Board: RTA1030W rev 1.0

BT's originals will flash fine:

http://www.voyager.bt.com/firmware_upgr … r_a2pb021g

Flashing Fails with the following Openwrt Images that i have tried:

http://downloads.openwrt.org/backfire/1 … fs-cfe.bin

http://downloads.openwrt.org/backfire/1 … fs-cfe.bin

Flashed and bricked it:

http://downloads.openwrt.org/backfire/1 … gr-cfe.bin

Currently all leds apart from the usb are on (wireless, ethernet,internet,dsl,power). Ethernet flashes when data is being transmitted, e.g ping 192.168.1.1 with the laptop using a static ip adress, 192.168.1.2:

ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
From 192.168.1.2 icmp_seq=1 Destination Host Unreachable

Tried but cannot get an IP from the router, gets stuck at obtaining ip address.

(Last edited by Zz on 20 Aug 2010, 23:41)

The power LED stays red and does not become green like another bt voyager modem (different model) i have. They both have two colour power leds.

They both have a 4 pin header, i think it is a serial header. The pin voltages:

Pin 1: 3.28V with respect to pin 3
Pin 2: 3.28V with respect to pin 3
Pin 3: Lowest voltage, i think it is ground
Pin 4: 3.28V with respect to pin 3

What is the pin assignment? i think i only need rx and gnd to test right? I only have a USB to Serial TTL converter, its not a 3.3v version, can i convert the voltages? I have a 3.3 voltage regulated output can i use some mosfets or something to make it work?

(Last edited by Zz on 20 Aug 2010, 13:04)

The serial header:

Hosted by Imgur

(Last edited by Zz on 19 Aug 2010, 23:07)

Bingo it is a serial port, i found a webpage about it.

http://jcsu.jesus.cam.ac.uk/~acw43/proj … erial.html

(Last edited by Zz on 20 Aug 2010, 15:47)

There is no ouput on the serial port from the bt voyager 2091, I have another bt voyager  and i connected to its serial port and i got a boot log from it, it even said "D%G - Power failure detected. ADSL Link down." when i powered it down.

If anyone know how i can recover the bt voyager 2091 it would be great.

(Last edited by Zz on 20 Aug 2010, 15:59)

OMG its responding to pings for a few milliseconds

From 192.168.1.2 icmp_seq=231 Destination Host Unreachable
From 192.168.1.2 icmp_seq=233 Destination Host Unreachable
From 192.168.1.2 icmp_seq=234 Destination Host Unreachable
From 192.168.1.2 icmp_seq=235 Destination Host Unreachable
64 bytes from 192.168.1.1: icmp_req=236 ttl=100 time=650 ms
64 bytes from 192.168.1.1: icmp_req=237 ttl=100 time=0.116 ms
From 192.168.1.2 icmp_seq=265 Destination Host Unreachable
From 192.168.1.2 icmp_seq=266 Destination Host Unreachable
From 192.168.1.2 icmp_seq=267 Destination Host Unreachable
From 192.168.1.2 icmp_seq=268 Destination Host Unreachable
From 192.168.1.2 icmp_seq=269 Destination Host Unreachable
From 192.168.1.2 icmp_seq=270 Destination Host Unreachable
From 192.168.1.2 icmp_seq=271 Destination Host Unreachable
From 192.168.1.2 icmp_seq=272 Destination Host Unreachable
From 192.168.1.2 icmp_seq=273 Destination Host Unreachable
From 192.168.1.2 icmp_seq=274 Destination Host Unreachable
From 192.168.1.2 icmp_seq=275 Destination Host Unreachable
From 192.168.1.2 icmp_seq=276 Destination Host Unreachable
64 bytes from 192.168.1.1: icmp_req=277 ttl=100 time=1218 ms
64 bytes from 192.168.1.1: icmp_req=278 ttl=100 time=218 ms
From 192.168.1.2 icmp_seq=307 Destination Host Unreachable
From 192.168.1.2 icmp_seq=308 Destination Host Unreachable
From 192.168.1.2 icmp_seq=309 Destination Host Unreachable
From 192.168.1.2 icmp_seq=311 Destination Host Unreachable

However netcat doesn't receive anything on port 4919 but is this just a linksys wrt54g* feature?

(Last edited by Zz on 20 Aug 2010, 16:12)

I think my USB to serial TTL cable is defective or broken. It sometimes gave garbled output on the working router and sometimes didn't work at all. The TTL voltages are ok since i only connected the RX and GND on the USB to TTL device to the TX and GND on the router. I will buy a cable and get this to work. I will also see if i can get a different (easier to work with) openwrt router

Its alive!!!

CFE version 1.0.37-0.6.8 for BCM96348 (32bit,SP,BE)                                                                               
Build Date: Thu Dec 28 18:06:17 CST 2006 (michaelc)

Flash Config: CS0(1f80000a,1f),Base(bf800000),Size(8MB)
Ethernet Network Device: Internal PHY
Auto-negotiation timed-out
bootflag 0
found@block 72
boot from bank 0

Board IP address                : 192.168.1.1:ffffff00 
Host IP address                 : 192.168.1.2 
Gateway IP address              :   
Run from flash/host (f/h)       : f 
Default host run file name      :   
Default host flash file name    : bcmModelName_fs_kernel 
Boot delay (1-9 seconds)        : 1 
Board Id Name                   : V2091_BB 
Psi size in KB                  : 24
Number of MAC Addresses (1-32)  : 4 
Ethernet MAC Address            : 00:16:e3:0c:32:e7 
WEP 128bit Key                  : 67956a2rucnac 
Memory size in MB               : 16

==== Press space key to stop auto run (1 seconds) ====
Auto run second count down(before hit space key): 0
Code Address: 0x80010000, Entry Address: 0x80010000
Decompression OK!
Entry at 0x80010000
Closing network.
Starting program at 0x80010000
Linux version 2.6.32.9 (agb@arrakis) (gcc version 4.3.3 (GCC) ) #1 Mon Mar 1 15:44:36 UTC 2010
Detected Broadcom 0x6348 CPU revision b0
CPU frequency is 240 MHz
16MB of RAM installed
registering 37 GPIOs
board_bcm963xx: CFE version: unknown
board_bcm963xx: unknown bcm963xx board:
bootconsole [early0] enabled
CPU revision is: 00029107 (Broadcom BCM6348)
Kernel panic - not syncing: unable to detect bcm963xx board

Now i've just got to fix that

There is no way that is one second, its more like half a second if you ask me

(Last edited by Zz on 22 Aug 2010, 14:36)

How do i do this?

==== Press space key to stop auto run (1 seconds) ====

Does minicom do two way communication? nothing happens when i press space. The output voltage of the TX pin on my USB to serial device is 3.3V

(Last edited by Zz on 22 Aug 2010, 16:29)

question

how did you flash it and brick it becouse im trying to flash it and see if i have any luck then we can share infomation.

The first thing to do is to connect to the serial port inside it and see what the board is, which is what i didn't do, once you know what the board is then you need to pick the image and upload it through the web interface or tftp.

I still don't know how well this router is supported, i can't find it in any of the supported hardware tables, and i haven't found the mailing lists either where these things are discussed.

(Last edited by Zz on 24 Aug 2010, 11:45)

I correctly connected to the serial with a DKU-5 Cable and it still does not send characters over minicom, is this a config issue?

I connected one the two usb to serial devices together and i could see on ttyUSB1 what i was typing on ttyUSB0 so its transmitting correctly but the modem isn't receiving it.

Can anyone help?

Does the BT Voyager need some modifications for it to work correctly?

(Last edited by Zz on 25 Aug 2010, 12:42)

Progress at last:

CFE version 1.0.37-0.6.8 for BCM96348 (32bit,SP,BE)
Build Date: Thu Dec 28 18:06:17 CST 2006 (michaelc)

Flash Config: CS0(1f80000a,1f),Base(bf800000),Size(8MB)
Ethernet Network Device: Internal PHY
bootflag 0
found@block 72
boot from bank 0

Board IP address                : 192.168.1.1:ffffff00 
Host IP address                 : 192.168.1.2 
Gateway IP address              :   
Run from flash/host (f/h)       : f 
Default host run file name      :   
Default host flash file name    : bcmModelName_fs_kernel 
Boot delay (1-9 seconds)        : 1 
Board Id Name                   : V2091_BB 
Psi size in KB                  : 24
Number of MAC Addresses (1-32)  : 4 
Ethernet MAC Address            : 00:16:e3:0c:32:e7 
WEP 128bit Key                  : 67956a2rucnac 
Memory size in MB               : 16

==== Press space key to stop auto run (1 seconds) ====
Auto run second count down(before hit space key): 1
CFE>

YAY! i flashed a new image:

sudo aptitude install xinetd tftpd tftp
sudo nano /etc/xinetd.d/tftp
# file contents of /etc/xinetd.d/tftp
service tftp
{
protocol        = udp
port            = 69
socket_type     = dgram
wait            = yes
user            = nobody
server          = /usr/sbin/in.tftpd
server_args     = -s /tftpboot
disable         = no
}
#
sudo mkdir /tftpboot
sudo chmod -R 777 /tftpboot
sudo chown -R nobody /tftpboot
mv openwrt-V2091_BB-squashfs-btvgr-cfe\ \(1\).bin /tftpboot/openwrt-firmware-10-v2091.bin
sudo /etc/init.d/xinetd restart

============================================

CFE> flashimage 192.168.1.2:openwrt-firmware-10-v2091.bin             
Loading 192.168.1.2:openwrt-firmware-10-v2091.bin ...
Finished loading 2686980 bytes
..........................................*********************

Finished flashing image.
Resetting board...?

CFE version 1.0.37-0.6.8 for BCM96348 (32bit,SP,BE)
Build Date: Thu Dec 28 18:06:17 CST 2006 (michaelc)

Flash Config: CS0(1f80000a,1f),Base(bf800000),Size(8MB)
Ethernet Network Device: Internal PHY
bootflag 0
found@block 72
boot from bank 0

Board IP address                : 192.168.1.1:ffffff00 
Host IP address                 : 192.168.1.2 
Gateway IP address              :   
Run from flash/host (f/h)       : f 
Default host run file name      :   
Default host flash file name    : bcmModelName_fs_kernel 
Boot delay (1-9 seconds)        : 1 
Board Id Name                   : V2091_BB 
Psi size in KB                  : 24
Number of MAC Addresses (1-32)  : 4 
Ethernet MAC Address            : 00:16:e3:0c:32:e7 
WEP 128bit Key                  : 67956a2rucnac 
Memory size in MB               : 16

==== Press space key to stop auto run (1 seconds) ====
Auto run second count down(before hit space key): 0
Code Address: 0x80010000, Entry Address: 0x80010000
Decompression OK!
Entry at 0x80010000
Closing network.
Starting program at 0x80010000
Linux version 2.6.32.10 (openwrt@wrt1.marcant.net) (gcc version 4.3.3 (GCC) ) #8 Thu Apr 1 10:20:02 CEST 2010
Detected Broadcom 0x6348 CPU revision b0
CPU frequency is 240 MHz
16MB of RAM installed
registering 37 GPIOs
board_bcm963xx: CFE version: unknown
board_bcm963xx: unknown bcm963xx board:
bootconsole [early0] enabled
CPU revision is: 00029107 (Broadcom BCM6348)
Kernel panic - not syncing: unable to detect bcm963xx board

Tried and Failed:
10.03.1-rc2/brcm63xx/openwrt-RTA1025W_16-squashfs-cfe.bin
10.03.1-rc2/brcm63xx/openwrt-BTV2091_BTR-squashfs-cfe.bin
10.03.1-rc2/brcm63xx/openwrt-BTV2091_ROI_WB-squashfs-cfe.bin
10.03/brcm63xx/openwrt-V2091-squashfs-btvgr-cfe.bin
10.03/brcm63xx/openwrt-V2091_BB-squashfs-btvgr-cfe.bin
10.03/brcm63xx/openwrt-BTV2091_BTR-squashfs-cfe.bin

Yea so nothing seems to work, and the V2091_BB images seem to have been removed from rc1

(Last edited by Zz on 25 Aug 2010, 13:50)

Working image from pubzie: http://www.puzbie.co.uk/shopdata/gg_blog.php?id=94

CFE> flashimage 192.168.1.2:1025w-2091.fir
Loading 192.168.1.2:1025w-2091.fir ...
Finished loading 2398369 bytes
.....................................**************************

Finished flashing image.
Resetting board...?

CFE version 1.0.37-0.6.8 for BCM96348 (32bit,SP,BE)
Build Date: Thu Dec 28 18:06:17 CST 2006 (michaelc)

Flash Config: CS0(1f80000a,1f),Base(bf800000),Size(8MB)
Ethernet Network Device: Internal PHY
bootflag 0
found@block 72

Check run time iamge integrity in the flash......[0xEE6A44DE] != [0x9AA72F68] Image Corrupted !!

Upgrade your run time image through CFE console or HTTP web......

boot 0 found no image
found@block 8
change to boot 1
boot from bank 1

Board IP address                : 192.168.1.1:ffffff00 
Host IP address                 : 192.168.1.2 
Gateway IP address              :   
Run from flash/host (f/h)       : f 
Default host run file name      :   
Default host flash file name    : bcmModelName_fs_kernel 
Boot delay (1-9 seconds)        : 1 
Board Id Name                   : V2091_BB 
Psi size in KB                  : 24
Number of MAC Addresses (1-32)  : 4 
Ethernet MAC Address            : 00:16:e3:0c:32:e7 
WEP 128bit Key                  : 67956a2rucnac 
Memory size in MB               : 16

==== Press space key to stop auto run (1 seconds) ====
Auto run second count down(before hit space key): 0
Code Address: 0x80010000, Entry Address: 0x8018b018
Decompression OK!
Entry at 0x8018b018
Closing network.
Starting program at 0x8018b018
Linux version 2.6.8.1 (compiled by michaelc) (gcc version 3.4.2) #1 Fri Feb 22 12:37:52 CST 2008
01/2200 System PLL( MPI clock 0x10)
Flash Config: CS0(1f80000a,1f),Base(bf800000),Size(8MB)
FLASH_BASE bfc00000,blk 47
Total Flash size: 8192K with 135 sectors NVRAM @71 block
Scratch pad is not used for this flash part.
CPU revision is: 00029107
Determined physical RAM map:
memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
  DMA zone: 4000 pages, LIFO batch:1
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB 2-way, linesize 16 bytes.
PID hash table entries: 64 (order 6: 512 bytes)
Using 120.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 14100k/16000k available (1315k kernel code, 1880k reserved, 197k data, 72k init, 0k highmem)
Calibrating delay loop... 239.20 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction...  unavailable.
NET: Registered protocol family 16
Can't analyze prologue code at 8015744c
1.parse options inodes 1765 block 1765
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v1.0
rootfs_addr 0bf810100
No BinFs
brcmboard: brcm_board_init entry
D%Gbcm963xx_serial driver v2.0
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET: Registered protocol family 1
NET: Registered protocol family 17
Ebtables v2.0 registered
NET: Registered protocol family 8
NET: Registered protocol family 20
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 72k freed
init started:  BusyBox v1.00 (2005) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5
tmpfs size 262144
1.parse options inodes 1774 block 64

BusyBox v1.00 (2005) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

Loading drivers and kernel modules...

atmapi: module license 'Proprietary' taints kernel.
blaadd: blaa_detect entry
adsl: adsl_init entry
Broadcom BCMPROCFS v1.0 initialized
Internal PHY
Broadcom BCM6348B0 Ethernet Network Device v0.3 Feb 22 2008 12:36:11
Config Internal PHY Through MDIO
BCM63xx_ENET: 100 MB Full-Duplex (auto-neg)
eth0: MAC Address: 00:16:E3:0C:32:E7
Broadcom BCM6348B0 USB Network Device v0.4 Feb 22 2008 12:36:13
usb0: MAC Address: 00 16 E3 0C 32 E8
usb0: Host MAC Address: 00 16 E3 0C 32 E9
USB Vendor id=069a, USB Product id=0318
PCI: Setting latency timer of device 0000:00:01.0 to 64
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
wl: srom not detected, using main memory mapped srom info (wombo board)
wl0: Broadcom BCM4318 802.11 Wireless Controller 3.91.41.0
eth0 Link UP.

pSdramPHY=0xA0FFFFF8, 0xFFFFFBFF 0xFFFFFFFF
AdslCoreHwReset: AdslOemDataAddr = 0xA0FFB404

==>   VOYAGER2091 BTR Software Version: 3.30r_A2pB021g.d19b    <==

Setting country code "AU"
ip_tables: (C) 2000-2002 Netfilter core team
ip_conntrack version 2.1 (125 buckets, 0 max) - 368 bytes per conntrack
ip_conntrack_pptp version 2.1 loaded
ip_nat_pptp version 2.0 loaded
ip_conntrack_h323: init
ip_nat_h323: initialize the module!
ip_conntrack_rtsp v0.01 loading
ip_nat_rtsp v0.01 loading
ip_nat_pptp version 2.0 unloaded
ip_conntrack_pptp version 2.1 unloaded
board_ioctl: boot complete!

YAY! my broadband connection is back, no need to keep using my phone

I can finally compile trunk

Just to clarify, talk talk disconnected customers who refused to either pay more for the service or switch the line rental to them also. And this message was about being reconnected by my new isp and not having to tether my phone.

Is it really the original Board ID? Then how did you brick it when you uploaded the openwrt-V2091_BB-squashfs-btvgr-cfe.bin to the V2091 or should the cfe version be flashed from CFE?

oldwiki:openwrtdocs:hardware:bt:voyager2091 - OpenWrt Wiki
BT's other Voyager routers and modems. Voyager 190, 210, 220, 2091, 2500 unlocking, firmware hacking and more.
Status of the Broadcom 63xx port of OpenWrt - OpenWrt Wiki
BCM63xx Firmware Image Information - OpenWrt Wiki