junhon_linux)
 +Copyright (C) 2000,​2001,​2002,​2003 Broadcom Corporation.
 +
 +Initializing Arena.
 +Initializing Devices.
 +init 5325E: init mii=0
 +init 5325E: init success, mii=9f
 +CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz
 +
 +Total memory used by CFE:  0x80401000 - 0x80521DF0 (1183216)
 +Initialized Data:          0x8041C740 - 0x8041E1B0 (6768)
 +BSS Area:                  0x8041E1B0 - 0x8041FDF0 (7232)
 +Local Heap:                0x8041FDF0 - 0x8051FDF0 (1048576)
 +Stack Area:                0x8051FDF0 - 0x80521DF0 (8192)
 +Text (code) segment: ​      ​0x80401000 - 0x8041C73C (112444)
 +Boot area (physical): ​     0x00522000 - 0x00562000
 +Relocation Factor: ​        ​I:​00000000 - D:00000000
 +
 +Board IP address ​               : 192.168.1.1
 +Host IP address ​                : 192.168.1.3
 +Gateway IP address ​             :
 +Run from flash/host (f/h)       : f
 +Default host run file name      : openwrt-brcm63xx-vmlinux.elf
 +Default host flash file name    : bcm963xx_fs_kernel
 +Boot delay (0-9 seconds) ​       : 5
 +Board Id Name                   : 96348GW-11
 +Psi size in KB                  : 24
 +Number of MAC Addresses (1-32) ​ : 11
 +Base MAC Address ​               : 00:​30:​da:​47:​bd:​b4
 +Ethernet PHY Type               : External Using Reverse MII with SPI
 +Memory size in MB               : 16
 +
 +*** Press any key to stop auto run (5 seconds) ***
 +Auto run second count down: 5543210
 +Code Address: 0x80010000, Entry Address: 0x8001046c
 +Decompression OK!
 +Entry at 0x8001046c
 +Closing network.
 +Starting program at 0x8001046c
 +Total Flash size: 4096K with 71 sectors
 +Scratch pad is not used for this flash part.
 +96348GW-11 prom init
 +CPU revision is: 00029107
 +Primary instruction cache 16kb, linesize 16 bytes (2 ways)
 +Primary data cache 8kb, linesize 16 bytes (2 ways)
 +Linux version 2.4.17 (root@max-redhat) (gcc version 3.1) #1 ¥| 12¤ë 2 04:34:28 CST 2004
 +Determined physical RAM map:
 + ​memory:​ 00fa0000 @ 00000000 (usable)
 +On node 0 totalpages: 4000
 +zone(0): 4000 pages.
 +zone(1): 0 pages.
 +zone(2): 0 pages.
 +Kernel command line: root=/​dev/​mtdblock0 ro
 +bcm_console_setup
 +Calibrating delay loop... 255.59 BogoMIPS
 +Memory: 14236k/​16000k available (1144k kernel code, 1764k reserved, 80k data, 48k init, 0k highmem)
 +Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes)
 +Inode-cache hash table entries: 1024 (order: 1, 8192 bytes)
 +Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
 +Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
 +Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
 +Checking for '​wait'​ instruction... ​ unavailable.
 +POSIX conformance testing by UNIFIX
 +mpi: No Card is in the PCMCIA slot
 +PCI: Fixing up bus 0
 +Linux NET4.0 for Linux 2.4
 +Based upon Swansea University Computer Society NET3.039
 +Initializing RT netlink socket
 +Starting kswapd
 +brcmboard: brcm_board_init entry
 +Module bcm63xx_cons.c v1.1 Dec  2 2004 04:34:57
 +block: 64 slots per queue, batch=16
 +PPP generic driver version 2.4.1
 +NET4: Linux TCP/IP 1.0 for NET4.0
 +IP Protocols: ICMP, UDP, TCP, IGMP
 +IP: routing cache hash table of 512 buckets, 4Kbytes
 +TCP: Hash tables configured (established 512 bind 1024)
 +Linux IP multicast router 0.06 plus PIM-SM
 +NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
 +Ebtables v2.0 registeredNET4:​ Ethernet Bridge 008 for NET4.0
 +802.1Q VLAN Support v1.6  Ben Greear ​
 +vlan Initialization complete.
 +VFS: Mounted root (cramfs filesystem) readonly.
 +Freeing unused kernel memory: 48k freed
 +init started: ​ BusyBox v0.60.4 (2004.12.01-20:​44+0000) multi-call binary
 +Algorithmics/​MIPS FPU Emulator v1.5
 +
 +
 +BusyBox v0.60.4 (2004.12.01-20:​44+0000) Built-in shell (msh)
 +Enter '​help'​ for a list of built-in commands.
 +
 +
 +Loading drivers and kernel modules...
 +
 +atmapi: init_module entry 0xc0006060
 +blaadd: blaa_detect entry
 +adsl: adsl_init entry
 +var 1.0 initialised
 +Broadcom BCM6348A2 Ethernet Network Device v0.1 Dec  2 2004 04:40:06 External Switch Reverse MII (SPI Device 1)
 +eth0: MAC Address: 00:​30:​DA:​47:​BD:​B4
 +Broadcom BCM6348A2 USB Network Device v0.3 Dec  2 2004 04:40:08
 +usb0: MAC Address: 00 30 DA 47 BD B5
 +usb0: Host MAC Address: 00 30 DA 47 BD B6
 +insmod: init_module:​ wl: No such device
 +BcmAdsl_Initialize=0xC0018418,​ g_pFnNotifyCallback=0xC002CCB0
 +AdslCoreHwReset:​ AdslOemDataAddr = 0xA0FE4D5C
 +
 +==> ​  ​Bcm963xx Software Version: A101-221CTL-C01_R04.A2pB017f.d15 ​  <​==
 +
 +device usb0 entered promiscuous mode
 +br0: port 1(usb0) entering listening state
 +br0: port 1(usb0) entering learning state
 +br0: port 1(usb0) entering forwarding state
 +br0: topology change detected, propagating
 +device eth0 entered promiscuous mode
 +br0: port 2(eth0) entering listening state
 +br0: port 2(eth0) entering learning state
 +br0: port 2(eth0) entering forwarding state
 +br0: topology change detected, propagating
 +pvc2684d: Interface "​nas_0_35"​ created sucessfully
 +
 +atm_connect (TX: cl 1,bw 0-0,sdu 1524; RX: cl 1,bw 0-0,sdu 1524,AAL 5)
 +pvc2684d: Communicating over ATM 0.0.35, encapsulation:​ LLC
 +
 +device nas_0_35 entered promiscuous mode
 +br0: port 3(nas_0_35) entering listening state
 +br0: port 3(nas_0_35) entering learning state
 +br0: port 3(nas_0_35) entering forwarding state
 +br0: topology change detected, propagating
 +eth0 Link UP.
 +
 +Message from syslogd@router at Jan 23 16:34:40 ...
 + ​BCM96345 started: BusyBox v0.60.4 (2004.12.01-20:​44+0000)
 +sntp: host not found
 +
 +Message from syslogd@router at Jan 23 16:34:41 ...
 + ​klogd:​ 802.1Q VLAN Support v1.6  Ben Greear reearb@candelatech.com>​
 +br0: port 1(usb0) entering disabled state
 +ADSL G.994 training
 +ADSL G.992 started
 +ADSL G.992 channel analysis
 +ADSL G.992 message exchange
 +ADSL link up, interleaved,​ us=800, ds=6016
 +PPP: PPP0_35_1 Start to connect ...
 +PPP: PPP0_35_1 Connection Up.
 +Primary DNS server = 216.183.128.10
 +Secondary DNS server = 216.183.128.4</​nowiki>​
 +</​WRAP>​\\
 +
 +==== kamikaze (2.6.27 kernel) ====
 +
 +<WRAP bootlog>
 +<​nowiki>​0x80010000/​3644617 0x80389cc9/​141127 Entry at 0x80014450
 +Closing network.
 +Starting program at 0x80014450
 +Linux version 2.6.27.11 (daniel@brennin) (gcc version 4.1.2) #3 Fri Jan 23 07:01:13 EST 2009
 +Detected Broadcom 0x6348 CPU revision a2
 +CPU frequency is 256000000 Hz
 +16MB of RAM installed
 +board_bcm963xx:​ CFE version: 1.0.37-5.17
 +console [early0] enabled
 +CPU revision is: 00029107 (Broadcom BCM6348)
 +board_bcm963xx:​ board name: 96348GW-11
 +Determined physical RAM map:
 + ​memory:​ 01000000 @ 00000000 (usable)
 +Initrd not found or empty - disabling initrd
 +Zone PFN ranges:
 +  Normal ​  ​0x00000000 -> 0x00001000
 +Movable zone start PFN for each node
 +early_node_map[1] active PFN ranges
 +    0: 0x00000000 -> 0x00001000
 +Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
 +Kernel command line: root=/​dev/​mtdblock2 rootfstype=squashfs,​jffs2 init=/​etc/​preinit noinitrd console=ttyS0,​115200
 +Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
 +Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes
 +PID hash table entries: 64 (order: 6, 256 bytes)
 +Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
 +Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
 +Memory: 12472k/​16384k available (1930k kernel code, 3912k reserved, 410k data, 1216k init, 0k highmem)
 +Calibrating delay loop... 255.48 BogoMIPS (lpj=510976)
 +Mount-cache hash table entries: 512
 +net_namespace:​ 776 bytes
 +NET: Registered protocol family 16
 +registering 37 GPIOs
 +registering PCI controller with io_map_base unset
 +bus: 00 index 0 io port: [8000000, 800ffff]
 +bus: 00 index 1 mmio: [30000000, 37ffffff]
 +NET: Registered protocol family 2
 +IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
 +TCP established hash table entries: 512 (order: 0, 4096 bytes)
 +TCP bind hash table entries: 512 (order: -1, 2048 bytes)
 +TCP: Hash tables configured (established 512 bind 512)
 +TCP reno registered
 +NET: Registered protocol family 1
 +audit: initializing netlink socket (disabled)
 +type=2000 audit(1.220:​1):​ initialized
 +squashfs: version 3.0 (2006/​03/​15) Phillip Lougher
 +Registering mini_fo version $Id$
 +JFFS2 version 2.2. (NAND) (SUMMARY) ​ © 2001-2006 Red Hat, Inc.
 +msgmni has been set to 24
 +io scheduler noop registered
 +io scheduler cfq registered (default)
 +bcm63xx_uart.0:​ ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart
 +console handover: boot [early0] -> real [ttyS0]
 +bcm63xx_enet MII bus: probed
 +bcm963xx_flash:​ 0x00400000 at 0x1fc00000
 +bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank
 + ​Amd/​Fujitsu Extended Query Table at 0x0040
 +number of CFI chips: 1
 +cfi_cmdset_0002:​ Disabling erase-suspend-program due to code brokenness.
 +bcm963xx_flash:​ Read Signature value of CFE1CFE1
 +bcm963xx_flash:​ CFE bootloader detected
 +bcm963xx_flash:​ CFE boot tag found with version 6 and board type 96348GW-11.
 +bcm963xx_flash:​ Partition 0 is CFE offset 0 and length 10000
 +bcm963xx_flash:​ Partition 1 is kernel offset 22f100 and length 656d3
 +bcm963xx_flash:​ Partition 2 is rootfs offset 10100 and length 35f000
 +bcm963xx_flash:​ Partition 3 is nvram offset 3f0000 and length 10000
 +Creating 4 MTD partitions on "​bcm963xx":​
 +0x00000000-0x00010000 : "​CFE"​
 +0x0022f100-0x002947d3 : "​kernel"​
 +mtd: partition "​kernel"​ doesn'​t start on an erase block boundary -- force read-only
 +0x00010100-0x0036f100 : "​rootfs"​
 +mtd: partition "​rootfs"​ doesn'​t start on an erase block boundary -- force read-only
 +mtd: partition "​rootfs"​ set to be root filesystem
 +split_squashfs:​ no squashfs found in "​bcm963xx"​
 +0x003f0000-0x00400000 : "​nvram"​
 +TCP bic registered
 +NET: Registered protocol family 17
 +Bridge firewalling registered
 +Freeing unused kernel memory: 1216k freed
 +Algorithmics/​MIPS FPU Emulator v1.5
 +[sighandler]:​ No more events to be processed, quitting.
 +[cleanup]: Waiting for children.
 +[cleanup]: All children terminated.
 +- preinit -
 +Press CTRL-C for failsafe
 +
 +Please press Enter to activate this console. bcm63xx_enet bcm63xx_enet.0:​ attached PHY at address 1 [Broadcom BCM63XX (1)]
 +bcm63xx_enet bcm63xx_enet.0:​ attached PHY at address 1 [Broadcom BCM63XX (1)]
 +eth1: link forced UP - 100/full - flow control off/off
 +device eth1 entered promiscuous mode
 +br-lan: topology change detected, propagating
 +br-lan: port 1(eth1) entering forwarding state
 +PPP generic driver version 2.4.2
 +ip_tables: (C) 2000-2006 Netfilter Core Team
 +nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
 +CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use
 +nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or
 +sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
 +br-lan: port 1(eth1) entering disabled state
 +br-lan: topology change detected, propagating
 +br-lan: port 1(eth1) entering forwarding state</​nowiki>​
 +</​WRAP>​\\
 +
 +===== Hardware =====
 +==== Info ====
 +| **[[wp>​Instruction set|Architecture]]:​** ​  | [[wp>​MIPS architecture|MIPS]] ​                  |
 +| **Vendor:​** ​                               | [[wp>​Broadcom]] ​                                |
 +| **[[doc:​techref:​Bootloader]]:​** ​           | [[doc:​techref:​bootloader:​CFE]] ​                 |
 +| **[[doc:​hardware:​soc|System-On-Chip]]:​** ​  | {{:​media:​datasheets:​bcm6348_product_brief.pdf|BCM6348}}|
 +| **[[doc:​hardware:​cpu|CPU]]/​Speed** ​        | BMIPS3300 V0.7 / 256 MHz                        |
 +| **Flash-Chip:​** ​                           | Fujitsu MPM29DL32B-70PFTN ​                      |
 +| **Flash size:​** ​                           | 4 MiB                                           |
 +| **RAM:​** ​                                  | Hynix 409A HY57 283220I-7, 16 MiB               |
 +| **Wireless:​** ​                             | No                                              |
 +| **Ethernet:​** ​       | Broadcom ​ {{:​media:​datasheets:​bcm5325_datasheet.pdf|BCM5325}} w/ vlan support [[doc:​uci:​network#​swconfig]] |
 +| **Internet:​** ​                             | ADSL2+ ​                               |
 +| **USB:​** ​                                  | slave, host possible with mod         |
 +| **[[doc:​hardware:​port.serial|Serial]]:​** ​  | [[#​Serial|Yes]],​ ADM202EARN RS-232c ​  |
 +| **[[doc:​hardware:​port.jtag|JTAG]]:​** ​      | [[#​JTAG|Yes]] ​                        |
 +
 +==== PCB Photos ====
 +=== CT-5621 ===
 +The CT-5621 board is exactly the same as the [[toh/​comtrend/​ct536plus#​photos|CT-536+]] without the miniPCI slot but  with a serial //Console// and USB slave ports.
 +
 +{{oldwiki/​openwrtdocs/​hardware/​comtrend/​ct-5621-board-trimmed.jpg?​400x200|}}
 +
 +=== CT-5621T ===
 +{{media:​comtrend:​ct-5621:​ct-5621_pcb-top.jpg?​0x300|}} {{media:​comtrend:​ct-5621:​ct-5621_pcb-bottom.jpg?​0x300|}}
 +{{media:​comtrend:​ct-5621:​ct-5621_pcb-mixed.jpg?​0x300|}}
 +
 +==== Opening the case ====
 +**Note:** This will void your warranty!
 +
 +  *Under the rear rubber feet are two screws that need to be removed.
 +  *The cover is held on by these screws and by plastic clips near the front.
 +  *The front and rear plates and LED assembly can simply be pulled out once the cover is removed.
 +  *A few more screws hold the PCB to the bottom of the case.
 +
 +==== Serial ====
 +-> [[doc:​hardware:​port.serial]] general information about the serial port, serial port cable, etc.
 +
 +
 +=== CT-5621 ===
 +CT-5621 version exposes a serial port via Ethernet port style labeled as //​Console//:​
 +<​code>​
 +RJ45 connector
 +3: Receive Data
 +4: Transmit Data
 +7: Ground
 +1,2,5,6,8: Not Connected
 +</​code>​
 +
 +
 +
 +=== CT-5621T ===
 +CT-5621T version hasn't the serial wired externally. Around the middle of the board is 4 pins arranged in a square. The one with a smaller square drawn around it is the Transmit pin. The one directly in front of it (toward the front of the device) is Receive. The one beside it is Ground. The one diagonal to it is Vcc. These pins operate at 3VDC and baud 115200, 8 bits, no parity, 1 stop bit (i.e. 115200,​8,​N,​1). See PCB photos above.
 +
 +Once connected to the serial port you can access three different modes:
 +
 +  * By holding/​mashing a key during power on you can access the CFE prompt and upload a new firmware (such as OpenWrt). This prompt also gives you the ability to download and run a kernel over ethernet without flashing it, which could be used to dump the stock firmware if one were so inclined.
 +  * By waiting for boot to complete you can access a login prompt, which is the same prompt you get over Telnet. The passwords seem to be the same as for the web interface.
 +    * The default account names are ''​support'',​ ''​user'',​ ''​apuser'',​ and the passwords are the account names. (However these don't actually work!? TODO figure out why.) ''​support''​ has the most privileges, ''​apuser''​ has the least.
 +    * User ''​root'',​ password ''​t313com''​ may also work on some devices. (This login also works for the web interface.)
 +    * This gives you an extremely limited shell (even as root!) with only a handful of commands for configuring the device.
 +  * By mashing Ctrl+C during boot (after the CFE prompt) you can interrupt boot and access a root shell, though it seems to be jailed or otherwise limited somehow.
 +    * ''​ls''​ command is not available, but you can list directories using ''​echo /​bin/​*''​.
 +    * Depending on when you interrupt, some directories such as ''/​proc''​ are missing or empty.
 +    * If you let ADSL start up, you'll be spammed with messages about the link status.
 +    * Some files aren't readable at all - they'​ll give "no such file" or "no such device"​ errors.
 +    * You can use ''​openssl''​ command to encode/​decode base64, allowing to dump binary data. e.g.: ''​openssl enc -e -a -in /​dev/​mtdblock0 -out /​dev/​ttyS0''​
 +     * This can be combined with ''​ping''​ to easily dump to file on the host: <​code>​ping -c 10 127.0.0.1; openssl enc -e -a -in /​dev/​mtdblock0 -out /​dev/​ttyS0</​code>​The ''​ping''​ gives you a few seconds to detach your terminal emulator and start ''​cat /dev/ttyS0 > data.b64''​ to capture the output. Once the file stops growing, strip the ''​ping''​ output from the beginning and decode. (But make sure ''​ping''​ works first! Depending when you interrupt, the ''​lo''​ interface might not be up yet.)
 +
 +
 +SSH is also supported, but using an obsolete algorithm that modern clients can't understand.
 +
 +==== JTAG ====
 +-> [[doc:​hardware:​port.jtag]] general information about the JTAG port, JTAG cable, etc.
 +
 +Located near the front left, beside the CPU.  Pin 1 has white box surrounding it and the whole connection area is surrounded by a white border (thin). ​ There is no existing header, if you want one you have to add it (there are only solder pads in the stock configuration).
 +
 +Pinout:\\
 +{{media:​comtrend:​ct-536_jtag.jpg?​300x200|}}
 +
 +| 1    | 2    |
 +| 3    | 4    |
 +| 5    | 6    |
 +| 7    | 8    |
 +| 9    | 10   |
 +| 11   | 12   |
 +
 +Meaning and mapping to LPT for an unbuffered cable
 +<​code>​
 +Pin 3 - TDI - DATA0  - Pin 2
 +Pin 5 - TD0 - SELECT - Pin 13
 +Pin 7 - TMS - DATA2  - Pin 4
 +Pin 9 - TCK - DATA1  - Pin 3
 +</​code>​
 +
 +===== Debricking =====
 +-> [[doc:​howto:​generic.debrick]]
 +
 +===== Bootloader Mods =====
 +  - you could read about [[doc:​techref:​bootloader]] in general
 +<​code>​CFE>​ web info: Waiting for connection on socket 0.
 +CFE>
 +CFE> c
 +Press: ​  to use current value
 +        '​-'​ to go previous parameter
 +        '​.'​ to clear the current value
 +        '​x'​ to exit this command
 +Board IP address ​               :  192.168.1.1:​ffffff00
 +Host IP address ​                : ​ 192.168.1.100
 +Gateway IP address ​             :
 +Run from flash/host (f/h)       : ​ f
 +Default host run file name      :  vmlinux
 +Default host flash file name    :  bcm963xx_fs_kernel
 +Boot delay (0-9 seconds) ​       :  5
 +*** command status = 0
 +CFE> b
 +Press: ​  to use current value
 +        '​-'​ to go previous parameter
 +        '​.'​ to clear the current value
 +        '​x'​ to exit this command
 +Board Id Name (0-5)
 +96348R ​          ​-------- 0
 +96348LV ​         -------- 1
 +96348GW ​         -------- 2
 +96348GW-10 ​      ​-------- 3
 +96348GW-11 ​      ​-------- 4
 +96348SV ​         -------- 5     : ​ 4
 +Number of MAC Addresses (1-32) ​ :  11
 +Base MAC Address ​               :  00:​40:​dd:​37:​ad:​e4</​code>​
 +
 +===== Hardware mods =====
 +  - as a beginner, you really should inform yourself about [[doc:​hardware:​soldering]] in general and then obtain some practical experience!
 +
 +==== USB mod ====
 +(Note: this is done with a different board than shown in photos above.)
 +
 +This board only needs 3 x 15 kΩ resistors and one 470μF capacitor, and the USB host (USB A Female) connector, to have a USB host port on the board (i.e. to drive USB mass storage, wireless, etc)
 +
 +Two of the resistors and the capacitor get voltages right, while the third resistor is used to tie the USB host enabled pin on the BCM63xx to Vcc, so that it is seen as enabled.
 +
 +There is a schematic from a NetGear that might be helpful. The only components that matter to our board are the 15k resistors.\\
 +{{:​oldwiki:​openwrtdocs:​hardware:​comtrend:​usb-schematic.png?​500}}
 +
 +Now we look at the space on the board that is for the USB host:\\
 +{{:​oldwiki:​openwrtdocs:​hardware:​comtrend:​usb-host-space.jpg?​500}}
 +
 +The following image shows what needs to be done in order to enable host usb:\\
 +{{:​oldwiki:​openwrtdocs:​hardware:​comtrend:​usb-host-marked-up.jpg?​500}}
 +
 +And here's what a badly done mod looks like (I had a terrible time soldering):​\\
 +{{:​oldwiki:​openwrtdocs:​hardware:​comtrend:​usb-post-mod.jpg?​500}}
 +
 +===== Notes =====
 +
 +
 +===== Tags =====
 +[[meta:​tags|How to add tags]]
 +{{tag>​bcm63xx bcm6348 FastEthernet 4Port USB 16RAM 4Flash MIPS MIPS32 ADSL ADSL2+ serial JTAG router modem switch broadcom}}