TELSEY S.p.A. Mod: CPAJJJSE20TL2

ADSL/voIP Router sold by Tele2/Comunitel in Spain.

Product page: http://www.telsey.com/product_details.asp?cat=1&subcat=13&id_p=127

Currently Unsupported. Work in progress.

OpenWRT can be booted once changing board id. in CFE:

Change board id. from "CPVA502+" to "96348GW-10", flash openwrt-96348GW-generic-squash-cfe.bin

OpenWRT will boot but no ip connection available. Following commands make possible to connect by ssh/telnet/http:

ifconfig br-lan down ifconfig eth0 192.168.1.1/24 up

Configure ethernet port on the computer as 192.168.1.2 and browse to 192.168.1.1 or telnet/ssh.

After reboot, checksum for image would be calculated as being wrong and the firmware erased. After the first boot use this command for solving the problem:

root@OpenWrt:/# mtd fixtrx linux

NOTE: Anything not included in model specific notes, or where a short comment couldn't be included on the notes.

1. → obtain.firmware
2. → Install OpenWrt

First let's have a quick view at the Flash Layout with the stock firmware and after OpenWrt has been installed. When you later want to understand, what the programs mtd and sysupgrade do, have a second look here:

• cf. → flash.layout or Flash Layout
• Obtain the data: cat /proc/mtd, dmesg, df -h, df, mount

With OpenWrt:

root@OpenWrt:/# cat /proc/mtd

dev: size erasesize name

mtd0: 00010000 00010000 "CFE"

mtd1: 000dff00 00010000 "kernel"

mtd2: 00300000 00010000 "rootfs"

mtd3: 00150000 00010000 "rootfs_data"

mtd4: 00010000 00002000 "nvram"

mtd5: 003e0000 00010000 "linux"

The instructions below are for Broadcom devices and only serve as an example. Don't leave them in place if they do not apply to a particular device!

This section deals with how you install OpenWrt from a device freshly opened. Plus the steps required such as reset to factory defaults if the device has already been configured

Note: Reset router to factory defaults if it has been previously configured.

• Browse to http://192.168.1.1/Upgrade.asp
• Upload .bin file to router
• Wait for it to reboot
• Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.

If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.

→ generic.sysupgrade

If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

• Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
• Upload image file for sysupgrade to LuCI
• Wait for reboot

• Login as root via SSH on 192.168.1.1
• Use the following commands to upgrade.

cd /tmp/
wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
sysupgrade /tmp/xxx.abc

• If sysupgrade does not support this router, use the following commands.

cd /tmp/
wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
mtd write /tmp/xxx.abc linux && reboot

→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The default network configuration is:

Device has only 2 ethernet ports.

→ generic.failsafe

→ hardware.button on howto use and configure the hardware button(s).

Model Number

Front:

Photo of front of the casing

Back:

Photo of back of the casing

Note: This will void your warranty!

• To remove the cover do a/b/c

Main PCB

Photo of PCB

CFE version 1.0.37-3.6 for BCM96348 (32bit,SP,BE) Build Date: ven lug 21 09:44:42 CEST 2006 (oliale@oliale.telsey.loc) Copyright (C) 2003,2004,2005 Telsey Telecommunications. Boot Address 0xbfc00000 Initializing Arena. Initializing Devices. Parallel flash device: name MX29LV320AT, id 0x22a7, size 4096KB Auto-negotiation timed-out 10 MB Half-Duplex (assumed) Check consistency for image tag [1]: Found good image at partition [1] Check consistency for image tag [2]: No image found at partition [2] CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz Total memory: 16777216 bytes (16MB) Total memory used by CFE: 0x80401000 - 0x80526FA0 (1204128) Initialized Data: 0x8041E610 - 0x80420480 (7792) BSS Area: 0x80420480 - 0x80424FA0 (19232) Local Heap: 0x80424FA0 - 0x80524FA0 (1048576) Stack Area: 0x80524FA0 - 0x80526FA0 (8192) Text (code) segment: 0x80401000 - 0x8041E60C (120332) Boot area (physical): 0x00527000 - 0x00567000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.1.1 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : CPVA502+ Psi size in KB : 24 Number of MAC Addresses (1-32) : 8 Base MAC Address : 00:03:XX:XX:XX:XX Ethernet PHY Type : Internal Memory size in MB : 16 mac server test........................### ### Not default mac address ### 00 03 6f 75 de 58 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 110 Code Address: 0x80010000, Entry Address: 0x801a2018 Decompression OK! Entry at 0x801a2018 Closing network. Starting program at 0x801a2018 Linux version 2.6.8.1 (devluc@pisaur.telsey.loc) (gcc version 3.4.2) #1 Mon Oct 9 13:15:54 CEST 2006 Parallel flash device: name MX29LV320AT, id 0x22a7, size 4096KB Total Flash size: 4096K with 71 sectors CPVA502+ prom init CPU revision is: 00029107 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 DMA zone: 4000 pages, LIFO batch:1 Normal zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=31:0 ro noinitrd brcm mips: enabling icache and dcache... Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 8kB 2-way, linesize 16 bytes. PID hash table entries: 64 (order 6: 512 bytes) Using 128.000 MHz high precision timer. Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 14008k/16000k available (1321k kernel code, 1972k reserved, 282k data, 72k init, 0k highmem) Calibrating delay loop... 255.59 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... unavailable. NET: Registered protocol family 16 Can't analyze prologue code at 80158e14 PPP generic driver version 2.4.2 NET: Registered protocol family 24 Using noop io scheduler bcm963xx_mtd driver v1.0 bcm963xx_mtd: rootfs_addr = 0xBFC10100, kernel_addr = 0xBFEAC100 brcmboard: brcm_board_init entry GPIO (0x4) LOW -- KIT ON POTS A confirm button interrupt is not configured on this board CPU monitor calibration Calibration loops: 51134656 bcm963xx_serial driver v2.0 NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) NET: Registered protocol family 1 NET: Registered protocol family 17 Ebtables v2.0 registered NET: Registered protocol family 8 NET: Registered protocol family 20 VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 72k freed init started: BusyBox v1.00 (2006.10.09-11:20+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 BusyBox v1.00 (2006.10.09-11:20+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... atmapi: module license 'Proprietary' taints kernel. blaadd: blaa_detect entry adsl: adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6348B0 Ethernet Network Device v0.3 Oct 9 2006 13:14:25 Config Internal PHY Through MDIO BCM63xx_ENET: Auto-negotiation timed-out BCM63xx_ENET: 10 MB Half-Duplex (assumed) eth0: MAC Address: 00:03:XX:XX:XX:XX Broadcom BCM6348B0 Ethernet Network Device v0.3 Oct 9 2006 13:14:25 Config External PHY Through MDIO mii_init: mii hardware reset BCM63xx_ENET: Auto-negotiation timed-out BCM63xx_ENET: 10 MB Half-Duplex (assumed) eth1: MAC Address: 00:03:XX:XX:XX:XX Telsey BCM6348B0 USB Network Device v0.4 Oct 9 2006 13:14:29 usb0: MAC Address: 00 03 XX XX XX XX usb0: Host MAC Address: 00 03 XX XX XX XX Telsey CPVA502+-W, hwVer = 0xb, USB product ID set to 6310 MAGIC USB configuration Endpoint: endpoint_init entry BOS: Enter bosInit Enter bosAppInit Exit bosAppInit BOS: Exit bosInit Endpoint: endpoint_init COMPLETED loading Broadcom WIFI module PCI: Setting latency timer of device 0000:00:01.0 to 64 PCI: Enabling device 0000:00:01.0 (0004 -> 0006) wl: srom not detected, using main memory mapped srom info (wombo board) wl0: wlc_attach: using main board MAC address base in NVRAM (wombo board) wl0 MAC Address: 00:03:XX:XX:XX:XX wl0: Broadcom BCM4318 802.11 Wireless Controller 3.131.35.0.cpe2.3 dgasp: kerSysRegisterDyingGaspHandler: wl0 registered wlctl: wlctl: BcmAdsl_Initialize=0xC005E218, g_pFnNotifyCallback=0xC0078AD4 pSdramPHY=0xA0FFFFF8, 0x7995F 0xDEADBECF AdslCoreHwReset: AdslOemDataAddr = 0xA0FF68A0 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered ip_tables: (C) 2000-2002 Netfilter core team ip_conntrack version 2.1 (125 buckets, 0 max) - 368 bytes per conntrack ip_conntrack_pptp version 2.1 loaded ip_nat_pptp version 2.0 loaded ip_conntrack_h323: init ip_nat_h323: initialize the module! insmod: cannot open module `/lib/modules/2.6.8.1/kernel/net/ipv4/netfilter/broadcom/ip_conntrack_ipsec.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.8.1/kernel/net/ipv4/netfilter/broadcom/ip_nat_ipsec.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.8.1/kernel/net/ipv4/netfilter/ip_conntrack_sip.ko': No such file or directory ==> Bcm963xx Software Version: 3.4.6V-h323.A2pB020a1.d17e <== device usb0 entered promiscuous mode bcm63xxenet: Command 35318 not supported. app: configure ethernet eth0 speed failed. bcm63xxenet: Command 35317 not supported. app: configure ethernet eth0 duplex type failed. br0: port 1(usb0) entering learning state br0: topology change detected, propagating br0: port 1(usb0) entering forwarding state device eth0 entered promiscuous mode br0: port 2(eth0) entering learning state br0: topology change detected, propagating br0: port 2(eth0) entering forwarding state bcm63xxenet: Command 35318 not supported. app: configure ethernet eth1 speed failed. bcm63xxenet: Command 35317 not supported. app: configure ethernet eth1 duplex type failed. device eth1 entered promiscuous mode br0: port 3(eth1) entering learning state br0: topology change detected, propagating br0: port 3(eth1) entering forwarding state Setting SSID "Telsey502plus" Setting SSID "Guest" pvc2684d: Interface "nas_0_44" created sucessfully pvc2684d: Communicating over ATM 0.0.44, encapsulation: LLC Starting the H323 application with the following parameters:H323 Gatekeeper address: 0.0.0.0H323 Gatekeeper ID: H323 Secondary Gatekeeper address: 0.0.0.0H323 Secondary Gatekeeper ID: H323 Gatekeeper port: 1719H323 Time to Live: 3600H323 Keep Alive Interval: 75 % of Time to LiveH323 Terminal Type: terminalH323 FastStart: Off (connect)H323 Alias: TelseyPhone Line1: Phone Line2: Dialplan Line1: .t4-Dialplan Line2: .t4-Supp. Services enable mask: 0x0:0x0User defined Supp. Services codes: Call Waiting Timeout (in seconds): 15Override Category: OffQ931 T301 Timer (in seconds): 180Q931 T303 Timer (in seconds): 4Q931 T310 Timer (in seconds): 120Starting restorebtnd... No-answer timeout (in seconds): 120Offhook timeout (in seconds): 100H245 Tunneling: OffH245 Channel After Fast Start: OffEarly H245: OffOOB DTMF: OffAlerting PI: 8Progress PI: 8Bearer Capability: SpeechPlug change timeout (in seconds): OffH323 TOS: OffH323 Debugger: mode = Off --- level = ERRORCurrent global voice parameters:Codec G711U: Packet=20(ms) ec=On ss=Off Codec G711A: Packet=20(ms) ec=On ss=Off Codec G729: Packet=20(ms) ec=On ss=Off Codec priority order: G711U,G711A,G729 Country: ITALYCLID signal type: FSKHookFlash interval: 50-200 (ms)On-Hook detection timeout: 600 (ms)Squelch inband DTMF: OffFax feature: OnModem feature: OnPass through codec: OffNLP on Modem detection: OffNLP on Fax detection: OnRTP TOS: A0VodslSettings::getStrParam: Set default G729 configuration parameters (ec and ss)VodslSettings::setVar varName = codec_G729_ec, varValue = On VodslSettings::setVar varName = codec_G729_ss, varValue = Off Starting cpumond... BcmWan_startInterface: vpi = 0, vci = 33, conId = 1 pWanId status = 0 BUFFER=vodsl h323start -p 0.0.0.0:1719-3600-75-terminal-Off-'' -i br0 -g 0.0.0.0-'' -G connect -c ITALY -s FSK -I 'Telsey' -n num:: -d ".t4-:.t4-" -m G711U,G711A,G729,:20-On-Off:20-On-Off:20-On-Off -t 50 -T 200 -H 600 -X 'Off' -Y 'Off' -S 'Off-A0' -e 'Off-On' -f 'On-On' -u none=0:0=0:0 -W 15 -O Off -L Off -N Off -E Off -B Speech -C Off -U 180 -V 4 -Z 120 -A 120 -F 100 -P 8:8 -o Off -D Off:ERROR & BcmWan_startInterface: vpi = 0, vci = 44, conId = 1 pWanId status = 0 process `snmp' is using obsolete setsockopt SO_BSDCOMPAT br0: port 2(eth0) entering disabled state main(404): pppd 2.4.1 started by admin, uid 0 br0: port 3(eth1) entering disabled state br0: port 1(usb0) entering disabled state BOS: Enter bosInit Enter bosAppInit Exit bosAppInit BOS: Exit bosInit 00:00:28 Address for host 0.0.0.0 resolved to 0.0.0.0 00:00:28 Address for host 0.0.0.0 resolved to 0.0.0.0 kernel::endpoint_open kernel::endpoint_open COMPLETED 00:00:28 EndpointProvis entering: provisioning item 54 00:00:28 EndpointProvis item=54 value=1 kernel:: endpoint provisioning 00:00:28 EndpointProvis entering: provisioning item 34 00:00:28 EndpointProvis item=34 value=50 kernel:: endpoint provisioning 00:00:28 EndpointProvis entering: provisioning item 35 00:00:28 EndpointProvis item=35 value=200 kernel:: endpoint provisioning 00:00:28 EndpointProvis entering: provisioning item 36 00:00:28 EndpointProvis item=36 value=600 kernel:: endpoint provisioning 00:00:28 EndpointProvis entering: provisioning item 37 00:00:28 EndpointProvis item=37 value=0 kernel:: endpoint provisioning 00:00:28 EndpointProvis entering: provisioning item 38 00:00:28 EndpointProvis item=38 value=0 kernel:: endpoint provisioning 00:00:28 EndpointProvis entering: provisioning item 39 00:00:28 EndpointProvis item=39 value=0 kernel:: endpoint provisioning 00:00:28 EndpointProvis entering: provisioning item 40 00:00:28 EndpointProvis item=40 value=1 kernel:: endpoint provisioning 00:00:28 EndpointProvis entering: provisioning item 41 00:00:28 EndpointProvis item=41 value=0 kernel:: endpoint provisioning 00:00:28 Endpoint Event task started with pid 389... 00:00:28 Endpoint Packet task started with pid 390 ... Enter bosStartApp bosAppRootTask() - Is it morning already? Spawning app task (epoch #0)... Enter TaskCreate aoAP TaskCreate - spawn new task aoAP Exit TaskCreate AppResetDetectionEnable() - Enabled reset detection. Exit bosStartApp Enter TaskCreate HRTBEAT TaskCreate - spawn new task HRTBEAT Exit TaskCreate HEARTBEAT: Initialized! slacLe9581Init: Init SLAC for country 10 slac6348Le9581.c: OpenSlac, boardId = 16777219 slac6348Le9581.c: OpenSlac, ABAT disabled HEARTBEAT: Patient (AC power) pid=0 registered (1 of 16 max registered) bosMsgQCreate: Created message queue VRGEVQ at address 0x0 Enter TaskCreate VRGEVPR TaskCreate - spawn new task VRGEVPR Exit TaskCreate Enter TaskCreate HCAS TaskCreate - spawn new task HCAS Exit TaskCreate ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x50) of type: 0x3 HEARTBEAT: Patient (Cnx state) pid=1 registered (2 of 16 max registered) HEARTBEAT: Patient (Endpt hookstate) pid=2 registered (3 of 16 max registered) HEARTBEAT: Patient (Endpt On/Off signal) pid=3 registered (4 of 16 max registered) HEARTBEAT: Patient (Endpt Caller ID signal) pid=4 registered (5 of 16 max registered) HEARTBEAT: Patient (Endpt signal) pid=5 registered (6 of 16 max registered) HEARTBEAT: Patient (Cnx signal) pid=6 registered (7 of 16 max registered) ENDPT: hdspVhdOpen Primary Connection VHD success. DSP 0, VHD (0x51) of type: 0x0 HEARTBEAT: Patient (Cnx state) pid=7 registered (8 of 16 max registered) ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x52) of type: 0x7 ENDPT 0: Fax Custom Options set to 0x0 Default value for provItemId '47' did not exist Default value for provItemId '210' did not exist Default value for provItemId '63' did not exist ENDPT: Initialization completed successfully for endpt 0 00:00:29 cmCallConfig: entering... WO........0=*43# WF........1=#43# WQ........2=*#43# RT........12=*31# RO........13=*32# RF........17=*33# RESTORE DEFAULT........11=###*1973*5*2846*147896325*### ENDPOINT 0: 00:00:29 rtpInit: RTCP task created, taskId = 5126 udpRawOpen: copying socketHandle b 00:00:29 RTP read thread started with pid 398 udpRawSetSendHandle: copying rawHdl 0 senddesc b udpRawOpen: copying socketHandle e 00:00:29 RTP read thread started with pid 399 udpRawSetSendHandle: copying rawHdl 1 senddesc e 00:00:29 RTCP thread started with pid 397

→ port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Photo of PCB with markings

→ port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

→ generic.debrick

This is my bootloader backup telsey_CPVA502+_MX29LV320CT_CFE — danitool 2012/01/16 11:58

1. you could read about bootloader in general

1. as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

For some Help with the Tags, please have a look here: tags