Comtrend CT-5621 / CT-5621T
CT-5621 is almost identical to CT-5621T. But the CT-5621 comes with a “Console” rj45 style port wired to the internal serial port at the board.
CT-5621T Front:
CT-5621T Back (with aftermarket serial port and sticky note):
CT-5621 Back
This is an ADSL2+ Modem + 4-port Switch with USB (it can act as a USB network device). It is manufactured by Comtrend who, as best I can determine from their voice prompts for assistance, only sell their equipment to ISP's and Telcos, thus bypassing regular users as customers and therefore recipients of source code.
Hardware Highlights
| SoC | CPU speed | Ram | Flash | Network | USB Client | USB Host | Serial | JTag |
|---|---|---|---|---|---|---|---|---|
| Broadcom 6348 | 256MHz | 16MiB | 4MiB | 4 x 1 | Yes | Yes* | Yes | Yes |
(*requires hardware modifications)
Installation
On some models it may be necessary to connect to the internal serial port and use the CFE prompt to change the board ID, or else the OpenWrt kernel will panic shortly after startup due to not recognizing the board. (If this happens and you don't want to wire a serial port, you can still hold Reset during startup to get into CFE - recognizable by red power LED - and upload another firmware via the web interface.)
Flash Layout
Please check out the article flash.layout. It contains an example and a couple of explanations.
OEM easy installation
- Unplug the power cord (or use the on/off switch if one is present).
- Press the reset button, don't release it yet!
- Plug the power cord.
- Wait 10 seconds.
- Release the reset button.
- Browse to http://192.168.1.1.
- Upload .bin file to router.
- Upgrade the image.
- Wait for it to reboot.
- Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.
OEM installation using the TFTP method
If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.
Upgrading OpenWrt
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
LuCI Web Upgrade Process
- Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
- Upload image file for sysupgrade to LuCI
- Wait for reboot
Terminal Upgrade Process
- Login as root via SSH on 192.168.1.1
- Use the following commands to upgrade.
cd /tmp/ wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc sysupgrade /tmp/xxx.abc
- If sysupgrade does not support this router, use the following commands.
cd /tmp/ wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc mtd write /tmp/xxx.abc linux && reboot
Basic configuration
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
Specific Configuration
Interfaces
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| br-lan | LAN & WiFi | 192.168.1.1/24 |
| eth0 | LAN ports (1 to 4) | None |
Switch Ports (for VLANs)
This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 will be the Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on.
| Port | Switch port | Mode |
|---|---|---|
| LAN 1 | 0 | lan |
| LAN 2 | 1 | lan |
| LAN 3 | 2 | lan |
| LAN 4 | 3 | Internet (WAN) |
# path: /etc/config/network
# port 4 = WAN
config interface loopback
option ifname lo
option proto static
option ipaddr 127.0.0.1
option netmask 255.0.0.0
config interface lan
option type bridge
option ifname eth0.0
option proto static
option ipaddr 192.168.1.1
option netmask 255.255.255.0
option nat 1
config interface wan
option ifname eth0.1
option macaddr 00:11:22:33:44:55
option proto dhcp
option defaultroute 1
config switch eth0
option enable 1
option reset 1
option enable_vlan 1
config switch_vlan
option device eth0
option vlan 0
option ports "0 1 2 5t"
config switch_vlan
option device eth0
option vlan 1
option ports "3 5t"
Failsafe mode
Buttons
→ hardware.button on howto use and configure the hardware button(s).
The Comtrend 5621 has one button. It is the Reset.
| BUTTON | Event |
|---|---|
| Reset | reset |
Bootlogs
Stock firmware (2.4.17 kernel)
CFE version 1.0.37-5.17 for BCM96348 (32bit,SP,BE) Build Date: Tue, 19 Oct 2004 12:02:54 +0800 (root@junhon_linux) Copyright (C) 2000,2001,2002,2003 Broadcom Corporation. Initializing Arena. Initializing Devices. init 5325E: init mii=0 init 5325E: init success, mii=9f CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz Total memory used by CFE: 0x80401000 - 0x80521DF0 (1183216) Initialized Data: 0x8041C740 - 0x8041E1B0 (6768) BSS Area: 0x8041E1B0 - 0x8041FDF0 (7232) Local Heap: 0x8041FDF0 - 0x8051FDF0 (1048576) Stack Area: 0x8051FDF0 - 0x80521DF0 (8192) Text (code) segment: 0x80401000 - 0x8041C73C (112444) Boot area (physical): 0x00522000 - 0x00562000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.1.1 Host IP address : 192.168.1.3 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : openwrt-brcm63xx-vmlinux.elf Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 5 Board Id Name : 96348GW-11 Psi size in KB : 24 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:30:da:47:bd:b4 Ethernet PHY Type : External Using Reverse MII with SPI Memory size in MB : 16 *** Press any key to stop auto run (5 seconds) *** Auto run second count down: 5543210 Code Address: 0x80010000, Entry Address: 0x8001046c Decompression OK! Entry at 0x8001046c Closing network. Starting program at 0x8001046c Total Flash size: 4096K with 71 sectors Scratch pad is not used for this flash part. 96348GW-11 prom init CPU revision is: 00029107 Primary instruction cache 16kb, linesize 16 bytes (2 ways) Primary data cache 8kb, linesize 16 bytes (2 ways) Linux version 2.4.17 (root@max-redhat) (gcc version 3.1) #1 ¥| 12¤ë 2 04:34:28 CST 2004 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 zone(0): 4000 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: root=/dev/mtdblock0 ro bcm_console_setup Calibrating delay loop... 255.59 BogoMIPS Memory: 14236k/16000k available (1144k kernel code, 1764k reserved, 80k data, 48k init, 0k highmem) Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes) Inode-cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX mpi: No Card is in the PCMCIA slot PCI: Fixing up bus 0 Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd brcmboard: brcm_board_init entry Module bcm63xx_cons.c v1.1 Dec 2 2004 04:34:57 block: 64 slots per queue, batch=16 PPP generic driver version 2.4.1 NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) Linux IP multicast router 0.06 plus PIM-SM NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. Ebtables v2.0 registeredNET4: Ethernet Bridge 008 for NET4.0 802.1Q VLAN Support v1.6 Ben Greear vlan Initialization complete. VFS: Mounted root (cramfs filesystem) readonly. Freeing unused kernel memory: 48k freed init started: BusyBox v0.60.4 (2004.12.01-20:44+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 BusyBox v0.60.4 (2004.12.01-20:44+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... atmapi: init_module entry 0xc0006060 blaadd: blaa_detect entry adsl: adsl_init entry var 1.0 initialised Broadcom BCM6348A2 Ethernet Network Device v0.1 Dec 2 2004 04:40:06 External Switch Reverse MII (SPI Device 1) eth0: MAC Address: 00:30:DA:47:BD:B4 Broadcom BCM6348A2 USB Network Device v0.3 Dec 2 2004 04:40:08 usb0: MAC Address: 00 30 DA 47 BD B5 usb0: Host MAC Address: 00 30 DA 47 BD B6 insmod: init_module: wl: No such device BcmAdsl_Initialize=0xC0018418, g_pFnNotifyCallback=0xC002CCB0 AdslCoreHwReset: AdslOemDataAddr = 0xA0FE4D5C ==> Bcm963xx Software Version: A101-221CTL-C01_R04.A2pB017f.d15 <== device usb0 entered promiscuous mode br0: port 1(usb0) entering listening state br0: port 1(usb0) entering learning state br0: port 1(usb0) entering forwarding state br0: topology change detected, propagating device eth0 entered promiscuous mode br0: port 2(eth0) entering listening state br0: port 2(eth0) entering learning state br0: port 2(eth0) entering forwarding state br0: topology change detected, propagating pvc2684d: Interface "nas_0_35" created sucessfully atm_connect (TX: cl 1,bw 0-0,sdu 1524; RX: cl 1,bw 0-0,sdu 1524,AAL 5) pvc2684d: Communicating over ATM 0.0.35, encapsulation: LLC device nas_0_35 entered promiscuous mode br0: port 3(nas_0_35) entering listening state br0: port 3(nas_0_35) entering learning state br0: port 3(nas_0_35) entering forwarding state br0: topology change detected, propagating eth0 Link UP. Message from syslogd@router at Jan 23 16:34:40 ... BCM96345 started: BusyBox v0.60.4 (2004.12.01-20:44+0000) sntp: host not found Message from syslogd@router at Jan 23 16:34:41 ... klogd: 802.1Q VLAN Support v1.6 Ben Greear reearb@candelatech.com> br0: port 1(usb0) entering disabled state ADSL G.994 training ADSL G.992 started ADSL G.992 channel analysis ADSL G.992 message exchange ADSL link up, interleaved, us=800, ds=6016 PPP: PPP0_35_1 Start to connect ... PPP: PPP0_35_1 Connection Up. Primary DNS server = 216.183.128.10 Secondary DNS server = 216.183.128.4
kamikaze (2.6.27 kernel)
0x80010000/3644617 0x80389cc9/141127 Entry at 0x80014450 Closing network. Starting program at 0x80014450 Linux version 2.6.27.11 (daniel@brennin) (gcc version 4.1.2) #3 Fri Jan 23 07:01:13 EST 2009 Detected Broadcom 0x6348 CPU revision a2 CPU frequency is 256000000 Hz 16MB of RAM installed board_bcm963xx: CFE version: 1.0.37-5.17 console [early0] enabled CPU revision is: 00029107 (Broadcom BCM6348) board_bcm963xx: board name: 96348GW-11 Determined physical RAM map: memory: 01000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00001000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00001000 Built 1 zonelists in Zone order, mobility grouping off. Total pages: 4064 Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200 Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes. Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes PID hash table entries: 64 (order: 6, 256 bytes) Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Memory: 12472k/16384k available (1930k kernel code, 3912k reserved, 410k data, 1216k init, 0k highmem) Calibrating delay loop... 255.48 BogoMIPS (lpj=510976) Mount-cache hash table entries: 512 net_namespace: 776 bytes NET: Registered protocol family 16 registering 37 GPIOs registering PCI controller with io_map_base unset bus: 00 index 0 io port: [8000000, 800ffff] bus: 00 index 1 mmio: [30000000, 37ffffff] NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP reno registered NET: Registered protocol family 1 audit: initializing netlink socket (disabled) type=2000 audit(1.220:1): initialized squashfs: version 3.0 (2006/03/15) Phillip Lougher Registering mini_fo version $Id$ JFFS2 version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. msgmni has been set to 24 io scheduler noop registered io scheduler cfq registered (default) bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart console handover: boot [early0] -> real [ttyS0] bcm63xx_enet MII bus: probed bcm963xx_flash: 0x00400000 at 0x1fc00000 bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. bcm963xx_flash: Read Signature value of CFE1CFE1 bcm963xx_flash: CFE bootloader detected bcm963xx_flash: CFE boot tag found with version 6 and board type 96348GW-11. bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000 bcm963xx_flash: Partition 1 is kernel offset 22f100 and length 656d3 bcm963xx_flash: Partition 2 is rootfs offset 10100 and length 35f000 bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000 Creating 4 MTD partitions on "bcm963xx": 0x00000000-0x00010000 : "CFE" 0x0022f100-0x002947d3 : "kernel" mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only 0x00010100-0x0036f100 : "rootfs" mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only mtd: partition "rootfs" set to be root filesystem split_squashfs: no squashfs found in "bcm963xx" 0x003f0000-0x00400000 : "nvram" TCP bic registered NET: Registered protocol family 17 Bridge firewalling registered Freeing unused kernel memory: 1216k freed Algorithmics/MIPS FPU Emulator v1.5 [sighandler]: No more events to be processed, quitting. [cleanup]: Waiting for children. [cleanup]: All children terminated. - preinit - Press CTRL-C for failsafe Please press Enter to activate this console. bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)] bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)] eth1: link forced UP - 100/full - flow control off/off device eth1 entered promiscuous mode br-lan: topology change detected, propagating br-lan: port 1(eth1) entering forwarding state PPP generic driver version 2.4.2 ip_tables: (C) 2000-2006 Netfilter Core Team nf_conntrack version 0.5.0 (1024 buckets, 4096 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. br-lan: port 1(eth1) entering disabled state br-lan: topology change detected, propagating br-lan: port 1(eth1) entering forwarding state
Hardware
Info
| Architecture: | MIPS |
| Vendor: | Broadcom |
| bootloader: | cfe |
| System-On-Chip: | BCM6348 |
| CPU/Speed | BMIPS3300 V0.7 / 256 MHz |
| Flash-Chip: | Fujitsu MPM29DL32B-70PFTN |
| Flash size: | 4 MiB |
| RAM: | Hynix 409A HY57 283220I-7, 16 MiB |
| Wireless: | No |
| Ethernet: | Broadcom BCM5325 w/ vlan support swconfig |
| Internet: | ADSL2+ |
| USB: | slave, host possible with mod |
| Serial: | Yes, ADM202EARN RS-232c |
| JTAG: | Yes |
PCB Photos
CT-5621
The CT-5621 board is exactly the same as the CT-536+ without the miniPCI slot but with a serial Console and USB slave ports.
CT-5621T
Opening the case
Note: This will void your warranty!
- Under the rear rubber feet are two screws that need to be removed.
- The cover is held on by these screws and by plastic clips near the front.
- The front and rear plates and LED assembly can simply be pulled out once the cover is removed.
- A few more screws hold the PCB to the bottom of the case.
Serial
→ port.serial general information about the serial port, serial port cable, etc.
CT-5621
CT-5621 version exposes a serial port via Ethernet port style labeled as Console:
RJ45 connector 3: Receive Data 4: Transmit Data 7: Ground 1,2,5,6,8: Not Connected
CT-5621T
CT-5621T version hasn't the serial wired externally. Around the middle of the board is 4 pins arranged in a square. The one with a smaller square drawn around it is the Transmit pin. The one directly in front of it (toward the front of the device) is Receive. The one beside it is Ground. The one diagonal to it is Vcc. These pins operate at 3VDC and baud 115200, 8 bits, no parity, 1 stop bit (i.e. 115200,8,N,1). See PCB photos above.
Once connected to the serial port you can access three different modes:
- By holding/mashing a key during power on you can access the CFE prompt and upload a new firmware (such as OpenWrt). This prompt also gives you the ability to download and run a kernel over ethernet without flashing it, which could be used to dump the stock firmware if one were so inclined.
- By waiting for boot to complete you can access a login prompt, which is the same prompt you get over Telnet. The passwords seem to be the same as for the web interface.
- The default account names are
support,user,apuser, and the passwords are the account names. (However these don't actually work!? TODO figure out why.)supporthas the most privileges,apuserhas the least. - User
root, passwordt313commay also work on some devices. (This login also works for the web interface.) - This gives you an extremely limited shell (even as root!) with only a handful of commands for configuring the device.
- By mashing Ctrl+C during boot (after the CFE prompt) you can interrupt boot and access a root shell, though it seems to be jailed or otherwise limited somehow.
lscommand is not available, but you can list directories usingecho /bin/*.- Depending on when you interrupt, some directories such as
/procare missing or empty. - If you let ADSL start up, you'll be spammed with messages about the link status.
- Some files aren't readable at all - they'll give “no such file” or “no such device” errors.
- You can use
opensslcommand to encode/decode base64, allowing to dump binary data. e.g.:openssl enc -e -a -in /dev/mtdblock0 -out /dev/ttyS0 - This can be combined with
pingto easily dump to file on the host:ping -c 10 127.0.0.1; openssl enc -e -a -in /dev/mtdblock0 -out /dev/ttyS0
The
pinggives you a few seconds to detach your terminal emulator and startcat /dev/ttyS0 > data.b64to capture the output. Once the file stops growing, strip thepingoutput from the beginning and decode. (But make surepingworks first! Depending when you interrupt, thelointerface might not be up yet.)
SSH is also supported, but using an obsolete algorithm that modern clients can't understand.
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
Located near the front left, beside the CPU. Pin 1 has white box surrounding it and the whole connection area is surrounded by a white border (thin). There is no existing header, if you want one you have to add it (there are only solder pads in the stock configuration).
Pinout:
| 1 | 2 |
| 3 | 4 |
| 5 | 6 |
| 7 | 8 |
| 9 | 10 |
| 11 | 12 |
Meaning and mapping to LPT for an unbuffered cable
Pin 3 - TDI - DATA0 - Pin 2 Pin 5 - TD0 - SELECT - Pin 13 Pin 7 - TMS - DATA2 - Pin 4 Pin 9 - TCK - DATA1 - Pin 3
Debricking
Bootloader Mods
- you could read about bootloader in general
CFE> web info: Waiting for connection on socket 0.
CFE>
CFE> c
Press: to use current value
'-' to go previous parameter
'.' to clear the current value
'x' to exit this command
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 5
*** command status = 0
CFE> b
Press: to use current value
'-' to go previous parameter
'.' to clear the current value
'x' to exit this command
Board Id Name (0-5)
96348R -------- 0
96348LV -------- 1
96348GW -------- 2
96348GW-10 -------- 3
96348GW-11 -------- 4
96348SV -------- 5 : 4
Number of MAC Addresses (1-32) : 11
Base MAC Address : 00:40:dd:37:ad:e4
Hardware mods
- as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!
USB mod
(Note: this is done with a different board than shown in photos above.)
This board only needs 3 x 15 kΩ resistors and one 470μF capacitor, and the USB host (USB A Female) connector, to have a USB host port on the board (i.e. to drive USB mass storage, wireless, etc)
Two of the resistors and the capacitor get voltages right, while the third resistor is used to tie the USB host enabled pin on the BCM63xx to Vcc, so that it is seen as enabled.
There is a schematic from a NetGear that might be helpful. The only components that matter to our board are the 15k resistors.
Now we look at the space on the board that is for the USB host:
The following image shows what needs to be done in order to enable host usb:
And here's what a badly done mod looks like (I had a terrible time soldering):
