Comtrend CT-5361
The CT-5361 was an adsl wifi router distributed by some Spanish ISP's like Movistar (white enclosure) or Jazztel (dark blue enclosure).
Supported Versions
Hardware Highlights
Installation
OEM easy installation
As reported in the Attitude adjustment announcement, for 16MiB of RAM devices you should better stay with Backfire (linux 2.6.32), or you will experience contention problems due to an often lack of free memory.
Get the firmware (Backfire version) openwrt-96348GW-generic-squashfs-cfe.bin
- Set a static IP on your computer, compatible with 192.168.1.1, i.e 192.168.1.100
- Conect the ethernet cable from your computer to the CT-5361
- Unplug the power cord
- Press the reset button, don't release it yet!
- Plug the power cord
- Wait 10 seconds or more
- Release the reset button
- Browse to http://192.168.1.1
- Select .bin file
- Upgrade the image
- Wait for it to reboot
- Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.
OEM installation using the TFTP method
If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.
Upgrading OpenWrt
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
LuCI Web Upgrade Process
- Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
- Upload image file for sysupgrade to LuCI
- Wait for reboot
Terminal Upgrade Process
- Login as root via SSH on 192.168.1.1
- Use the following commands to upgrade.
cd /tmp/ wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-96348GW-generic-squashfs-cfe.bin sysupgrade /tmp/openwrt-96348GW-generic-squashfs-cfe.bin
- If sysupgrade does not support this router, use the following commands.
cd /tmp/ wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-96348GW-generic-squashfs-cfe.bin mtd write /tmp/openwrt-96348GW-generic-squashfs-cfe.bin linux && reboot
Basic configuration
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
Specific Configuration
Interfaces
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| br-lan | LAN & WiFi | 192.168.1.1/24 |
| eth0 | LAN ports (1 to 4) | bridged |
| wlan0 | WiFi | Disabled (bridged) |
Switch Ports (for VLANs)
This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 will be the Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on.
| Port | Switch port | Mode |
|---|---|---|
| LAN 1 | 0 | lan |
| LAN 2 | 1 | lan |
| LAN 3 | 2 | lan |
| LAN 4 | 3 | Internet (WAN) |
# path: /etc/config/network
# port 4 = WAN
config interface loopback
option ifname lo
option proto static
option ipaddr 127.0.0.1
option netmask 255.0.0.0
config interface lan
option type bridge
option ifname eth0.0
option proto static
option ipaddr 192.168.1.1
option netmask 255.255.255.0
option nat 1
config interface wan
option ifname eth0.1
option macaddr 00:11:22:33:44:55
option proto dhcp
option defaultroute 1
config switch eth0
option enable 1
option reset 1
option enable_vlan 1
config switch_vlan
option device eth0
option vlan 0
option ports "0 1 2 5t"
config switch_vlan
option device eth0
option vlan 1
option ports "3 5t"
Failsafe mode
Buttons
→ hardware.button on howto use and configure the hardware button(s).
The Comtrend 5361 has one button. It is the Reset.
| BUTTON | Event |
|---|---|
| Reset | reset |
Hardware
Info
| Instruction set: | MIPS |
| Vendor: | Broadcom |
| bootloader: | cfe |
| Board ID: | 96348GW-11 |
| System-On-Chip: | BCM6348 |
| CPU/Speed | BMIPS3300 V0.7 / 256 MHz |
| Flash-Chip: | MX29LV320AB |
| Flash size: | 4 MiB |
| RAM-Chip: | EM638165TS-7 / SDR-143 |
| RAM size: | 2×8 MiB |
| Wireless: | Broadcom 4318 rev9, 802.11b/g (miniPCI) |
| switch: | Broadcom BCM5325E w/ vlan support swconfig |
| Internet: | ADSL2+, not supported in OpenWrt |
| USB: | possible with mod |
| PSU: | 16.5V AC 850mA / EVER GLOW ADV165085 |
| Serial: | Yes |
| JTAG: | Yes |
Photos
Model Number
Front of the casing
Back of the casing
Opening the case
Note: This will void your warranty!
- To remove the cover do a/b/c
Main PCB
Serial
→ port.serial general information about the serial port, serial port cable, etc.
How to connect to the Serial Port of this specific device:
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
Debricking
Bootloader Mods
→ you could read about bootloader in general
Hardware mods
→ as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!
Overclocking
As default the CPU is clocked to 256 MHz. By moving two resistors we can set the frequency to 300 MHz:
These resistors are connected to both the flash chip and the miniPCI, they are 10 kohm (01C marking) pulldown resistors.
- Move AD27 to AD28, and AD30 to AD29. After this change you should see these kernel messages:
[ 0.000000] CPU frequency is 300 MHz [ 0.000000] Calibrating delay loop... 297.98 BogoMIPS (lpj=595968)
USB Mod
64MiB RAM Mod
Possible using a custom CFE bootloader.
Bootlogs
OEM bootlog
CFE version 1.0.37-0.7-1 for BCM96348 (32bit,SP,BE) Build Date: Thu Apr 28 12:04:28 CST 2005 (root@jyang.linux.comtrend.com) Copyright (C) 2000,2001,2002,2003 Broadcom Corporation. Initializing Arena. Initializing Devices. CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz Total memory used by CFE: 0x80401000 - 0x80522DF0 (1187312) Initialized Data: 0x8041AF10 - 0x8041C790 (6272) BSS Area: 0x8041C790 - 0x80420DF0 (18016) Local Heap: 0x80420DF0 - 0x80520DF0 (1048576) Stack Area: 0x80520DF0 - 0x80522DF0 (8192) Text (code) segment: 0x80401000 - 0x8041AF0C (106252) Boot area (physical): 0x00523000 - 0x00563000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : 96348GW-11 Psi size in KB : 24 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:1d:20:40:c5:96 Ethernet PHY Type : Internal Memory size in MB : 16 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 Code Address: 0x80010000, Entry Address: 0x801ab018 Decompression OK! Entry at 0x801ab018 Closing network. Starting program at 0x801ab018 Linux version 2.6.8.1 (wenxing@broadcom.comtrend.com) (gcc version 3.4.2) #1 Wed Nov 28 13:50:37 CST 2007 Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB Total Flash size: 4096K with 71 sectors 96348GW-11 prom init CPU revision is: 00029107 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 DMA zone: 4000 pages, LIFO batch:1 Normal zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=31:0 ro noinitrd brcm mips: enabling icache and dcache... Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 8kB 2-way, linesize 16 bytes. PID hash table entries: 64 (order 6: 512 bytes) Using 128.000 MHz high precision timer. Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 13940k/16000k available (1431k kernel code, 2040k reserved, 208k data, 72k init, 0k highmem) Calibrating delay loop... 255.59 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... unavailable. NET: Registered protocol family 16 MPI: No Card is in the PCMCIA slot Can't analyze prologue code at 80174694 Initializing Cryptographic API PPP generic driver version 2.4.2 NET: Registered protocol family 24 Using noop io scheduler bcm963xx_mtd driver v1.0 brcmboard: brcm_board_init entry bcm963xx_serial driver v2.0 NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) Initializing IPsec netlink socket NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 Ebtables v2.0 registered NET: Registered protocol family 8 NET: Registered protocol family 20 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 72k freed init started: BusyBox v1.00 (2007.11.28-05:55+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 BusyBox v1.00 (2007.11.28-05:55+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... atmapi: module license 'Proprietary' taints kernel. blaadd: blaa_detect entry adsl: adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6348B0 Ethernet Network Device v0.3 Nov 28 2007 13:49:01 Config Ethernet Switch Through SPI Slave Select 1 dgasp: kerSysRegisterDyingGaspHandler: eth0 registered eth0: MAC Address: 00:1D:20:40:C5:96 PCI: Setting latency timer of device 0000:00:01.0 to 64 PCI: Enabling device 0000:00:01.0 (0004 -> 0006) wl0: Broadcom BCM4318 802.11 Wireless Controller 3.131.35.4.cpe2.0 dgasp: kerSysRegisterDyingGaspHandler: wl0 registered #frank#BcmDb_getSysFlagInfo:2195 PSI status != PSI_STS_OK# #frank#BcmDb_getSysFlagInfo:2203 DefaultValue enblEnhancedIgmp# eth0 Link UP. BcmAdsl_Initialize=0xC00663F8, g_pFnNotifyCallback=0xC007F204 AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00000980 adsl2=0x00000000 pSdramPHY=0xA0FFFFF8, 0x17F2F 0xDEADBEEF AdslCoreHwReset: AdslOemDataAddr = 0xA0FFA724 AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00000980 adsl2=0x00000000 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered ATM proc init !!! ip_tables: (C) 2000-2002 Netfilter core team ip_conntrack version 2.1 (125 buckets, 0 max) - 368 bytes per conntrack ip_conntrack_pptp version 2.1 loaded ip_nat_pptp version 2.0 loaded ip_conntrack_h323: init ip_nat_h323: initialize the module! ip_conntrack_rtsp v0.01 loading ip_nat_rtsp v0.01 loading ==> Comtrend Router Software Version: A111-306FPT-C01_R02 <== device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state glbDnsRelDhcpEnable=TRUE Setting SSID "Comtrend" Setting SSID "Guest" eth0 Link DOWN. br0: port 1(eth0) entering disabled state eth0 Link UP. br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state Setting country code using abbreviation: "VN" wl0: current channel 6 device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state device wl0.1 entered promiscuous mode pvc2684d: Interface "nas_0_33" created sucessfully pvc2684d: Communicating over ATM 0.0.33, encapsulation: LLC Starting BcmNtwk_startDefDhcpSrv with leasedTime=60 dns1=192.168.1.1, dns2=192.168.1.1 dns1=192.168.1.1 dns2=192.168.1.1 pvc2684d: Interface "nas_8_35" created sucessfully pvc2684d: Communicating over ATM 0.8.35, encapsulation: LLC device nas_8_35 entered promiscuous mode br0: port 4(nas_8_35) entering learning state br0: topology change detected, propagating br0: port 4(nas_8_35) entering forwarding state device eth0 left promiscuous mode br0: port 1(eth0) entering disabled state device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state device wl0 left promiscuous mode br0: port 2(wl0) entering disabled state device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state device wl0.1 left promiscuous mode br0: port 3(wl0.1) entering disabled state device wl0.1 entered promiscuous mode device nas_8_35 left promiscuous mode br0: port 4(nas_8_35) entering disabled state device nas_8_35 entered promiscuous mode br0: port 4(nas_8_35) entering learning state br0: topology change detected, propagating br0: port 4(nas_8_35) entering forwarding state Login: root Password: >
OpenWrt bootlog
CFE version 1.0.37-0.7-1 for BCM96348 (32bit,SP,BE) Build Date: Thu Apr 28 12:04:28 CST 2005 (root@jyang.linux.comtrend.com) Copyright (C) 2000,2001,2002,2003 Broadcom Corporation. Initializing Arena. Initializing Devices. CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz Total memory used by CFE: 0x80401000 - 0x80522DF0 (1187312) Initialized Data: 0x8041AF10 - 0x8041C790 (6272) BSS Area: 0x8041C790 - 0x80420DF0 (18016) Local Heap: 0x80420DF0 - 0x80520DF0 (1048576) Stack Area: 0x80520DF0 - 0x80522DF0 (8192) Text (code) segment: 0x80401000 - 0x8041AF0C (106252) Boot area (physical): 0x00523000 - 0x00563000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : 96348GW-11 Psi size in KB : 24 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:1d:20:40:c5:96 Ethernet PHY Type : Internal Memory size in MB : 16 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 Code Address: 0x80010000, Entry Address: 0x80010000 Decompression OK! Entry at 0x80010000 Closing network. Starting program at 0x80010000 Linux version 2.6.32.27 (jow@nd-build-02.linux-appliance.net) (gcc version 4.3.3 (GCC) ) #5 Wed Dec 21 05:51:40 CET 2011 Detected Broadcom 0x6348 CPU revision b0 CPU frequency is 256 MHz 16MB of RAM installed registering 37 GPIOs board_bcm963xx: CFE version: 1.0.37-0.7 bootconsole [early0] enabled CPU revision is: 00029107 (Broadcom BCM6348) board_bcm963xx: board name: 96348GW-11 Determined physical RAM map: memory: 01000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00001000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00001000 Built 1 zonelists in Zone order, mobility grouping off. Total pages: 4064 Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 PID hash table entries: 64 (order: -4, 256 bytes) Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes. Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes Memory: 13284k/16384k available (2140k kernel code, 3100k reserved, 453k data, 140k init, 0k highmem) Hierarchical RCU implementation. NR_IRQS:128 Calibrating delay loop... 254.97 BogoMIPS (lpj=509952) Mount-cache hash table entries: 512 NET: Registered protocol family 16 registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 pci 0000:01:1e.0: CardBus bridge, secondary bus 0000:02 pci 0000:01:1e.0: IO window: 0x8008000-0x80080ff pci 0000:01:1e.0: IO window: 0x8008400-0x80084ff pci 0000:01:1e.0: MEM window: 0x38000000-0x3fffffff PCI: Enabling device 0000:01:1e.0 (0000 -> 0003) Switching to clocksource MIPS PCI: Enabling device 0000:00:01.0 (0000 -> 0002) ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP reno registered NET: Registered protocol family 1 audit: initializing netlink socket (disabled) type=2000 audit(0.330:1): initialized squashfs: version 4.0 (2009/01/31) Phillip Lougher Registering mini_fo version $Id$ JFFS2 version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. msgmni has been set to 25 io scheduler noop registered io scheduler deadline registered (default) gpiodev: gpio device registered with major 254 gpiodev: gpio platform device registered with access mask FFFFFFFF bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart console [ttyS0] enabled, bootconsole disabled console [ttyS0] enabled, bootconsole disabled bcm963xx_flash: 0x00400000 at 0x1fc00000 bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank CFI mfr 0x000000c2 CFI id 0x000022a8 Amd/Fujitsu Extended Query Table at 0x0040 Amd/Fujitsu Extended Query version 1.1. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. bcm963xx_flash: Read Signature value of CFE1CFE1 bcm963xx_flash: CFE bootloader detected bcm963xx_flash: CFE boot tag found with version 6 and board type 96348GW-11 bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000 bcm963xx_flash: Partition 1 is kernel offset 10100 and length dff00 bcm963xx_flash: Partition 2 is rootfs offset f0000 and length 300000 bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000 bcm963xx_flash: Partition 4 is linux offset 10000 and length 3e0000 bcm963xx_flash: Spare partition is 2b0000 offset and length 140000 Creating 5 MTD partitions on "bcm963xx": 0x000000000000-0x000000010000 : "CFE" 0x000000010100-0x0000000f0000 : "kernel" mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only 0x0000000f0000-0x0000003f0000 : "rootfs" mtd: partition "rootfs" set to be root filesystem mtd: partition "rootfs_data" created automatically, ofs=2B0000, len=140000 0x0000002b0000-0x0000003f0000 : "rootfs_data" 0x0000003f0000-0x000000400000 : "nvram" 0x000000010000-0x0000003f0000 : "linux" bcm63xx_enet MII bus: probed bcm63xx_wdt started, timer margin: 30 sec Registered led device: adsl-fail Registered led device: ppp Registered led device: ppp-fail Registered led device: power Registered led device: stop TCP westwood registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 140k freed Please be patient, while OpenWrt loads ... - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - switching to jffs2 mini_fo: using base directory: / mini_fo: using storage directory: /overlay - init - Please press Enter to activate this console. bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)] eth1: link forced UP - 100/full - flow control off/off device eth1 entered promiscuous mode br-lan: port 1(eth1) entering forwarding state Compat-wireless backport release: compat-wireless-2011-11-08-1-g4ab9b62 Backport based on wireless-testing.git master-2011-11-15 cfg80211: Calling CRDA to update world regulatory domain cfg80211: World regulatory domain updated: cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) roboswitch: Probing device eth0: Failed to enable switch roboswitch: Probing device eth1: found a 5325! It's a 5350. b43-phy0: Broadcom 4318 WLAN found (core revision 9) Registered led device: b43-phy0::tx Registered led device: b43-phy0::rx Registered led device: b43-phy0::radio Broadcom 43xx driver loaded [ Features: PL ] PPP generic driver version 2.4.2 ip_tables: (C) 2000-2006 Netfilter Core Team NET: Registered protocol family 24 nf_conntrack version 0.5.0 (209 buckets, 836 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. BusyBox v1.15.3 (2011-11-24 04:32:28 CET) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M Backfire (10.03.1, r29592) ------------------------ * 1/3 shot Kahlua In a shot glass, layer Kahlua * 1/3 shot Bailey's on the bottom, then Bailey's, * 1/3 shot Vodka then Vodka. --------------------------------------------------- root@OpenWrt:/# free total used free shared buffers Mem: 13424 12112 1312 0 1432 Swap: 0 0 0 Total: 13424 12112 1312 root@OpenWrt:/#