1 (edited by NetworkPro 2011-02-15 00:12:06)

Topic: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

Hello,

I tftp-flashed a https://dev.openwrt.org/ticket/5594 ZTE ZXDSL531B (BTC now Vivacom) to Dynalink RTA1025W (cfe-rta1025wau-v364y_a2pb025c) as seen in a How-To found on some Russian sites.

board: http://i034.radikal.ru/0908/6d/8b221fbda472.jpg

After this the device is stable even after cold restart.
At this point I can upload OpenWRT as a firmware update from the Web interface.

All works well with "openwrt-RTA1025W_16-squashfs-cfe.bin" found directly on OpenWRT download site. ( I tried with backfire 10.03 and with 10.03.1 RC4)

After cold restart the device is back to a boot loader listening on http 192.168.1.1 waiting for a firmware to be uploaded.
At this point I can upload either Dynalink fw (no probs) or OpenWRT (The story repeats after a cold restart).

Please advise.

Thank you.

P.S.
Bootloader looks like this:

Boot Loader, Version 1.0.37-6.8.5

This device is currently running on the boot loader.


Update Firmware
Step 1:  Obtain an updated firmware image file from your ISP.
Step 2:  Enter the path to the image file location in the box below or click "Browse" to locate the image file.
Step 3:  Click "Update Firmware" once to upload the new image file.

NOTE:  The update process takes about 2 minutes to complete, and your DSL Router will reboot.




New Firmware File Name:

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

OK under OpenWRT, I did this:

cat /dev/mtd0 > /www/backup_RTA1025W_16_1.0.37-6.8.5_CFE_please_switchend_before_flashing_or_brick.bin

And then I got it here: http://192.168.1.1/backup_RTA1025W_16_1 … _brick.bin and here it is:
http://www.megaupload.com/?d=KVT1IHJ4

smile

Now how can I mod this sh!t ?!?

P.S. I also did this:

mtd write -f /www/backup_RTA1025W_16_1.0.37-6.8.5_CFE_please_switchend_before_flashing_or_brick.bin CFE

and then I powered down the router and powered it up again.

The CFE is still working unlike the Davolink movie I've gone through: https://forum.openwrt.org/viewtopic.php?id=28573




There is some CFEs here but they seem "RAW" : http://bitswitcher.svn.sourceforge.net/viewvc/bitswitcher/trunk/dev_tree/targets/cfe/



CFE Builder, I wonder how this could help me modify the current CFE to run OpenWRT each time without falling back to boot loader mode: http://al.robotfuzz.com/~al/thomson/cfe-builder/




If anyone has any ideas, please share them. Thank you !!

3 (edited by NetworkPro 2011-02-15 11:20:40)

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

Anyone has any pointers what can I do to the CFE so it would work with OpenWRT? Or what can we do to OpenWRT so it would work with the CFE?

Thank you.

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

try resetting the NVRAM.
try flashing OpenWrt partition by partition(i.e. first the kernel, then the rootfs).
try flashing the complete openwrt image, then when you are booted into it, reflash it partition by partition.
DO NOT flash CFE, unless you know what you are doing AND have a jtag equipment ready and are ready to use it.

After you report that your device has a CFE(and the webserver looks like the BC-CFE too) I assume you are running things on a broadcom platform - I once had a BroadCom SoC with OpenWRT(Thanks german Government for seizing it - f**king nazis!). On first approach it did not work too well, but then I used the serial interface to flash it and to reset NVRAM. After that it worked like a charm(well, almost, openwrt disabled wifi by default and assigned the only eth-port to the wan *d:)

I express my Uniqueness!

5 (edited by NetworkPro 2011-02-15 12:09:00)

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

- OK I can boot into OpenWRT right after I give the image to the CFE web interface. At this point I can reset the NVRAM ? And expect for OpenWRT to remain on the router after reboot?

- By the way on this board there is a connector but its giving 3.3volts on 3 of the pins and 0v on one of them. I am afraid I could burn my MAx232 if I connect it there. Does this sound like a normal TTL serial connection?

- There is a 14 pin connector (holes on the PCB) but there is a capacitor put ontop of it. I don't know if it is a JTAG. It would be good if we could try a supposedly working CFE with the flashing with mtd method if this is possible.

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

yes it does. PCs do have a +-12V Connection on RS-232. The MAX-232 chip converts this to 3.3V.

If you are unsure, you can use a siemens serial datacable for testing too - just do not connect the board to your computer without a signal current converter.

well, as for that JTAG, when I looked at the photo of you PCB I noticed the 14-pin header on the lower left, also I did notice the capacitor on top of it, and I considered that this could be some 14pin wiggler-compatible JTAG, which just has to be connected from the bottom of the board.

Anyhow, as far as I am concerned, if you want to reset NVRAM, either use a serial connection or do it after you flashed openwrt onto it. I think there was some erase option for the nvram command.

I express my Uniqueness!

7 (edited by NetworkPro 2011-02-20 16:24:04)

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

By the way I grabbed another such modem and I tried:

Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
                   =======================
                   Welcome to ZXDSL 531BII
                   =======================

ZTE Inc., Software Release ZXDSL 531BIIV3.1.0e_B09_BG

Login name: root
Password: rootWLaccess
> sh
BusyBox v1.00 (2005) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# dmesg
Linux version 2.6.8.1 (joshua@cjb.askey-sh.com.cn) (gcc version 3.4.2) #1 Thu Oct 18 19:20:20 CST 2007
Flash Config: CS0(1fc00009,15),Base(bfc00000),Size(4MB)
FLASH_BASE bfc00000,blk 0
Total Flash size: 4096K with 71 sectors NVRAM @0 block
Scratch pad is not used for this flash part.
RTA1025W_16 prom init
CPU revision is: 00029107
mpi: No Card is in the PCMCIA slot
Determined physical RAM map:
 memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
  DMA zone: 4000 pages, LIFO batch:1
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB 2-way, linesize 16 bytes.
PID hash table entries: 64 (order 6: 512 bytes)
Using 120.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 14084k/16000k available (1321k kernel code, 1896k reserved, 206k data, 72k init, 0k highmem)
Calibrating delay loop... 239.20 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction...  unavailable.
NET: Registered protocol family 16
Can't analyze prologue code at 80158f14
1.parse options inodes 1763 block 1763
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v1.0
brcmboard: brcm_board_init entry
bcm963xx_serial driver v2.0
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET: Registered protocol family 1
NET: Registered protocol family 17
Ebtables v2.0 registered
NET: Registered protocol family 8
NET: Registered protocol family 20
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 72k freed
Algorithmics/MIPS FPU Emulator v1.5
size -2134762256
1.parse options inodes 1772 block 64
atmapi: module license 'Proprietary' taints kernel.
blaadd: blaa_detect entry
adsl: adsl_init entry
Broadcom BCMPROCFS v1.0 initialized
External Switch Detected !!
Broadcom BCM6348B0 Ethernet Network Device v0.3 Oct 18 2007 19:18:55
Config Ethernet Switch Through SPI Slave Select 0
eth0: MAC Address: 00:1E:73:50:B0:80
Broadcom BCM6348B0 USB Network Device v0.4 Oct 18 2007 19:18:57
usb0: MAC Address: 00 1E 73 50 B0 81
usb0: Host MAC Address: 00 1E 73 50 B0 82
USB Vendor id=069a, USB Product id=0312 
PCI: Setting latency timer of device 0000:00:01.0 to 64
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
wl: srom not detected, using main memory mapped srom info (wombo board)
eth0 Link UP.
wl0: Broadcom BCM4318 802.11 Wireless Controller 3.91.41.0
bridge: set_group_prio: bridge br0 group_prio 1
bridge: set_multicast: bridge br0 support_multicast 1
eth0.2: dev_set_promiscuity(master, 1)
eth0.3: dev_set_promiscuity(master, 1)
eth0.4: dev_set_promiscuity(master, 1)
eth0.5: dev_set_promiscuity(master, 1)
ip_tables: (C) 2000-2002 Netfilter core team
ip_conntrack version 2.1 (125 buckets, 0 max) - 368 bytes per conntrack
ip_conntrack_pptp version 2.1 loaded
ip_nat_pptp version 2.0 loaded
ip_conntrack_h323: init 
ip_nat_h323: initialize the module!
ip_conntrack_sip v0.01 loading
ip_nat_sip v0.01 loading
ip_conntrack_rtsp v0.01 loading
ip_nat_rtsp v0.01 loading

# tftp -g  -f openwrt-RTA1025W_16-squashfs-cfe.bin -t i 192.168.1.100
Done removing processes
Checking Image tag.....
User request image with tag 'RTA1025W_16' flash into board ID 'RTA1025W_16'
Allocating 2686988 bytes for broadcom image.
Memory allocated
Total image size: 2686980
Checking Image tag.....
User request image with tag 'RTA1025W_16' flash into board ID 'RTA1025W_16'
tagVer=6   curVer=6   tagVerLast=26  FlashLayoutVer=5  curFlashLayoutVer=3



***** Your flash layout is different so you are not allowed to upgrade/downgrade ********

***** CFE must included ******

Tftp Image failed: Illegal image.

# tftp -g -f cfe-rta1025wnz-v329u_a2pb021g -t i 192.168.1.17         
Done removing processes
Checking Image tag.....
User request image with tag 'RTA1025W_16' flash into board ID 'RTA1025W_16'
Allocating 2382435 bytes for broadcom image.
Memory allocated
Total image size: 2382427
Checking Image tag.....
User request image with tag 'RTA1025W_16' flash into board ID 'RTA1025W_16'

[1]     Askey format verified.
Tftp image done.

Flashing CFE...

Dynalink ADSL2+ Wireless Router RTA1025WNZ
Software Version: 3.29u
Login name: root
Password:
Login incorrect. Try again.
Login name: admin
Password:
> sh


BusyBox v1.00 (2005) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# dmesg
Linux version 2.6.8.1 (compiled by michaelc) (gcc version 3.4.2) #1 Fri Dec 15 22:50:53 CST 2006
c2/22a8 System PLL( MPI clock 0x10)
Flash Config: CS0(1fc00009,15),Base(bfc00000),Size(4MB)
FLASH_BASE bfc00000,blk 0
Total Flash size: 4096K with 71 sectors NVRAM @0 block
Scratch pad is not used for this flash part.
CPU revision is: 00029107
Determined physical RAM map:
 memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
  DMA zone: 4000 pages, LIFO batch:1
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB 2-way, linesize 16 bytes.
PID hash table entries: 64 (order 6: 512 bytes)
Using 120.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 14084k/16000k available (1322k kernel code, 1896k reserved, 205k data, 72k init, 0k highmem)
Calibrating delay loop... 239.20 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction...  unavailable.
NET: Registered protocol family 16
Can't analyze prologue code at 8015934c
1.parse options inodes 1763 block 1763
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v1.0
rootfs_addr 0bfc10100
No BinFs
brcmboard: brcm_board_init entry
bcm963xx_serial driver v2.0
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET: Registered protocol family 1
NET: Registered protocol family 17
Ebtables v2.0 registered
NET: Registered protocol family 8
NET: Registered protocol family 20
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 72k freed
Algorithmics/MIPS FPU Emulator v1.5
tmpfs size 262144
1.parse options inodes 1772 block 64
atmapi: module license 'Proprietary' taints kernel.
blaadd: blaa_detect entry
adsl: adsl_init entry
Broadcom BCMPROCFS v1.0 initialized
External Switch Detected !!
Broadcom BCM6348B0 Ethernet Network Device v0.3 Dec 15 2006 22:49:12
Config Ethernet Switch Through SPI Slave Select 0
eth0: MAC Address: 00:1E:73:50:B0:80
Broadcom BCM6348B0 USB Network Device v0.4 Dec 15 2006 22:49:13
usb0: MAC Address: 00 1E 73 50 B0 81
usb0: Host MAC Address: 00 1E 73 50 B0 82
USB Vendor id=069a, USB Product id=0311 
PCI: Setting latency timer of device 0000:00:01.0 to 64
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
wl: srom not detected, using main memory mapped srom info (wombo board)
wl0: Broadcom BCM4318 802.11 Wireless Controller 3.91.41.0
eth0 Link UP.
pSdramPHY=0xA0FFFFF8, 0x20000440 0x10000600
AdslCoreHwReset: AdslOemDataAddr = 0xA0FFB404
disable vlan
ip_tables: (C) 2000-2002 Netfilter core team
ip_conntrack version 2.1 (125 buckets, 0 max) - 368 bytes per conntrack
ip_conntrack_pptp version 2.1 loaded
ip_nat_pptp version 2.0 loaded
ip_conntrack_h323: init 
ip_nat_h323: initialize the module!
ip_conntrack_rtsp v0.01 loading
ip_nat_rtsp v0.01 loading
board_ioctl: boot complete!

# tftp -g  -f openwrt-RTA1025W_16-squashfs-cfe.bin -t i 192.168.1.17
kill process [pid: 440] [name: sshd]...
kill process [pid: 536] [name: mpd]...
kill process [pid: 550] [name: dproxy]...
kill process [pid: 350] [name: dhcpd]...
Done removing processes
Checking Image tag.....
User request image with tag 'RTA1025W_16' flash into board ID 'RTA1025W_16'
Allocating 2686988 bytes for broadcom image.
Memory allocated
Total image size: 2686980
Checking Image tag.....
User request image with tag 'RTA1025W_16' flash into board ID 'RTA1025W_16'

=== IMPORTANT ============================
  Use 'passwd' to set your login password
  this will disable telnet and enable SSH
------------------------------------------


BusyBox v1.15.3 (2010-11-11 23:54:31 PST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
Backfire (10.03.1-rc4, r24045) --------------------
  * 1/3 shot Kahlua    In a shot glass, layer Kahlua
  * 1/3 shot Bailey's  on the bottom, then Bailey's,
  * 1/3 shot Vodka     then Vodka.
---------------------------------------------------
root@OpenWrt:/#

root@OpenWrt:/# dmesg
Linux version 2.6.32.25 (openwrt@ampere) (gcc version 4.3.3 (GCC) ) #1 Fri Nov 19 21:51:29 PST 2010
Detected Broadcom 0x6348 CPU revision b0
CPU frequency is 240 MHz
16MB of RAM installed
registering 37 GPIOs
board_bcm963xx: CFE version: 1.0.37-0.6
bootconsole [early0] enabled
CPU revision is: 00029107 (Broadcom BCM6348)
board_bcm963xx: board name: RTA1025W_16
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00001000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00001000
On node 0 totalpages: 4096
free_area_init_node: node 0, pgdat 802981f0, node_mem_map 802df000
  Normal zone: 32 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 4064 pages, LIFO batch:0
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
PID hash table entries: 64 (order: -4, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes
Memory: 13284k/16384k available (2140k kernel code, 3100k reserved, 453k data, 140k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
Calibrating delay loop... 238.59 BogoMIPS (lpj=477184)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
pci 0000:00:01.0: reg 10 32bit mmio: [0x000000-0x001fff]
pci 0000:01:1e.0: CardBus bridge, secondary bus 0000:02
pci 0000:01:1e.0:   IO window: 0x8008000-0x80080ff
pci 0000:01:1e.0:   IO window: 0x8008400-0x80084ff
pci 0000:01:1e.0:   MEM window: 0x38000000-0x3fffffff
PCI: Enabling device 0000:01:1e.0 (0000 -> 0003)
PCI: Setting latency timer of device 0000:01:1e.0 to 64
Switching to clocksource MIPS
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:01.0 to 64
ssb: Core 0 found: ChipCommon (cc 0x800, rev 0x0D, vendor 0x4243)
ssb: Core 1 found: IEEE 802.11 (cc 0x812, rev 0x09, vendor 0x4243)
ssb: Core 2 found: PCI (cc 0x804, rev 0x0C, vendor 0x4243)
ssb: Core 3 found: PCMCIA (cc 0x80D, rev 0x07, vendor 0x4243)
ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
NET: Registered protocol family 1
audit: initializing netlink socket (disabled)
type=2000 audit(0.366:1): initialized
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  ?© 2001-2006 Red Hat, Inc.
msgmni has been set to 25
io scheduler noop registered
io scheduler deadline registered (default)
gpiodev: gpio device registered with major 254
gpiodev: gpio platform device registered with access mask FFFFFFFF
bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart
console [ttyS0] enabled, bootconsole disabled
bcm963xx_flash: 0x00400000 at 0x1fc00000
bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank
 CFI mfr 0x000000c2
 CFI id  0x000022a8
 Amd/Fujitsu Extended Query Table at 0x0040
  Amd/Fujitsu Extended Query version 1.1.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
bcm963xx_flash: Read Signature value of CFE1CFE1
bcm963xx_flash: CFE bootloader detected
bcm963xx_flash: CFE boot tag found with version 6 and board type RTA1025W_16
bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000
bcm963xx_flash: Partition 1 is kernel offset 10100 and length dff00
bcm963xx_flash: Partition 2 is rootfs offset f0000 and length 300000
bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000
bcm963xx_flash: Partition 4 is linux offset 10000 and length 3e0000
bcm963xx_flash: Spare partition is 2a0000 offset and length 150000
Creating 5 MTD partitions on "bcm963xx":
0x000000000000-0x000000010000 : "CFE"
0x000000010100-0x0000000f0000 : "kernel"
mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
0x0000000f0000-0x0000003f0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=2A0000, len=150000 
0x0000002a0000-0x0000003f0000 : "rootfs_data"
0x0000003f0000-0x000000400000 : "nvram"
0x000000010000-0x0000003f0000 : "linux"
bcm63xx_enet MII bus: probed
bcm63xx_wdt started, timer margin: 30 sec
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 140k freed
Please be patient, while OpenWrt loads ...
mini_fo: using base directory: /
mini_fo: using storage directory: /tmp/root
bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)]
eth1: link forced UP - 100/full - flow control off/off
device eth1 entered promiscuous mode
br-lan: port 1(eth1) entering forwarding state
Compat-wireless backport release: compat-wireless-2010-10-14-7-gab01eca
Backport based on wireless-testing.git master-2010-10-19
cfg80211: Calling CRDA to update world regulatory domain
cfg80211: World regulatory domain updated:
    (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
    (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
    (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
    (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
    (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
    (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
roboswitch: Probing device eth0: Failed to enable switch
roboswitch: Probing device eth1: Failed to enable switch
roboswitch: Probing device eth2: No such device
roboswitch: Probing device eth3: No such device
b43-phy0: Broadcom 4318 WLAN found (core revision 9)
ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
Registered led device: b43-phy0::tx
Registered led device: b43-phy0::rx
Registered led device: b43-phy0::radio
Broadcom 43xx driver loaded [ Features: PL, GPIO LED Mask: 0x000f, Firmware-ID: FW13 ]
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 24
nf_conntrack version 0.5.0 (209 buckets, 836 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
jffs2_build_filesystem(): unlocking the mtd device... done.
jffs2_build_filesystem(): erasing all blocks after the end marker... done.
mini_fo: using base directory: /
mini_fo: using storage directory: /overlay

root@OpenWrt:/# mtd -r erase nvram
Unlocking nvram ...
Erasing nvram ...
Rebooting ...

And still I am presented with the CFE waiting for an image to flash.

So erasing nvram seems to not work.

8 (edited by routednbooted 2011-02-20 05:16:58)

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

the problem is the cfe trying to protect you. I have had the same problem in the past luckily for me i was willing to brick my board by trying different bootloaders and i no longer use cfe, i hacked up a redboot.

the voyager 220v is based on a RTA1025, 8MB flash split as two 4MB, one primary image, one backup.

the problem goes like this,

you write firmware image to flash,
image header also gets written to flash,
header has checksum for fs image,
on boot, cfe checksums the image, compares checksum with the one in the header, if it matches cfe boots the image, if not it tries the other, if thats currupt or missing, it waits for you to load a new image,
openwrt has a marker to mark the end of the read only partition,
you boot openwrt,
openwrt finds this marker and replaces it, marking the beginning of the jffs2 writeable partition,
guess what,
image crc doesnt match the trx header anymore, cfe hates you.

i cant understand why openwrt offers these images when they are incompatible with the working of these cfe's

my post about this, https://forum.openwrt.org/viewtopic.php?id=25775

look here too https://forum.openwrt.org/viewtopic.php?pid=128492#p128492 in particular # mtd fixtrx linux

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

I think it is time the community "hacks up" a universal redboot - one that should even be included in the OpenWRT images for flashing. Where do we start?

10

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

OpenWrt / How to flash FON2100 with combined firmware

11 (edited by routednbooted 2011-02-20 15:37:05)

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

The redboot is quite different.

Without going into too much detail,

The seperate parts of the firmware have to be flashed seperate, kernel has its own partition, squashfs has a partition and then the rest of the flash is partitioned as 'rootfs_data' which openwrt assumes for jffs2. It works quite well. It supports tftp kernel booting, is very configurable, best of all it has a boot shell you can telnet into. The redboot source i have in my possession, could potentially support any router. Only problem being i have no knowledge of the bcm63xx memory initialization routine, the source i have has a binary blob for this particular job. I cut a compatible one from my original bootloader and hacked it in.

12 (edited by NetworkPro 2011-02-20 16:05:04)

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

Thank you fyi.

The Fon is with Atheros chips, right?

This microredboot mod is currently not supposed to work on Broadcom according to a post in that thread.

It is my opinion that we need to modify the CFE because Broadcom initialize the hardware on the board with it and It looks to me like we can't get rid of this. There are basically these challenges:

- 0. To have the CFE source code so we have full control over it therefore solving any future issues.
- 1. either use mtd fixtrx linux or patch CFE to get rid of this check
- 2. patch cfe to get rid of backup image to use full flash
- 3. make the patches work on different routers with different CFEs and versions.
- 4. make the patches easy, like uploading an "OpenWRT-first-step-patch-CFE.bin" first and then uploading the full OpenWRT image. Or even easier - uploading just one image through web.
- 5. make our own updated and latest and greatest CFE from the sources and stuff we have. Unify the new CFE - to use with routers that have custom sh!t like Thomson.

So far we have modified CFE by LinuxInside for DV201AMR http://wiki.openwrt.org/oldwiki/Hardware/Davolink/DV201AMR
and a backup of such CFE by RomMon http://rapidshare.com/files/448322148/cfe_flashable_gpl_fw.zip
+ python scripts that supposedly unpack and repack the CFE?  http://al.robotfuzz.com/~al/thomson/cfe-builder/

I can help with testing.
What can the more experienced point to? Thank you.

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

If you really want to get to grips with these things,

A guide to mips assembly language here: http://en.wikibooks.org/wiki/MIPS_Assembly

Theres some mips manuals i uploaded here: http://fruittool.fileave.com/

A mips tutorial: http://programmedlessons.org/AssemblyTutorial/

Might be worth a look: http://user.it.uu.se/~justin/Teaching/NewDarkSlides/

A mips dissasembler here: http://acade.au7.de/disasmips.htm this come in handy when i hacked up the thomson loader. The cfe binary is quite hard to deal with as its code cant be just disassembled, most of it has to be decompressed first.

Mipster:
"MIPSter is a text editor written specifically for the MIPS assembly language. It was designed to help college/university students who are taking MIPS programming classes."
http://www.downcastsystems.com/mipster/

Believe it or not i can actually understand assembly much easier than higher level languages like c. If i had all the data from broadcom i dont think id find it too hard to build a loader from scratch. I have proprietory headers that describe the registers and the data that needs to be written to them only problem being the order these writes need to go in, disassembling loaders sort of helps but then its about figuring out where the different routines start and end.

An example,
This is the routine that initializes the sdram for one of my devices. It tells the processor about the speed, command rate, size and width.
The mtc's and mfc's (move to coprocessor, move from coprocessor) commented # reserved are vendor registers, the ones that need documentation from broadcom to fully understand.
If you think this is madness the PLL initialization is about 10 times the size.

Hex           Assembly                     Comments

3c08fffe    lui    $t0,0xfffe        
35081200    ori    $t0,0x1200        # fffe1200
3c09fffe    lui    $t1,0xfffe        
352912a0    ori    $t1,0x12a0        # fffe12a0
240a00d0    move    $t2,208=0x00d0        
24020020    move    $v0,32=0x0020        
354a0a04    ori    $t2,0xa04        
3c010001    lui    $at,0x1            
34210003    ori    $at,0x3            # 10003 -> 504bc9a9
01415025    or    $t2,$at            
ad0a0004    sw    $t2,4($t0)        
240a0007    move    $t2,7            
ad2a0008    sw    $t2,8($t1)        
3c0a0007    lui    $t2,0x7            
354a54d9    ori    $t2,0x54d9        # 754d9
ad0a001c    sw    $t2,28($t0)        
240a0003    move    $t2,3            
ad0a0000    sw    $t2,0($t0)        
240a000b    move    $t2,11=0x000b        
ad0a0000    sw    $t2,0($t0)        
240a4002    move    $t2,16386=0x4002    
ad0a0010    sw    $t2,16($t0)        
240a0013    move    $t2,19=0x0013        
ad0a0000    sw    $t2,0($t0)        
240a0163    move    $t2,355=0x0163        
ad0a0010    sw    $t2,16($t0)        
240a0013    move    $t2,19=0x0013        
ad0a0000    sw    $t2,0($t0)        
00000000    nop                
00000000    nop                
00000000    nop                
240a000b    move    $t2,11=0x000b        
ad0a0000    sw    $t2,0($t0)        
340a840f    move    $t2,0x840f        
ad0a0008    sw    $t2,8($t0)        
240a0007    move    $t2,7            
ad0a0000    sw    $t2,0($t0)        
240a0007    move    $t2,7            
ad0a0000    sw    $t2,0($t0)        
240a0063    move    $t2,99=0x0063        
ad0a0010    sw    $t2,16($t0)        
240a0013    move    $t2,19=0x0013        
ad0a0000    sw    $t2,0($t0)        
3c0a7717    lui    $t2,0x7717        
ad2a0020    sw    $t2,32($t1)        
8d2a0018    lw    $t2,24($t1)        
000a5202    srl    $t2,8            
314a00ff    andi    $t2,0xff        
000a50c0    sll    $t2,3            
354a2000    ori    $t2,0x2000        
8d2b0028    lw    $t3,40($t1)        
356b7fff    ori    $t3,0x7fff        
396b7fff    xori    $t3,0x7fff        
016a5825    or    $t3,$t2            
ad2b0028    sw    $t3,40($t1)        
0f800574    jal    0xe0015d0        #
00000000    nop                
3c08ff41    lui    $t0,0xff41        
3c09fffe    lui    $t1,0xfffe        
352912a0    ori    $t1,0x12a0        # fffe12a0
240a0800    move    $t2,2048=0x0800        
240b0001    move    $t3,1            
8d0c0040    lw    $t4,64($t0)        # ff410040
000c6402    srl    $t4,16            
318c0041    andi    $t4,0x41        
24010040    move    $at,64=0x0040        
1181000b    beq    $t4,$at,144r        
00000000    nop                
316d07ff    andi    $t5,$t3,0x7ff        
3c017717    lui    $at,0x7717        
01a16825    or    $t5,$at            
ad2d0020    sw    $t5,32($t1)        
8d050040    lw    $a1,64($t0)        
216b0001    addi    $t3,1            
154bfff3    bne    $t2,$t3,104r        
00000000    nop                
10000018    beq    0,0,1a0r        
00000000    nop                
8d2a0020    lw    $t2,32($t1)        
314affff    andi    $t2,0xffff        
3c017137    lui    $at,0x7137        
01415025    or    $t2,$at            
ad2a0020    sw    $t2,32($t1)        
240a0010    move    $t2,16=0x0010        
ad0a0040    sw    $t2,64($t0)        
3c0a8000    lui    $t2,0x8000        
354a0090    ori    $t2,0x90        # 80000090
ad0a0040    sw    $t2,64($t0)        
3c0a8000    lui    $t2,0x8000        
354a0c90    ori    $t2,0xc90        # 80000c90
ad0a0040    sw    $t2,64($t0)        
8d0a0040    lw    $t2,64($t0)        
8d0a0040    lw    $t2,64($t0)        
8d0a0040    lw    $t2,64($t0)        
8d0a0040    lw    $t2,64($t0)        
8d0a0040    lw    $t2,64($t0)        
4009b005    mfc0    $t1,R22.5        # reserved
3c01efff    lui    $at,0xefff        
3421ffff    ori    $at,0xffff        # efffffff
01214824    and    $t1,$at            
4089b005    mtc0    $t1,R22.5        # reserved
3c09ff40    lui    $t1,0xff40        
8d2a001c    lw    $t2,28($t1)        # ff40001c
3c010200    lui    $at,0x200        
34210001    ori    $at,0x1            # 2000001
01415025    or    $t2,$at            
ad2a001c    sw    $t2,28($t1)        # ff40001c
3c0a1000    lui    $t2,0x1000        
ad2a0004    sw    $t2,4($t1)        # ff400004
8d2a0000    lw    $t2,0($t1)        # ff400000
354a0015    ori    $t2,0x15        
ad2a0000    sw    $t2,0($t1)        
8d2a0008    lw    $t2,8($t1)        
354a0015    ori    $t2,0x15        
ad2a0008    sw    $t2,8($t1)        
4009b000    mfc0    $t1,R22            # reserved
3c01ffdf    lui    $at,0xffdf        
3421ffff    ori    $at,0xffff        # ffdfffff
01214824    and    $t1,$at            
3c010002    lui    $at,0x2            
01214825    or    $t1,$at            
4089b000    mtc0    $t1,R22            # reserved
8fbf0000    lw    $ra,0($sp)        
23bd0004    addi    $sp,4

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

I have small disassembly experience. I have used IDA Pro and W32Dasm(patched) to find out that a Win32 soft is able to be unl... fixed by just including additional stuff in the .ini file.

IDA Pro presents the information neatly in blocks that are connected to each-other. Also there are string resources in Win32 binaries that make it easier to understand what are you looking at. I suspect for mips there aren't such helpers smile ?

15 (edited by NetworkPro 2011-02-21 12:41:07)

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

OK Now OpenWRT loads on startup

AND IT SAVED SOME SETTINGS !!!


root@OpenWrt:/# 
 === IMPORTANT ============================
  Use 'passwd' to set your login password
  this will disable telnet and enable SSH
 ------------------------------------------


BusyBox v1.17.3 (2011-02-20 20:39:24 EET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 ATTITUDE ADJUSTMENT (bleeding edge, r25616) ----------
  * 1/4 oz Vodka      Pour all ingredents into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------

root@OpenWrt:/# dmesg
Linux version 2.6.35.11 (compileuser@networkpro.compilebox) (gcc version 4.3.3 (GCC) ) #1 Sun Feb 20 21:06:25 EET 2011
Detected Broadcom 0x6348 CPU revision b0
CPU frequency is 240 MHz
16MB of RAM installed
registering 37 GPIOs
board_bcm963xx: CFE version: 1.0.37-0.6
bootconsole [early0] enabled
CPU revision is: 00029107 (Broadcom BCM6348)
board_bcm963xx: board name: RTA1025W_16
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00001000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00001000
On node 0 totalpages: 4096
free_area_init_node: node 0, pgdat 802823a0, node_mem_map 802d4000
  Normal zone: 32 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 4064 pages, LIFO batch:0
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
Kernel command line:  root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
PID hash table entries: 64 (order: -4, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes
Memory: 13328k/16384k available (2141k kernel code, 3056k reserved, 364k data, 160k init, 0k highmem)
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:128
Calibrating delay loop... 238.59 BogoMIPS (lpj=477184)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
pci 0000:00:01.0: reg 10: [mem 0x00000000-0x00001fff]
pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x30001fff]
pci 0000:00:01.0: BAR 0: set to [mem 0x30000000-0x30001fff] (PCI address [0x30000000-0x30001fff]
Switching to clocksource MIPS
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:01.0 to 64
ssb: Core 0 found: ChipCommon (cc 0x800, rev 0x0D, vendor 0x4243)
ssb: Core 1 found: IEEE 802.11 (cc 0x812, rev 0x09, vendor 0x4243)
ssb: Core 2 found: PCI (cc 0x804, rev 0x0C, vendor 0x4243)
ssb: Core 3 found: PCMCIA (cc 0x80D, rev 0x07, vendor 0x4243)
ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
PCI: CLS 0 bytes, default 32
audit: initializing netlink socket (disabled)
type=2000 audit(0.352:1): initialized
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 26
io scheduler noop registered
io scheduler deadline registered (default)
gpiodev: gpio device registered with major 254
bcm963xx_flash: 0x00400000 at 0x1fc00000
bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank
 CFI mfr 0x000000c2
 CFI id  0x000022a8
Amd/Fujitsu Extended Query Table at 0x0040
  Amd/Fujitsu Extended Query version 1.1.
number of CFI chips: 1
bcm963xx_flash: Read Signature value of CFE1CFE1
bcm963xx_flash: CFE bootloader detected
bcm963xx_flash: CFE boot tag found with version 6 and board type RTA1025W_16
bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000
bcm963xx_flash: Partition 1 is kernel offset 10100 and length dff00
bcm963xx_flash: Partition 2 is rootfs offset f0000 and length 300000
bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000
bcm963xx_flash: Partition 4 is linux offset 10000 and length 3e0000
bcm963xx_flash: Spare partition is 270000 offset and length 180000
Creating 5 MTD partitions on "bcm963xx":
0x000000000000-0x000000010000 : "CFE"
0x000000010100-0x0000000f0000 : "kernel"
mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
0x0000000f0000-0x0000003f0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=260000, len=190000 
0x000000260000-0x0000003f0000 : "rootfs_data"
0x0000003f0000-0x000000400000 : "nvram"
0x000000010000-0x0000003f0000 : "linux"
bcm63xx_enet MII bus: probed
bcm63xx_wdt started, timer margin: 30 sec
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech>
All bugs added by David S. Miller <davem@redhat>
turn off boot console early0
Please be patient, while OpenWrt loads ...
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 160k freed
eth1: link forced UP - 100/full - flow control off/off
roboswitch: Probing device eth0: 
roboswitch: [/home/compileuser/trunk/build_dir/linux-brcm63xx/kmod-switch/switch-robo.c:125] SIOCGETCPHYRD failed!
roboswitch: [/home/compileuser/trunk/build_dir/linux-brcm63xx/kmod-switch/switch-robo.c:125] SIOCGETCPHYRD failed!
No Robo switch in managed mode found, phy_id = 0xffffffff
roboswitch: Probing device eth1: Failed to enable switch
roboswitch: Probing device eth2: No such device
roboswitch: Probing device eth3: No such device
mini_fo: using base directory: /
mini_fo: using storage directory: /overlay
bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)]
eth1: link forced UP - 100/full - flow control off/off
device eth1 entered promiscuous mode
br-lan: port 1(eth1) entering forwarding state
br-lan: port 1(eth1) entering forwarding state
There is already a switch registered on the device 'eth0'
roboswitch: Probing device eth1: Failed to enable switch
roboswitch: Probing device eth2: No such device
roboswitch: Probing device eth3: No such device
wl: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
Got version 2 SPROM from SSB
wl0: Broadcom BCM4318 802.11 Wireless Controller 5.10.56.27
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 24
nf_conntrack version 0.5.0 (210 buckets, 840 max)
device wl0 entered promiscuous mode
br-lan: port 2(wl0) entering forwarding state
br-lan: port 2(wl0) entering forwarding state
root@OpenWrt:/#

BWAHAHAHA SUCCESS >:) !!

16 (edited by routednbooted 2011-02-20 21:10:21)

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

NetworkPro wrote:

IDA Pro presents the information neatly in blocks that are connected to each-other. Also there are string resources in Win32 binaries that make it easier to understand what are you looking at. I suspect for mips there aren't such helpers smile ?

Not that i know of. It would be nice if the more experienced so called experts would share what they know. But i think they see it from the point of view, why should they share their paid for education with the likes of us who have the initiative to learn things for ourselves and not pay some dude to beat it into us with a book.

I cant see that your image has prepared the jffs2 for the overlay.

17 (edited by NetworkPro 2011-02-21 01:06:09)

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

Where can this be learned ? In what college, university or class ? This is street-smarts here. smile

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

Any progress/status update on this?
I'd be very very interested in getting this working on my RTA1025w. Any info on how you managed it if its working correctly?

19 (edited by NetworkPro 2011-03-12 11:43:39)

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

yes https://forum.openwrt.org/viewtopic.php?id=28573

tut: http://translate.google.com/translate?j … pic%3D2985

20 (edited by eXDee 2011-03-20 11:57:11)

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

Sweet.
I see ADSL does not work. Anything else not functioning?

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

By the way there is new stock firmware for RTA1025W_16

Wireless ADSL2+ Router RTA1025WBTC_D29
Software Version: ZXDSL 531BIIV5.1.0a_B09_BG
Login name: root
Password: warmWLspot
> sh


BusyBox v1.00 (2008.07.24-07:47+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# dmesg
Linux version 2.6.8.1 ( Compiled by lourel_cao) (gcc version 3.4.2) #1 Thu Jul 24 15:44:43 CST 2008
Flash Config: CS0(1fc00009,1f),Base(bfc00000),Size(4MB)
Parallel flash device: name AM29LV320MB, id 0x2200, size 4096KB
using old scheme mem size is 16 Mbytes
CPU revision is: 00029107
Determined physical RAM map:
 memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
  DMA zone: 4000 pages, LIFO batch:1
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB 2-way, linesize 16 bytes.
PID hash table entries: 64 (order 6: 512 bytes)
Using 120.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 13896k/16000k available (1468k kernel code, 2084k reserved, 211k data, 72k init, 0k highmem)
KLOB Pool 1 Initialized: 1048576 bytes <0x80e00000 ... 0x80f00000>
Calibrating delay loop... 239.20 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction...  unavailable.
NET: Registered protocol family 16
Total Flash size: 4096K with 71 sectors, flash base bfc00000
using old scheme mem size is 16 Mbytes
Can't analyze prologue code at 8017da94
Initializing Cryptographic API
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v1.0
rootfs_addr 0bfc10100
No BinFs
brcmboard: brcm_board_init entry
using old scheme mem size is 16 Mbytes
Serial number:
Serial: BCM63XX driver $Revision: 1.1.1.1 $
ttyS0 at MMIO 0xfffe0300 (irq = 10) is a BCM63XX
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
Initializing IPsec netlink socket
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
NET: Registered protocol family 8
NET: Registered protocol family 20
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 72k freed
Algorithmics/MIPS FPU Emulator v1.5
atmapi: module license 'Proprietary' taints kernel.
adsl: adsl_init entry
blaadd: blaa_detect entry
Broadcom BCMPROCFS v1.0 initialized
External Switch Mode 00007547 !!
Broadcom BCM6348B0 Ethernet Network Device v0.3 Jul 24 2008 15:43:29
Config Ethernet Switch Through SPI Slave Select 0
dgasp: kerSysRegisterDyingGaspHandler: eth0 registered
eth0: MAC Address: 00:15:EB:E5:73:4C
eth0 Link UP.
PCI: Setting latency timer of device 0000:00:01.0 to 64
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
wl: srom not detected, using main memory mapped srom info (wombo board)
wl0: wlc_attach: use mac addr from the system pool by id: 0x776c0000
wl0: MAC Address: 00:15:EB:E5:73:4D
wl0: Broadcom BCM4318 802.11 Wireless Controller 4.150.10.5.cpe2.0
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
BcmAdsl_Initialize=0xC005E878, g_pFnNotifyCallback=0xC0077E44
AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00003981 adsl2=0x00000000
pSdramPHY=0xA0FFFFF8, 0x3333CCCC 0x3333CCCE
AdslCoreHwReset: AdslOemDataAddr = 0xA0FFB114
AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00003981 adsl2=0x00000000
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
ATM proc init !!!
eth0.2: MAC Address: 00:15:EB:E5:73:4C
eth0.3: MAC Address: 00:15:EB:E5:73:4C
eth0.4: MAC Address: 00:15:EB:E5:73:4C
eth0.5: MAC Address: 00:15:EB:E5:73:4C
ip_tables: (C) 2000-2002 Netfilter core team
ip_conntrack version 2.1 (125 buckets, 0 max) - 368 bytes per conntrack
ip_conntrack_pptp version 2.1 loaded
ip_nat_pptp version 2.0 loaded
KLOB extended to 2 pools
ip_ct_h323: init success
ip_nat_h323: init success
BRCM NAT Caching v0.1 Jul  3 2007 10:16:19
BRCM NAT Cache: Hooking hit function @ c005bc48
ip_conntrack_rtsp v0.01 loading
ip_nat_rtsp v0.01 loading
board_ioctl: boot complete!

Does OpenWRT trunk have "BRCM NAT Cache" capability and if not - what is the reason to not have it. If yes - what was necessary to make it work? Thanks.

You can download stock ISP customised images here: http://stream-tst.ru/component/option,com_fireboard/Itemid,29/func,view/id,13/catid,13#13

Regards

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

2 NetworkPro :

Hello! I'm working around making RTA1025W-16 modem into Ethernet router (with ethernet WAN port). After installing OpenWrt I've inoperational LEDs on front panel, RESET button, and external switch (bcm5325) in bridge (no VLANs) mode. There is no information in /proc/cpuinfo and others. Is there any applicable driver for bcm6348 CPU to make useful all features?

Does somebody force to work switch in VLAN mode on this model?

Thanks!

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

Hello,

OpenWRT's Florian told me I should expect a new broadcom switch patch soon. Until then - the switch is in full bridge mode without vlans unless you make your own patch and compile?

What info do you expect in /proc/cpuinfo similar places? If you show what is wrong exactly - maybe at least OpenWRT devs would have some idea what to patch.

Regards.

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

With original firmware :

CONSOLED launched

Login name: admin
Password:
> sh


BusyBox v1.00 (2009.05.22-03:00+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# cat /proc/cpuinfo

system type             : RTA1025W_16
processor               : 0
cpu model               : BCM6348 V0.7
BogoMIPS                : 239.20
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : no
unaligned access                : 21
VCED exceptions         : not available
VCEI exceptions         : not available
#

In OpenWrt :

awk: /proc/cpuinfo: No such file or directory

Please see https://dev.openwrt.org/ticket/12222

Regards

Re: RTA1025W (ZXDSL531B /brcm63xx/) back to boot loader after cold restart

Thank you submitting the Ticket.

If testing is needed - provide details what traffic in what direction and what to look for if working/broken and I may be able to test during the weekend.

Regards.