AVM FRITZ!Box Fon WLAN 7112
The FRITZ!Box Fon WLAN 7112 is a small DSL router that is also sold with DSL contracts from DSL provider 1&1 in Germany.
Supported Versions
Not supported (April 2017). Try freetz for custom stock firmware.
Maybe this version could work, but untested: https://archive.openwrt.org/backfire/10.03.1/ar7/openwrt-EVA-2.6-squashfs.bin
Hardware Highlights
SoC | Ram | Flash | Network | USB | Serial | JTag |
---|---|---|---|---|---|---|
AR7 | 32 MiB | 8 MiB | 1x | maybe | 2x | unknown |
Manufacturer's site: http://avm.de/service/fritzbox/fritzbox-7112/uebersicht/
Forum: (No forum topics)
Installation
There is no OpenWrt support for this device at the moment.
Flash Layout
This is the MTD layout of the vendor firmware from /proc/mtd
dev | size | erasesize | name |
---|---|---|---|
mtd0 | 0x800000 | 0x10000 | “phys_mapped_flash” |
mtd1 | 0x6d3000 | 0x10000 | “filesystem” |
mtd2 | 0x770000 | 0x10000 | “kernel” |
mtd3 | 0x10000 | 0x10000 | “bootloader” |
mtd4 | 0x40000 | 0x10000 | “tffs (1)” |
mtd5 | 0x40000 | 0x10000 | “tffs (2)” |
mtd6 | 0x200000 | 0x10000 | “jffs2” |
mtd7 | 0x570000 | 0x10000 | “Kernel without jffs2” |
MTD partitions as seen in /var/env
partition | ||
---|---|---|
mtd0 | 0x90000000 | 0x90000000 |
mtd1 | 0x90010000 | 0x90780000 |
mtd2 | 0x90000000 | 0x90010000 |
mtd3 | 0x90780000 | 0x907C0000 |
mtd4 | 0x907C0000 | 0x90800000 |
Failsafe mode
Buttons
The Fritz!Box Fon WLAN 7112 has one button.
BUTTON | Event |
---|---|
WLAN | WLAN on/off |
Vendor firmware
These are the default settings for the vendor firmware:
- IP address: 192.168.178.1 (with DHCP server, served IPs start at 192.168.178.20)
- WLAN SSID: Fritz!Box Fon WLAN 7112
- password: no password
- Telnet: disabled
Enable/disable telnet
Telnet access can be enabled by connecting a telephone to one of the telephone ports and dialing the number #96*7*. The Fritz!Box will answer with one dial tone. Disabling telnet can be done with dialing #96*8*.
Hardware
Info
Instruction set | MIPS |
---|---|
bootloader | EVA (Version 1.607) |
System-On-Chip | AR7 OHIO (Infineon PSB7200ZDW) |
CPU @Frq | MIPS 4KEc V4.8 @ 125 MHz |
Flash size | 8192 KiB |
Flash Chip | MACRONIX Top-Flash 8MB |
RAM size | 32 MiB |
RAM Chip | |
Wireless | PSB1350A |
switch | n/a |
Modem | (DSL Annex-B) |
USB | No USB port, may be possible |
Serial | 2x |
JTAG | unknown |
Devices/Drivers
Interrupts
- 1: System timer (OHIO System)
- 6: OHIO primary (OHIO System)
- 15: serial (OHIO primary)
- 23: SAR (OHIO primary)
- 27: Cpmac driver (OHIO primary)
- 28: ubki2_swirq (OHIO primary)
- 31: DSL (OHIO primary)
Ethernet
Driver: avm_cpmac
Clocks
There are several clocks installed as part of the OHIO system. The list below shows their frequencies when using the vendor firmware (found in /proc/clocks)
- CPU: 125000 kHz
- System: 125000 kHz
- USB: 100000 kHz
- DSP: 211968 kHz
- VLYNQ: 0 kHz
Photos
Opening the case
Note: This will void your warranty!
To open the case you need a small flat screwdriver. However there are no screws you need to unscrew.
- First you have to remove the reflecting plastic cover. You need to place the small screwdriver between the cover and the case. Then you need to lever the cover with the screwdriver.
- The case is splitted into an upper and lower part. On all sides there is a slit where both parts of the case are put together. You need to place the small screwdriver in one edge at the slit and lever the upper part of the case.
- To unmount the PCB you have to use the small screwdriver and lever the pcb on one of the frond edges.
Photo of PCB
Serial
→ port.serial general information about the serial port, serial port cable, etc.
There are two serial ports available: tty0 and tty1. tty0 is for booting. The serial mode for both ports is: 38400,n,8,1,hw
How to connect to the Serial Port of this specific device:
FritzBox7112 | 3V3 | RX | TX | GND | serial mode |
Board | square | cirlce | cirlce | cirlce | |
Siemens Data Cable | white | blue | black | sudo screen /dev/ttyUSB0 38400 | |
Cutecom: Rate: 38400, Flow: none, Data: 8, Stop: 1, Parity: none → got no input @BoxFTPMode |
Photo of PCB with markings
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device: TODO
Photo of PCB with markings
Backup Firmware
FTP
connection to FritzBox: Lan, Serial (optional)
backup via FTP did not work for: “(AVM) EVA Revision: 1.607 Version: 1607” → Error: 502 Command not implemented → use TFTP
- set PC-Lan-IP to: 192.168.178.3, Sub: 255.255.255.0, Gateway: 192.168.178.1
- start serial terminal
- power on FritzBox → interrupt boot immediately pressing a key in serial terminal, then start FTP connection
- OR power on FritzBox → immediately start FTP connection (did not work? - try again connecting a bit later), first 5seconds it accepts ftp connections - ping 192.168.178.1 for 5sec can help
- Bonus for full backup: mtd3 (tffs1) & mtd4 (tffs2)
ftp 192.168.178.1 Connected to 192.168.178.1. 220 ADAM2 FTP Server ready Name (192.168.178.1:..): adam2 331 Password required for adam2 Password: adam2 230 User adam2 successfully logged in Remote system type is AVM. ftp> quote MEDIA FLSH 200 Media set to MEDIA_FLASH ftp> passive Passive mode on. ftp> binary 200 Type set to BINARY ftp> get mtd2 urloader_backup.image 227 Entering Passive Mode (192,168,178,1,6,193) 150 Opening BINARY data connection ^C <-- press: CTRL-C, not too early - wait for data beeing transferred receive aborted waiting for remote to finish abort 226 Transfer complete 502 Command not implemented 65536 bytes received in 67.12 secs (1.0 kB/s) <-- size of "65536 bytes received" matters, kB/s is faulty if CTRL-C was used ftp> get mtd1 firmware_backup.image 227 Entering Passive Mode (192,168,178,1,6,193) 150 Opening BINARY data connection ^C <-- press: CTRL-C, not too early - wait for data beeing transferred receive aborted waiting for remote to finish abort 226 Transfer complete 502 Command not implemented xxxxxxxx bytes received in xx.xx secs (xx.x kB/s) <-- size of "xxxxxxxx bytes received" matters, kB/s is faulty if CTRL-C was used ftp> quote REBOOT ftp> quit
Serial & TFTP
- get required packages: sudo apt-get install python python-tk
- set PC-Lan-IP to: 192.168.178.3, Sub: 255.255.255.0, Gateway: 192.168.178.1
- start tftpgui: sudo python tftpgui.py
- start serial terminal, e.g.: sudo screen /dev/ttyUSB0 38400
- power on FritzBox and wait till boot finished
- press Enter to activate BusyBox console:
cat /proc/mtd cat /dev/mtdblock3 | tftp -p -l - -r urlader.image 192.168.178.3 cat /dev/mtdblock7 | tftp -p -l - -r firmware.image 192.168.178.3
- images should be in ../tftpgui/tftproot
Flash Firmware
Web Interface
Default IP: 192.168.178.1
Emergency IP: Box is always available on http://169.254.1.1. Set PC-IP address manually in range of 169.254.1.x
If a default password is set try: 0000
Web Interface works in most cases if image fits.
FTP
Debricking
→ get stock firmware → rename it to .tar → find and extract kernel.image → flash kernel.image
→ bootloop of a faulty device → build a minimal firmware.image:
- make menuconfig
- check everything @ “Removal patches” except “Remove WLAN”
- @ “Other patches” disable all “AVM daemons”
- rename firmware to .tar → find and extract kernel.image → flash kernel.image
Bootlogs
OEM bootlog
(AVM) EVA Revision: 1.607 Version: 1607 (C) Copyright 2005 AVM Date: Feb 25 2009 Time: 09:44:53 (3) 2 0x0-0x419 [FLASH:] MACRONIX Top-Flash 8MB [FLASH:](Eraseregion [0] 127 sectors a 64kB) [FLASH:](Eraseregion [1] 8 sectors a 8kB) [SYSTEM:] OHIO on 125MHz/125MHz syncron Eva_AVM > [cpmac]<no link> AVM decompress Kernel: ....................executeProgram on 0x941DA000 [ohio_pre_init] System Clk = 62500000 Hz LINUX started... Linux version 2.6.13.1-ohio (3964) (gcc-Version 3.4.6) #1 Thu May 5 17:38:55 CEST 2011 memsize=32 MByte flashsize=8 MByte &_end=0x942317d4 PFN_ALIGN(&_end)=0x94232000 CPHYSADDR(PFN_ALIGN(&_end))=0x14232000 memsize=0x2000000 CPU revision is: 00018448 [ohio_gpio_init] Determined physical RAM map: memory: 00232000 @ 14000000 (reserved) memory: 01dce000 @ 14232000 (usable) On node 0 totalpages: 8192 [alloc_node_mem_map] reduce size from 2883616 Bytes to 262176 Bytes [alloc_node_mem_map]: (org) sizeof(mem_map) = 262176 mem_map=0x94235000-0x94275020 [alloc_node_mem_map]: sizeof(mem_map) = 2883616 mem_map=0x93fb5000-0x94275020 zone=0 zone_size[j]=0x90112 realsize=8192 DMA zone: 8192 pages, LIFO batch:3 zone=1 zone_size[j]=0x0 realsize=0 Normal zone: 0 pages, LIFO batch:1 zone=2 zone_size[j]=0x0 realsize=0 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: console=ttyS0,38400n8r [ld_mmu_r4xx0] memcpy((void *)(CAC_BASE + 0x100), &except_vec2_generic, 0x30) Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes. Primary data cache 8kB, 4-way, linesize 16 bytes. Synthesized TLB refill handler (20 instructions). Base=0x941f4a0c TLB synthesizer field overflow (simm) Synthesized TLB load handler fastpath (34 instructions) Base=0x941f8620. TLB synthesizer field overflow (simm) Synthesized TLB store handler fastpath (34 instructions) Base=0x941f8820. TLB synthesizer field overflow (simm) Synthesized TLB modify handler fastpath (33 instructions) Base=0x941f8a20. PID hash table entries: 256 (order: 8, 4096 bytes) CPU frequency 125.00 MHz Using 62.500 MHz high precision timer. [setup_irq]: irq 255 irqaction->handler 0x94041dc0 () [register_console] enable commandline console 0 Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 30140k/30520k available (1588k kernel code, 320k reserved, 303k data, 116k init, 0k highmem) totalram_pages= 7550 Calibrating delay loop... 124.51 BogoMIPS (lpj=622592) loops_per_jiffy=622592 Mount-cache hash table entries: 512 Checking for 'wait' instruction... available. NET: Registered protocol family 16 Can't analyze prologue code at 9418b7c4 Squashfs 2.2-r2b (released 2006/02/23) (C) 2002-2005 Phillip Lougher avm_net_trace: Up and running. [avm_power]Ohio250 detected -> overclocking possible [avm] configured: watchdog eventled enable shift register enable direct gpio gpio usage: reset=12 clock=13 store=10 data=9 AR7WDT: Watchdog Driver for AR7 Hardware (Version 1.0, build: May 5 2011 17:35:56) Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled [uart_add_one_port] ttyS0 at MMIO 0x0 (irq = 15) is a OHIO_UART [uart_add_one_port] dont register console port->type = 16 port->cons = 0x941ce300 port->cons->flags = 0x7 [uart_add_one_port] success io scheduler noop registered [cpmac] Version: 1.129 - Revision 790:1110 - Do 5.05.2011 17:37:27 [cpmac] [cpmac_if_register] dev eth0 (phy_id 0) registered tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> physmap flash device: 400000 at 10000000 phys_mapped_flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 phys_mapped_flash: Swapping erase regions for broken CFI table. number of CFI chips: 1 RedBoot partition parsing not available Generic platform RAM MTD, (c) 2004 Simtec Electronics Ohio flash driver (size->0x400000 mem->0x10000000) flash_size=0x800000 flash_mask=0xffffff Ohio flash memory: Found 1 x16 devices at 0x0 in 16-bit bank [genprobe_ident_chips] 4 i 0 j 0 [genprobe_ident_chips] 5 i 0 j 1 Amd/Fujitsu Extended Query Table at 0x0040 Ohio flash memory: Swapping erase regions for broken CFI table. number of CFI chips: 1 [mtd]: set to default: jffs2_size = 0x20 * 64KByte (0x200000 Bytes) [ohio_find_hidden_filesystem]: super block found: bytes_used: 0x4c0c46/4983878 [init_ohio_flash] find hidden filesystem size=0x6d3000 offset=0xad000 [mtd] configure jffs2 partition [mtd] fs_size=0x560000 max=0x210000 is=0x200000 max jffs2_size value 33 [mtd] ohio_flash_map: name=Ohio flash memory bankwidth=2 virt=0xb0000000 phys=0x10000000 size=0x800000 Creating 7 MTD partitions on "Ohio flash memory": 0x000ad000-0x00780000 : "filesystem" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' mtd: partition "filesystem" doesn't start on an erase block boundary -- force read-only 0x00010000-0x00780000 : "kernel" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' 0x00000000-0x00010000 : "bootloader" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' 0x00780000-0x007c0000 : "tffs (1)" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' 0x007c0000-0x00800000 : "tffs (2)" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' 0x00580000-0x00780000 : "jffs2" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' 0x00010000-0x00580000 : "Kernel without jffs2" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' partition_info[0]: name=filesystem offset=ad000 size=6d3000 partition_info[0]: 0xb00ad000: 0x73717368 0xd69 partition_info[1]: name=kernel offset=10000 size=770000 partition_info[1]: 0xb0010000: 0xfeed1281 0x9cefa partition_info[2]: name=bootloader offset=0 size=10000 partition_info[2]: 0xb0000000: 0x40809000 0x40809800 partition_info[3]: name=tffs (1) offset=780000 size=40000 partition_info[3]: 0xb0780000: 0x40001 0xc5fdffff partition_info[4]: name=tffs (2) offset=7c0000 size=40000 partition_info[4]: 0xb07c0000: 0x40001 0xc6fdffff partition_info[5]: name=jffs2 offset=580000 size=200000 partition_info[5]: 0xb0580000: 0xffffffff 0xffffffff partition_info[6]: name=Kernel without jffs2 offset=10000 size=570000 partition_info[6]: 0xb0010000: 0xfeed1281 0x9cefa NET: Registered protocol family 2 IP route cache hash table entries: 512 (order: -1, 2048 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered TCP bic registered mcfw: IGMPv3 fast forwarding NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 8 NET: Registered protocol family 20 [setup_irq]: irq 1 irqaction->handler 0x94001590 () [setup_irq]: irq 6 irqaction->handler 0x940015a4 () [ohio_late_init] [avm_new] push_button_gpio=8 value=0 enabled TFFS: tiny flash file system driver. GPL (c) AVM Berlin (Version 2.0) mount on mtd4 and mtd5 (double buffering) Adam2 environment variables API installed. [prepare_namespace] new mount root /dev/mtdblock1 use lzma compression VFS: Mounted root (squashfs filesystem) readonly. Freeing prom memory: 0kb freed Freeing unused kernel memory: 116k freed (7579 free) [setup_irq]: irq 15 irqaction->handler 0x940d9cdc () 3init started: BusyBox v1.8.2 (2009-04-22 13:54:57 CEST) starting pid 99, tty '/dev/console': '/etc/init.d/rc.S' AR7WDT: System Init UEberwachung 120 Sekunden TFFS Name Table H mknod: /var/flash/ar7.cfg: File exists P-Defaults: do nothing checkempty: : No such file or directory Piglet_noemif: module license ' (C) Copyright 2007 by AVM ' taints kernel. Piglet_noemif: Ignoring new-style parameters in presence of obsolete ones [piglet]use gpio-settings for 159 [piglet]bitfile '/lib/modules/bitfile.bit' change : vlynq clock 70656000 [piglet] Read 72761 bytes total from file attempting to load DSL Firmware '/lib/modules/microvoip-dsl.bin' **** ANNEX: 'B' ************************************* setting DSL Firmware to Annex B EOC info: product_name='FRITZ!BoxFonWLAN7112(UI)' registered device TI Avalanche SAR tiatm driver (patch_annex=0xc0057e4c) [tiatm] Set StrictPriority=0 DSP binary filesize = 322952 bytes [dsl_ur8] dsl serial number successfully set to "465249545a21426f78466f6e574c414e37313132433032353036414534424135" [tiatm] INFO V2U-BRIDGEREGISTER: 0x00000019 [avm_power]Ohio250 detected -> overclocking possible [avm_power]#### boostVoltage: DSP Core voltage set to 1,5 V #### [setup_irq]: irq 23 irqaction->handler 0xc0043208 () [setup_irq]: irq 31 irqaction->handler 0xc0043258 () [tiatm]: Powermanagment (States => 1,3,10) supported! Texas Instruments ATM driver: version:[4.08.02.01] [tiatm] AvmInterface length: 44 ubik2 driver (ubik2 - 0x10=0xc006a094) atm_dsp_register_ubik2: ubik2_ToMIPS_notify=0xc005bbfc atm_dsp_register_ubik2: dsp mem pointer 0xa1c107cc ubik2_init_interface: DSP-Link Version v3 8480 [ubik2_debug]redirect kernel-messages (/dev/debug) [4294938594][isdn]svn:2812 driver params overwritten io_addr=0x0 irq_num=0 [setup_irq]: irq 28 irqaction->handler 0xC0066AF0 () [4294938596]CPU-Clk: 62 * 2 MHz [4294938597]DSP-Fw: Version 3.495] EC=3 DTMF=0 Slots=6 BChan=5(Analog=3) DChan=1 Fifo=128 Bitfile: no EMIF capicodec_init() [capi_codec] support fax [capi_codec] support Codecs kdsldmod: init start (Feb 9 2014 14:16:12) sizeof(struct sk_buff)=176 kdsldmod: init done /etc/init.d/rc.net: line 415: websrv: not found [4294939595]DSP: XDU=0( ) OVR=0 MIPS_OVR=2 [setup_irq]: irq 27 irqaction->handler 0x940EA74C () [cpmac] [cpmac_main_ioctl] unknown ioctl 35142 device eth0 entered promiscuous mode MAC WLAN: C0:25:06:AE:4B:A4 WLAN is not enabled Jan 1 01:00:24 multid[355]: DHCPD on lan:0 skipped, is virtual interface ifconfig: SIOCGIFFLAGS: No such device ifconfig: SIOCGIFFLAGS: No such device ifconfig: SIOCGIFFLAGS: No such device ifconfig: SIOCGIFFLAGS: No such device ifconfig: SIOCGIFFLAGS: No such device ifconfig: SIOCGIFFLAGS: No such device eth: port 0 status 2 throttle 0 [avm_power] : ethernet not registered eth: port 1 status 1 throttle 1 [avm_power] : ethernet not registered eth: port 2 status 1 throttle 1 [avm_power] : ethernet not registered eth: port 3 status 1 throttle 1 [avm_power] : ethernet not registered Jan 1 01:00:26 telefon[375]: use clock_gettime(CLOCK_MONOTONIC)! Jan 1 01:00:27 telefon[375]: NoOldMSNNames Jan 1 01:00:27 telefon[375]: SIGCHLD received! Jan 1 01:00:27 telefon[375]: WARNING No config file '/var/flash/fx_def' ! [capi_oslib] capi_installed [capi_oslib] capi_installed create sema UPNPAPI_DATA_phonebook run_clock demon started AR7WDT: System Init UEberwachung abgeschlossen (93310 ms noch verfuegbar) [avm_power] pm_ressourceinfo_scriptparse: powerdevice_cpuclock: norm_power_rate=100 act_rate=58 mul=0 div=1 offset=0 NormP=0 mW -> SumNormP=0 mW [avm_power] pm_ressourceinfo_scriptparse: powerdevice_dspclock: norm_power_rate=100 act_rate=84 mul=154 div=10 offset=974 NormP=2514 mW -> SumNormP=2514 mW [avm_power] pm_ressourceinfo_scriptparse: powerdevice_systemclock: norm_power_rate=100 act_rate=83 mul=65 div=10 offset=1793 NormP=2443 mW -> SumNormP=4957 mW [avm_power] pm_ressourceinfo_scriptparse: powerdevice_wlan: norm_power_rate=100 act_rate=0 mul=84 div=10 offset=100 NormP=940 mW -> SumNormP=5897 mW Please press Enter to activate this console. starting pid 406, tty '/dev/console': '/bin/sh' BusyBox v1.8.2 (2009-04-22 13:54:57 CEST) built-in shell (ash) Enter 'help' for a list of built-in commands. ermittle die aktuelle TTY tty is "/dev/console" Serielles Terminal # userman: device registerd with major=228 cat: read error: Broken pipe # reboot starting pid 471, tty '/dev/console': '/bin/sh' # unmounting '/var/media/ftp/*' .. unload dsl and dependend driver .. Jan 1 01:26:01 telefon[379]: SIGTERM received! Jan 1 01:26:01 pbd[388]: received signal: Terminated. Jan 1 01:26:01 pbd[394]: received signal: Terminated. Jan 1 01:26:01 pbd[395]: received signal: Terminated. Jan 1 01:26:02 pbd[388]: terminating. rmmod: rfcntl rmmod: isdn_fbox_fon5 rmmod: isdn_fbox_fon4 rmmod: isdn_fbox_fon2 rmmod: isdn_fbox_fon rmmod: ulpcmlink rmmod: dect_io rmmod: avm_dect rmmod: pcmlink rmmod: userman rmmod: kdsldmod PID Uid VSZ Stat Command 1 root 1308 S init 2 root SWN [ksoftirqd/0] 3 root SW< [events/0] 4 root SW< [khelper] 5 root SW< [kthread] 6 root SW< [kblockd/0] 23 root SW< [pdflush] 24 root SW< [pdflush] 26 root SW< [aio/0] 25 root SW [kswapd0] 62 root SW [pm_info] 66 root SW< [CPMAC] 70 root SW [mtdblockd] 96 root SW [tffsd_mtd_0] 261 root SW< [capi_oslib] 263 root Z [capitransp] 345 root Z N [ctlmgr] 350 root 5112 S upnpd 355 root 3836 S multid 371 root Z [dsld] 379 root Z [telefon] 383 root Z < [voipd] 388 root Z [pbd] 397 root 860 S /bin/run_clock -c /dev/tffs -d 406 root 1324 S -sh 416 root 5112 S upnpd 417 root 5112 S upnpd 418 root 5112 S upnpd 419 root Z N [ctlmgr] 420 root Z N [ctlmgr] 421 root Z N [ctlmgr] 431 root Z [usermand] 470 root 1308 S init 471 root 1308 S /bin/sh -c /var/post_install 472 root 1316 S /bin/sh /var/post_install 659 root 1328 S /bin/sh /etc/init.d/rc.dsl.sh stop 763 root 1308 R ps Module S[avm_power]pm_ressourceinfo_thread: exit ize Used by Tainted: P kdsldmod 769712 2 Piglet_noemif 4816 0 system is going down .. The system is going down NOW! Sending SIGTERM to all processes SendiRequesting system reboot Restarting system.
Freetz bootlog
Freetz-devel-14237, default config:
(AVM) EVA Revision: 1.607 Version: 1607 (C) Copyright 2005 AVM Date: Feb 25 2009 Time: 09:44:53 (3) 2 0x0-0x419 [FLASH:] MACRONIX Top-Flash 8MB [FLASH:](Eraseregion [0] 127 sectors a 64kB) [FLASH:](Eraseregion [1] 8 sectors a 8kB) [SYSTEM:] OHIO on 125MHz/125MHz syncron Eva_AVM >AVM decompress Kernel: ....................executeProgram on 0x941DA000 [ohio_pre_init] System Clk = 62500000 Hz LINUX started... Linux version 2.6.13.1-ohio (3964) (gcc-Version 3.4.6) #1 Thu May 5 17:38:55 CEST 2011 memsize=32 MByte flashsize=8 MByte &_end=0x942317d4 PFN_ALIGN(&_end)=0x94232000 CPHYSADDR(PFN_ALIGN(&_end))=0x14232000 memsize=0x2000000 CPU revision is: 00018448 [ohio_gpio_init] Determined physical RAM map: memory: 00232000 @ 14000000 (reserved) memory: 01dce000 @ 14232000 (usable) On node 0 totalpages: 8192 [alloc_node_mem_map] reduce size from 2883616 Bytes to 262176 Bytes [alloc_node_mem_map]: (org) sizeof(mem_map) = 262176 mem_map=0x94235000-0x94275020 [alloc_node_mem_map]: sizeof(mem_map) = 2883616 mem_map=0x93fb5000-0x94275020 zone=0 zone_size[j]=0x90112 realsize=8192 DMA zone: 8192 pages, LIFO batch:3 zone=1 zone_size[j]=0x0 realsize=0 Normal zone: 0 pages, LIFO batch:1 zone=2 zone_size[j]=0x0 realsize=0 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: console=ttyS0,38400n8r [ld_mmu_r4xx0] memcpy((void *)(CAC_BASE + 0x100), &except_vec2_generic, 0x30) Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes. Primary data cache 8kB, 4-way, linesize 16 bytes. Synthesized TLB refill handler (20 instructions). Base=0x941f4a0c TLB synthesizer field overflow (simm) Synthesized TLB load handler fastpath (34 instructions) Base=0x941f8620. TLB synthesizer field overflow (simm) Synthesized TLB store handler fastpath (34 instructions) Base=0x941f8820. TLB synthesizer field overflow (simm) Synthesized TLB modify handler fastpath (33 instructions) Base=0x941f8a20. PID hash table entries: 256 (order: 8, 4096 bytes) CPU frequency 125.00 MHz Using 62.500 MHz high precision timer. [setup_irq]: irq 255 irqaction->handler 0x94041dc0 () [register_console] enable commandline console 0 Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 30140k/30520k available (1588k kernel code, 320k reserved, 303k data, 116k init, 0k highmem) totalram_pages= 7550 Calibrating delay loop... 124.51 BogoMIPS (lpj=622592) loops_per_jiffy=622592 Mount-cache hash table entries: 512 Checking for 'wait' instruction... available. NET: Registered protocol family 16 Can't analyze prologue code at 9418b7c4 Squashfs 2.2-r2b (released 2006/02/23) (C) 2002-2005 Phillip Lougher avm_net_trace: Up and running. [avm_power]Ohio250 detected -> overclocking possible [avm] configured: watchdog eventled enable shift register enable direct gpio gpio usage: reset=12 clock=13 store=10 data=9 AR7WDT: Watchdog Driver for AR7 Hardware (Version 1.0, build: May 5 2011 17:35:56) Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled [uart_add_one_port] ttyS0 at MMIO 0x0 (irq = 15) is a OHIO_UART [uart_add_one_port] dont register console port->type = 16 port->cons = 0x941ce300 port->cons->flags = 0x7 [uart_add_one_port] success io scheduler noop registered [cpmac] Version: 1.129 - Revision 790:1110 - Do 5.05.2011 17:37:27 [cpmac] [cpmac_if_register] dev eth0 (phy_id 0) registered tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> physmap flash device: 400000 at 10000000 phys_mapped_flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 phys_mapped_flash: Swapping erase regions for broken CFI table. number of CFI chips: 1 RedBoot partition parsing not available Generic platform RAM MTD, (c) 2004 Simtec Electronics Ohio flash driver (size->0x400000 mem->0x10000000) flash_size=0x800000 flash_mask=0xffffff Ohio flash memory: Found 1 x16 devices at 0x0 in 16-bit bank [genprobe_ident_chips] 4 i 0 j 0 [genprobe_ident_chips] 5 i 0 j 1 Amd/Fujitsu Extended Query Table at 0x0040 Ohio flash memory: Swapping erase regions for broken CFI table. number of CFI chips: 1 [mtd]: set to default: jffs2_size = 0x20 * 64KByte (0x200000 Bytes) [ohio_find_hidden_filesystem]: super block found: bytes_used: 0x4c4035/4997173 [init_ohio_flash] find hidden filesystem size=0x6d3000 offset=0xad000 [mtd] configure jffs2 partition [mtd] fs_size=0x570000 max=0x200000 is=0x200000 max jffs2_size value 32 [mtd] ohio_flash_map: name=Ohio flash memory bankwidth=2 virt=0xb0000000 phys=0x10000000 size=0x800000 Creating 7 MTD partitions on "Ohio flash memory": 0x000ad000-0x00780000 : "filesystem" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' mtd: partition "filesystem" doesn't start on an erase block boundary -- force read-only 0x00010000-0x00780000 : "kernel" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' 0x00000000-0x00010000 : "bootloader" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' 0x00780000-0x007c0000 : "tffs (1)" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' 0x007c0000-0x00800000 : "tffs (2)" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' 0x00580000-0x00780000 : "jffs2" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' 0x00010000-0x00580000 : "Kernel without jffs2" 'nor-flash' 'Bits can be cleared (flash)' 'Has an erase function' partition_info[0]: name=filesystem offset=ad000 size=6d3000 partition_info[0]: 0xb00ad000: 0x73717368 0x9c4 partition_info[1]: name=kernel offset=10000 size=770000 partition_info[1]: 0xb0010000: 0xfeed1281 0x9cefa partition_info[2]: name=bootloader offset=0 size=10000 partition_info[2]: 0xb0000000: 0x40809000 0x40809800 partition_info[3]: name=tffs (1) offset=780000 size=40000 partition_info[3]: 0xb0780000: 0x40001 0xc3fdffff partition_info[4]: name=tffs (2) offset=7c0000 size=40000 partition_info[4]: 0xb07c0000: 0x40001 0xc4fdffff partition_info[5]: name=jffs2 offset=580000 size=200000 partition_info[5]: 0xb0580000: 0xffffffff 0xffffffff partition_info[6]: name=Kernel without jffs2 offset=10000 size=570000 partition_info[6]: 0xb0010000: 0xfeed1281 0x9cefa NET: Registered protocol family 2 IP route cache hash table entries: 512 (order: -1, 2048 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered TCP bic registered mcfw: IGMPv3 fast forwarding NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 8 NET: Registered protocol family 20 [setup_irq]: irq 1 irqaction->handler 0x94001590 () [setup_irq]: irq 6 irqaction->handler 0x940015a4 () [ohio_late_init] [avm_new] push_button_gpio=8 value=0 enabled TFFS: tiny flash file system driver. GPL (c) AVM Berlin (Version 2.0) mount on mtd4 and mtd5 (double buffering) Adam2 environment variables API installed. [prepare_namespace] new mount root /dev/mtdblock1 use lzma compression VFS: Mounted root (squashfs filesystem) readonly. Freeing prom memory: 0kb freed Freeing unused kernel memory: 116k freed (7579 free) [setup_irq]: irq 15 irqaction->handler 0x940d9cdc () 3init started: BusyBox v1.24.2 (2017-04-13 15:50:40 CEST) rootdir=/ table='/etc/device.table' AR7WDT: System Init UEberwachung 120 Sekunden TFFS Name Table H mknod: /var/flash/ar7.cfg: File exists Loading /var/flash/freetz ... done. Loading users, groups and passwords ... done. Loading hosts ... done. Loading config ... done. Loading modules ... done. P-Defaults: do nothing checkempty: : No such file or directory Piglet_noemif: module license ' (C) Copyright 2007 by AVM ' taints kernel. Piglet_noemif: Ignoring new-style parameters in presence of obsolete ones [piglet]use gpio-settings for 159 [piglet]bitfile '/lib/modules/bitfile.bit' change : vlynq clock 70656000 [piglet] Read 72761 bytes total from file attempting to load DSL Firmware '/lib/modules/microvoip-dsl.bin' **** ANNEX: 'B' ************************************* setting DSL Firmware to Annex B EOC info: product_name='FRITZ!BoxFonWLAN7112(UI)' registered device TI Avalanche SAR tiatm driver (patch_annex=0xc0057e4c) [tiatm] Set StrictPriority=0 DSP binary filesize = 322952 bytes [dsl_ur8] dsl serial number successfully set to "465249545a21426f78466f6e574c414e37313132433032353036414534424135" [tiatm] INFO V2U-BRIDGEREGISTER: 0x00000019 [avm_power]Ohio250 detected -> overclocking possible [avm_power]#### boostVoltage: DSP Core voltage set to 1,5 V #### [setup_irq]: irq 23 irqaction->handler 0xc0043208 () [setup_irq]: irq 31 irqaction->handler 0xc0043258 () [tiatm]: Powermanagment (States => 1,3,10) supported! Texas Instruments ATM driver: version:[4.08.02.01] [tiatm] AvmInterface length: 44 ubik2 driver (ubik2 - 0x10=0xc006a094) atm_dsp_register_ubik2: ubik2_ToMIPS_notify=0xc005bbfc atm_dsp_register_ubik2: dsp mem pointer 0xa1c107cc ubik2_init_interface: DSP-Link Version v3 8480 [ubik2_debug]standard kernel-messages driver params overwritten io_addr=0x0 irq_num=0 [setup_irq]: irq 28 irqaction->handler 0xc0066af0 () capicodec_init() [capi_codec] support fax [capi_codec] support Codecs kdsldmod: init start (Feb 9 2014 14:16:12) sizeof(struct sk_buff)=176 kdsldmod: init done /etc/init.d/rc.net: line 416: websrv: not found [setup_irq]: irq 27 irqaction->handler 0x940ea74c () [cpmac] [cpmac_main_ioctl] unknown ioctl 35142 device eth0 entered promiscuous mode lan: port 1(eth0) entering learning state lan: topology change detected, propagating lan: port 1(eth0) entering forwarding state Jan 1 01:00:26 multid[462]: DHCPD on lan:0 skipped, is virtual interface eth: port 0 status 2 throttle 0 [avm_power] : ethernet not registered eth: port 1 status 1 throttle 1 [avm_power] : ethernet not registered eth: port 2 status 1 throttle 1 [avm_power] : ethernet not registered eth: port 3 status 1 throttle 1 [avm_power] : ethernet not registered AVMMULTID: Starting AVM multid ... done. MAC WLAN: C0:25:06:AE:4B:A4 avm_net_trace: New net trace device 'WLAN' registered with minor 128. WSTART (May 5 2011 17:41:31)wlanparams_get2: ver=0, sz=1228 libwlanparam: config ok(1) Wstart - made configure_wpa_authenticator [Wstart] wlan_cal ist gesetzt: NVS DATEI WIRD MIT KALIBRIERUNGSWERTEN GEPATCHT!!! [Wstart] 9 Parameter werden gepatcht: [Wstart] NVS DATEI WURDE GEPATCHT. NVS File loaded. [ohio_vlynq_init] device 0 [ohio_vlynq_startup_link] [setup_irq]: irq 29 irqaction->handler 0x94005c4c () [setup_irq]: irq 79 irqaction->handler 0xc02692dc () userman: LAN Client Internet-Accounting and Blocking userman: device registerd with major=228 userman: init ok wlan started (OK) Wstart - made configure_and_start_ap_driver WSTART: done(0) WLAN is enabled device tiwlan0 entered promiscuous mode lan: port 2(tiwlan0) entering learning state lan: topology change detected, propagating lan: port 2(tiwlan0) entering forwarding state device wdsup0 entered promiscuous mode lan: port 3(wdsup0) entering learning state lan: topology change detected, propagating lan: port 3(wdsup0) entering forwarding state device wdsdw0 entered promiscuous mode lan: port 4(wdsdw0) entering learning state lan: topology change detected, propagating lan: port 4(wdsdw0) entering forwarding state device wdsdw1 entered promiscuous mode lan: port 5(wdsdw1) entering learning state lan: topology change detected, propagating lan: port 5(wdsdw1) entering forwarding state device wdsdw2 entered promiscuous mode lan: port 6(wdsdw2) entering learning state lan: topology change detected, propagating lan: port 6(wdsdw2) entering forwarding state device wdsdw3 entered promiscuous mode lan: port 7(wdsdw3) entering learning state lan: topology change detected, propagating lan: port 7(wdsdw3) entering forwarding state AVMDSLD: Starting AVM dsld ... done. Jan 1 01:00:38 dsld[525]: voip: ppptarget voip disabled, ignored Jan 1 01:00:39 telefon[530]: use clock_gettime(CLOCK_MONOTONIC)! Jan 1 01:00:39 telefon[530]: NoOldMSNNames Jan 1 01:00:39 telefon[530]: SIG[capi_oslib] capi_installed CHLD received! Jan 1 01:00:39 telefon[530]: WARNING No config file '/var/flash/fx_def' ! [capi_oslib] capi_installed create sema UPNPAPI_DATA_phonebook run_clock AR7WDT: System Init UEberwachung abgeschlossen (81390 ms noch verfuegbar) demon started SysRq : Changing Loglevel Loglevel set to 4 rc.mod version freetz-devel-14237 crond is disabled. AVM telnetd is disabled. Starting Freetz webinterface ... done. swap is disabled. syslogd is disabled. rc.mod finished. Please press Enter to activate this console. BusyBox v1.24.2 (2017-04-13 15:50:40 CEST) built-in shell (ash) <0x1b>[50;132qroot@fritz:/var/mod/root# reboot root@fritz:/var/mod/root# SHUTDOWN: initiated SHUTDOWN: executing /mod/etc/init.d/rc.mod stop Stopping all packages: crond: Stopping crond ... not running. telnetd: Stopping AVM telnetd ... not running. webcfg: Stopping Freetz webinterface ... done. dsld: Stopping AVM dsld ... done. multid: Stopping AVM multid ... done. Stopping all packages finished. SHUTDOWN: executing /var/post_install unmounting '/var/media/ftp/*' .. unload dsl and dependend driver .. Jan 1 01:02:12 telefon[560]: SIGTERM received! Jan 1 01:02:12 pbd[569]: received signal: Terminated. Jan 1 01:02:12 pbd[575]: received signal: Terminated. Jan 1 01:02:12 pbd[576]: received signal: Terminated. Jan 1 01:02:13 pbd[569]: terminating. rmmod: can't unload 'rfcntl': unknown symbol in module, or unknown parameter rmmod: can't unload 'isdn_fbox_fon5': unknown symbol in module, or unknown parameter rmmod: can't unload 'isdn_fbox_fon4': unknown symbol in module, or unknown parameter rmmod: can't unload 'isdn_fbox_fon2': unknown symbol in module, or unknown parameter rmmod: can't unload 'isdn_fbox_fon': unknown symbol in module, or unknown parameter rmmod: can't unload 'ulpcmlink': unknown symbol in module, or unknown parameter rmmod: can't unload 'dect_io': unknown symbol in module, or unknown parameter rmmod: can't unload 'avm_dect': unknown symbol in module, or unknown parameter rmmod: can't unload 'pcmlink': unknown symbol in module, or unknown parameter rmmod: can't unload 'userman': unknown symbol in module, or unknown parameter PID USER VSZ STAT COMMAND 1 root 1056 S init 2 root 0 SWN [ksoftirqd/0] 3 root 0 SW< [events/0] 4 root 0 SW< [khelper] 5 root 0 SW< [kthread] 6 root 0 SW< [kblockd/0] 23 root 0 SW< [pdflush] 24 root 0 SW< [pdflush] 26 root 0 SW< [aio/0] 25 root 0 SW [kswapd0] 62 root 0 SW [pm_info] 66 root 0 SW< [CPMAC] 70 root 0 SW [mtdblockd] 96 root 0 SW [tffsd_mtd_0] 409 root 0 SW< [capi_oslib] 483 root 4944 S upnpd 516 root 1816 S wpa_authenticator 544 root 4944 S upnpd 545 root 4944 S upnpd 546 root 4944 S upnpd 578 root 692 S /bin/run_clock -c /dev/tffs -d 886 root 1068 S -/bin/sh 931 root 1052 S /bin/sh -c /etc/inittab.shutdown 932 root 1052 S {inittab.shutdow} /bin/sh /etc/inittab.shutdown 1023 root 1060 S {busybox} ash /var/post_install 1205 root 1080 S {busybox} ash /etc/init.d/rc.dsl.sh stop 1282 root 1048 R {busybox} ps Module Size Used by Tainted: P tiap 378016 0 Piglet_noemif 4816 0 system is going down .. SHUTDOWN: unmounting SysRq : Emergency Sync SysRq : Emergency Remount R/O SHUTDOWN: unmounting 'sysfs' on '/sys' SHUTDOWN: unmounting 'devpts' on '/dev/pts' SHUTDOWN: umount rootfs (on /) failed, trying to remount readonly... SHUTDOWN: still rw mounted: rootfs (on /) SHUTDOWN: still ro mounted: /dev/root (on /) SHUTDOWN: still rw mounted: dev (on /dev) SHUTDOWN: still rw mounted: proc (on /proc) SHUTDOWN: still rw mounted: tmpfs (on /var) SHUTDOWN: finished Th[avm_power]pm_ressourceinfo_thread: exit e system is going down NOW! Sent SIGTERM to all processes Sent SIGKILL toRestarting system.
Notes
This device is not supported anymore by AVM.
Sources
- Handbuch Fritz!Box Fon WLAN 7112 (http://avm.de/fileadmin/user_upload/DE/Handbuecher/FRITZ_Box/Weitere/Handbuch_FRITZ_Box_Fon_WLAN_7112.pdf)