FRITZ!WLAN Repeater DVB-C is a WLAN repeater by AVM featuring 2.4GHz, 5GHz, a gigabit LAN port and DVB-C (TV).
It's got 64MB of RAM and 16MB of flash and runs on MIPS.
Sourcecode: http://osp.avm.de/fritzwlan/fritzwlan-repeater-dvb-c/
In the first seconds after Power is connected, the bootloader will listen for FTP connections on 192.168.178.1. Firmware can be uploaded like following:
ftp> quote USER adam2 ftp> quote PASS adam2 ftp> binary ftp> debug ftp> passive ftp> quote MEDIA FLSH ftp> put openwrt-sysupgrade.bin mtd1
This procedure might take up to two minutes. You need to powercycle the device afterwards to boot OpenWrt.
Note for Windows: The ethernet interface might take too long to start after you restart your router, so that you miss the time window for your FTP connection. Putting a network hub/switch between your computer an the router removes this problem. Also, upload with ftp.exe present in Windows 10/11 might not work (even if you set passive mode with “quote pasv”). Using WSL however works.
AVM provides a recovery tool for Windows: https://download.avm.de/fritzwlan/fritzwlan-repeater-dvb-c/other/recover/
Here are interesting hardware infos from the boot log:
[FLASH:] WINBOND Uniform-Flash 16MB 256 Bytes WriteBuffer [SYSTEM:] QCA955x on 720/600/200MHz CPU0 revision is: 00019750 (MIPS 74Kc) SoC: Qualcomm Atheros QCA9556 ver 1 rev 0 [plat_mem_setup] memsize 0x4000000, memstart 0x00000000 Atheros on-chip NAND FLash Controller Driver, Version 1.0 (c) 2014 AVM GmbH, 2010 Atheros Communications, Ltd.
According to the boot log, there's a USB interface and a USB hub gets detected
[module-alloc-by-name] give 0x1000 bytes at 0x810e2000 to module 'usb_common' (0x381000 total bytes left) [module-alloc-by-name] give 0x22000 bytes at 0x810e3000 to module 'usbcore' (0x35f000 total bytes left) usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb [module-alloc-by-name] give 0x9000 bytes at 0x81105000 to module 'ehci_hcd' (0x356000 total bytes left) ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [module-alloc-by-name] give 0x2000 bytes at 0x8110e000 to module 'ehci_ath79' (0x354000 total bytes left) ehci-ath79 1b000000.usb: EHCI Host Controller ehci-ath79 1b000000.usb: new USB bus registered, assigned bus number 1 ehci-ath79 1b000000.usb: TX-TX IDP fix enabled ehci-ath79 1b000000.usb: irq 88, io mem 0x1b000000 ehci-ath79 1b000000.usb: USB 2.0 started, EHCI 1.00 usb usb1: New USB device found, idVendor=1d6b, idProduct=0002 usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb1: Product: EHCI Host Controller usb usb1: Manufacturer: Linux 4.4.60 ehci_hcd usb usb1: SerialNumber: 1b000000.usb hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected avm_net_trace: New net trace device 'usb1' registered with minor 161.
Later in the log it's revealed that the DVB-C adapter is hooked up through USB (internally):
em28174 #0: FRITZ!WLAN Repeater DVB DVB: registering new adapter (em28174 #0) usb 1-1: DVB: registering adapter 0 frontend 0 (MxL251)... em28174 #0: FRITZ!WLAN Repeater DVB DVB: registering new adapter (em28174 #0) usb 1-1: DVB: registering adapter 1 frontend 0 (MxL251)... Successfully loaded em28xx-dvb Em28xx: Initialized (Em28xx dvb Extension) extension
Here's some info on em28xx devices: https://linuxtv.org/wiki/index.php/Em28xx_devices
The WiFi chip seems to be the Atheros AR9380 according to the boot log:
ath_hal: 0.9.17.1 (AR9380, REGOPS_FUNC, WRITE_EEPROM, 11D)
[LED] use GPIO 106 for 'gpio_avm_led_power' [LED] use GPIO 105 for 'gpio_avm_led_tv' [LED] use GPIO 107 for 'gpio_avm_led_wlan' [LED] use GPIO 100 for 'gpio_avm_led_fsi0' [LED] use GPIO 104 for 'gpio_avm_led_fsi1' [LED] use GPIO 103 for 'gpio_avm_led_fsi2' [LED] use GPIO 102 for 'gpio_avm_led_fsi3' [LED] use GPIO 101 for 'gpio_avm_led_fsi4' [BUTTON] use GPIO 4 for 'gpio_avm_button_wlan'
Serial can be used to get a root shell
# screen /dev/ttyUSB0 115200
The boot log reveals the following:
Enabling UART-Input for Pin 9
[ 0.000000] Linux version 5.15.137 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23630-842932a63d) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Tue Nov 14 13:38:11 2023 [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc) [ 0.000000] MIPS: machine is AVM FRITZ!WLAN Repeater DVB-C [ 0.000000] SoC: Qualcomm Atheros QCA9556 ver 1 rev 0 [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16240 [ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2 [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 55904K/65536K available (6079K kernel code, 597K rwdata, 780K rodata, 1240K init, 217K bss, 9632K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 51 [ 0.000000] CPU clock: 720.000 MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns [ 0.000001] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns [ 0.008370] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048) [ 0.075041] pid_max: default: 32768 minimum: 301 [ 0.080847] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.088639] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.103650] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.114172] futex hash table entries: 256 (order: -1, 3072 bytes, linear) [ 0.121613] pinctrl core: initialized pinctrl subsystem [ 0.128957] NET: Registered PF_NETLINK/PF_ROUTE protocol family [ 0.135812] thermal_sys: Registered thermal governor 'step_wise' [ 0.148007] clocksource: Switched to clocksource MIPS [ 0.161256] NET: Registered PF_INET protocol family [ 0.166645] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 0.175308] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear) [ 0.184277] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 0.192551] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.200722] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.208250] TCP: Hash tables configured (established 1024 bind 1024) [ 0.215168] UDP hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.222198] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.230039] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 0.236133] PCI: CLS 0 bytes, default 32 [ 0.243693] workingset: timestamp_bits=14 max_order=14 bucket_order=0 [ 0.255598] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.261884] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.273677] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251) [ 0.285427] pinctrl-single 1804002c.pinmux: 544 pins, size 68 [ 0.292807] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.302231] printk: console [ttyS0] disabled [ 0.306848] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A [ 0.316089] printk: console [ttyS0] enabled [ 0.324998] printk: bootconsole [early0] disabled [ 0.360258] spi-nor spi0.0: w25q128 (16384 Kbytes) [ 0.365187] 4 fixed-partitions partitions found on MTD device spi0.0 [ 0.371707] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions [ 0.378489] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions [ 0.385464] Creating 4 MTD partitions on "spi0.0": [ 0.390419] 0x000000000000-0x000000020000 : "urlader" [ 0.397809] 0x000000020000-0x000000f00000 : "firmware" [ 0.404119] 2 eva-fw partitions found on MTD device firmware [ 0.409940] Creating 2 MTD partitions on "firmware": [ 0.415032] 0x000000000000-0x000000238cce : "kernel" [ 0.420094] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only [ 0.431005] 0x000000240100-0x000000ee0000 : "rootfs" [ 0.436061] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only [ 0.446432] mtd: setting mtd3 (rootfs) as root device [ 0.452556] 1 squashfs-split partitions found on MTD device rootfs [ 0.458943] 0x000000640000-0x000000ee0000 : "rootfs_data" [ 0.465422] 0x000000f00000-0x000000f80000 : "tffs (1)" [ 0.473362] 0x000000f80000-0x000001000000 : "tffs (2)" [ 0.489600] ag71xx 1a000000.eth: invalid MAC address, using random address [ 0.908765] ag71xx 1a000000.eth: connected to PHY at mdio.0:00 [uid=004dd074, driver=Qualcomm Atheros AR8031/AR8033] [ 0.920152] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: sgmii [ 0.926876] i2c_dev: i2c /dev entries driver [ 0.939764] NET: Registered PF_INET6 protocol family [ 0.950926] Segment Routing with IPv6 [ 0.954732] In-situ OAM (IOAM) with IPv6 [ 0.958908] NET: Registered PF_PACKET protocol family [ 0.964115] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 0.977559] 8021q: 802.1Q VLAN Support v1.8 [ 1.003108] PCI host bridge to bus 0000:00 [ 1.007281] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff] [ 1.014294] pci_bus 0000:00: root bus resource [io 0x0000] [ 1.019963] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 1.028050] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000 [ 1.034184] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit] [ 1.041139] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref] [ 1.048029] pci 0000:00:00.0: supports D1 [ 1.052104] pci 0000:00:00.0: PME# supported from D0 D1 D3hot [ 1.059037] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 [ 1.065777] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit] [ 1.073255] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref] [ 1.091772] VFS: Mounted root (squashfs filesystem) readonly on device 31:3. [ 1.105428] Freeing unused kernel image (initmem) memory: 1240K [ 1.111478] This architecture does not have kernel memory protection. [ 1.118027] Run /sbin/init as init process [ 1.122186] with arguments: [ 1.122190] /sbin/init [ 1.122195] with environment: [ 1.122199] HOME=/ [ 1.122204] TERM=linux [ 1.766028] init: Console is alive [ 1.770096] init: - watchdog - [ 3.153654] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 3.234125] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 3.252002] init: - preinit - [ 5.476248] random: jshn: uninitialized urandom read (4 bytes read) [ 5.862134] random: jshn: uninitialized urandom read (4 bytes read) [ 6.326359] random: jshn: uninitialized urandom read (4 bytes read) [ 6.553492] random: jshn: uninitialized urandom read (4 bytes read) [ 6.619472] random: jshn: uninitialized urandom read (4 bytes read) [ 6.732429] random: jshn: uninitialized urandom read (4 bytes read) [ 9.194727] jffs2: notice: (403) jffs2_build_xattr_subsystem: complete building xattr subsystem, 38 of xdatum (31 unchecked, 7 orphan) and 51 of xref (7 dead, 0 orphan) found. [ 9.213651] mount_root: switching to jffs2 overlay [ 9.222456] overlayfs: upper fs does not support tmpfile. [ 9.237362] urandom-seed: Seeding with /etc/urandom.seed [ 9.407005] procd: - early - [ 9.411337] procd: - watchdog - [ 10.109200] procd: - watchdog - [ 10.114706] procd: - ubus - [ 10.200493] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.209899] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.217990] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.237341] procd: - init - [ 11.443969] random: jshn: uninitialized urandom read (4 bytes read) [ 11.566327] kmodloader: loading kernel modules from /etc/modules.d/* [ 12.260832] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b [ 12.268500] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36 [ 12.967916] PPP generic driver version 2.4.2 [ 12.979750] NET: Registered PF_PPPOX protocol family [ 13.043604] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x3c. [ 13.078950] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002) [ 13.085481] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0 [ 13.868382] urngd: v1.0.2 started. [ 15.798474] random: crng init done [ 15.801942] random: 24 urandom warning(s) missed due to ratelimiting [ 18.364728] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043202ff sub 0000:0000 [ 18.374174] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0 [ 18.386190] ath10k_pci 0000:00:00.0: firmware ver 10.1-ct-8x-__fW-022-ecad3248 api 2 features wmi-10.x,has-wmi-mgmt-tx,mfp,txstatus-noack,wmi-10.x-CT,ratemask-CT,txrate-CT,get-temp-CT,tx-rc-CT,cust-stats-CT,retry-gt2-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT crc32 3e4cf97f [ 18.500423] ath10k_pci 0000:00:00.0: Loading BDF type 0 [ 19.464558] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08 [ 20.494941] ath10k_pci 0000:00:00.0: 10.1 wmi init: vdevs: 16 peers: 127 tid: 256 [ 20.512285] ath10k_pci 0000:00:00.0: wmi print 'P 128 V 8 T 410' [ 20.518671] ath10k_pci 0000:00:00.0: wmi print 'msdu-desc: 1424 sw-crypt: 0 ct-sta: 0' [ 20.526806] ath10k_pci 0000:00:00.0: wmi print 'alloc rem: 24984 iram: 38672' [ 20.583403] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 2 htt-op 2 cal file max-sta 128 raw 0 hwcrypto 1 [ 20.597685] ath10k_pci 0000:00:00.0: NOTE: Firmware DBGLOG output disabled in debug_mask: 0x10000000 [ 20.729688] ath: EEPROM regdomain: 0x0 [ 20.729711] ath: EEPROM indicates default country code should be used [ 20.729717] ath: doing EEPROM country->regdmn map search [ 20.729731] ath: country maps to regdmn code: 0x3a [ 20.729738] ath: Country alpha2 being used: US [ 20.729745] ath: Regpair used: 0x3a [ 20.813014] ath: EEPROM regdomain: 0x0 [ 20.813039] ath: EEPROM indicates default country code should be used [ 20.813045] ath: doing EEPROM country->regdmn map search [ 20.813060] ath: country maps to regdmn code: 0x3a [ 20.813067] ath: Country alpha2 being used: US [ 20.813074] ath: Regpair used: 0x3a [ 20.830852] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht' [ 20.832809] ieee80211 phy1: Atheros AR9550 Rev:0 mem=0xb8100000, irq=13 [ 20.918463] kmodloader: done loading kernel modules from /etc/modules.d/* [ 42.620819] br-lan: port 1(eth0) entered blocking state [ 42.626147] br-lan: port 1(eth0) entered disabled state [ 42.631764] device eth0 entered promiscuous mode [ 45.294338] ath: EEPROM regdomain: 0x8114 [ 45.298477] ath: EEPROM indicates we should expect a country code [ 45.304654] ath: doing EEPROM country->regdmn map search [ 45.310059] ath: country maps to regdmn code: 0x37 [ 45.314923] ath: Country alpha2 being used: DE [ 45.319439] ath: Regpair used: 0x37 [ 45.322974] ath: regdomain 0x8114 dynamically updated by user [ 45.328897] ath: EEPROM regdomain: 0x8114 [ 45.332961] ath: EEPROM indicates we should expect a country code [ 45.339157] ath: doing EEPROM country->regdmn map search [ 45.344543] ath: country maps to regdmn code: 0x37 [ 45.349410] ath: Country alpha2 being used: DE [ 45.353915] ath: Regpair used: 0x37 [ 45.357452] ath: regdomain 0x8114 dynamically updated by user [ 47.380902] br-lan: port 2(phy1-sta0) entered blocking state [ 47.386666] br-lan: port 2(phy1-sta0) entered disabled state [ 47.392754] device phy1-sta0 entered promiscuous mode