Table of Contents
T-Home Speedport W 723V Typ B
The T-Home Speedport W 723V Typ B (VGV8539JW22) is an IAD sold by Deutsche Telekom with an ADSL2+/VDSL2 modem, 802.11abgn wifi and two FXS ports as well as a S0 bus connector. The device is manufactured by Arcadyan.
 | This device is not supported yet. |
Supported Versions
 | There are two very different verions of this device. This article refers to Typ B of this device. Please check the label on the back of your device! |
| Version/Model | Launch Date | S/N | OpenWrt Version Supported | Model Specific Notes |
|---|---|---|---|---|
| Typ A | - | - | not supported | |
| Typ B | - | - | not supported | Manufactured by Arcadyan |
There is a U-Boot tarball available U-Boot tarball. The device is shipped with brnboot.
Hardware Highlights
| SoC | Ram | Flash | Network | USB | Serial | JTag |
|---|---|---|---|---|---|---|
| Lantiq VR9 VRX288 v1.1 @ 500 Mhz | 64 MiB | 8 MiB | 4 x 1 | Yes | Yes | ? |
State of OpenWrt support
| Status | Comment | |
|---|---|---|
| WLAN | ✘ | supported by br43 |
| DSL | ✘ | should work as in other Lantiq based routers |
| Switch | ✘ | integrated in SoC |
| Bootloader | ✘ | brnboot |
| LED | ✘ | |
| USB | ✘ | |
| Telephony | ✘ |
Installation
This device is not supported yet.
Flash Layout
This is the default flash layout as reported by the bootloader:
---------------------------------------
Area Address Length
---------------------------------------
[0] Boot 0xB0000000 192K
[1] Configuration 0xB0030000 256K
[2] Image 0 0xB0070000 3840K
[3] Image 1 0xB0430000 3840K
[4] Boot Params 0xB07F0000 64K
[5] Flash Image 0xB0000000 8192K
---------------------------------------
| Please note that area/partition “[5] Flash Image” is the complete flash, so do never try to erase or reflash this area. Also don't mess with areas 0, 1 and 4 as you might brick your device. |
Flash custom firmware
→ brnboot
Start your serial terminal, press the space bar 3 times (as soon as the device is powered on) to access the bootloader. The access password are the first 4 digits of your “Gerätepasswort” (device password). Press return to see help menu. Press “!” to access the hidden administrator mode with extended
options. Press “k” to run the minikernel, which will run a webserver on 192.168.2.1:80 with recovery options.
======================================================================= Wireless ADSL IAD VR9 Loader v1.01.00 build Aug 13 2010 11:48:41 Arcadyan Technology Corporation ======================================================================= MXIC MX29LV640EB bottom boot 16-bit mode found Copying boot params.....DONE Press Space Bar 3 times to enter command mode ... Get Primary to 0.....123 Please Enter Password:**** Yes, Enter command mode ... [VR9 Boot]:! Enter Administrator Mode ! ====================== [U] Upload to Flash [E] Erase Flash [G] Run Runtime Code [M] Upload to Memory [R] Read from Memory [W] Write to Memory [Y] Go to Memory [A] Set MAC Address [#] Set Serial Number [V] Set Board Version [O] Set COSIC OSCTrim Options [N] Set DECT RFPI Num [H] Set Options [D] Clear DDR Param [C] Set Default Password [K] Run Mini Kernel [P] Print Boot Params [0] Primary = Image 0 [1] Primary = Image 1 ====================== [VR9 Boot]:
Bootloader
The device uses brnboot as bootloader. With more recent versions of brnboot, Arcadyan got more imaginative with their obfuscation/encryption algorhytms.
Buttons
→ hardware.button on howto use and configure the hardware button(s).
Hardware
Info
| Instruction set | MIPS |
|---|---|
| Vendor | Lantiq |
| bootloader | brnboot |
| System-On-Chip | Lantiq VR9 |
| CPU @Frq | MIPS 34KEc @500MHz |
| Flash size | 8 MiB |
| Flash Chip | MXIC MX29LV640EB |
| RAM size | 64 MiB |
| RAM Chip | Zentel A3S12D40ETP-G6 |
| ISDN | ? |
| Wireless | BCM43222 |
| switch | intern |
| Modem | VDSL2 |
| USB | Yes |
| Serial | Yes |
| JTAG | ? |
Photos
Front
Insert photo of case frontside
Rear
Insert photo of case backside
Opening the case
Note: This will void your warranty!
Main PCB
Insert photo of main PCB
Serial
→ port.serial general information about the serial port, serial port cable, etc.
J8 is located between the RAM Chip and the CPU. Pin 1 is marked by an arrow.
| Pin | use |
|---|---|
| 4 | GND |
| 3 | RX |
| 2 | TX |
| 1 | Vcc 3.3V |
Serial connection parameters: 115200, 8N1
Debricking
Bootlogs
U-Boot ram image bootlog
[VR9 Boot]:Y Go to Memory Address: (default:0x80002000) : 0x80100000 Jump to address 0x80100000 ... U-Boot 2013.10-openwrt4 (Jun 18 2014 - 22:59:48) EASY80920 Board: Lantiq EASY80920 VRX200 Family Board SoC: Lantiq VRX288 v1.1 CPU: 500 MHz IO: 200 MHz BUS: 200 MHz BOOT: NOR DRAM: 64 MiB Flash: 8 MiB NAND: 0 MiB Using default environment In: serial Out: serial Err: serial SPI: ready Net: ltq-eth EASY80920 #
OEM bootlog
ROM VER: 1.0.5 CFG 01 VRX family DDR Access auto data-eye tuning Rev 0.1a DDR check ok... start booting... ======================================================================= Wireless ADSL IAD VR9 Loader v1.01.00 build Aug 13 2010 11:48:41 Arcadyan Technology Corporation ======================================================================= MXIC MX29LV640EB bottom boot 16-bit mode found Copying boot params.....DONE Press Space Bar 3 times to enter command mode ... Get Primary to 0..... Flash Checking Passed. Unzipping firmware at 0x80002000 ... with AREA[2][ZIP 3] [ZIP Extra] [ZIP 1] done Ready to run firmware In c_entry() function ... install_exception Co config = 80048483 sys_irq_init ... IrqConnect : IRQ = 53, Handler = 0x8001E76C VR9 is not A21 chip !!!!, ifx_bsp_basic_mps_decrypt bfc01ea4 0xbf106a10 : 78 0xbf106a11 : 0 0xbf106a0c : 88 ##### _ftext = 0x80002000 ##### _fdata = 0x80BA75B0 ##### __bss_start = 0x80C7BEE5 ##### end = 0x83B08850 allocate_memory_after_end: alloc from 83B10850 to 83BE51A0, length=870709 ##### Backup Data from 0x80BA75B0 to 0x83B10850~0x83BE5185 len 870709 ##### Backup Data completed ##### Backup Data verified [GPIO FLOW] SetGpio() Begin .. BF103008 : 9ba67017 BF103004 : b01f23 BF10734C :CHIP LOC 13250e BF107354 :ID0 1040203 BF107358 :ID1 800496 LOT :ID 0x049601040203 -->192411083 PLL1 locked..fails 0. ifx_gpio_init() !!! ifx_gpio_pre_init() !!! [KERN_INFO]IFX GPIO driver, version 1.2.10, (c)2009 Infineon Technologies AG Register LED MODULE OK!! Register BUTTON MODULE OK!! [GPIO FLOW] SetGpio() End. [INIT] System Log Pool startup ... [INIT] MTinitialize .. CPU Clock 500000000 Hz mips_counter_frequency:250000000 r4k_offset: 0x0003d090(250000) init_US_counter : time1 = 30 , time2 = 225105, diff 225075 US_counter = 112 set to constant US_counter = 112 cnt1 2040034 cnt2 2042598, diff 2564 cnt1 2886380 cnt2 2888212, diff 1832 Runtime code version: 1.32.000 System startup... [INIT] Memory COLOR 0, 6932160 bytes .. [INIT] Memory COLOR 1, 1572864 bytes .. [INIT] Memory COLOR 2, 5401584 bytes .. InitCommSys: RESOURCE_BASE = 136, NUMRES = 640 InitCommSys: EVENT_BASE = 333, NUMEVT = 818 InitCommSys: MAILBOX_BASE = 6, NUMMBX = 64 rzMemory start: 0x81EDB984, end 0x820AF3FC, size 1915512 Build Day = Oct 4 2013 >>>>set_MP_pass_Magic to 4 MXIC MX29LV640EB bottom boot 16-bit mode found Set flash memory layout to FL2MacAddr=74:31:70:74:51:FF CMP_MACADDR=74:31:70:74:51:FE WLAN_MAC=74:31:70:74:52:02 Boot Parameters found !!! Use Flash Data as COSIC Parameters >>>>>>>>>>>>>>>>>> HWOption set BMC Param : ucOscTrimValLOW bf >>>>>>>>>>>>>>>>>> HWOption set BMC Param : g_ucOscTrimValHigh 1 Bootcode version: v1.01.00 Serial number: J143097712 Hardware version: 01 WPA Key is from MAC and SN pBootParams->password 32 35 30 (20) Entered default password checking 8 8 fread_config_b> sizeof(struct III_Config_t) is 445932 MXIC MX29LV640EB bottom boot 16-bit mode found fread_config_b> 29644 bytes read from flash decomp_buf2buf_impl> buffer size *M=4014068 Decompression ratio = 0.1 fread_config_b> 471348 bytes decompressed successfully. 82d3b5d0 my CFGVersionMagic = 33343536 my CFGsize = 445952, my CFGDescSize = 44620 my Version = 1.32.000 My CfgHexSize:14721 My CFGDescSize:44620 old CFGVersionMagic on flash = 33343536 CFGsize on flash = 445952, CFGDescSize on flash = 44620 Version on flash = 1.32.000 === Old CfgHexSize = 14721, Old CFGDescSize = 44620 Unzipping from 81B84E84 to 81B7A028 ... unzip_address sig 5d000080 pre, zipfile=0x81b84e84, unzipfile=0x81b7a028 unzip_address sig 8000005d end [ZIP 1] allocate_memory_after_end: alloc from 83BE51A0 to 83BF9020, length=81516 [ZIP 1 49492c30] done Uncompressed size = 44618 Tail1 : END_III_Config_t Size of Old CFG_DESC is :44618!!! 1.useCfgDesc:1 Unzipping from 81B7668C to 81B6B830 ... unzip_address sig 5d000080 pre, zipfile=0x81b7668c, unzipfile=0x81b6b830 unzip_address sig 8000005d end [ZIP 1] [ZIP 1 49492c30] done Uncompressed size = 44618 2.useCfgDesc:1 Tail : END_III_Config_t useCfgDesc:3 Restore Config file from ver: 1.32.000 !!! to copy from gConfig to gSetting in restore_config DS_Tail:[t_VGV8539JW] RELEASE_BUF_AND_RETURN_OK - restore_config_new() #17046, in vr9/config.c - restore_config_new() #17047, in vr9/config.c restore config OK. nCfgDescLen=460681. -----------------------> Checking SysLog in Flash OK. nLen=10667 syslog_reload_restore> nLogCount=3, offset=204 -----------------------> Restore SysLog from Flash 204 bytes from 7078f -----------------------> Restore Call Log from Flash 10457 bytes from 70862 not factory settings in_Factory_default=0 boot parameter wireless_channel=0,255 [updateConfig] flash version:[1.32.000], [1.32.0.100] [updateConfig] code version:[1.32.000], [1.32.0.100] ====xxx==============================-->425@-230;600(.4/.4/1,.4/3/1) -->425@-230;60(.2/.2/1,.2/5/1) -->600(.9/4.8) -->600(.3/.5,.3/3) -->600(.9/3.9) IsWanUplinkEnabled returns 0 Disable UART TX