Table of Contents

AVM FRITZ!WLAN Repeater DVB-C

FRITZ!WLAN Repeater DVB-C is a WLAN repeater by AVM featuring 2.4GHz, 5GHz, a gigabit LAN port and DVB-C (TV).

It's got 64MB of RAM and 16MB of flash and runs on MIPS.

Sourcecode: http://osp.avm.de/fritzwlan/fritzwlan-repeater-dvb-c/

Supported Versions

Hardware Highlights

Installation

Installation via EVA

In the first seconds after Power is connected, the bootloader will listen for FTP connections on 192.168.178.1. Firmware can be uploaded like following:

ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put openwrt-sysupgrade.bin mtd1

This procedure might take up to two minutes. You need to powercycle the device afterwards to boot OpenWrt.

Note for Windows: The ethernet interface might take too long to start after you restart your router, so that you miss the time window for your FTP connection. Putting a network hub/switch between your computer an the router removes this problem. Also, upload with ftp.exe present in Windows 10/11 might not work (even if you set passive mode with “quote pasv”). Using WSL however works.

Recovery Tool

AVM provides a recovery tool for Windows: https://download.avm.de/fritzwlan/fritzwlan-repeater-dvb-c/other/recover/

Hardware

Here are interesting hardware infos from the boot log:

[FLASH:] WINBOND Uniform-Flash 16MB 256 Bytes WriteBuffer
[SYSTEM:] QCA955x on 720/600/200MHz
CPU0 revision is: 00019750 (MIPS 74Kc)
SoC: Qualcomm Atheros QCA9556 ver 1 rev 0
[plat_mem_setup] memsize 0x4000000, memstart 0x00000000
Atheros on-chip NAND FLash Controller Driver, Version 1.0 (c) 2014 AVM GmbH, 2010 Atheros Communications, Ltd.

According to the boot log, there's a USB interface and a USB hub gets detected

[module-alloc-by-name] give 0x1000 bytes at 0x810e2000 to module 'usb_common' (0x381000 total bytes left)
[module-alloc-by-name] give 0x22000 bytes at 0x810e3000 to module 'usbcore' (0x35f000 total bytes left)
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
[module-alloc-by-name] give 0x9000 bytes at 0x81105000 to module 'ehci_hcd' (0x356000 total bytes left)
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[module-alloc-by-name] give 0x2000 bytes at 0x8110e000 to module 'ehci_ath79' (0x354000 total bytes left)
ehci-ath79 1b000000.usb: EHCI Host Controller
ehci-ath79 1b000000.usb: new USB bus registered, assigned bus number 1
ehci-ath79 1b000000.usb: TX-TX IDP fix enabled
ehci-ath79 1b000000.usb: irq 88, io mem 0x1b000000
ehci-ath79 1b000000.usb: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: EHCI Host Controller
usb usb1: Manufacturer: Linux 4.4.60 ehci_hcd
usb usb1: SerialNumber: 1b000000.usb
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
avm_net_trace: New net trace device 'usb1' registered with minor 161.

Later in the log it's revealed that the DVB-C adapter is hooked up through USB (internally):

em28174 #0: FRITZ!WLAN Repeater DVB
DVB: registering new adapter (em28174 #0)
usb 1-1: DVB: registering adapter 0 frontend 0 (MxL251)...
em28174 #0: FRITZ!WLAN Repeater DVB
DVB: registering new adapter (em28174 #0)
usb 1-1: DVB: registering adapter 1 frontend 0 (MxL251)...
Successfully loaded em28xx-dvb
Em28xx: Initialized (Em28xx dvb Extension) extension

Here's some info on em28xx devices: https://linuxtv.org/wiki/index.php/Em28xx_devices

The WiFi chip seems to be the Atheros AR9380 according to the boot log:

ath_hal: 0.9.17.1 (AR9380, REGOPS_FUNC, WRITE_EEPROM, 11D)

GPIO

[LED] use GPIO 106 for 'gpio_avm_led_power'
[LED] use GPIO 105 for 'gpio_avm_led_tv'
[LED] use GPIO 107 for 'gpio_avm_led_wlan'
[LED] use GPIO 100 for 'gpio_avm_led_fsi0'
[LED] use GPIO 104 for 'gpio_avm_led_fsi1'
[LED] use GPIO 103 for 'gpio_avm_led_fsi2'
[LED] use GPIO 102 for 'gpio_avm_led_fsi3'
[LED] use GPIO 101 for 'gpio_avm_led_fsi4'
[BUTTON] use GPIO 4 for 'gpio_avm_button_wlan'

Serial

Serial can be used to get a root shell

# screen /dev/ttyUSB0 115200

UART

The boot log reveals the following:

Enabling UART-Input for Pin 9

Bootlogs

OpenWrt bootlog

[ 0.000000] Linux version 5.15.137 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23630-842932a63d) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Tue Nov 14 13:38:11 2023 [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc) [ 0.000000] MIPS: machine is AVM FRITZ!WLAN Repeater DVB-C [ 0.000000] SoC: Qualcomm Atheros QCA9556 ver 1 rev 0 [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16240 [ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2 [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 55904K/65536K available (6079K kernel code, 597K rwdata, 780K rodata, 1240K init, 217K bss, 9632K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 51 [ 0.000000] CPU clock: 720.000 MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns [ 0.000001] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns [ 0.008370] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048) [ 0.075041] pid_max: default: 32768 minimum: 301 [ 0.080847] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.088639] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.103650] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.114172] futex hash table entries: 256 (order: -1, 3072 bytes, linear) [ 0.121613] pinctrl core: initialized pinctrl subsystem [ 0.128957] NET: Registered PF_NETLINK/PF_ROUTE protocol family [ 0.135812] thermal_sys: Registered thermal governor 'step_wise' [ 0.148007] clocksource: Switched to clocksource MIPS [ 0.161256] NET: Registered PF_INET protocol family [ 0.166645] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 0.175308] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear) [ 0.184277] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 0.192551] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.200722] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.208250] TCP: Hash tables configured (established 1024 bind 1024) [ 0.215168] UDP hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.222198] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.230039] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 0.236133] PCI: CLS 0 bytes, default 32 [ 0.243693] workingset: timestamp_bits=14 max_order=14 bucket_order=0 [ 0.255598] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.261884] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.273677] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251) [ 0.285427] pinctrl-single 1804002c.pinmux: 544 pins, size 68 [ 0.292807] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.302231] printk: console [ttyS0] disabled [ 0.306848] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A [ 0.316089] printk: console [ttyS0] enabled [ 0.324998] printk: bootconsole [early0] disabled [ 0.360258] spi-nor spi0.0: w25q128 (16384 Kbytes) [ 0.365187] 4 fixed-partitions partitions found on MTD device spi0.0 [ 0.371707] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions [ 0.378489] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions [ 0.385464] Creating 4 MTD partitions on "spi0.0": [ 0.390419] 0x000000000000-0x000000020000 : "urlader" [ 0.397809] 0x000000020000-0x000000f00000 : "firmware" [ 0.404119] 2 eva-fw partitions found on MTD device firmware [ 0.409940] Creating 2 MTD partitions on "firmware": [ 0.415032] 0x000000000000-0x000000238cce : "kernel" [ 0.420094] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only [ 0.431005] 0x000000240100-0x000000ee0000 : "rootfs" [ 0.436061] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only [ 0.446432] mtd: setting mtd3 (rootfs) as root device [ 0.452556] 1 squashfs-split partitions found on MTD device rootfs [ 0.458943] 0x000000640000-0x000000ee0000 : "rootfs_data" [ 0.465422] 0x000000f00000-0x000000f80000 : "tffs (1)" [ 0.473362] 0x000000f80000-0x000001000000 : "tffs (2)" [ 0.489600] ag71xx 1a000000.eth: invalid MAC address, using random address [ 0.908765] ag71xx 1a000000.eth: connected to PHY at mdio.0:00 [uid=004dd074, driver=Qualcomm Atheros AR8031/AR8033] [ 0.920152] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: sgmii [ 0.926876] i2c_dev: i2c /dev entries driver [ 0.939764] NET: Registered PF_INET6 protocol family [ 0.950926] Segment Routing with IPv6 [ 0.954732] In-situ OAM (IOAM) with IPv6 [ 0.958908] NET: Registered PF_PACKET protocol family [ 0.964115] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 0.977559] 8021q: 802.1Q VLAN Support v1.8 [ 1.003108] PCI host bridge to bus 0000:00 [ 1.007281] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff] [ 1.014294] pci_bus 0000:00: root bus resource [io 0x0000] [ 1.019963] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 1.028050] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000 [ 1.034184] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit] [ 1.041139] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref] [ 1.048029] pci 0000:00:00.0: supports D1 [ 1.052104] pci 0000:00:00.0: PME# supported from D0 D1 D3hot [ 1.059037] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 [ 1.065777] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit] [ 1.073255] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref] [ 1.091772] VFS: Mounted root (squashfs filesystem) readonly on device 31:3. [ 1.105428] Freeing unused kernel image (initmem) memory: 1240K [ 1.111478] This architecture does not have kernel memory protection. [ 1.118027] Run /sbin/init as init process [ 1.122186] with arguments: [ 1.122190] /sbin/init [ 1.122195] with environment: [ 1.122199] HOME=/ [ 1.122204] TERM=linux [ 1.766028] init: Console is alive [ 1.770096] init: - watchdog - [ 3.153654] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 3.234125] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 3.252002] init: - preinit - [ 5.476248] random: jshn: uninitialized urandom read (4 bytes read) [ 5.862134] random: jshn: uninitialized urandom read (4 bytes read) [ 6.326359] random: jshn: uninitialized urandom read (4 bytes read) [ 6.553492] random: jshn: uninitialized urandom read (4 bytes read) [ 6.619472] random: jshn: uninitialized urandom read (4 bytes read) [ 6.732429] random: jshn: uninitialized urandom read (4 bytes read) [ 9.194727] jffs2: notice: (403) jffs2_build_xattr_subsystem: complete building xattr subsystem, 38 of xdatum (31 unchecked, 7 orphan) and 51 of xref (7 dead, 0 orphan) found. [ 9.213651] mount_root: switching to jffs2 overlay [ 9.222456] overlayfs: upper fs does not support tmpfile. [ 9.237362] urandom-seed: Seeding with /etc/urandom.seed [ 9.407005] procd: - early - [ 9.411337] procd: - watchdog - [ 10.109200] procd: - watchdog - [ 10.114706] procd: - ubus - [ 10.200493] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.209899] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.217990] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.237341] procd: - init - [ 11.443969] random: jshn: uninitialized urandom read (4 bytes read) [ 11.566327] kmodloader: loading kernel modules from /etc/modules.d/* [ 12.260832] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b [ 12.268500] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36 [ 12.967916] PPP generic driver version 2.4.2 [ 12.979750] NET: Registered PF_PPPOX protocol family [ 13.043604] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x3c. [ 13.078950] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002) [ 13.085481] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0 [ 13.868382] urngd: v1.0.2 started. [ 15.798474] random: crng init done [ 15.801942] random: 24 urandom warning(s) missed due to ratelimiting [ 18.364728] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043202ff sub 0000:0000 [ 18.374174] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0 [ 18.386190] ath10k_pci 0000:00:00.0: firmware ver 10.1-ct-8x-__fW-022-ecad3248 api 2 features wmi-10.x,has-wmi-mgmt-tx,mfp,txstatus-noack,wmi-10.x-CT,ratemask-CT,txrate-CT,get-temp-CT,tx-rc-CT,cust-stats-CT,retry-gt2-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT crc32 3e4cf97f [ 18.500423] ath10k_pci 0000:00:00.0: Loading BDF type 0 [ 19.464558] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08 [ 20.494941] ath10k_pci 0000:00:00.0: 10.1 wmi init: vdevs: 16 peers: 127 tid: 256 [ 20.512285] ath10k_pci 0000:00:00.0: wmi print 'P 128 V 8 T 410' [ 20.518671] ath10k_pci 0000:00:00.0: wmi print 'msdu-desc: 1424 sw-crypt: 0 ct-sta: 0' [ 20.526806] ath10k_pci 0000:00:00.0: wmi print 'alloc rem: 24984 iram: 38672' [ 20.583403] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 2 htt-op 2 cal file max-sta 128 raw 0 hwcrypto 1 [ 20.597685] ath10k_pci 0000:00:00.0: NOTE: Firmware DBGLOG output disabled in debug_mask: 0x10000000 [ 20.729688] ath: EEPROM regdomain: 0x0 [ 20.729711] ath: EEPROM indicates default country code should be used [ 20.729717] ath: doing EEPROM country->regdmn map search [ 20.729731] ath: country maps to regdmn code: 0x3a [ 20.729738] ath: Country alpha2 being used: US [ 20.729745] ath: Regpair used: 0x3a [ 20.813014] ath: EEPROM regdomain: 0x0 [ 20.813039] ath: EEPROM indicates default country code should be used [ 20.813045] ath: doing EEPROM country->regdmn map search [ 20.813060] ath: country maps to regdmn code: 0x3a [ 20.813067] ath: Country alpha2 being used: US [ 20.813074] ath: Regpair used: 0x3a [ 20.830852] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht' [ 20.832809] ieee80211 phy1: Atheros AR9550 Rev:0 mem=0xb8100000, irq=13 [ 20.918463] kmodloader: done loading kernel modules from /etc/modules.d/* [ 42.620819] br-lan: port 1(eth0) entered blocking state [ 42.626147] br-lan: port 1(eth0) entered disabled state [ 42.631764] device eth0 entered promiscuous mode [ 45.294338] ath: EEPROM regdomain: 0x8114 [ 45.298477] ath: EEPROM indicates we should expect a country code [ 45.304654] ath: doing EEPROM country->regdmn map search [ 45.310059] ath: country maps to regdmn code: 0x37 [ 45.314923] ath: Country alpha2 being used: DE [ 45.319439] ath: Regpair used: 0x37 [ 45.322974] ath: regdomain 0x8114 dynamically updated by user [ 45.328897] ath: EEPROM regdomain: 0x8114 [ 45.332961] ath: EEPROM indicates we should expect a country code [ 45.339157] ath: doing EEPROM country->regdmn map search [ 45.344543] ath: country maps to regdmn code: 0x37 [ 45.349410] ath: Country alpha2 being used: DE [ 45.353915] ath: Regpair used: 0x37 [ 45.357452] ath: regdomain 0x8114 dynamically updated by user [ 47.380902] br-lan: port 2(phy1-sta0) entered blocking state [ 47.386666] br-lan: port 2(phy1-sta0) entered disabled state [ 47.392754] device phy1-sta0 entered promiscuous mode


Tags

How to add tags