OpenWrt Forum Archive

Topic: Zyxel P-2812HNU-F1 NOTBranded:/mnt/Config/user-startup-parameters.sh

The content of this topic has been archived on 17 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Post #1
oxo
25 Oct 2013, 08:55

Given root, obtain control of yr router with user_startup_parameters.sh

"Wireless Freedom" - at least in the "confines" of the compiled firware, but better than nothing.

Firmware Version:    V3.11(TUJ.0)
A dropbox of a modified  fwupgrade_erase_write.sh with  (zboot+kernel/rootfs) files

https://www.dropbox.com/sh/eywont3uni0r8gw/-Wwe6MCudj
Plus bootloader thanks to cornelus2000

/mnt/NAND/script/init.d/rcS2, from firmware:

if [ -e /mnt/Config/user_startup_parameters.sh ]; then
sh /mnt/Config/user_startup_parameters.sh
fi

/mnt/Config/user_startup_parameters.sh, vi your own script:

#!/bin/sh
# starting in own sh
while  [ ! -e /var/mnt/usb/sda1/user_startup/user_startup.sh ]; do
        sleep 10
done
. /var/mnt/usb/sda1/user_startup/user_startup.sh

Firmware: V3.11(TUJ.0) on a "not branded" router

Root access : http://p2812.blogspot.dk/p/how-to-get-root.html

or easy get root method
Use for ping:

;telnetd -p 24 -l /bin/sh;
# telnet router.home 24
Entering character mode
Escape character is '^]'.
# whoami
root
#

(Last edited by oxo on 29 Oct 2013, 09:38)

Post #2
oxo
25 Oct 2013, 15:10

Debug flag set from # ..!!

# atec
number of arguments is not incorrect
# atec 1 1
write to flash
# atsh
ZLD   Version          : V3.11(TUJ.0)
Bootbase Version       : V3.04|04/01|2011(TUJ)
Vender Name            : ZyXEL Communications Corp.
Product Model          : P-2812HNU-F1
Serial Number          : S120Y27044724
First MAC Address      : B0B2DC975CC0
Last MAC Address       : B0B2DC975CC7
MAC Address Quantity   : 08
Default Country Code   : 01
Boot Module Debug Flag : 01
RootFS      Checksum   : 0000c2ac
Kernel      Checksum   : 000072d4
RomFile     Checksum   : 00003b4f
Main Feature Bits      : 00
Other Feature Bits     :
          06 00 00 04 19 01 00 ff-f8 00 01 00 01 00 00 00
          00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
# more /etc/zyfwupgrade
VendorName              ZyXEL Communications Corp.
ProductName             P-2812HNU-F1
EtherAddr               B0B2DC975CC0
LastEtherAddr           B0B2DC975CC7
EtherAddrQuantity       08
CountryCode             00FD
SerialNumber            S120Y27044724

MainFeatureBits         00
FeatureBits             06000004190100fff80001000100000000000000000000000000000000000000



# The following items are Feature Bits

ModelID                 06000004
DualIM                  1
FullFunc                1
SupportDeviceTree       0
MergedRAS               1
DoubleMrdCert           1

FlashNum                1
MaxFullImageUgcount     00fff800
EngDebugFlag            01
EmbedFlag               0
CheckingFlag            1

boot prompt atse gives a seed to unlock other stuff

(doesn't work via shell and I haven't put on a cable to router yet)

http://www.inventec.ch/chdh/notes/5.htm

Cause: Some of the debug-mode AT-commands are protected and must be enabled using a randomly generated password.

Solution: Use the "ATSE" command to display the seed of the password generator. Compute the password and enter the password with the command "ATEN 1,password". After that, "ATHE" (help) will include the protected commands in the list.

The following formula can be used to compute the password:

a = first 3 bytes of seed value
b = a + 0x10F0A563
c = (last byte of seed value) AND 7
password = (b ROR c)  XOR a

Note: ROR is a 32-bit rotate-right operation.

http://www.adslayuda.com/Zyxel650-actua … mware.html

http://www.hot.ee/xiios/zyxel/keygen/zyxel.cc

#define CURVER "1.1"
#define CURDAT "01.09.2004"
#define OLDVER "01.09.2004 - 1.0\n"\
               "10.02.2004 - 1.0 beta"
#define BANNER (\
    "+----------------------------------------------+\n"\
    "| A password generator for some ZyXEL hardware |\n"\
    "|                                              |\n"\
    "| "CURDAT"          "CURVER"         xiios@hot.ee |\n"\
    "+----------------------------------------------+\n")
#define FORMAT "Usage: zyxel <seed>"


#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <ctype.h>



/* constants & variables */
const char *hexa = "0123456789ABCDEF";
char input[256];
int s1, s2, a, b, c, p,
    slen, bsym;



void term (int i)
{
    printf ("Press ENTER to terminate...\n");
    getc (stdin);
    while (getc (stdin) != '\n');
    _exit (i);
}

/* quit with an appropriate message */
void quit (int code)
{
    switch (code)
    {
        /* normal quit */
        case 0:
            printf ("\nThe password is: %X\n\n", p);
            term (0);

        /* errors */
        case 1:
            printf ("\n"
                    "ERROR: Missing argument.\n"
                    "       Give me a seed value.\n\n"
                    "%s\n\n", FORMAT);
            term (1);
        case 2:
            printf ("\n"
                    "ERROR: Bad seed length (%d).\n"
                    "       Give me 12 characters.\n\n"
                    "%s\n\n", slen, FORMAT);
            term (2);
        case 3:
            printf ("\n"
                    "ERROR: Bad symbol (letter #%d) in seed.\n"
                    "       Give me characters %s only.\n\n"
                    "%s\n\n", bsym, hexa, FORMAT);
            term (3);
        case 4:
            printf ("\n"
                    "%s\n\n"
                    "When you\'ve connected to your ZyXEL device using\n"
                    "a RS232->RS422 cable and entered the debug mode,\n"
                    "the command ATSE gives you a seed. This program\n"
                    "calculates the password which you need in order\n"
                    "to change the BootExtension Debug Flag to 1:\n\n"
                    "\tATEN1,password\n\n"
                    "Version history:\n"
                    "%s\n\n", FORMAT, OLDVER);
            term (0);
    }
}

/* convert a hex string to bin int */
int tobin (char *str, char *end)
{
    int mlt = 1,
        bin = 0;
    for (char *chr = (end - 1); chr >= str; chr--)
    {
        if (islower (*chr))
            *chr -= ('a' - 'A');
        if (!strchr (hexa, *chr))
        {
            bsym = (chr - input + 1);
            quit (3); // bad seed contents
        }
        bin += ((strchr (hexa, *chr) - hexa) * mlt);
        mlt *= 16;
    }
    return bin;
}



int main (int argc, char **argv)
{
    printf ("\n%s", BANNER);

    memset (input, 0, 13);

    /* check argument */
    argv++;
    argc--;
    if (!argc)
    {
        printf ("\nEnter a seed value\n"
                "   or type --help: ");
        scanf ("%s", input);
    }
    else
        strcpy (input, argv[0]);
    if (!strlen (input))
        quit (1); // missing argument

    /* help */
    if (!strcmp (input, "--help") || !strcmp (input, "/h"))
        quit (4);

    char *chr;

    /* get seed from argument skipping leading 0x if present */
    if ((input[0] == '0') && input[1] && strchr ("xX", input[1]))
        chr = &input[2];
    else
        chr = &input[0];
    if ((slen = strlen (chr)) != 12)
        quit (2); // bad seed length
    strcpy (input, chr);

    /* convert parts of hex string seed to bin ints s1 and s2 */
    chr = strchr (input, 0);
    s2 = tobin (chr - 2, chr);
    chr = input + 6;
    s1 = tobin (chr - 6, chr);

    /* FORMULA: ****************************
       a = first 3 bytes of seed value
       b = a + 0x10F0A563
       c = (last byte of seed value) AND 7
       password = (b ROR c) XOR a
     ***************************************/
    a = s1;
    b = a + 0x10F0A563;
    c = s2 & 7;
    p = ((b >> c) | (b << (32 - c))) ^ a;

    quit (0);
}

(Last edited by oxo on 29 Oct 2013, 09:38)

Post #3
oxo
26 Oct 2013, 07:40

Debug flag set from # ..!!

# atec
number of arguments is not incorrect
# atec 1 1
write to flash
# atsh
ZLD   Version          : V3.11(TUJ.0)
Bootbase Version       : V3.04|04/01|2011(TUJ)
Vender Name            : ZyXEL Communications Corp.
Product Model          : P-2812HNU-F1
Serial Number          : S120Y27044724
First MAC Address      : B0B2DC975CC0
Last MAC Address       : B0B2DC975CC7
MAC Address Quantity   : 08
Default Country Code   : 01
Boot Module Debug Flag : 01
RootFS      Checksum   : 0000c2ac
Kernel      Checksum   : 000072d4
RomFile     Checksum   : 00003b4f
Main Feature Bits      : 00
Other Feature Bits     :
          06 00 00 04 19 01 00 ff-f8 00 01 00 01 00 00 00
          00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
# more /etc/zyfwupgrade
VendorName              ZyXEL Communications Corp.
ProductName             P-2812HNU-F1
EtherAddr               B0B2DC975CC0
LastEtherAddr           B0B2DC975CC7
EtherAddrQuantity       08
CountryCode             00FD
SerialNumber            S120Y27044724

MainFeatureBits         00
FeatureBits             06000004190100fff80001000100000000000000000000000000000000000000



# The following items are Feature Bits

ModelID                 06000004
DualIM                  1
FullFunc                1
SupportDeviceTree       0
MergedRAS               1
DoubleMrdCert           1

FlashNum                1
MaxFullImageUgcount     00fff800
EngDebugFlag            01
EmbedFlag               0
CheckingFlag            1

boot prompt atse gives a seed to unlock other stuff

(doesn't work via shell and I haven't put on a cable to router yet)

http://www.inventec.ch/chdh/notes/5.htm

Cause: Some of the debug-mode AT-commands are protected and must be enabled using a randomly generated password.

Solution: Use the "ATSE" command to display the seed of the password generator. Compute the password and enter the password with the command "ATEN 1,password". After that, "ATHE" (help) will include the protected commands in the list.

The following formula can be used to compute the password:

a = first 3 bytes of seed value
b = a + 0x10F0A563
c = (last byte of seed value) AND 7
password = (b ROR c)  XOR a

Note: ROR is a 32-bit rotate-right operation.

http://www.adslayuda.com/Zyxel650-actua … mware.html

http://www.hot.ee/xiios/zyxel/keygen/zyxel.cc

#define CURVER "1.1"
#define CURDAT "01.09.2004"
#define OLDVER "01.09.2004 - 1.0\n"\
               "10.02.2004 - 1.0 beta"
#define BANNER (\
    "+----------------------------------------------+\n"\
    "| A password generator for some ZyXEL hardware |\n"\
    "|                                              |\n"\
    "| "CURDAT"          "CURVER"         xiios@hot.ee |\n"\
    "+----------------------------------------------+\n")
#define FORMAT "Usage: zyxel <seed>"


#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <ctype.h>



/* constants & variables */
const char *hexa = "0123456789ABCDEF";
char input[256];
int s1, s2, a, b, c, p,
    slen, bsym;



void term (int i)
{
    printf ("Press ENTER to terminate...\n");
    getc (stdin);
    while (getc (stdin) != '\n');
    _exit (i);
}

/* quit with an appropriate message */
void quit (int code)
{
    switch (code)
    {
        /* normal quit */
        case 0:
            printf ("\nThe password is: %X\n\n", p);
            term (0);

        /* errors */
        case 1:
            printf ("\n"
                    "ERROR: Missing argument.\n"
                    "       Give me a seed value.\n\n"
                    "%s\n\n", FORMAT);
            term (1);
        case 2:
            printf ("\n"
                    "ERROR: Bad seed length (%d).\n"
                    "       Give me 12 characters.\n\n"
                    "%s\n\n", slen, FORMAT);
            term (2);
        case 3:
            printf ("\n"
                    "ERROR: Bad symbol (letter #%d) in seed.\n"
                    "       Give me characters %s only.\n\n"
                    "%s\n\n", bsym, hexa, FORMAT);
            term (3);
        case 4:
            printf ("\n"
                    "%s\n\n"
                    "When you\'ve connected to your ZyXEL device using\n"
                    "a RS232->RS422 cable and entered the debug mode,\n"
                    "the command ATSE gives you a seed. This program\n"
                    "calculates the password which you need in order\n"
                    "to change the BootExtension Debug Flag to 1:\n\n"
                    "\tATEN1,password\n\n"
                    "Version history:\n"
                    "%s\n\n", FORMAT, OLDVER);
            term (0);
    }
}

/* convert a hex string to bin int */
int tobin (char *str, char *end)
{
    int mlt = 1,
        bin = 0;
    for (char *chr = (end - 1); chr >= str; chr--)
    {
        if (islower (*chr))
            *chr -= ('a' - 'A');
        if (!strchr (hexa, *chr))
        {
            bsym = (chr - input + 1);
            quit (3); // bad seed contents
        }
        bin += ((strchr (hexa, *chr) - hexa) * mlt);
        mlt *= 16;
    }
    return bin;
}



int main (int argc, char **argv)
{
    printf ("\n%s", BANNER);

    memset (input, 0, 13);

    /* check argument */
    argv++;
    argc--;
    if (!argc)
    {
        printf ("\nEnter a seed value\n"
                "   or type --help: ");
        scanf ("%s", input);
    }
    else
        strcpy (input, argv[0]);
    if (!strlen (input))
        quit (1); // missing argument

    /* help */
    if (!strcmp (input, "--help") || !strcmp (input, "/h"))
        quit (4);

    char *chr;

    /* get seed from argument skipping leading 0x if present */
    if ((input[0] == '0') && input[1] && strchr ("xX", input[1]))
        chr = &input[2];
    else
        chr = &input[0];
    if ((slen = strlen (chr)) != 12)
        quit (2); // bad seed length
    strcpy (input, chr);

    /* convert parts of hex string seed to bin ints s1 and s2 */
    chr = strchr (input, 0);
    s2 = tobin (chr - 2, chr);
    chr = input + 6;
    s1 = tobin (chr - 6, chr);

    /* FORMULA: ****************************
       a = first 3 bytes of seed value
       b = a + 0x10F0A563
       c = (last byte of seed value) AND 7
       password = (b ROR c) XOR a
     ***************************************/
    a = s1;
    b = a + 0x10F0A563;
    c = s2 & 7;
    p = ((b >> c) | (b << (32 - c))) ^ a;

    quit (0);
}

(Last edited by oxo on 29 Oct 2013, 09:35)

Post #4
oxo
26 Oct 2013, 10:00

Blanked out for another post

(Last edited by oxo on 29 Oct 2013, 09:36)

Post #5
asmartin
19 Nov 2013, 23:42

Hello everybody.

My name is Alex from Spain (also known as asmartin in some forums).

I recently adquired a P-2812HNU-F1 but it's branded with firmware from any ISP (seems to be Radik from Netherlands).

I would like to recover original zyxel firm.

Is it possible to load the bootloader by this procedure:

http://www.dslreports.com/forum/r265770 … e-recovery ?

I have serial cable to connect by teraterm. I tried to upload bin file with AT command but bootloader seems to be trucked, because it requests me for ATSE command before ATEN but with argument

ATSE x

No argument available for ATSE, so I feel force to upload first bootloader and then .bin file by serial cable.

Any advertise will be welcome.

Thanks in advance.

Regards

(Last edited by asmartin on 20 Nov 2013, 00:49)

Post #6
asmartin
20 Nov 2013, 17:23

Hi ALL.

This is my starting message:

ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK

ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
DDR Access auto data-eye tuning Rev 0.3a
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...



ZyU-F02-300-20AA003-V3.05|11/07|2011(TUJ)

CLOCK CPU 500M RAM 250M
DRAM:  128 MB

 relocate_code start
 relocate_code finish.
128 MiB
*** Warning - bad CRC or NAND, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   fw_addr=0xa0200000
Internal phy(GE) firmware version: 0x0405
vr9 Switch
Hit any key to stop autoboot:  0

NAND read: device 0 offset 116736, size 65536 ...  65536 bytes read: OK
## Starting application at 0x86A80000 ...


Z-LOADER 3.0(Nov  7 2011)

NAND flash block size: 0x20000
Dual image: Both OK! upgcnt1=0 upgcnt2=1
Select 2nd zboot image...
go 0x86a90000
## Starting application at 0x86A90000 ...


Z-Boot 3.0.0(Sep 15 2011)

we get zloader version: 3.0
Hit any key to stop autoboot: 3
ZHAL>

Please observe the line where you can read bad CRC. Seems somewhere tried to upload wrong image fiel.

*** Warning - bad CRC or NAND, using default environment

I think it should be easy to repair, just uploading the right image, but ... I can't access to ATUR command because I need to activate with ATEN the debug mode, but I cannot activate with ATEN because it request me for ATSE command before

ZHAL> ATHE
ATBT    x         block0 write enable (1=enable, 0=disable)
ATWM    x         set MAC address in working buffer
ATEN    x,(y)     set BootExtension Debug Flag (y=password)
ATSE    x          show the seed of password generator
ATWZ    a(,b,c)   write ZyXEL MAC addr, Country code, EngDbgFlag
ATCB              copy from FLASH ROM to working buffer
ATCL              clear working buffer
ATSB              save working buffer to FLASH ROM
ATBU              dump manufacturer related data in working buffer
ATSH              dump manufacturer related data in ROM
ATCO    x         set country code in working buffer
ATFL    x         set EngDebugFlag in working buffer
ATVD    x         set vendor name in working buffer
ATPN    x         set product name in working buffer
ATFE    x,y,...   set feature bits in working buffer
ATSN    x         set serial number in FLASH ROM
ATTL              MRD_CERT & ROM-D partition utility
ATGO              boot up whole system
ATGU              go back to U-Boot command line mode
ATRT    (x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations
ATMI    x         Enable/Disable model ID checking (1=enable, 0=disable)
ATUR    x         upgrade RAS image (filename)
ATUB    x         upgrade ZyU-Boot image (filename)
ZHAL> ATEN 1,10F0A563
please run atse first
ZHAL> ATSE
num of argument is incorrect
ZHAL>

And finally I don't know which ATSE argument I have to use.

If I log to Z-Loader I obtain the following message:

ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK

ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
DDR Access auto data-eye tuning Rev 0.3a
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...



ZyU-F02-300-20AA003-V3.05|11/07|2011(TUJ)

CLOCK CPU 500M RAM 250M
DRAM:  128 MB

 relocate_code start
 relocate_code finish.
128 MiB
*** Warning - bad CRC or NAND, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   fw_addr=0xa0200000
Internal phy(GE) firmware version: 0x0405
vr9 Switch
Hit any key to stop autoboot:  0

NAND read: device 0 offset 116736, size 65536 ...  65536 bytes read: OK
## Starting application at 0x86A80000 ...


Z-LOADER 3.0(Nov  7 2011)

NAND flash block size: 0x20000
ZLO> help
ZLGO              boot up the whole system
ZLGU              go back to U-Boot command line
ZLUA    x         upgrade ras image (whole image)
ZLUP    x         upgrade ras image (zboot+kernel+rootfs)
ZLO>

I just want to repair this router but ...

Is this bootbase ( ZyU-F02-300-20AA003-V3.05|11/07|2011(TUJ) )suitable for official zyxel image ( 3.11(TUJ.0)C0 )?

How can I load most recent image ( 311TUJ0C0.bin )?, maybe with ZLUA command?, and if so, what argument x I have to use?

Any kind user may help me?

(Last edited by asmartin on 20 Nov 2013, 19:49)

Post #7
asmartin
20 Nov 2013, 19:43

Well, finally I uploaded firmware 311TUJ0C0.bin by ZLUA command, but cannot find drivers when booting. Probably due to the version of bootbase (3.05).

I need a full image of this router to uploadwith same command.

(Last edited by asmartin on 20 Nov 2013, 19:49)

Post #8
oxo
20 Nov 2013, 22:17
asmartin wrote:
*** Warning - bad CRC or NAND, using default environment

The warning seems to be usual https://forum.openwrt.org/viewtopic.php … 16#p214216

At the moment, bricked 2812's seem to be the result of trying to change branded to not branded https://forum.openwrt.org/viewtopic.php … 79#p216679

There may be progress at some stage in Openwrt on p2812, but it might take time and maybe on just unbranded units but who knows.

Any progress with 2812 requires time and knowledge : the source code for the F1 and F3 units are available, as is openwrt smile
https://www.dropbox.com/sh/eywont3uni0r8gw/-Wwe6MCudj

Bottom line is probably to get another router that is supported by Openwrt if you do not have time and have a need for something that Openwrt offers.

(Last edited by oxo on 20 Nov 2013, 22:26)

Post #9
cornelus2009
21 Nov 2013, 06:22

The image from zyxel downloads , needs to be uploaded with zlup command, not zlua. Used that command i,m affraid u erased other important partitions as mrdcert1, 2. Try execute zlup with firmware from zyxel.

Post #10
asmartin
21 Nov 2013, 08:39

Hi ALL.

@OXO:

Thanks for your advice, but I just try to recover this bricked router because I want to change my vodafone IAD to this other.

Anyway, I found an interesting link to the problem of bad CRC or NAND: http://www.denx.de/wiki/view/DULG/Warni … nvironment

Now the question is how to obtain a whole image from ZyXEL to recover original zyxel functionality. I need also VoIP support and OpenWRT does not support this stuff :S .

@cornelus2009:

I think you are right, but I obtained same results with both commands. First I executed ZLUP with 311TUJ0C0.bin, and later with ZLUA. That's why I need a whole image.

I don't know mapping of partitions to bootbase and firm files, but I think these drivers are located in the bootbase file, and my bootbase is 3.05 instead of 3.04 that was made to support 3.11(TUJ.0)C0.


I already requested the whole image to ZyXEL (UK), and if they are kind enough, I will receive it soon.

Thanks for your help and support.

(Last edited by asmartin on 21 Nov 2013, 08:46)

Post #11
asmartin
21 Nov 2013, 23:51

Still waiting for ZyXEL (UK) to reply to my email. No whoe image by now.

But I uploaded 311TUJ0C0.bin file with ZLUP, and still same result.

Booting sequence is


ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK

ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
DDR Access auto data-eye tuning Rev 0.3a
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...



ZyU-F02-300-20AA003-V3.05|11/07|2011(TUJ)

CLOCK CPU 500M RAM 250M
DRAM:  128 MB

 relocate_code start
 relocate_code finish.
128 MiB
*** Warning - bad CRC or NAND, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   fw_addr=0xa0200000
Internal phy(GE) firmware version: 0x0405
vr9 Switch
Hit any key to stop autoboot:  0

NAND read: device 0 offset 116736, size 65536 ...  65536 bytes read: OK
## Starting application at 0x86A80000 ...


Z-LOADER 3.0(Nov  7 2011)

NAND flash block size: 0x20000
Dual image: Both OK! upgcnt1=4 upgcnt2=5
Select 2nd zboot image...
go 0x86a90000
## Starting application at 0x86A90000 ...


Z-Boot 3.0.0(Sep 15 2011)

we get zloader version: 3.0
Hit any key to stop autoboot: 0
ROM-D check=0
MRD_CERT_1 check=0
MRD_CERT_2 check=0


 Read Kernel to RAM from 2f11000
bootargs=root=/dev/mtdblock1 console=ttyS0,115200 phym=128M mem=126M panic=1 vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=1
## Booting image at 80800000 ...
   Image Name:   MIPS Linux-2.6.20
   Created:      2011-09-19  12:23:19 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1283659 Bytes =  1.2 MB
   Load Address: 80002000
   Entry Point:  803a5000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 803a5000) ...
## Giving linux memsize in MB, 128

Starting kernel ...

Infineon xDSL CPE VR9
mips_hpt_frequency = 250000000, counter_resolution = 2
Linux version 2.6.20.19
 (tommy@holyBuild) (gcc version 4.3.3 (GCC) ) #28 Mon Sep 19 20:23:07 CST 2011
phym = 08000000, mem = 07e00000, max_pfn = 00007e00
Reserving memory for CP1 @0xa7e00000, size 0x00200000
CPU revision is: 00019556
Determined physical RAM map:
User-defined physical RAM map:
 memory: 07e00000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists.  Total pages: 32004
Kernel command line: root=/dev/mtdblock1 console=ttyS0,115200 phym=128M mem=126M panic=1 vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=1
1 MIPSR2 register sets available
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
Lantiq ICU driver, version 3.0.1, (c) 2001-2010 Lantiq Deutschland GmbH
PID hash table entries: 512 (order: 9, 2048 bytes)


cycles_per_jiffy = 2500000
Using 250.000 MHz high precision timer.
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 123520k/129024k available (2994k kernel code, 5420k reserved, 725k data, 180k init, 0k highmem)
Security Framework v1.0.0 initialized
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Lantiq PCI host controller driver, version 1.1.9, (c) 2001-2010 Lantiq Deutschland GmbH
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 4096 bind 2048)
TCP reno registered
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 118
gptu: succeeded to request irq 119
gptu: succeeded to request irq 120
gptu: succeeded to request irq 121
gptu: succeeded to request irq 122
gptu: succeeded to request irq 123
IFX DMA driver, version ifxmips_dma_core.c:v1.0.10
,(c)2009 Infineon Technologies AG
Lantiq CGU driver, version 1.0.11, (c) 2001-2010 Lantiq Deutschland GmbH
Wired TLB entries for Linux read_c0_wired() = 0
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (SUMMARY)  (C) 2001-2006 Red Hat, Inc.
yaffs Sep 15 2011 11:15:40 Installing.
Infineon Technologies DEU driver version 1.0.1
IFX DEU DES initialized (multiblock).
IFX DEU AES initialized (multiblock).
IFX DEU ARC4 initialized (multiblock).
IFX DEU SHA1 initialized.
io scheduler noop registered (default)
ifx_pmu_init: Major 252
Lantiq PMU driver, version 1.1.4, (c) 2001-2010 Lantiq Deutschland GmbH
Lantiq GPIO driver, version 1.2.12, (c) 2001-2010 Lantiq Deutschland GmbH
Infineon Technologies RCU driver version 1.0.6
Lantiq LED Controller driver, version 1.0.4, (c) 2001-2010 Lantiq Deutschland GmbH
MEI CPE Driver, Version 1.1.0
<6>(c) Copyright 2009, Infineon Technologies AG
<6>### MEI CPE - MEI CPE - MEI CPE - MEI CPE ###
<6>ttyS0 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC
Lantiq ASC (UART) driver, version 1.0.5, (c) 2001-2010 Lantiq Deutschland GmbH
RAMDISK driver initialized: 1 RAM disks of 6144K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
IFX SWITCH API, Version 1.1.6
SWAPI: Registered character device [switch_api] with major no [81]
Switch API: PCE MicroCode loaded !!
Switch Auto Polling value = 0
GPHY FIRMWARE LOAD SUCCESSFULLY AT ADDR : 3f0000
IFX GPHY driver GE Mode, version ifxmips_vr9_gphy: V0.7 - Firmware: 8304
Checking PHY LED States!!
ifx_nand_init
Probe for NAND flash...
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 21 at 0x002a0000
Bad eraseblock 819 at 0x06660000
Bad eraseblock 980 at 0x07a80000
Creating 8 MTD partitions on "ifx_nand":
0x000e0000-0x01ee0000 : "rootfs,kernel1"
0x01ee0000-0x03ce0000 : "rootfs,kernel2"
0x03ce0000-0x04760000 : "reserve"
0x04760000-0x07420000 : "firmware"
0x07420000-0x07ec0000 : "config"
0x07de0000-0x07e20000 : "romd"
0x07f00000-0x07f40000 : "mrd_cert1"
0x07f40000-0x07f80000 : "mrd_cert2"
Lantiq SSC driver, version 2.2.2, (c) 2001-2010 Lantiq Deutschland GmbH
pegasus: v0.6.14 (2006/09/27), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new interface driver pegasus
Registered led device: ledc_0
Registered led device: ledc_1
Registered led device: ledc_2
Registered led device: ledc_3
Registered led device: ledc_4
Registered led device: ledc_5
Registered led device: ledc_6
Registered led device: ledc_7
Registered led device: ledc_8
Registered led device: ledc_9
Registered led device: ledc_10
Registered led device: ledc_11
Registered led device: ledc_12
Registered led device: ledc_13
Registered led device: ledc_14
Registered led device: ledc_15
Registered led device: ledc_16
Registered led device: ledc_17
Registered led device: ledc_18
Registered led device: ledc_19
Registered led device: ledc_20
Registered led device: ledc_21
Registered led device: ledc_22
Registered led device: ledc_23
Lantiq LED driver, version 1.0.15, (c) 2001-2010 Lantiq Deutschland GmbH
Mirror/redirect action on
u32 classifier
    Performance counters on
    input device check on
    Actions configured
nf_conntrack version 0.5.0 (1008 buckets, 8064 max)
nf_ct_ftp: registering helper for pf: 2 port: 21
nf_ct_ftp: registering helper for pf: 10 port: 21
ip_conntrack_rtsp v0.6.21 loading
ZLD: zy_sm_init() register hooks successful.
GRE over IPv4 tunneling driver
ip_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_time loading
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
ebt_ulog: not logging via ulog since somebody else already registered for PF_BRIDGE
NET: Registered protocol family 8
atmpvc_init() failed with -17
lec.c: Sep 15 2011 11:17:31 initialized
mpc.c: Sep 15 2011 11:17:27 initialized
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>
yaffs: dev is 32505857 name is "mtdblock1"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.1, "mtdblock1"
Time: MIPS clocksource has been installed.
yaffs: auto selecting yaffs2
yaffs_read_super: isCheckpointed 0
VFS: Mounted root (yaffs filesystem) readonly.
init started: BusyBox v1.10.4 (2011-09-19 20:41:07 CST)
starting pid 166, tty '': '/etc/init.d/rcS'
Algorithmics/MIPS FPU Emulator v1.5
Run init.d/rcS!
Trying to mount NAND flash as YAFFS2 for configuration files (/dev/mtdblock4)
yaffs: dev is 32505860 name is "mtdblock4"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.4, "mtdblock4"
yaffs: restored from checkpoint
yaffs_read_super: isCheckpointed 1
save exit: isCheckpointed 1
Trying to mount NAND flash as YAFFS2 for temporal space for firmware upgrade (/deyaffs: dev is 32505859 name is "mtdblock3"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.3, "mtdblock3"
v/mtdblockyaffs: restored from checkpoint
yaffs_read_super: isCheckpointed 1
3)
save exit: isCheckpointed 1
/
INITRD: Trying to mount NAND flash as Root FSsync
Run init.d/rcS1!
Running all S1 scripts in /etc/init.dload hidden_nand_access.ko
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 21 at 0x002a0000
Bad eraseblock 819 at 0x06660000
Bad eraseblock 980 at 0x07a80000


===> Dump Default Romfile and FW Info

dump & decompress ROM-D file to /var/default-pdm/config.romd.xml successfully!

==================================================
=    ZyCLiP Version Information                  =
==================================================
ZyCLiP    :   3.0.0.0
ZLOader   :   3.0
Z-Boot    :   3.0.0
Run S1_10ethernet to load Ethernet module
First get MAC address=B0B2DCD1F480
Create MAC = B0:B2:DC:D1:F4:80
Create MAC = B0:B2:dc:d1:f4:81
Create MAC = B0:B2:dc:d1:f4:82
Create MAC = B0:B2:dc:d1:f4:83
Create MAC = B0:B2:dc:d1:f4:84
Create MAC = B0:B2:dc:d1:f4:85
Create MAC = B0:B2:dc:d1:f4:86
Insert BTN IO module


GPIO phy addr:1e100b10, len:58, vir addr: be100b10


LED phy addr:1e100bb0, len:14, vir addr: be100bb0
init_gpio_reg
/proc/btn_io is created
init_btn_io_module() SUCCESS, Major Numer is 220

Enable BTN_timer.
Insert LCD Control module
Run S1_12xdsl to load xdsl module
IFXOS, Version 1.5.11
<6>(c) Copyright 2007, Infineon Technologies AG
<6>### IFXOS - IFXOS - IFXOS - IFXOS ###
Wan pin select is 1 (0:Ethernet Wan, 1:DSL Wan)
Wan mode file setting is VDSL
>>>>debug: get wan mode VDSL
Loads switch module S17
portdisable Disable Success
disable ether wan
portdisable Disable Success
portdisable Disable Success
portdisable Disable Success
portdisable Disable Success
Run S1_20voip to load ZyIMS module
#### Tune MIPS-34k VPE Priority for VoIP ####
insmod: cannot insert '/usr/opt/ifx/bin/drv_ifxos.ko': File exists
Lantiq TAPI device driver, version 3.13.0.2, (c) 2001-2010 Lantiq Deutschland GmbH
<6>IFX KPI egress tasklet registered to group 1
Lantiq KPI2UDP driver, version 2.2.0.0, (c) 2008-2010 Lantiq Deutschland GmbH
modprobe: cannot parse modules.dep
Lantiq MIPS34KEc MPS driver, version 2.2.2.5, (c) 2006-2010 Lantiq Deutschland GmbH
Lantiq VMMC device driver, version 1.9.0.3, (c) 2006-2010 Lantiq Deutschland GmbH
BRIDGE_DEV=br0
ignore /sbin/CfgVLAN.sh
Set VLAN Enable Success
pkgSize 1536 Success
portdisable Disable Success
portdisable Disable Success
portdisable Disable Success
portdisable Disable Success
portdisable Disable Success
******WAN PORT *******
        nRegAddr = 0xccd
        nData = 0x0
*******WAN PORT *******
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
igmpquery Success
igmpquery Success
igmpquery Success
Wan pin select is 1 (0:Ethernet Wan, 1:DSL Wan)
Wan mode file setting is VDSL
ifxmips_ppa_datapath_vr9_e5: module license 'unspecified' taints kernel.
Loading D5 (MII0/1) driver ...... <0><6>

ZyXEL: after start_cpu_port()

ERROR: (MAC dynamic0) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
Succeeded!
PPE datapath driver info:
  Version ID: 128.3.3.1.0.0.1
  Family    : N/A
  DR Type   : Normal Data Path | Indirect-Fast Path
  Interface : MII0 | MII1
  Mode      : Routing
  Release   : 0.0.1
PPE 0 firmware info:
  Version ID: 7.1.5.1.0.30
  Family    : VR9
  FW Type   : Standard
  Interface : MII0/1 + PTM
  Mode      : reserved - 1
  Release   : 0.30
PPE 1 firmware info:
  Version ID: 7.2.1.6.1.17
  Family    : VR9
  FW Type   : Acceleration
  Interface : MII0 + MII1
  Mode      : Bridging + IPv4 Routing
  Release   : 1.17
PPA API --- init successfully


Lantiq CPE API Driver version: DSL CPE API V4.9.2-pd1

Predefined debug level: 3
Bring up VDSL
ADSL Annex A
dsl_cpe_control -i  -T4_1_1 -f /lib/firmware/2.6.20.19/xcpe_hw.bin -A /usr/opt/ifx/bin/vdsl.scr -a /usr/opt/ifx/bin/adsl.scr -n /usr/etc/dsl_api/xdslrc.sh -t0.0.0.0 &
IFXOS - User Thread Startup <tcpmsg>, TID 1026 (PID 600) - ENTER
IFXOS - User Thread Startup <tcpcli>, TID 2051 (PID 606) - ENTER
IFXOS - User Thread Startup <dsl_soap>, TID 3076 (PID 607) - ENTER
IFXOS - User Thread Startup <evnthnd>, TID 4101 (PID 608) - ENTER
IFXOS - User Thread Startup <tPipe_0>, TID 5126 (PID 609) - ENTER
IFXOS - User Thread Startup <tPipe_1>, TID 6151 (PID 610) - ENTER
VDSL Annex A
nReturn=0

nReturn=0

ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
Insert internet LED control module
init_internet_led_control_module() SUCCESS, Major Numer is 225
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
device eth0 entered promiscuous mode
br0: port 1(eth0) entering disabled state
br0: port 1(eth0) entering learning state
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
Enabling IP forwarding
Bringing up interface lo
params = lo 127.0.0.1
Read GATEWAY_CONF_FILE fail

dnsmasq: setting capabilities failed: Operation not permitted
portdisable Enable Success
portdisable Enable Success
portdisable Enable Success
portdisable Enable Success
Running all S2 scripts in /mnt/NAND/script/init.d/
Starting syslog-ng...
Starting ZLD CCC(Common Configuration Center)...
<7>ENTER - Kernel Thread Startup <pmex_ne>
<7>ENTER - Kernel Thread Startup <pmex_fe>

RESET CCC LOG LEVEL: 6


RESET CCC LOG LEVEL: 6


RESET CCC LOG LEVEL: 6

finish download certificate
rm: cannot remove '/etc/allcert/all.pem': No such file or directory
Starting mini_httpd...
touch: invalid option -- t
BusyBox v1.10.4 (2011-09-19 20:41:07 CST) multi-call binary

Usage: touch [-c] FILE [FILE...]

Update the last-modified date on the given FILE[s]

Options:
        -c      Do not create any files

Can not find httpd /usr/apache2/bin/apachectl
Can not find /usr/local/app/dms/bin/mediaserver
starting ftpd... socket: Address family not supported by protocol
can't get rdm Layer3Forwarding object
Layer3Forwarding.DefaultConnectionService value is wrong.
nReturn=0 nData="19C5 0000 0001 0202 "
mkdir: cannot create directory '2': Read-only file system
BE DHCPCLIENT init
interface eth0.10 does not exist!
vconfig: ioctl error for rem: Invalid argument
done
Start ROM Convert
Starting ZySH daemon and client...
/etc/init.d/rcS: /mnt/NAND/script/init.d/rcS2: line 64: /sbin/zysh.sh: not found
/etc/init.d/rcS: /mnt/NAND/script/init.d/rcS2: line 67: /usr/sbin/zyshclient: not found
sysctl: can't open '/etc/sysctl.conf': No such file or directory
/etc/init.d/rcS: /mnt/NAND/script/init.d/rcS2: line 73: /usr/bin/setsystz: not found
/etc/init.d/rcS: /mnt/NAND/script/init.d/rcS2: line 76: /etc/init.d/stoinit.sh: not found
nice: /usr/local/btn/do_btncpy: No such file or directory
Starting crond...
Starting crontab...
Starting diagnosed...
nice: /usr/bin/schedule_controller: No such file or directory
Run GPHY SNR workaround !!
starting pid 899, tty '': '/sbin/getty 115200 ttyS0'
nice: timer_source: No such file or directory
Start GPHY detect mode !!
The x.register_access.nData port 0 = f4
GPHY port 0 is linked up
=======================================
resetAllPPPDUnitNumberStatus():
pppdUnitNumberInUsed[0]=0
pppdUnitNumberInUsed[1]=0
pppdUnitNumberInUsed[2]=0
pppdUnitNumberInUsed[3]=0
pppdUnitNumberInUsed[4]=0
pppdUnitNumberInUsed[5]=0
pppdUnitNumberInUsed[6]=0
pppdUnitNumberInUsed[7]=0
=======================================
sh: %8: not found
sh: cannot create cp6c/dev/null: nonexistent directory
ifconfig: SIOCSIFHWADDR: Device or resource busy
cp: cannot stat '/etc/sysconfig/network-scripts/wan-multi/ifcfg-eth0': No such file or directory

(none) login: <7>ptm0.10: add 01:00:5e:00:00:01 mcast address to master interface
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
ifconfig: bad address '1500'
device ptm0.10 is not a slave of br0
ifconfig: SIOCSIFHWADDR: Device or resource busy
cp: cannot stat '/etc/sysconfig/network-scripts/wan-multi/ifcfg-eth0': No such file or directory
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ifconfig: bad address '1500'
device ptm0.20 is not a slave of br0
ifconfig: SIOCSIFHWADDR: Device or resource busy
cp: cannot stat '/etc/sysconfig/network-scripts/wan-multi/ifcfg-eth0': No such file or directory
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ifconfig: bad address '1500'
cat: can't open '/var/tmp/hosts': No such file or directory
Starting celld daemon......
mkdir: cannot create directory '2': Read-only file system
Enter user spaceRTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
starting p910nd... done
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
device eth0 left promiscuous mode
br0: port 1(eth0) entering disabled state
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
br0: port 1(eth0.3901) entering learning state
sh: cannot create /proc/lan_vid: nonexistent directory
cat: can't open '/tmp/schedule/*.sche': No such file or directory
killall: updatedd: no process killed
ERROR: drivers/net/ifxmips_switch_api/ifx_ethsw_pce.c:ifx_pce_rule_write:2012
igmpenable Success
portdisable Enable Success
autonego Success
portdisable Enable Success
autonego Success
portdisable Enable Success
autonego Success
portdisable Enable Success
autonego Success


=== pAd = c0273000, size = 643880 ===

<-- RTMPAllocAdapterBlock, Status=0
$LOCAL_ADMIN_MAC=B2:B2:DC:D1:F4:84
RX DESC a4914000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff ff 00 00 01
Main bssid = b2:b2:dc:d1:f4:84
<==== rt28xx_init, Status=0
0x1300 = 00064320
/proc/driver/wlan_short_cut created
Init RALINK_FP_Handle
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
device ra0 entered promiscuous mode
device ra1 entered promiscuous mode
device ra2 entered promiscuous mode
device ra3 entered promiscuous mode
Remove RALINK_FP_Handle
Terminate the task(RtmpCmdQTask) with pid(1286)!
Terminate the task(RtmpWscTask) with pid(1287)!
/proc/driver/wlan_short_cut removed
br0: port 2(ra0) entering disabled state
br0: port 3(ra1) entering learning state
br0: port 4(ra2) entering learning state
br0: port 5(ra3) entering learning state
RX DESC a486d000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff ff 00 00 01
Main bssid = b2:b2:dc:d1:f4:84
<==== rt28xx_init, Status=0
0x1300 = 00064320
/proc/driver/wlan_short_cut created
Init RALINK_FP_Handle
br0: port 2(ra0) entering learning state
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
rm: cannot remove '/etc/igmpproxy.conf': No such file or directory
rm: cannot remove '/etc/igmpv3.conf': No such file or directory
iptables v1.3.8: interface name `ruletmp:/sbin/crond' must be shorter than IFNAMSIZ (15)
Try `iptables -h' or 'iptables --help' for more information.
sh: -p: not found
Jan  1 00:00:38 ccc_be: beSysMtnReloadConfig(): Loading beVoipConfigLoad...

***********************************************
zyims is not running , just start up zyims
Restarting
killall: voiceApp: no process killed
killall: mm.exe: no process killed
killall: icf.exe: no process killed
icf_port_open_ipc_channel path = /var/iptk_es.chanl
the open channel succeded
exit from the es init
br0: topology change detected, propagating
br0: port 1(eth0.3901) entering forwarding state
***********************************************
Stopping strongSwan IPsec failed: starter is not running
MaxLineCount = 8

 GetWanInterfaceDnsName: get_voip_iface_address fail

 GetWanInterfaceDnsName: get_voip_iface_address fail
Filesystem firmware binary used (/root/voip_fw/ar9_firmware.bin).
Filesystem BBD binary used (/root/voip_CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == bfc01ed0, ra == c01602c8
fOops[#1]:
Cpu 0
$ 0   : 00000000 2ac077dc 80380000 00000000
$ 4   : a7e00000 000807cc 00000003 a7e00000
$ 8   : 00000001 a7e807d4 00806880 0000df00
$12   : 00000000 00000001 00000000 01980198
$16   : 84fe5cf0 c0170000 c0170000 800165bc
$20   : 00000000 c0088bc8 00401e30 7fd736a0
$24   : 00000000 fffffffc
$28   : 84fe4000 84fe5c88 7fd4f510 c01602c8
Hi    : 00000369
Lo    : 00001be5
epc   : bfc01ed0 0xbfc01ed0     Tainted: P
ra    : c01602c8 ifx_mps_download_firmware+0x328/0x4a0 [drv_vmmc]
Status: 1100fc03    KERNEL EXL IE
Cause : 00800008
BadVA : 00000000
PrId  : 00019556
Modules linked in:
rt3062ap 1055504 1 - Live 0xc03ca000 (P)
internet_led_control 2128 0 - Live 0xc00f9000
drv_dsl_cpe_api 427472 0 - Live 0xc0209000
ifx_ppa_api_proc 34832 0 - Live 0xc016f000 (P)
ifx_ppa_api 113920 1 ifx_ppa_api_proc,- Live 0xc0117000 (P)
ifxmips_ppa_hal_vr9_e5 60160 2 ifx_ppa_api_proc,ifx_ppa_api,- Live 0xc0107000 (P)
ifxmips_ppa_datapath_vr9_e5 169536 4 rt3062ap,internet_led_control,ifx_ppa_api,ifxmips_ppa_hal_vr9_e5,- Live 0xc0097000 (P)
drv_vmmc 210176 2 - Live 0xc013a000
drv_kpi2udp 5968 0 - Live 0xc0094000
drv_tapi 182752 6 drv_vmmc,drv_kpi2udp,- Live 0xc00c5000
drv_ifxos 24096 3 drv_dsl_cpe_api,drv_vmmc,drv_tapi,- Live 0xc0088000
btn_io_module 14368 3 rt3062ap,internet_led_control,- Live 0xc008f000
hidden_nand_module 7408 0 - Live 0xc0062000
----------------------------
Process mm.exe (pid: 1450, threadinfo=84fe4000, task=86b0ed88)
Stack : 84fe5cf8 8056900b 84fe5cf8 8350d878 84fe5ea0 00000000 84fe5cf0 84fe5cf0
        ffffffea 00000001 c016d0dc 84fe5d60 7fd4f334 c015a860 c014af08 00000007
        c016c510 c014a02c 00000000 84fe5ea0 0000002f 800871f4 0000cf68 00000000
        00000000 00000000 2ab87008 000807cc da8ec2e5 00000007 00000000 c016c510
        00000008 c0147e08 ffffffe9 804363a0 80536bfc 00000000 84fe5d60 00000000
        ...
Call Trace:
[<c015a860>] ifx_mps_ioctl+0x2e8/0xc4c [drv_vmmc]
[<c014af08>] VMMC_VC_Callback+0x0/0x7f0 [drv_vmmc]
[<c014a02c>] VMMC_Register_Callback+0xb8/0x1cc [drv_vmmc]
[<800871f4>] __link_path_walk+0xf00/0x15b8
[<c0147e08>] VMMC_ChipAccessInit+0x198/0x200 [drv_vmmc]
[<c014c434>] VMMC_Dev_Spec_Ioctl+0x434/0x750 [drv_vmmc]
[<8008452c>] getname+0x28/0xc8
[<c00ccc88>] TAPI_Ioctl+0x29c/0x1204 [drv_tapi]
[<8008819c>] do_path_lookup+0xe0/0x438
[<c0088d0c>] IFXOS_BlockAlloc+0x20/0x34 [drv_ifxos]
[<8007c634>] get_empty_filp+0x54/0x17c
[<8012cce4>] kobject_get+0x1c/0x30
[<c00c78d8>] ifx_tapi_open+0xcc/0x310 [drv_tapi]
[<80084eec>] permission+0x158/0x18c
[<8007e270>] cdev_get+0x24/0xc0
[<8007e3f8>] chrdev_open+0xc4/0x1d0
[<800894d0>] path_lookup_open+0x18/0x24
[<8007e334>] chrdev_open+0x0/0x1d0
[<800788dc>] __dentry_open+0xe4/0x2e0
[<80078bb4>] nameidata_to_filp+0x4c/0x64
[<c00c7ba4>] ifx_tapi_ioctl+0x88/0xa4 [drv_tapi]
[<8008b174>] vfs_ioctl+0x25c/0x364
[<8008b34c>] sys_ioctl+0xd0/0xe4
[<80018aa4>] stack_done+0x20/0x3c


Code: 24060003  2419fffc  01b91824 <8c620000> 004c6824  15acfffd  2402ffff  1000000d  2529ffff
w/bbd_Netherlands.bin).
Stopping strongSwan IPsec failed: starter is not running
br0: topology change detected, propagating
br0: port 3(ra1) entering forwarding state
br0: topology change detected, propagating
br0: port 4(ra2) entering forwarding state
br0: topology change detected, propagating
br0: port 5(ra3) entering forwarding state
Initializing XFRM netlink socket
Starting strongSwan 4.2.8 IPsec [starter]...
no default route - cannot cope with %defaultroute!!!
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
stopping ftpd... done
starting ftpd... done
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
mini_httpd: exiting due to signal 15
socket: Address family not supported by protocol
socket: Address family not supported by protocol
socket: Address family not supported by protocol
cannot open directory: /var/mnt/usb
stopping minidlna server... cat: can't open '/var/run/minidlna.pid': No such file or directory
sh: you need to specify whom to kill
Killed
Sorry, rule does not exist.
killall: upnpd: no process killed
Jan  1 00:00:59 ccc_mr: cccRegModule(): register tr69FE

PPAcmd httplearning enable

VAH_LINKDETECTION Init!
rmmod: /lib/modules/2.6.20.19/kernel/fs/fuse/fuse.ko: No such file or directory
Action 4 device ifb1 ifindex 3
Action 4 device ifb1 ifindex 3
Action 4 device ifb1 ifindex 3
killall: webipqd: no process killed
killall: zyTimeZoneUpdater: no process killed
mini_httpd: exiting due to signal 15
mini_httpd_ssl: exiting due to signal 15
socket: Address family not supported by protocol
socket: Address family not supported by protocol
socket: Address family not supported by protocol
eventVoiceDspDataSend: ****timeout wait response****
VOICE DSP init fail, exit application

It cannot wake up services because it cannot find drivers.

The environment variables seems to be right:

VR9 # printenv
bootcmd=nand read 0x86a80000 0x0001C800 10000; go 0x86a80000
bootdelay=0
baudrate=115200
mem=126M
phym=128M
ipaddr=192.168.1.1
serverip=192.168.1.33
ethaddr=00:E0:92:00:01:40
netdev=eth0
console=ttyS0
baudrate=115200
reset_ddr_config=prot off 0x0001ff34   0x0001ff4b;  erase 0x0001ff34 0x0001ff4b 1
mtdparts=ifx_nand:256k(uboot),-(rootfs)
reset_uboot_config=nand write.jffs 80400000 0x07040000 0x1000
f_calibration_addr= IFX_CFG_FLASH_CALIBRATION_CFG_SIZE
f_calibration_size=IFX_CFG_FLASH_CALIBRATION_CFG_SIZE
stdin=serial
stdout=serial
stderr=serial
ethact=vr9 Switch

Environment size: 570/4092 bytes
VR9 #

But when I try to make a simple ping:

VR9 # ping 192.168.1.33
Using vr9 Switch device
checksum bad
checksum bad
checksum bad
checksum bad
host 192.168.1.33 is alive
VR9 #

Same checksum error each time I try to upload image with ZLUA and ZLUP (probably not uploaded at all).

(Last edited by asmartin on 21 Nov 2013, 23:56)

Post #12
asmartin
22 Nov 2013, 10:23

Well, Zyxel support service from UK denied me access to whole image.

I need whole image.

Post #13
oxo
22 Nov 2013, 15:30

Differences between branded / non-branded F1 start after

All bugs added by David S. Miller <davem@redhat.com>
ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>

From my non-branded working F1: NOTE: using dmesg and NOT serial

login as: root
root@router's password:
# dmesg
 32004 pages, LIFO batch:7
  Normal zone: 0 pages used for memmap
Built 1 zonelists.  Total pages: 32004
Kernel command line: root=/dev/mtdblock1 console=ttyS0,115200 phym=128M mem=126M panic=1 vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=1
1 MIPSR2 register sets available
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
Lantiq ICU driver, version 3.0.1, (c) 2001-2010 Lantiq Deutschland GmbH
PID hash table entries: 512 (order: 9, 2048 bytes)


cycles_per_jiffy = 2500000
Using 250.000 MHz high precision timer.
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 123520k/129024k available (2994k kernel code, 5420k reserved, 725k data, 180k init, 0k highmem)
Calibrating delay loop... 332.59 BogoMIPS (lpj=1662976)
Security Framework v1.0.0 initialized
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Lantiq PCI host controller driver, version 1.1.9, (c) 2001-2010 Lantiq Deutschland GmbH
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 4096 bind 2048)
TCP reno registered
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 118
gptu: succeeded to request irq 119
gptu: succeeded to request irq 120
gptu: succeeded to request irq 121
gptu: succeeded to request irq 122
gptu: succeeded to request irq 123
IFX DMA driver, version ifxmips_dma_core.c:v1.0.10
,(c)2009 Infineon Technologies AG
Lantiq CGU driver, version 1.0.11, (c) 2001-2010 Lantiq Deutschland GmbH
Wired TLB entries for Linux read_c0_wired() = 0
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (SUMMARY)  (C) 2001-2006 Red Hat, Inc.
yaffs Sep 15 2011 11:15:40 Installing.
Infineon Technologies DEU driver version 1.0.1
IFX DEU DES initialized (multiblock).
IFX DEU AES initialized (multiblock).
IFX DEU ARC4 initialized (multiblock).
IFX DEU SHA1 initialized.
io scheduler noop registered (default)
ifx_pmu_init: Major 252
Lantiq PMU driver, version 1.1.4, (c) 2001-2010 Lantiq Deutschland GmbH
Lantiq GPIO driver, version 1.2.12, (c) 2001-2010 Lantiq Deutschland GmbH
Infineon Technologies RCU driver version 1.0.6
Lantiq LED Controller driver, version 1.0.4, (c) 2001-2010 Lantiq Deutschland GmbH
MEI CPE Driver, Version 1.1.0
<6>(c) Copyright 2009, Infineon Technologies AG
<6>### MEI CPE - MEI CPE - MEI CPE - MEI CPE ###
<6>ttyS0 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC
Lantiq ASC (UART) driver, version 1.0.5, (c) 2001-2010 Lantiq Deutschland GmbH
RAMDISK driver initialized: 1 RAM disks of 6144K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
IFX SWITCH API, Version 1.1.6
SWAPI: Registered character device [switch_api] with major no [81]
Switch API: PCE MicroCode loaded !!
Switch Auto Polling value = 0
GPHY FIRMWARE LOAD SUCCESSFULLY AT ADDR : 3f0000
IFX GPHY driver GE Mode, version ifxmips_vr9_gphy: V0.7 - Firmware: 8304
Checking PHY LED States!!
ifx_nand_init
Probe for NAND flash...
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 195 at 0x01860000
Bad eraseblock 560 at 0x04600000
Bad eraseblock 744 at 0x05d00000
Bad eraseblock 866 at 0x06c40000
Creating 8 MTD partitions on "ifx_nand":
0x000e0000-0x01ee0000 : "rootfs,kernel1"
0x01ee0000-0x03ce0000 : "rootfs,kernel2"
0x03ce0000-0x04760000 : "reserve"
0x04760000-0x07420000 : "firmware"
0x07420000-0x07ec0000 : "config"
0x07de0000-0x07e20000 : "romd"
0x07f00000-0x07f40000 : "mrd_cert1"
0x07f40000-0x07f80000 : "mrd_cert2"
Lantiq SSC driver, version 2.2.2, (c) 2001-2010 Lantiq Deutschland GmbH
pegasus: v0.6.14 (2006/09/27), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new interface driver pegasus
Registered led device: ledc_0
Registered led device: ledc_1
Registered led device: ledc_2
Registered led device: ledc_3
Registered led device: ledc_4
Registered led device: ledc_5
Registered led device: ledc_6
Registered led device: ledc_7
Registered led device: ledc_8
Registered led device: ledc_9
Registered led device: ledc_10
Registered led device: ledc_11
Registered led device: ledc_12
Registered led device: ledc_13
Registered led device: ledc_14
Registered led device: ledc_15
Registered led device: ledc_16
Registered led device: ledc_17
Registered led device: ledc_18
Registered led device: ledc_19
Registered led device: ledc_20
Registered led device: ledc_21
Registered led device: ledc_22
Registered led device: ledc_23
Lantiq LED driver, version 1.0.15, (c) 2001-2010 Lantiq Deutschland GmbH
Mirror/redirect action on
u32 classifier
    Performance counters on
    input device check on
    Actions configured
nf_conntrack version 0.5.0 (1008 buckets, 8064 max)
nf_ct_ftp: registering helper for pf: 2 port: 21
nf_ct_ftp: registering helper for pf: 10 port: 21
ip_conntrack_rtsp v0.6.21 loading
ZLD: zy_sm_init() register hooks successful.
GRE over IPv4 tunneling driver
ip_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_time loading
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
ebt_ulog: not logging via ulog since somebody else already registered for PF_BRIDGE
NET: Registered protocol family 8
atmpvc_init() failed with -17
lec.c: Sep 15 2011 11:17:31 initialized
mpc.c: Sep 15 2011 11:17:27 initialized
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>

Differences start here I think
dmesg probabl does not contain the messages of init's after mount read only

ieee80211_crypt: registered algorithm 'NULL'
yaffs: dev is 32505857 name is "mtdblock1"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.1, "mtdblock1"
Time: MIPS clocksource has been installed.
yaffs: auto selecting yaffs2
yaffs_read_super: isCheckpointed 0
VFS: Mounted root (yaffs filesystem) readonly.
Freeing unused kernel memory: 180k freed
Algorithmics/MIPS FPU Emulator v1.5
yaffs: dev is 32505860 name is "mtdblock4"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.4, "mtdblock4"
yaffs: restored from checkpoint
yaffs_read_super: isCheckpointed 1
save exit: isCheckpointed 1
yaffs: dev is 32505859 name is "mtdblock3"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.3, "mtdblock3"
yaffs: restored from checkpoint
yaffs_read_super: isCheckpointed 1
save exit: isCheckpointed 1
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 195 at 0x01860000
Bad eraseblock 560 at 0x04600000
Bad eraseblock 744 at 0x05d00000
Bad eraseblock 866 at 0x06c40000


GPIO phy addr:1e100b10, len:58, vir addr: be100b10


LED phy addr:1e100bb0, len:14, vir addr: be100bb0
init_gpio_reg
/proc/btn_io is created
init_btn_io_module() SUCCESS, Major Numer is 220

Enable BTN_timer.
IFXOS, Version 1.5.11
<6>(c) Copyright 2007, Infineon Technologies AG
<6>### IFXOS - IFXOS - IFXOS - IFXOS ###
Lantiq TAPI device driver, version 3.13.0.2, (c) 2001-2010 Lantiq Deutschland GmbH
ENTER - Kernel Thread Startup <TAPIkpi_in>
<6>IFX KPI egress tasklet registered to group 1
Lantiq KPI2UDP driver, version 2.2.0.0, (c) 2008-2010 Lantiq Deutschland GmbH
Lantiq MIPS34KEc MPS driver, version 2.2.2.5, (c) 2006-2010 Lantiq Deutschland GmbH
Lantiq VMMC device driver, version 1.9.0.3, (c) 2006-2010 Lantiq Deutschland GmbH
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ifxmips_ppa_datapath_vr9_e5: module license 'unspecified' taints kernel.
Loading D5 (MII0/1) driver ...... <0><6>

ZyXEL: after start_cpu_port()

ERROR: (MAC dynamic0) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
Succeeded!
PPE datapath driver info:
  Version ID: 128.3.3.1.0.0.1
  Family    : N/A
  DR Type   : Normal Data Path | Indirect-Fast Path
  Interface : MII0 | MII1
  Mode      : Routing
  Release   : 0.0.1
PPE 1 firmware info:
  Version ID: 7.2.1.6.1.17
  Family    : VR9
  FW Type   : Acceleration
  Interface : MII0 + MII1
  Mode      : Bridging + IPv4 Routing
  Release   : 1.17
PPA API --- init successfully
init_internet_led_control_module() SUCCESS, Major Numer is 225
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
device eth0 entered promiscuous mode
br0: port 1(eth0) entering disabled state
br0: port 1(eth0) entering learning state
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
eth1.3900: add 01:00:5e:00:00:01 mcast address to master interface
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
eth0.3901: add 01:00:5e:00:00:01 mcast address to master interface
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ERROR: (VID does not exists) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_VLAN_IdGet:1765
ERROR: drivers/net/ifxmips_switch_api/ifx_ethsw_pce.c:ifx_pce_rule_write:2012
PCI: Setting latency timer of device 0000:00:0e.0 to 64


=== pAd = c0179000, size = 643880 ===

 RTMPAllocAdapterBlock, Status=0
RX DESC a530b000  size = 2048
 RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff ff 00 00 01
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
Main bssid = b2:b2:dc:cc:56:2c
== rt28xx_init, Status=0
0x1300 = 00064320
/proc/driver/wlan_short_cut created
Init RALINK_FP_Handle
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
device ra0 entered promiscuous mode
device ra1 entered promiscuous mode
device ra2 entered promiscuous mode
device ra3 entered promiscuous mode
Remove RALINK_FP_Handle
Terminate the task(RtmpCmdQTask) with pid(1126)!
Terminate the task(RtmpWscTask) with pid(1127)!
/proc/driver/wlan_short_cut removed
br0: port 2(ra0) entering disabled state
br0: port 3(ra1) entering learning state
br0: port 4(ra2) entering learning state
br0: port 5(ra3) entering learning state
RX DESC a5133000  size = 2048
 RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff ff 00 00 01
Main bssid = b2:b2:dc:cc:56:2c
== rt28xx_init, Status=0
0x1300 = 00064320
/proc/driver/wlan_short_cut created
Init RALINK_FP_Handle
br0: port 2(ra0) entering learning state
ERROR: (MAC dynamic1) drivers/net/ifxmips_switch_api/ifx_ethsw_flow_api.c:IFX_FLOW_MAC_TableEntryAdd:1178 11
VPE loader: VPE1 running successfully
73M1966 TAPI Driver, Rev. 2.2, (c) 2007-2009 Teridian Semiconductor Corp.
73M1966 Driver, Rev. 2.7.3lq4, (c) 2007-2009 Teridian Semiconductor Corp.
Initializing XFRM netlink socket
br0: topology change detected, propagating
br0: port 3(ra1) entering forwarding state
br0: topology change detected, propagating
br0: port 4(ra2) entering forwarding state
br0: topology change detected, propagating
br0: port 5(ra3) entering forwarding state
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial Driver core
drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
IFXUSB: ifxusb_hcd: version 3.2 B110610
IFXUSB: USB core #0 soft-reset
IFXUSB: USB core #0 soft-reset
ifxusb_hcd ifxusb_hcd: IFX USB Controller
ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 1
ifxusb_hcd ifxusb_hcd: irq 54, io mem 0xbe101000
IFXUSB: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
IFXUSB: USB core #1 soft-reset
IFXUSB: USB core #1 soft-reset
ifxusb_hcd ifxusb_hcd: IFX USB Controller
ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 2
ifxusb_hcd ifxusb_hcd: irq 83, io mem 0xbe106000
IFXUSB: Init: Power Port (0)
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
ifx_ppa_init - init succeeded
save exit: isCheckpointed 1
save exit: isCheckpointed 1
ZLD_SM_DownStream(LAN)=[1]
ZLD_SM_UpStream(WAN)=[1]
Session Match: Add WAN interface [eth1]
Session Match: Add WAN interface [eth1.3900]
Session Match: Add LAN interface [eth0.3901]
Session Match: Add LAN interface [br0]
eth1.3900: dev_set_allmulti(master, 1)
disable led
 Session Match: Delete WAN interface [eth1.3900]
enable led
AP SETKEYS DONE - WPA2, AuthMode(7)=WPA2PSK, WepStatus(6)=AES, GroupWepStatus(4)=TKIP

Session Match: Add WAN interface [eth1.3900]
eth1.3900: dev_set_allmulti(master, 1)
eth1.3900: add 01:00:5e:00:00:00 mcast address to master interface
eth1.3900: del 01:00:5e:00:00:00 mcast address from master interface
eth1.3900: add 01:00:5e:7f:ff:fa mcast address to master interface
eth1.3900: add 01:00:5e:00:00:fc mcast address to master interface
eth1.3900: del 01:00:5e:00:00:fc mcast address from master interface
eth1.3900: add 01:00:5e:00:00:fc mcast address to master interface
#

(Last edited by oxo on 22 Nov 2013, 15:57)

Post #14
asmartin
23 Nov 2013, 08:59

Thanks a lot for your quick response, OXO.

I purchased this router as NEW ( see stuffforsalehull @ ebay.co.uk ) but it was bricked and came from any Netherland ISP.

Do you know how I can obtain zyxel original whole image?. Maybe I could recover the router by ZLUA command, but it requires WHOLE image wich includes BOOTBASE.

(Last edited by asmartin on 23 Nov 2013, 09:01)

Post #15
cornelus2009
23 Nov 2013, 12:51

Bootbase suitable for what zyxel offers now, have oxo on dropbox. But as i say to passero, is not safe. He get a brick after tryed to move from 311tue to 311tul

Post #16
asmartin
23 Nov 2013, 19:31
cornelus2009 wrote:

Bootbase suitable for what zyxel offers now, have oxo on dropbox. But as i say to passero, is not safe. He get a brick after tryed to move from 311tue to 311tul

Yes, I know, I already developed a procedure to unbrand ZyXEL P-870HW 51av2 from Movistar, and finally there was a whole image in zyxel ftp server that allowed to unbrand directly: you only had to load that image as a firmware upgrade. The whole image includes the bootbase for unbranded and ever worked fine.

That's why I requested the whole image to ZyXEL, but they denied my request because of "ISP agreements".

Hope to find an whole image.

Maybe Oxo could make a whole image backup of his router.... don't know wink

(Last edited by asmartin on 23 Nov 2013, 19:42)

Post #17
oxo
25 Nov 2013, 09:12
asmartin wrote:

Maybe Oxo could make a whole image backup of his router.... don't know wink

Just give me the commands: there are a lot of files on the dropbox: but they resulted in a brick...

Note that the GPL for F1 is not complete, as y noticed, the compressed file has problems: I was however able to extract the bootloader source from it.

Post #18
asmartin
25 Nov 2013, 09:17
oxo wrote:
asmartin wrote:

Maybe Oxo could make a whole image backup of his router.... don't know wink

Just give me the commands: there are a lot of files on the dropbox: but they resulted in a brick...

Note that the GPL for F1 is not complete, as y noticed, the compressed file has problems: I was however able to extract the bootloader source from it.

Hi oxo

Yes, it does not uncompress at all.

I contacted to Zyxel yesterday and they announced me there will be a new GPL version during next 2 weeks.

I will try to compile 3.10(TUJ.0)C0 instead that cornelus2009 provided me. I'm just interested in bootbase, because I will upgrade firmware later.

Thanks a lot for your quick answer and your support.

Post #19
asmartin
25 Nov 2013, 14:18

Hi ALL.

I have one problem with fakeroot.

When I perform

make rootfs

I botain the following error:

cd /home/asmartin/P-2812HNU-F1/310TUJ0/makecode/../build; fakeroot ./mkrootfs.sh YAFFS2
fakeroot: preload library not found, aborting.
make: *** [rootfs] Error 1

Seems to be amistake in the script wen calling to fakeroot (Makefile) or maybe fakeroot-sysv script

#!/bin/bash

# This script first starts faked (the daemon), and then it will run
# the requested program with fake root privileges.

usage () {
cat - >&2 <<EOF
fakeroot, create a fake root environment.
   usage: fakeroot [-l|--lib fakerootlib] [-f|--faked fakedbin]
                   [-i file] [-s file] [-u|--unknown-is-real]
           [-b|--fd-base fd] [-h|--help] [-v|--version]
                   [--] [command]
EOF
  exit 1
}

stderr ()
{
  local i
  for i
  do
      echo >&2 "fakeroot: $i"
  done
}

fatal ()
{
  stderr "$@"
  exit 1
}

# strip /bin/fakeroot to find install prefix
PREFIX=/usr
BINDIR=/usr/bin

USEABSLIBPATH=0
LIB=libfakeroot-sysv.so
PATHS=/usr/lib/libfakeroot:${PREFIX}/lib64/libfakeroot:${PREFIX}/lib32/libfakeroot
FAKED=${BINDIR}/faked-sysv

FAKED_MODE="unknown-is-root"
export FAKED_MODE

libfound=no

GETOPTEST=`getopt --version`
case $GETOPTEST in
getopt*) # GNU getopt
    TEMP=`getopt -l lib: -l faked: -l unknown-is-real -l fd-base: -l version -l help -- +l:f:i:s:ub:vh "$@"`
    ;;
*) # POSIX getopt ?
    TEMP=`getopt l:f:i:s:ub:vh "$@"`
    ;;
esac

if test "$?" -ne 0; then
  usage
fi

eval set -- "$TEMP"

FAKEDOPTS=""
PIPEIN=""
WAITINTRAP=0

while test "X$1" != "X--"; do
  case "$1" in
    -l|--lib)
       shift
       LIB=`eval echo "$1"`
       PATHS=
       ;;
    -f|--faked)
       shift
       FAKED="$1"
       ;;
    -i)
       shift
       if test -f "$1"; then
         FAKEDOPTS=$FAKEDOPTS" --load"
         PIPEIN="<$1"
       else
         stderr "database file \`$1' does not exist."
       fi
       ;;
    -s)
       shift
       FAKEDOPTS=$FAKEDOPTS" --save-file $1"
       [ -p $1 ] || WAITINTRAP=1
       ;;
    -u|--unknown-is-real)
       FAKEDOPTS=$FAKEDOPTS" --unknown-is-real"
       FAKED_MODE="unknown-is-real"
       ;;
    -b|--fd-base)
       shift
       FAKEROOT_FD_BASE="$1"
       ;;
    -v|--version)
       echo "fakeroot version 1.12.4"
       exit 0
       ;;
    -h|--help)
       usage
       ;;
  esac
  shift
done

shift #get rid of the '--'

# make sure the preload is available
ABSLIB=""
if [ -n "$PATHS" ]
then
    for dir in `echo $PATHS | sed 's/:/ /g'`
    do
    if test -r "$dir/$LIB"
    then
        libfound=yes
        ABSLIB="$dir/$LIB"
    fi
    done
else
    if test -r "$LIB"
    then
    libfound=yes
    ABSLIB="$LIB"
    fi
fi

if test $libfound = no
then
    fatal "preload library \`$LIB' not found, aborting."
fi

if test -n "$FAKEROOTKEY"
then
    fatal "FAKEROOTKEY set to $FAKEROOTKEY" \
          "nested operation not yet supported"
fi

unset FAKEROOTKEY
KEY_PID=`eval $FAKED $FAKEDOPTS $PIPEIN`
FAKEROOTKEY=`echo $KEY_PID|cut -d: -f1`
PID=`echo $KEY_PID|cut -d: -f2`

if [ "$WAITINTRAP" -eq 0 ]; then
  trap "kill -s TERM $PID" EXIT INT
else
  trap 'FAKEROOTKEY=$FAKEROOTKEY LD_LIBRARY_PATH="$PATHS"  LD_PRELOAD="$LIB" /bin/ls -l / >/dev/null 2>&1; while kill -s TERM $PID 2>/dev/null; do sleep 0.1; done' EXIT INT
fi

if test -z "$FAKEROOTKEY" || test -z "$PID"; then
  fatal "error while starting the \`faked' daemon."
fi

if test $USEABSLIBPATH -ne 0 ; then
  LIB=$ABSLIB
fi
# Keep other library paths
if test -n "$LD_LIBRARY_PATH"; then
  PATHS="$PATHS:$LD_LIBRARY_PATH"
fi
# ...and preloaded libs
if test -n "$LD_PRELOAD"; then
  LIB="$LIB $LD_PRELOAD"
fi

export FAKEROOT_FD_BASE

if test -z "$*"; then
  FAKEROOTKEY=$FAKEROOTKEY LD_LIBRARY_PATH="$PATHS"  LD_PRELOAD="$LIB" ${SHELL:-/bin/sh}
  RESULT=$?
else
  FAKEROOTKEY=$FAKEROOTKEY LD_LIBRARY_PATH="$PATHS"  LD_PRELOAD="$LIB" "$@"
  RESULT=$?
fi

exit $RESULT

# Local Variables:
# mode: shell-script
# End:

fakeroot ver 1.12.4

I need help

Post #20
asmartin
25 Nov 2013, 17:18

Hi.

fakeroot issue solved: just editing makefile and deleting fakeroot, and launch as root.

But image that cornelus provided me has 2 incnveniences:

1. It's TUS version (for F3 not F1)

2. Does not include Bootbase, just the firmware itself.

So it's not useful without bootbase.

Any idea?

(Last edited by asmartin on 26 Nov 2013, 18:38)

Post #21
asmartin
29 Nov 2013, 08:44

@OXO

Please, could you tell me start address of the bootbase you uploaded to dropbox?, and the start address of the firmware?

Could you, please, upload the bootbase with Debug flag enabled?, just to compare both files and locate that flag.

Thanks in advance.

I work with serial cable to UART.

I also requested GPL source to Zyxel, but they don't want to send me the code, they ever say "Please wait patiently", but when I request the latest version (3.11(TUJ.0)) they say "I have reported your request internally" but they don't provide me with files.

They are violating GNU license (GPL) agreement terms. What can I do?

Post #22
cornelus2009
29 Nov 2013, 09:16

the bootloader can be extracted from log.
first run

nand read 0x80000000 0x00000000 40000

then do a with log opened

md 0x80000000 40000

after close log, delete unnecesary lines from there and convert to binary, and u will have bootloader.

dunno if loader have 20000 or 40000 hex length.

Post #23
cornelus2009
29 Nov 2013, 09:16

the bootloader can be extracted from log.
first run

nand read 0x80000000 0x00000000 40000

then do a with log opened

md 0x80000000 40000

after close log, delete unnecesary lines from there and convert to binary, and u will have bootloader.

dunno if loader have 20000 or 40000 hex length.

Post #24
asmartin
2 Dec 2013, 09:36

Hi cornelus2009.

Thanks a lot for your answer, but it was a bit late sad

I already uploaded your bootbase from dropbox to the block 0 of nand, and router crashes, with no more access to any environment (keeps testing DRAM).

The only possible solution is to reprogram NAND wit a full image.

What editor did you use to "extract" info as binary from the log?

(Last edited by asmartin on 2 Dec 2013, 09:36)

Post #25
asmartin
2 Dec 2013, 14:36

@oxo

Hi oxo.

I've downloaded md parts and saw downloading script in nanddump folder:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01e00000 00020000 "rootfs,kernel1"
mtd1: 01e00000 00020000 "rootfs,kernel2"
mtd2: 00a80000 00020000 "reserve"
mtd3: 02cc0000 00020000 "firmware"
mtd4: 00aa0000 00020000 "config"
mtd5: 00040000 00020000 "romd"
mtd6: 00040000 00020000 "mrd_cert1"
mtd7: 00040000 00020000 "mrd_cert2"

size is partition size, and erasesize is another parameter of flash that determines how to erase (size of blocks to erase before programming the flash) the flash memory.

But script to download nand

1 for i in $(seq 0 8);do
2     nanddump -f mtd$i /dev/mtd$i
3     nanddump -f mtd$i-nooob -o /dev/mtd$i
4 done

performs dumps that I don't recognize when I open as bin files

Where are starting address of each partition?

Are these files right?

I suppose this shell (#) is seen when you login into router as root and type ssh, is it right? (all from network interface). I use to work with UART interface instead, and uboot environment instead.

Where I could find info about these partitions and its function?

Thanks a lot

(Last edited by asmartin on 2 Dec 2013, 14:41)

The discussion might have continued from here.