Geschenkte Gaul


#1

Von einem Kollegen:

ich hab im angebot 20 stück comtrend 3223 iad. vdsl/adsl + lan + firewall + 4 v-lan + usb fein konfigurierbar. interesse? kost nix aber ich muß die morgen früh da wegholen sonst schrott

@wingdu @gwrx


SortierSamstag!
#2

Habe da leider keine Firmware für, also nix fertiges… scheint so es gibt es auch kein openwrt für die dinger…


#4

Falls no nit zu spät, I hätt gern eins. Bin halt erst wieda am 19. in Ibk.


#5

Hab so ein Ding aufgeschraubt - Die Platine sieht sehr ähnlich aus wie der:
https://wiki.openwrt.org/toh/comtrend/vr3025u
mit zusätzlich noch Telefon-Zeugs dazu.
Genaues aber schwer zu sagen - der WLAN-Chip ist auf jeden Fall identisch, der Haupt-SOC sieht gleich aus - aber genausowenig beschriftet wie auf den Bildern da…

Hab dann mal das git gezogen - make hat bei mir aber ziemlich schnell mal aufgegeben…

Im schlimmsten Fall haben wir eben 12V/2A-Netzteile bekommen ;))


#6

mm… machste mir mal nen screen wo der ausgestiegen ist ?


#7

Hab’s sogar noch offen:

libtool: link: gcc -O2 -I/home/robelix/hacking/openwrt/comtrend/openwrt/staging_dir/host/include -Wall -D_REENTRANT -o testglib testglib.o  -L/home/robelix/hacking/openwrt/comtrend/openwrt/staging_dir/host/lib ./.libs/libglib.a
./.libs/libglib.a(garray.o): In function `g_bit_nth_lsf':
garray.c:(.text+0x130): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(garray.o): In function `g_bit_nth_msf':
garray.c:(.text+0x160): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(garray.o): In function `g_bit_storage':
garray.c:(.text+0x1a0): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(ghash.o): In function `g_bit_nth_lsf':
ghash.c:(.text+0x230): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(ghash.o): In function `g_bit_nth_msf':
ghash.c:(.text+0x260): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(ghash.o): In function `g_bit_storage':
ghash.c:(.text+0x2a0): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(glist.o): In function `g_bit_nth_lsf':
glist.c:(.text+0x180): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(glist.o): In function `g_bit_nth_msf':
glist.c:(.text+0x1b0): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(glist.o): In function `g_bit_storage':
glist.c:(.text+0x1f0): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(gmem.o): In function `g_bit_nth_lsf':
gmem.c:(.text+0x50): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(gmem.o): In function `g_bit_nth_msf':
gmem.c:(.text+0x80): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(gmem.o): In function `g_bit_storage':
gmem.c:(.text+0xc0): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(gmessages.o): In function `g_bit_nth_lsf':
gmessages.c:(.text+0x670): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(gmessages.o): In function `g_bit_nth_msf':
gmessages.c:(.text+0x6a0): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(gmessages.o): In function `g_bit_storage':
gmessages.c:(.text+0x6e0): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(gmutex.o): In function `g_bit_nth_lsf':
gmutex.c:(.text+0x70): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(gmutex.o): In function `g_bit_nth_msf':
gmutex.c:(.text+0xa0): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(gmutex.o): In function `g_bit_storage':
gmutex.c:(.text+0xe0): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(gnode.o): In function `g_bit_nth_lsf':
gnode.c:(.text+0x860): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(gnode.o): In function `g_bit_nth_msf':
gnode.c:(.text+0x890): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(gnode.o): In function `g_bit_storage':
gnode.c:(.text+0x8d0): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(gprimes.o): In function `g_bit_nth_lsf':
gprimes.c:(.text+0x0): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(gprimes.o): In function `g_bit_nth_msf':
gprimes.c:(.text+0x30): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(gprimes.o): In function `g_bit_storage':
gprimes.c:(.text+0x70): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(grel.o): In function `g_bit_nth_lsf':
grel.c:(.text+0x290): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(grel.o): In function `g_bit_nth_msf':
grel.c:(.text+0x2c0): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(grel.o): In function `g_bit_storage':
grel.c:(.text+0x300): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(gslist.o): In function `g_bit_nth_lsf':
gslist.c:(.text+0xf0): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(gslist.o): In function `g_bit_nth_msf':
gslist.c:(.text+0x120): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(gslist.o): In function `g_bit_storage':
gslist.c:(.text+0x160): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(gstrfuncs.o): In function `g_bit_nth_lsf':
gstrfuncs.c:(.text+0x0): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(gstrfuncs.o): In function `g_bit_nth_msf':
gstrfuncs.c:(.text+0x30): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(gstrfuncs.o): In function `g_bit_storage':
gstrfuncs.c:(.text+0x70): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(gstring.o): In function `g_bit_nth_lsf':
gstring.c:(.text+0xa0): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(gstring.o): In function `g_bit_nth_msf':
gstring.c:(.text+0xd0): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(gstring.o): In function `g_bit_storage':
gstring.c:(.text+0x110): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(gtimer.o): In function `g_bit_nth_lsf':
gtimer.c:(.text+0x0): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(gtimer.o): In function `g_bit_nth_msf':
gtimer.c:(.text+0x30): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(gtimer.o): In function `g_bit_storage':
gtimer.c:(.text+0x70): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(gtree.o): In function `g_bit_nth_lsf':
gtree.c:(.text+0x8f0): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(gtree.o): In function `g_bit_nth_msf':
gtree.c:(.text+0x920): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(gtree.o): In function `g_bit_storage':
gtree.c:(.text+0x960): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
./.libs/libglib.a(gutils.o): In function `g_bit_nth_lsf':
gutils.c:(.text+0x0): multiple definition of `g_bit_nth_lsf'
testglib.o:testglib.c:(.text+0x100): first defined here
./.libs/libglib.a(gutils.o): In function `g_bit_nth_msf':
gutils.c:(.text+0x30): multiple definition of `g_bit_nth_msf'
testglib.o:testglib.c:(.text+0x130): first defined here
./.libs/libglib.a(gutils.o): In function `g_bit_storage':
gutils.c:(.text+0x70): multiple definition of `g_bit_storage'
testglib.o:testglib.c:(.text+0x170): first defined here
collect2: error: ld returned 1 exit status
make[8]: *** [Makefile:457: testglib] Error 1
make[8]: Leaving directory '/home/robelix/hacking/openwrt/comtrend/openwrt/build_dir/host/pkg-config-0.25/glib-1.2.10'
make[7]: *** [Makefile:531: all-recursive] Error 1
make[7]: Leaving directory '/home/robelix/hacking/openwrt/comtrend/openwrt/build_dir/host/pkg-config-0.25/glib-1.2.10'
make[6]: *** [Makefile:364: all] Error 2
make[6]: Leaving directory '/home/robelix/hacking/openwrt/comtrend/openwrt/build_dir/host/pkg-config-0.25/glib-1.2.10'
make[5]: *** [Makefile:536: all-recursive] Error 1
make[5]: Leaving directory '/home/robelix/hacking/openwrt/comtrend/openwrt/build_dir/host/pkg-config-0.25'
make[4]: *** [Makefile:309: all] Error 2
make[4]: Leaving directory '/home/robelix/hacking/openwrt/comtrend/openwrt/build_dir/host/pkg-config-0.25'
make[3]: *** [Makefile:35: /home/robelix/hacking/openwrt/comtrend/openwrt/build_dir/host/pkg-config-0.25/.built] Error 2
make[3]: Leaving directory '/home/robelix/hacking/openwrt/comtrend/openwrt/tools/pkg-config'
make[2]: *** [tools/Makefile:151: tools/pkg-config/compile] Error 2
make[2]: Leaving directory '/home/robelix/hacking/openwrt/comtrend/openwrt'
make[1]: *** [tools/Makefile:149: /home/robelix/hacking/openwrt/comtrend/openwrt/staging_dir/target-mips_r2_uClibc-0.9.33.2/stamp/.tools_install_nnnnn] Error 2
make[1]: Leaving directory '/home/robelix/hacking/openwrt/comtrend/openwrt'
make: *** [/home/robelix/hacking/openwrt/comtrend/openwrt/include/toplevel.mk:154: world] Fehler 2

#8

Probier mal die fertig kompilierten Versionen auf dem FTP Server von dehnen.

Die sollten eigentlich direkt rennen…


#9

Gestern probiert.
Hochgeschoben, das Ding sagt, daß es flasht und nach 2 Minuten rebooten wird. Tut aber nicht rebooten, nach nem powercycle kommt’s wieder mit der alten Firmware hoch.

btw: Login von Orig-Firmware: root/12345


#10

Hab einem mal Header an den serial gelötet, hier der boot-log von der Orig-Firmware:

CFE version 1.0.37-106.24-37 for BCM96368 (32bit,SP,BE)
Build Date: 2013-01-15 14:53:53 (herbert@rd7-server)
Copyright (C) 2000-2009 Broadcom Corporation.

Parallel flash device: name MX29GL128EH, id 0x2221 size 16384KB
Total Flash size: 16384K with 128 sectors
Chip ID: BCM6368B2, MIPS: 400MHz
Main Thread: TP0
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000

Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Board Id (0-15)                   : 96368IT-1441N1  
Number of MAC Addresses (1-32)    : 32  
Base MAC Address                  : 38:72:c0:5c:cb:4d  
PSI Size (1-64) KBytes            : 64  
Enable Backup PSI [0|1]           : 0  
System Log Size (0-256) KBytes    : 0  
Main Thread Number [0|1]          : 0  
Serial Number                     : 1293225UXXF-AA000940  
Voice Board Configuration (0-19)  : ADVNgr_3225u  

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 110
Booting from only image (0xb8020000) ...
Code Address: 0x80010000, Entry Address: 0x80014230
Decompression OK!
Entry at 0x80014230
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x80014230
Linux version 2.6.30 (rick@rd6-server) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #2 Mon Nov 4 17:43:30 CST 2013

Parallel flash device: name MX29GL128EH, id 0x2221 size 16384KB

96368IT-1441N1 prom init

Linux TP ID = 0 

CPU revision is: 0002a031 (Broadcom4350)

Determined physical RAM map:

 memory: 03f00000 @ 00000000 (usable)

Zone PFN ranges:

  DMA      0x00000000 -> 0x00001000

  Normal   0x00001000 -> 0x00003f00

Movable zone start PFN for each node

early_node_map[1] active PFN ranges

    0: 0x00000000 -> 0x00003f00

On node 0 totalpages: 16128

free_area_init_node: node 0, pgdat 80361750, node_mem_map 81000000

  DMA zone: 32 pages used for memmap

  DMA zone: 0 pages reserved

  DMA zone: 4064 pages, LIFO batch:0

  Normal zone: 94 pages used for memmap

  Normal zone: 11938 pages, LIFO batch:1

Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16002

Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200

wait instruction: enabled

Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.

Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes

RCU-based detection of stalled CPUs is enabled.

NR_IRQS:128

PID hash table entries: 256 (order: 8, 1024 bytes)

console [ttyS0] enabled

Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)

Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)

Allocating memory for DSP module core and initialization code

Allocated DSP module memory - CORE=0x8108c720 SIZE=1587776, INIT=0x81210160 SIZE=44

Memory: 58540k/64512k available (2847k kernel code, 5952k reserved, 553k data, 128k init, 0k highmem)

Calibrating delay loop... 399.36 BogoMIPS (lpj=199680)

Mount-cache hash table entries: 512

net_namespace: 1096 bytes

NET: Registered protocol family 16

Total Flash size: 16384K with 128 sectors

registering PCI controller with io_map_base unset

bio: create slab  at 0

SCSI subsystem initialized

usbcore: registered new interface driver usbfs

usbcore: registered new interface driver hub

usbcore: registered new device driver usb

pci 0000:00:01.0: reg 10 32bit mmio: [0x000000-0x00ffff]

pci 0000:00:09.0: reg 10 32bit mmio: [0x10001600-0x100016ff]

pci 0000:00:0a.0: reg 10 32bit mmio: [0x10001500-0x100015ff]

BLOG v3.0 Initialized

NET: Registered protocol family 8

NET: Registered protocol family 20

NET: Registered protocol family 2

IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

TCP established hash table entries: 2048 (order: 2, 16384 bytes)

TCP bind hash table entries: 2048 (order: 1, 8192 bytes)

TCP: Hash tables configured (established 2048 bind 2048)

TCP reno registered

NET: Registered protocol family 1

squashfs: version 4.0 (2009/01/31) Phillip Lougher

squashfs: version 4.0 with LZMA457 ported by BRCM

fuse init (API version 7.11)

msgmni has been set to 114

io scheduler noop registered (default)

Driver 'sd' needs updating - please use bus_type methods

Driver 'sr' needs updating - please use bus_type methods

PPP generic driver version 2.4.2

PPP Deflate Compression module registered

PPP BSD Compression module registered

NET: Registered protocol family 24

bcm963xx_mtd driver v1.0

File system address: 0xb8020100

ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver

PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)

PCI: Setting latency timer of device 0000:00:0a.0 to 64

ehci_hcd 0000:00:0a.0: EHCI Host Controller

ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1

ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM

ehci_hcd 0000:00:0a.0: irq 15, io mem 0x10001500

ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00

usb usb1: configuration #1 chosen from 1 choice

hub 1-0:1.0: USB hub found

hub 1-0:1.0: 2 ports detected

ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver

PCI: Enabling device 0000:00:09.0 (0000 -> 0002)

PCI: Setting latency timer of device 0000:00:09.0 to 64

ohci_hcd 0000:00:09.0: OHCI Host Controller

ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2

ohci_hcd 0000:00:09.0: irq 13, io mem 0x10001600

usb usb2: configuration #1 chosen from 1 choice

hub 2-0:1.0: USB hub found

hub 2-0:1.0: 2 ports detected

usbcore: registered new interface driver usblp

brcmboard: brcm_board_init entry

SES: Button Interrupt 0x1 is enabled

SES: LED GPIO 0x8017 is enabled

Invalid External Interrupt definition 

Serial: BCM63XX driver $Revision: 3.00 $

ttyS0 at MMIO 0xb0000100 (irq = 10) is a BCM63XX

ttyS1 at MMIO 0xb0000120 (irq = 11) is a BCM63XX

bcmxtmrt: Broadcom BCM6368B2 ATM/PTM Network Device v0.3 Nov  4 2013 17:40:22

Broadcom Logger v0.1 Nov  4 2013 17:38:08

Mirror/redirect action on

u32 classifier

    input device check on 

    Actions configured 

TCP cubic registered

Initializing XFRM netlink socket

NET: Registered protocol family 10

NET: Registered protocol family 17

NET: Registered protocol family 15

Initializing MCPD Module

Ebtables v2.0 registered

ebt_time registered

ebt_ftos registered

ebt_wmm_mark registered

802.1Q VLAN Support v1.8 Ben Greear 

All bugs added by David S. Miller 

VFS: Mounted root (squashfs filesystem) readonly on device 31:0.

Freeing unused kernel memory: 128k freed


init started:  BusyBox v1.00 (2013.11.04-09:45+0000) multi-call binary


BusyBox v1.00 (2013.11.04-09:45+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.


Loading drivers and kernel modules... 

ct_hotplug_monitor: not found
173
pktflow: module license 'Proprietary' taints kernel.

Disabling lock debugging due to kernel taint

Initialized fcache state

Broadcom Packet Flow Cache  Char Driver v2.2 Sep 24 2010 17:51:48 Registered<242>

Created Proc FS /procfs/fcache

Broadcom Packet Flow Cache registered with netdev chain

Broadcom Packet Flow Cache learning via BLOG enabled.

Constructed Broadcom Packet Flow Cache v2.2 Sep 24 2010 17:51:48

Broadcom Packet CMF (Experimental) Char Driver v0.1 Sep 24 2010 17:51:45 Registered<232>

Broadcom Packet CMF (Experimental) [6368-B2] v0.1 Sep 24 2010 17:51:45 Loaded

bcmxtmcfg: bcmxtmcfg_init entry

adsl: adsl_init entry

Broadcom BCM6368B2 Ethernet Network Device v0.1 Nov  4 2013 17:39:16

ETH Init: 180 tx BDs at 0xa3941000

ETH Init: 400 rx BDs at 0xa39c2000

ETH Init: 400 rx BDs at 0xa3042000

######## ethsw_init_table:111 ####### switch_port_phyid[0]=1 

######## ethsw_init_table:111 ####### switch_port_phyid[1]=2 

######## ethsw_init_table:111 ####### switch_port_phyid[2]=3 

######## ethsw_init_table:111 ####### switch_port_phyid[3]=4 

######## ethsw_init_table:111 ####### switch_port_phyid[4]=17 

/proc/buffer16 created

dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered 

Broadcom Packet CMF (Experimental) SWC RESET.

Broadcom Packet CMF (Experimental) SWC INITIALIZED.

Broadcom Packet CMF (Experimental) Forwarder Net Device 0 v0.1 Sep 24 2010 17:51:46 Registered

Broadcom Packet CMF (Experimental) Forwarder Net Device 0 v0.1 Sep 24 2010 17:51:46 Registered

Broadcom Packet CMF (Experimental) ENABLED.

===== Found Interface name mapping : 96368IT-1441N1 =====

eth1: MAC Address: 38:72:C0:5C:CB:4D

eth2: MAC Address: 38:72:C0:5C:CB:4D

eth3: MAC Address: 38:72:C0:5C:CB:4D

eth4: MAC Address: 38:72:C0:5C:CB:4D

eth0: MAC Address: 38:72:C0:5C:CB:4D

PCI: Enabling device 0000:00:01.0 (0000 -> 0002)

PCI: Setting latency timer of device 0000:00:01.0 to 64

wl:srom strapped

wl:(srom strapped) probe/present=0

wl:srom not detected, using main memory mapped srom info(wombo board)

wl:loading /etc/wlan/bcm43222_map.bin

wl0: Broadcom BCMa8d6 802.11 Wireless Controller 5.100.123.0.cpe4.06L03.4

dgasp: kerSysRegisterDyingGaspHandler: wl0 registered 

IRQ 21/brcm_21: IRQF_DISABLED is not guaranteed on shared IRQs

DSP Driver: DSP init stub

Endpoint: endpoint_init entry

BHAL(ts: 8 s 699ms):Obtained board id string (ADVNgr_3225u)

BHAL(ts: 8 s 704ms):Successfully obtained voice parameters

BHAL(ts: 8 s 710ms):---------- Voice board configuration ----------

BHAL(ts: 8 s 716ms):Number of FXS lines          =  2

BHAL(ts: 8 s 721ms):Number of FXO lines          =  0

BHAL(ts: 8 s 726ms):Number of DECT lines         =  0

BHAL(ts: 8 s 731ms):Number of failover relay pins=  0

BHAL(ts: 8 s 736ms):

BHAL(ts: 8 s 738ms):Voice device 0: 

BHAL(ts: 8 s 741ms):

BHAL(ts: 8 s 743ms):Device type      = 16

BHAL(ts: 8 s 747ms):Requires reset   = 1

BHAL(ts: 8 s 751ms):Reset GPIO       = 0x0000800A

BHAL(ts: 8 s 755ms):SPI device Id    = 0

BHAL(ts: 8 s 759ms):

BHAL(ts: 8 s 761ms):	 Channel 0 active

BHAL(ts: 8 s 764ms):	 Freqrange     =  0

BHAL(ts: 8 s 768ms):	 EndianMode    =  0

BHAL(ts: 8 s 772ms):	 SampleSize    =  0

BHAL(ts: 8 s 776ms):	 PCM comp mode =  1

BHAL(ts: 8 s 779ms):	 TX timeslot   =  0

BHAL(ts: 8 s 783ms):	 RX timeslot   =  0

BHAL(ts: 8 s 787ms):

BHAL(ts: 8 s 789ms):	 Channel 1 inactive 

BHAL(ts: 8 s 793ms):

BHAL(ts: 8 s 795ms):----------

BHAL(ts: 8 s 798ms):Voice device 1: 

BHAL(ts: 8 s 801ms):

BHAL(ts: 8 s 803ms):Device type      = 17

BHAL(ts: 8 s 807ms):Requires reset   = 0

BHAL(ts: 8 s 811ms):Reset GPIO       = 0x0000800A

BHAL(ts: 8 s 815ms):SPI device Id    = 1

BHAL(ts: 8 s 819ms):

BHAL(ts: 8 s 821ms):	 Channel 0 active

BHAL(ts: 8 s 825ms):	 Freqrange     =  0

BHAL(ts: 8 s 828ms):	 EndianMode    =  0

BHAL(ts: 8 s 832ms):	 SampleSize    =  0

BHAL(ts: 8 s 836ms):	 PCM comp mode =  1

BHAL(ts: 8 s 840ms):	 TX timeslot   =  1

BHAL(ts: 8 s 843ms):	 RX timeslot   =  1

BHAL(ts: 8 s 847ms):

BHAL(ts: 8 s 849ms):	 Channel 1 inactive 

BHAL(ts: 8 s 853ms):

BHAL(ts: 8 s 855ms):----------

endpt 0 deviceId 0 indexCount 0 

 deviceChannelMap[0].txTimeslot = 0 

endpt 1 deviceId 1 indexCount 0 

 deviceChannelMap[1].txTimeslot = 1 

PROV(ts: 8 s 871ms):Allocated memory = 34280 

Endpoint: endpoint_init COMPLETED

p8021ag: p8021ag_init entry

Broadcom 802.1Q VLAN Interface, v0.1

Initializing USB Mass Storage driver...

usbcore: registered new interface driver usb-storage

USB Mass Storage support registered.

usbcore: registered new interface driver usbserial

USB Serial support registered for generic

usbcore: registered new interface driver usbserial_generic

usbserial: USB Serial Driver core

USB Serial support registered for GSM modem (1-port)

usbcore: registered new interface driver option

option: v0.7.2:USB Driver for GSM modems

usbcore: registered new interface driver hso

hso: 1.6-Option:USB High Speed Option driver


===== Comtrend Release Version M631-S406T2A-C07_R01 =====

ssk:error:15.194:BOS: Enter bosInit 

lck_checkBeforeEEnter bosAppInit 

ntry:171:lock reExit bosAppInit 

quired during cmBOS: Exit bosInit 

sObj_getNextInSuendpoint_open COMPLETED

bTreeFlags
273: old priority 0, new priority -20
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
dhcpd:error:19.341:set_iface_config_defaults:423:SIOCGIFADDR failed on br0!
ip_tables: (C) 2000-2006 Netfilter Core Team

sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
ip6_tables: (C) 2000-2006 Netfilter Core Team

/proc/PSD_data created

Netfilter messages via NETLINK v0.30.

nf_conntrack version 0.5.0 (1008 buckets, 4032 max)

[!] @@@@@ nf_conntrack_init:1546 @@@@@ !

sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
RADVDAdvLinkMTUUserMode[0] mtu:1492
device eth1 entered promiscuous mode

#### Brctl_Port_Base_VLAN_config:60 ####

#### Brctl_Port_Base_VLAN_config:84 ####

######## bcm63xx_enet_open:1029 ####### dev->base_addr=0 phyport:0 0

ADDRCONF(NETDEV_UP): eth1: link is not ready

device eth2 entered promiscuous mode

#### Brctl_Port_Base_VLAN_config:60 ####

#### Brctl_Port_Base_VLAN_config:84 ####

######## bcm63xx_enet_open:1029 ####### dev->base_addr=1 phyport:0 1

ADDRCONF(NETDEV_UP): eth2: link is not ready

device eth3 entered promiscuous mode

#### Brctl_Port_Base_VLAN_config:60 ####

#### Brctl_Port_Base_VLAN_config:84 ####

######## bcm63xx_enet_open:1029 ####### dev->base_addr=2 phyport:1 2

ADDRCONF(NETDEV_UP): eth3: link is not ready

sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
device eth4 entered promiscuous mode

#### Brctl_Port_Base_VLAN_config:60 ####

#### Brctl_Port_Base_VLAN_config:84 ####

######## bcm63xx_enet_open:1029 ####### dev->base_addr=3 phyport:2 3

ADDRCONF(NETDEV_UP): eth4: link is not ready

[ll] EUI-64 mdoe
device eth0 entered promiscuous mode

#### Brctl_Port_Base_VLAN_config:60 ####

#### Brctl_Port_Base_VLAN_config:84 ####

######## bcm63xx_enet_open:1029 ####### dev->base_addr=5 phyport:5 5

####reset_IP1001:512 #### IP1001 Reset OK !! phyAddr=0x11

ADDRCONF(NETDEV_UP): eth0: link is not ready

[ll] EUI-64 mdoe
device wl0 entered promiscuous mode

#### Brctl_Port_Base_VLAN_config:60 ####

#### Brctl_Port_Base_VLAN_config:84 ####

br0: port 6(wl0) entering forwarding state

WLmngr Daemon is running
optarg=0 shmId=0 
interface wl0.1 does not exist!
br0: port 6(wl0) entering disabled state

br0: port 6(wl0) entering forwarding state

SIOCGIFFLAGS: No such device
SIOCSIFADDR: No such device
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
BcmAdsl_Initialize=0xC0155214, g_pFnNotifyCallback=0xC0188B34

wlevt_init@107: opened loopback socket 4
wlevt is ready for new msg...
kerSysGetSerialNumber: sn is 1293225UXXF-AA000940

Clocks for QPROC and AFE are being aligned with step through ... 

AFE is aligned, i = 064, PhaseValue = -050, PhaseCntl = 0x3FC00000

QPROC is aligned, i = 017, PhaseValue = 0050, PhaseCntl = 0x3FC04011

Clocks for QPROC and AFE are aligned with syn_status AFE = 0x70, QPROC = 0x78

AFE  phase control reg @0xb0f570f8 default actual = 0x0021C38F, exp = 0x0021c38f

QPRC phase control reg @0xb0f5f0c0 default actual = 0x0421C38F, exp = 0x0421c38f

pSdramPHY=0xA3FFFFF8, 0xF0F0F0F0 0xF0F8F0F0

*** XfaceOffset: 0x5FF90 => 0x5FF90 ***

*** PhySdramSize got adjusted: 0xC8B08 => 0xFF200 ***

AdslCoreSharedMemInit: shareMemAvailable=3552

AdslCoreHwReset:  pLocSbSta=83500000 bkupThreshold=3072

AdslCoreHwReset:  AdslOemDataAddr = 0xA3FBE278

Version Number of EOC:S406T2A-C07_R01

dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered 

XTM Init: 400 rx BDs at 0xa2dce000

XTM Init: 100 rx BDs at 0xa2888c00

Register interface ppp0 !!

Register interface ppp1 !!

Register interface ppp2 !!

Register interface atm3 !!

Register interface ppp3 !!

Register interface ptm0.1 !!

Register interface ppp4.2 !!

ssk:error:38.463:stopSamba:318:Samba is not running.
killall: smbd: no process killed
ssk:error:38.548:stopSamba:330:NETBIOS is not running.
killall: nmbd: no process killed
monitor task is initialized pid= 263 

ssk:error:39.218:initVodslBoundIpIfWanSideUpLocked:466:Failed to get WAN Connection object
device wl0 left promiscuous mode

br0: port 6(wl0) entering disabled state

#### Brctl_Port_Base_VLAN_config:60 ####

#### Brctl_Port_Base_VLAN_config:84 ####

device wl0 entered promiscuous mode

#### Brctl_Port_Base_VLAN_config:60 ####

#### Brctl_Port_Base_VLAN_config:84 ####

br0: port 6(wl0) entering forwarding state

br0: port 6(wl0) entering disabled state

br0: port 6(wl0) entering forwarding state

interface wl0.1 does not exist!
interface wl0.1 does not exist!
br0: port 6(wl0) entering disabled state

sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
br0: port 6(wl0) entering forwarding state

SIOCGIFFLAGS: No such device
SIOCSIFADDR: No such device
br0: port 6(wl0) entering disabled state

There is no Predefined DevicePin in CFE
WPS Device PIN = 17596978
Setting SSID: "pacher.biz"
Setting SSID: "Pacher_Test"
Setting SSID: "wl0_Guest2"
Setting SSID: "wl0_Guest3"
wlctl: Not In Range
wlctl: Not In Range
COEX: downgraded chanspec 0x2d08 to 0x2b06: channel 11 used by exiting BSSs 

chanspec 0x2b01 selected 
device wl0 left promiscuous mode

br0: port 6(wl0) entering disabled state

#### Brctl_Port_Base_VLAN_config:60 ####

#### Brctl_Port_Base_VLAN_config:84 ####

device wl0 entered promiscuous mode

#### Brctl_Port_Base_VLAN_config:60 ####

#### Brctl_Port_Base_VLAN_config:84 ####

br0: port 6(wl0) entering forwarding state

device wl0.1 is not a slave of br0
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
device wl0.1 entered promiscuous mode

#### Brctl_Port_Base_VLAN_config:60 ####

#### Brctl_Port_Base_VLAN_config:84 ####

br0: port 6(wl0) entering disabled state

br0: port 6(wl0) entering forwarding state

br0: port 7(wl0.1) entering forwarding state

Reaped 1078
UPnP daemon is ready to run
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)
sntp:ntp query -> 195.96.0.4
sntp: Network is unreachable (80)

#11

und beim nicht funktionierenden firmware upload meint er:

httpd:error:333.480:cmsImg_validateImage:659:broadcom image is too large for flash, got 16777472, max 16777236
httpd:error:333.481:do_upload_pre:624:invalid image format [content-len=16777727 imageLen=16777472]
glbBoundary   =>---------------------------10347651295292293435514404<=
start boundary=>-----------------------------10347651295292293435514404

<=
line1         =Content-Disposition: form-data; name="filename"; filename="openwrt-VR-3025u-squashfs-cfe.bin"


line2         =


Post Header content_len=16777727
uploadBufLen =16777672
uploadSize   =16777533
imageLen     =16777472
sleepCountH  =0
sleepCountM  =0
glbUploadStatus  =9851
Start of image buf:
36 00 00 00 42 72 6f 61 64 63 6f 6d 20 43 6f 72 

End of image buf:
ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 0a 


#12

Das Image vom:
https://wiki.openwrt.org/toh/comtrend/vr3025un ist deutlich kleiner - flasht, aber will nicht booten:

[    0.000000] Linux version 3.10.49 (bb@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r42625) ) #3 SMP Wed Oct 1 15:13:13 CEST 2014
[    0.000000] Detected Broadcom 0x6368 CPU revision b2
[    0.000000] CPU frequency is 400 MHz
[    0.000000] 64MB of RAM installed
[    0.000000] registering 38 GPIOs
[    0.000000] board_bcm963xx: Boot address 0xb8000000
[    0.000000] board_bcm963xx: CFE version: 1.0.37-106.24-37
[    0.000000] board_bcm963xx: unknown bcm963xx board: 96368IT-1441N1
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0002a031 (Broadcom BMIPS4350)
[    0.000000] Kernel panic - not syncing: unable to detect bcm963xx board

#13

Man kann das oben genannte OpenWRT-Image zum laufen kriegen - allerdings nur mit angelöteter Serial

In der Serial gleich beim bootloader irgendwelche Tasten drücken - dann kriegt man die cmdline vom bootloader CFE>
da dann:
b Change board parameters

und gleich den ersten Wert - Board ID auf
96368M-1341N ------- 9

Damit bootet das Ding ;)))


#14

Default host run file name : vmlinux

ist da wirklich vmlinux drauf?


#15

Die Original-Firmware da drauf ist auf jeden Fall ein Linux, allerdings ne spezielle Shell drauf.

Oder was meinst?


#16

Mal gesucht wo diese board-id definiert wird:


Außer den offsets schaut’s mal sehr simpel aus. Und die kann man vermutlich die selben benutzen - das ding läuft ja damit wenn man die board-id ändert.


#17

Heute mal noch genauer angeschaut das Teil:

  • WLAN - funktioniert
  • 4x 10/100 Ethernet - funktioniert
  • 1x GB-Ethernet - Es gibt wohl nen Treiber für den benutzten PHY (IP1001LF - kernel modul: icplus)
  • USB - sollte tun, in dem benutzten Image sind aber die Module nicht dabei
  • DSL - wohl nocht
  • Telefonie - schaut auch eher schlecht aus - (Chips: Le89810 und Le89116 - außer einem 2seitigen Werbe-PDF nix zu finden)

#18

Hoi,

Robelix kannst du mal schauen ob du da Lede drauf bekommst ? Openwrt ist so ziemlich tod…


#19

Lede mal probiert: fehlt wohl irgend ein flash driver
https://downloads.lede-project.org/snapshots/targets/brcm63xx/generic/lede-brcm63xx-generic-VR-3025un-squashfs-cfe.bin

[    0.708906] List of all partitions:
[    0.712460] 1f00              64 mtdblock0  (driver?)
[    0.717645] 1f01            8064 mtdblock1  (driver?)
[    0.722826] 1f02              64 mtdblock2  (driver?)
[    0.728015] No filesystem could mount root, tried:  squashfs jffs2
[    0.734391] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)
[    0.744660] Rebooting in 1 seconds..

#20

Hmm, jetz kenn i mi mal nimmer ganz aus
Hab jetzt wieder das schon mal laufende Image rauf - aber jetzt


[    0.752000] SQUASHFS error: Failed to initialise xz decompressor
[    0.760000] VFS: Cannot open root device "mtdblock2" or unknown-block(31,2): error -5
[    0.768000] Please append a correct "root=" boot option; here are the available partitions:
[    0.776000] 1f00             128 mtdblock0  (driver?)
[    0.780000] 1f01            1332 mtdblock1  (driver?)
[    0.784000] 1f02           14795 mtdblock2  (driver?)
[    0.792000] 1f03           12800 mtdblock3  (driver?)
[    0.796000] 1f04             128 mtdblock4  (driver?)
[    0.800000] 1f05           16128 mtdblock5  (driver?)
[    0.808000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)

#21

Hm, nochmal geflasht, und das geht wieder.