Draytek Vigor2760(Vn)/(Delight)
ADSL+2/VDSL2 modem with optional WiFi and VoIP , Lantiq
This device was originally released in three different configurations under 2012/2013, running a system based on OpenWrt Backfire. The SoC is VR9/VRX288. They later rebranded the series to 'Delight' (e.g 2760Vn became 2760Vn Delight), which is basically just the same hardware model (photos and FCC-ID are identical) but instead of running Linux, they now run DrayOS.
Supported Versions
| Version/Model | Revision | System | Release Date | OpenWrt Version Supported | Model Specific Notes |
|---|---|---|---|---|---|
| Vigor 2760 | 1.0 | Custom OpenWrt Backfire | 2012-13 | work in progress on this SoC, but not this model | ADSL2+/VDSL2 |
| Vigor 2760n | 1.0 | Custom OpenWrt Backfire | 2012-13 | work in progress on this SoC, but not this model | ADSL2+/VDSL2 WiFi |
| Vigor 2760Vn | 1.0 | Custom OpenWrt Backfire | 2012-13 | work in progress on this SoC, but not this model | ADSL2+/VDSL2 VoIP WiFi |
| Vigor 2760 Delight | 1.0D | DrayOS | 2014 | work in progress on this SoC, but not this model | ADSL2+/VDSL2 |
| Vigor 2760n Delight | 1.0D | DrayOS | 2014 | work in progress on this SoC, but not this model | ADSL2+/VDSL2 WiFi |
| Vigor 2760Vn Delight | 1.0D | DrayOS | 2014 | work in progress on this SoC, but not this model | ADSL2+/VDSL2 VoIP WiFi |
Additional information
The original Vigor 2760(Vn) can be upgraded to the Delight version with little effort, although Draytek was hasty in removing the information from the forums on which the method was spread. The method included two modified u-boot files together with a FrmUpg.exe (just a simple tftp client). First the main uboot was flashed and after this a secondary boot loader was flashed using the same tool -- this would then allow flashing DrayOS using recovery mode. Using these modified boot loaders, the recovery mode will also allow flashing it back to the original system based on OpenWrt Backfire should one wish to do so. Recovery mode is accessed by holding the reset button for about 5 seconds while switching on the device, you will know it has entered recovery mode by seeing two of the leds flashing.
The board has a pre-soldered header for serial access, but will not tolerate halting into u-boot menu. You can however log in to the running linux system (admin/admin). Here you can then for example change the contents of the passwd file (in persistent storage /ramdisk & /ramdisk_copy), which will enable root SSH access. This is done by changing the shell of the user 'draytek' from '/sbin/draysh' to '/bin/sh'. This will persist across reboots. Unfortunately it will not ask for username or password using this method, so it's a security risk.
External resources
More recent modem code/firmware and tools can be extracted from up-to-date firmware upgrades.
Hardware Highlights
| SoC | Ram | Flash | Network | Wireless NIC | Wireless Standard | USB | Serial | JTag | ADSL2+ Modem | VDSL2 Modem |
|---|---|---|---|---|---|---|---|---|---|---|
| Lantiq XWay VRX288 @500MHz | 128 MiB | 256KiB SPI & 128MiB NAND | 4x 1000Mbps | Ralink RT5392 (some models) | b/g/n | 2x 2.0 | YES | YES | YES | YES |
Flash layout
| partition | address space | size | name | filesystem | function |
|---|---|---|---|---|---|
| mtd0 | 0x000000000000-0x000000080000 | 512KiB | uboot | n/a | DrayBoot-v1.2.5 |
| mtd1 | 0x000000080000-0x000000100000 | 512KiB | firmware | squashfs | dsl firmware |
| mtd2 | 0x000000100000-0x000000500000 | 4096KiB | kernel | legacy uImage* | Vigor Linux-2.6.32.32 |
| mtd3 | 0x000000500000-0x000002d00000 | 40960KiB | rootfs | jffs2 | root |
| mtd4 | 0x000002d00000-0x000002f80000 | 2560KiB | sysconfig | jffs2 | system configuration |
| mtd5 | 0x000002f80000-0x000002fc0000 | 256KiB | ubootconfig | n/a | uboot variables |
| mtd6 | 0x000002fc0000-0x000003000000 | 256KiB | fwdiag | unknown | unknown |
| mtd7 | 0x000003000000-0x000003280000 | 2560KiB | sysconfigbak | jffs2 | system configuration backup |
| mtd8 | 0x000003280000-0x000005a80000 | 40960KiB | backupimg | unknown | unknown |
| mtd9 | 0x000005a80000-0x000008000000 | 38400KiB | storage | jffs2 | shared storage/ftp/samba |
* u-boot legacy uImage, Vigor Linux-2.6.32.32, Linux/MIPS, OS Kernel Image (lzma), 1572800 bytes, Mon May 26 13:04:06 2014, Load Address: 0x80002000, Entry Point: 0x800061B0, Header CRC: 0x01525F1D, Data CRC: 0xF364F135
mtd0 and mtd6 seem to be locked, trying to dump them only results in FFFFFFFF hex data.
Information
| Instruction set | MIPS |
|---|---|
| Vendor | Lantiq |
| bootloader | U-Boot DrayBoot-v1.2.5 |
| System-On-Chip | XWAY VRX288 (VR9 Family) |
| CPU/Speed | Lantiq XWAY™ VRX288 (PSB 80920 EL V1.2) (MIPS34Kc) 500MHz |
| Flash Chip | MX25L200 & Toshiba TC58NVG0S3ETA00 |
| Flash Specs | 256KiB SPI & 128MiB 8-bit NAND |
| RAM Specs | 128 MiB DDR2 @ 250 MHz (Samsung?) |
| Wireless | Ralink RT5392 2×2:2 (Select models) |
| Ethernet | 4x 10/100/1000 BASE-TX Ethernet Interface (2x XWAY VR9 GPHY 11G & 2x XWAY PEF7071 via RGMII) |
| Switch | Infineon |
| xDSL | Lantiq XWAY VRX288 ADSL1/2/2+ (G.992.1/3/5) Annexes A, B, I, J, M, L, VDSL1 (G.993.1, T1.424, TS 101 270), VDSL2 (G.993.2), ITU-T G 998.2 Bonding, EFM (IEEE 802.3ah), Vectoring |
| USB | 2 x USB 2.0 |
| GPIO Buttons | WPS button, WiFi toggle switch, Reset button |
| GPIO LEDs | ADSL, Internet, WPS, USB Port 1, USB Port 2 |
| Power | External 12-15V 1.1-0.9A |
| Serial | Yes |
| JTAG | Yes |
| FCC-ID | VGYV2760VN |
Photos
Internal photo:
Debug Logs
boot/dmesg
ROM VER: 1.1.4 CFG 05 ROM VER: 1.1.4 CFG 05 boa�rd_init_f: DrayBoot-v1.2.5 (Sep 25 2013 - 15:02:46) CLOCK CPU 500M RAM 250M DRAM: 128 MiB relocate_code start NAND device: Manufacturer ID: 0x98, Chip ID: 0xd1 (Toshiba NAND 128MiB 3,3V 8-bit) 128 MiB Bad block table not found for chip 0 Bad block table not found for chip 0 Bad block table written to 0x000007fe0000, version 0x01 Bad block table written to 0x000007fc0000, version 0x01 256 KiB MX25L200 series at 0:0 is now current device Net: GPHY fw ver: 0x8434 vr9 Switch device 0 offset 0x100000, size 0x180000 0x180000 bytes read: OK Starting kernel ... Lantiq xDSL CPE VR9 mips_hpt_frequency = 250000000, counter_resolution = 2 <5>Linux version 2.6.32.32 (camus@rd5.draytek.com) (gcc version 4.3.3 (GCC) ) #1 Wed May 8 13:13:42 CST$ <4>phym = 08000000, mem = 07f00000, max_pfn = 00007f00 <4>Reserving memory for CP1 @0xa7f00000, size 0x00100000 <6>CPU revision is: 00019556 (MIPS 34Kc) <6>Determined physical RAM map: <6>User-defined physical RAM map: <6> memory: 07f00000 @ 00000000 (usable) <6>Initrd not found or empty - disabling initrd <4>Zone PFN ranges: <4> Normal 0x00000000 -> 0x00007f00 <4>Movable zone start PFN for each node <4>early_node_map[1] active PFN ranges <4> 0: 0x00000000 -> 0x00007f00 <7>On node 0 totalpages: 32512 <7>free_area_init_node: node 0, pgdat 8045cb90, node_mem_map 81000000 <7> Normal zone: 254 pages used for memmap <7> Normal zone: 0 pages reserved <7> Normal zone: 32258 pages, LIFO batch:7 <4>Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32258 <5>Kernel command line: root=/dev/mtdblock3 rw rootfstype=jffs2 ip=192.168.1.1:192.168.1.91::::eth0:on $ <6>PID hash table entries: 512 (order: -1, 2048 bytes) <6>Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) <6>Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) <4>Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. <4>Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes <6>Writing ErrCtl register=00050040 <6>Readback ErrCtl register=00050040 <6>Memory: 123660k/130048k available (3448k kernel code, 6208k reserved, 1012k data, 192k init, 0k high$ <6>Hierarchical RCU implementation. <6>NR_IRQS:185 <6>Lantiq ICU driver, version 3.0.1, (c) 2001-2011 Lantiq Deutschland GmbH <6>console [ttyS0] enabled <6>Calibrating delay loop... 332.59 BogoMIPS (lpj=1662976) <6>Security Framework initialized <4>Mount-cache hash table entries: 512 <6>NET: Registered protocol family 16 <3>ifx_pcie_wait_phy_link_up timeout <3>ifx_pcie_wait_phy_link_up timeout <3>ifx_pcie_wait_phy_link_up timeout <3>ifx_pcie_wait_phy_link_up timeout <3>ifx_pcie_wait_phy_link_up timeout <3>pcie_rc_initialize link up failed!!!!! <6>Lantiq PCIe Root Complex driver, version 1.5.3, (c) 2001-2011 Lantiq Deutschland GmbH <4>bio: create slab <bio-0> at 0 <5>SCSI subsystem initialized <6>usbcore: registered new interface driver usbfs <6>usbcore: registered new interface driver hub <6>usbcore: registered new device driver usb <6>NET: Registered protocol family 8 <6>NET: Registered protocol family 20 <6>Switching to clocksource MIPS <6>NET: Registered protocol family 2 <6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes) <6>TCP established hash table entries: 4096 (order: 3, 32768 bytes) <6>TCP bind hash table entries: 4096 (order: 2, 16384 bytes) <6>TCP: Hash tables configured (established 4096 bind 4096) <6>TCP reno registered <6>NET: Registered protocol family 1 <6>gptu: totally 6 16-bit timers/counters <6>gptu: misc_register on minor 63 <6>gptu: succeeded to request irq 118 <6>gptu: succeeded to request irq 119 <6>gptu: succeeded to request irq 120 <6>gptu: succeeded to request irq 121 <6>gptu: succeeded to request irq 122 <6>gptu: succeeded to request irq 123 <6>IFX DMA driver, version ifxmips_dma_core.c:v1.0.17 <6>,(c)2009 Infineon Technologies AG <6>Lantiq CGU driver, version 1.1.27, (c) 2001-2011 Lantiq Deutschland GmbH <4>vpe1_mem = 100000 <4>Wired TLB entries for Linux read_c0_wired() = 0 <6>squashfs: version 4.0 (2009/01/31) Phillip Lougher <4>Registering mini_fo version $Id$ <6>JFFS2 version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. <6>msgmni has been set to 241 <4>Line: 127, function: deu_init <6>Infineon Technologies DEU driver version 2.0.0 <5>IFX DEU DES initialized (multiblock). <5>IFX DEU AES initialized (multiblock). <5>IFX DEU ARC4 initialized (multiblock). <5>IFX DEU SHA1 initialized. <5>IFX DEU MD5 initialized. <5>IFX DEU SHA1_HMAC initialized. <5>IFX DEU MD5_HMAC initialized. <6>io scheduler noop registered (default) <6>ifx_pmu_init: Major 252 <6>Lantiq PMU driver, version 1.2.2, (c) 2001-2011 Lantiq Deutschland GmbH <6>Lantiq GPIO driver, version 1.2.14, (c) 2001-2011 Lantiq Deutschland GmbH <6>Infineon Technologies RCU driver version 1.0.8 <6>Lantiq LED Controller driver, version 1.0.6, (c) 2001-2011 Lantiq Deutschland GmbH <6>Turn on ACT on ifx_ledc_init~~~~~ <6>MEI CPE Driver, Version 1.1.1 <6> <6>(c) Copyright 2009, Infineon Technologies AG <6> <6>### MEI CPE - MEI CPE - MEI CPE - MEI CPE ### <6> <6>ttyS0 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC <6>Register ASC (UART) to PMCU. <6>Lantiq ASC (UART) driver, version 1.0.9, (c) 2001-2011 Lantiq Deutschland GmbH <6>brd: module loaded <6>loop: module loaded <4>ifx_nand_init <4>IFX_EBU_BUSCON1=40f295. <4>IFX_EBU_NAND_CON=5f3. <4>Probe for NAND flash... <6>NAND device: Manufacturer ID: 0x98, Chip ID: 0xd1 (Toshiba NAND 128MiB 3,3V 8-bit) <6>Scanning device for bad blocks <3>mtd: bad character after partition (-) <5>10 cmdlinepart partitions found on MTD device ifx_nand <5>Creating 10 MTD partitions on "ifx_nand": <5>0x000000000000-0x000000080000 : "uboot" <5>0x000000080000-0x000000100000 : "firmware" <5>0x000000100000-0x000000500000 : "kernel" <5>0x000000500000-0x000002d00000 : "rootfs" <5>mtd: partition "rootfs" set to be root filesystem <5>0x000002d00000-0x000002f80000 : "sysconfig" <5>0x000002f80000-0x000002fc0000 : "ubootconfig" <5>0x000002fc0000-0x000003000000 : "fwdiag" <5>0x000003000000-0x000003280000 : "sysconfigbak" <5>0x000003280000-0x000005a80000 : "backupimg" <5>0x000005a80000-0x000008000000 : "storage" <6>Lantiq SSC driver, version 2.2.6, (c) 2001-2011 Lantiq Deutschland GmbH <6>Lantiq SPI EERPOM driver, version 1.1.1, (c) 2001-2011 Lantiq Deutschland GmbH <6>PPP generic driver version 2.4.2 <6>PPP Deflate Compression module registered <6>PPP BSD Compression module registered <6>PPP MPPE Compression module registered <6>NET: Registered protocol family 24 <6>IMQ driver loaded successfully. <6> Hooking IMQ after NAT on PREROUTING. <6> Hooking IMQ after NAT on POSTROUTING. <6>pegasus: v0.6.14 (2006/09/27), Pegasus/Pegasus II USB Ethernet driver <6>usbcore: registered new interface driver pegasus <4>IFX SWITCH API, Version 1.1.7.2 <6>SWAPI: Registered character device [switch_api] with major no [81] <4>Switch API: PCE MicroCode loaded !! <4>Switch Auto Polling value = 0 <3>GPHY FW load for A2x !! <4>GPHY FIRMWARE LOAD SUCCESSFULLY AT ADDR : 4b0000 <6>IFX GPHY driver GE Mode, version ifxmips_vr9_gphy: V0.9 - Firmware: 8430 <6>usbcore: registered new interface driver usblp <6>Initializing USB Mass Storage driver... <6>usbcore: registered new interface driver usb-storage <6>USB Mass Storage support registered. <6>usbcore: registered new interface driver ums-alauda <6>usbcore: registered new interface driver ums-datafab <6>usbcore: registered new interface driver ums-freecom <6>usbcore: registered new interface driver ums-jumpshot <6>usbcore: registered new interface driver ums-karma <6>usbcore: registered new interface driver ums-sddr09 <6>usbcore: registered new interface driver ums-sddr55 <6>usbcore: registered new interface driver ums-usbat <6>usbcore: registered new interface driver usbserial <6>USB Serial support registered for generic <6>usbcore: registered new interface driver usbserial_generic <6>usbserial: USB Serial Driver core <6>USB Serial support registered for FTDI USB Serial Device <6>usbcore: registered new interface driver ftdi_sio <6>ftdi_sio: v1.5.0:USB FTDI Serial Converters Driver <6>USB Serial support registered for GSM modem (1-port) <6>usbcore: registered new interface driver option <6>option: v0.7.2:USB Driver for GSM modems <6>Registered led device: broadband_led <6>Registered led device: ledc_1 <6>Registered led device: ledc_2 <6>Registered led device: ledc_3 <6>Registered led device: ledc_4 <6>Registered led device: ledc_5 <6>Registered led device: ledc_6 <6>Registered led device: ledc_7 <6>Registered led device: phone2_led <6>Registered led device: phone1_led <6>Registered led device: line_led <6>Registered led device: wps_led <6>Registered led device: wlan_led <6>Registered led device: usb2_led <6>Registered led device: usb1_led <6>Registered led device: act_led <6>Turn on ACT led~ <6>Lantiq LED driver, version 1.0.17, (c) 2001-2011 Lantiq Deutschland GmbH <4>u32 classifier <4> Performance counters on <4> input device check on <4> Actions configured <4>nf_conntrack version 0.5.0 (1935 buckets, 7740 max) <4>ip_conntrack_rtsp v0.6.21 loading <6>xt_time: kernel timezone is -0000 <6>IPv4 over IPv4 tunneling driver <4>ip_nat_rtsp v0.6.21 loading <6>ip_tables: (C) 2000-2006 Netfilter Core Team <6>TCP cubic registered <6>Initializing XFRM netlink socket <6>NET: Registered protocol family 10 <6>lo: Disabled Privacy Extensions <6>tunl0: Disabled Privacy Extensions <6>NET: Registered protocol family 17 <6>NET: Registered protocol family 15 <5>Bridge firewalling registered <6>NET: Registered protocol family 8 <4>atmpvc_init() failed with -17 <4>lec.c: May 8 2013 13:09:02 initialized <4>mpc.c: May 8 2013 13:08:57 initialized <4>KOAM is loaded successfully. <6>802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> <6>All bugs added by David S. Miller <davem@redhat.com> <4>VFS: Mounted root (jffs2 filesystem) on device 31:3. <6>Freeing unused kernel memory: 192k freed <4>Please be patient, while OpenWrt loads ... <4>Loading E5 (MII0/1) driver ...... Succeeded! <4>PPE datapath driver info: <4> Version ID: 64.3.3.1.0.1.1 <4> Family : VR9 <4> DR Type : Normal Data Path | Indirect-Fast Path <4> Interface : MII0 | MII1 <4> Mode : Routing <4> Release : 0.1.1 <4>PPE 0 firmware info: <4> Version ID: 7.1.5.1.0.33 <4> Family : VR9 <4> FW Type : Standard <4> Interface : MII0/1 + PTM <4> Mode : reserved - 1 <4> Release : 0.33 <4>PPE 1 firmware info: <4> Version ID: 7.2.1.6.2.0 <4> Family : VR9 <4> FW Type : Acceleration <4> Interface : MII0 + MII1 <4> Mode : Bridging + IPv4 Routing <4> Release : 2.0 <4>ifx_ppa_api: module license 'unspecified' taints kernel. <4>Disabling lock debugging due to kernel taint <4>PPA API --- init successfully <6>IFXOS, Version 1.5.14 (c) Copyright 2009, Lantiq Deutschland GmbH <6> <4> <4>Lantiq CPE API Driver version: DSL CPE API V4.9.2.1 <4> <4>Predefined debug level: 3 <3> <3>>>dray_switchapi_init: Dray switch api driver init~~ << <4> <4>DrayTek Firewall Core initialize <4>[Firewall-Configuration-Interface] has been installed.ksocket version 0.0.2 <4>BSD-style socket APIs for kernel 2.6 developers <4>msn : song.xian-guang@hotmail.com <4>blog: http://sxg.cublog.cn <4>Patch: Null sock protection <6>ktp_query is working!!! <4> <4>[kfile v0.0.1] has been registered.Assert at /home/camus/draytek/2760mk2/build_dir/linux-ltqcpe_2_6_$ <4> <4>[Application Control] resources have been allocated <4>[Protocol Enforcement] resources have been allocated <6> <6>dray_user_mngt init scuuessful !! <6> <6>Register hook Access Control successfully !! <4>DrayTek proxy architecture initialize successful <4> <4>DrayTek IPF Module initializeTransparent Proxy use Ksocket/DrayEPoll version 0.0.1 <4>Use DrayEPoll <6>/proc/ktp created <6>/proc/ktp/ktp_info created <6>Thread kmonitor_tsk wake_up_process-start <6>ktp is working!!! <7> <7>DrayTek Accept target initialize <6> <6>Register hook IPsec Info successfully !! <4>DrayTek proxy architecture initialize successful <6>GRE over IPv4 demultiplexor driver <6>PPTP driver version 0.8.5 <6>GRE over IPv4 tunneling driver <4> wdt_ioctl:enable watch dog timer! <6>device eth0.101 entered promiscuous mode <6>device eth0 entered promiscuous mode <6>lan1: port 1(eth0.101) entering forwarding state <4> <4>[FR]No fiilter rule data <4>[FR]No local fiilter rule data <4>[FR]No fiilter rule data <4>[FR]No local fiilter rule data <4>[FR]No fiilter rule data <4>[FR]No local fiilter rule data <4>Service object handle, len=348, action=100TAPI, Version 4.7.1.2, (c) 2001-2010 Lantiq Deutschland Gm$ <4>Lantiq MIPS34KEc MPS driver, version 2.2.3.1, (c) 2006-2010 Lantiq Deutschland GmbH <4>Lantiq VMMC device driver, version 1.10.2.2, (c) 2006-2010 Lantiq Deutschland GmbH <6>Lantiq KPI2UDP driver, version 3.0.1.0, (c) 2008-2011 Lantiq Deutschland GmbH <4>73M1966 TAPI Driver, Rev. 2.2, (c) 2007-2009 Teridian Semiconductor Corp. <4>73M1966 Driver, Rev. 2.7.3lq5, (c) 2007-2009 Teridian Semiconductor Corp. <6>IFXUSB: ifxusb_hcd: version 3.2 B120208 <6>Chip Version :0002 BurstSize=4 <6>IFXUSB: USB core #0 soft-reset <6>IFXUSB: USB core #0 soft-reset <6>ifxusb_hcd ifxusb_hcd: IFX USB Controller <6>ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 1 <6>ifxusb_hcd ifxusb_hcd: irq 54, io mem 0xbe101000 <3>drivers/char/ifxmips_gpio.c:1083:ifx_gpio_pin_reserve: Pin ID 33 (port 2, pin 1) has been reserved b$ <6>IFXUSB: Register USB VBus Failed!! <6>IFXUSB: Init: Power Port (0) <6>usb usb1: configuration #1 chosen from 1 choice <6>hub 1-0:1.0: USB hub found <6>hub 1-0:1.0: 1 port detected <6>IFXUSB: USB core #1 soft-reset <6>IFXUSB: USB core #1 soft-reset <6>ifxusb_hcd ifxusb_hcd: IFX USB Controller <6>ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 2 <6>ifxusb_hcd ifxusb_hcd: irq 83, io mem 0xbe106000 <6>IFXUSB: Init: Power Port (0) <6>usb usb2: configuration #1 chosen from 1 choice <6>hub 2-0:1.0: USB hub found <6>hub 2-0:1.0: USB hub found <6>hub 2-0:1.0: 1 port detected <3>userspace registering PID
System Info
Linux version 2.6.32.32 (camus@rd5.draytek.com) (gcc version 4.3.3 (GCC) ) #1 Wed Dec 11 20:37:25 CST 2013 root=/dev/mtdblock3 rw rootfstype=jffs2 ip=192.168.1.1:192.168.1.91::::eth0:on console=ttyS0,115200 ethaddr=00:1d:aa:xx:xx:xx phym=128M mem=127M panic=1 mtdparts=ifx_nand:512k(uboot),512k(firmware),4m(kernel) root@vigor:/etc/init.d# cat /proc/cpuinfo system type : VR9 processor : 0 cpu model : MIPS 34Kc V5.6 BogoMIPS : 332.59 wait instruction : yes microsecond timers : yes tlb_entries : 16 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ff8, 0x0ff8] ASEs implemented : mips16 dsp mt shadow register sets : 1 core : 0 VCED exceptions : not available VCEI exceptions : not available root@vigor:/etc/init.d# cat /proc/mtd dev: size erasesize name mtd0: 00080000 00020000 "uboot" mtd1: 00080000 00020000 "firmware" mtd2: 00400000 00020000 "kernel" mtd3: 02800000 00020000 "rootfs" mtd4: 00280000 00020000 "sysconfig" mtd5: 00040000 00020000 "ubootconfig" mtd6: 00040000 00020000 "fwdiag" mtd7: 00280000 00020000 "sysconfigbak" mtd8: 02800000 00020000 "backupimg" mtd9: 02580000 00020000 "storage" root@vigor:/proc# cat partitions major minor #blocks name 7 0 392 loop0 31 0 512 mtdblock0 31 1 512 mtdblock1 31 2 4096 mtdblock2 31 3 40960 mtdblock3 31 4 2560 mtdblock4 31 5 256 mtdblock5 31 6 256 mtdblock6 31 7 2560 mtdblock7 31 8 40960 mtdblock8 31 9 38400 mtdblock9 root@vigor:/etc/init.d# df Filesystem 1024-blocks Used Available Use% Mounted on /dev/root 40960 21148 19812 52% / /dev/mtdblock4 2560 504 2056 20% /etc/sysconfig /dev/mtdblock7 2560 468 2092 18% /etc/sysconfig_bak /dev/mtdblock9 38400 1568 36832 4% /mnt/share /dev/mtdblock1 512 512 0 100% /lib/firmware/2.6.32.32 root@vigor:/proc# cat interrupts CPU0 15: 0 IFX_ICU ifx_ssc_tx 54: 0 IFX_ICU ifxusb_hcd_1:usb1 55: 1609 IFX_ICU mei_cpe 56: 0 IFX_ICU ifxusb2_oc 60: 0 IFX_ICU ifxusb1_oc 62: 0 IFX_ICU dma-core 64: 0 IFX_ICU dma-core 65: 0 IFX_ICU dma-core 66: 0 IFX_ICU dma-core 67: 0 IFX_ICU dma-core 68: 0 IFX_ICU dma-core 69: 0 IFX_ICU dma-core 70: 0 IFX_ICU dma-core 71: 0 IFX_ICU dma-core 72: 0 IFX_ICU dma-core 73: 0 IFX_ICU dma-core 74: 0 IFX_ICU dma-core 75: 0 IFX_ICU dma-core 80: 0 IFX_ICU dma-core 83: 0 IFX_ICU ifxusb_hcd_2:usb2 85: 0 IFX_ICU dma-core 87: 0 IFX_ICU a5_mailbox0_isr 88: 0 IFX_ICU a5_mailbox_isr 89: 0 IFX_ICU dma-core 90: 0 IFX_ICU dma-core 91: 0 IFX_ICU dma-core 92: 0 IFX_ICU dma-core 93: 0 IFX_ICU dma-core 103: 102522 IFX_ICU asc1_tx 105: 485 IFX_ICU asc1_rx 106: 0 IFX_ICU asc1_err 118: 0 IFX_ICU gptu 119: 0 IFX_ICU gptu 120: 0 IFX_ICU gptu 121: 0 IFX_ICU gptu 122: 0 IFX_ICU gptu 123: 0 IFX_ICU gptu 128: 0 IFX_ICU dma-core 129: 614 IFX_ICU dma-core 130: 0 IFX_ICU dma-core 131: 0 IFX_ICU dma-core 132: 0 IFX_ICU dma-core 133: 0 IFX_ICU dma-core 134: 0 IFX_ICU dma-core 135: 0 IFX_ICU dma-core 142: 0 IFX_ICU mps_mbx vc0 143: 0 IFX_ICU mps_mbx vc1 144: 0 IFX_ICU mps_mbx vc2 145: 0 IFX_ICU mps_mbx vc3 146: 0 IFX_ICU mps_mbx ad0 147: 0 IFX_ICU mps_mbx ad1 158: 0 IFX_EIC Teridian_1966_FXO 159: 0 IFX_ICU perf_ctr 176: 85557 TIMER timer root@vigor:/proc# cat meminfo MemTotal: 124040 kB MemFree: 88376 kB Buffers: 396 kB Cached: 9820 kB SwapCached: 0 kB Active: 15900 kB Inactive: 4432 kB Active(anon): 10116 kB Inactive(anon): 0 kB Active(file): 5784 kB Inactive(file): 4432 kB Unevictable: 0 kB Mlocked: 0 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 10120 kB Mapped: 3332 kB Shmem: 0 kB Slab: 9680 kB SReclaimable: 824 kB SUnreclaim: 8856 kB KernelStack: 640 kB PageTables: 536 kB NFS_Unstable: 0 kB Bounce: 0 kB WritebackTmp: 0 kB CommitLimit: 117836 kB Committed_AS: 15712 kB VmallocTotal: 1048372 kB VmallocUsed: 4380 kB VmallocChunk: 1003056 kB root@vigor:/proc# cat devices Character devices: 1 mem 2 pty 3 ttyp 4 ttyS 5 /dev/tty 5 /dev/console 5 /dev/ptmx 10 misc 60 eeprom 81 switch_api 90 mtd 108 ppp 109 drv_dsl_cpe_api 122 ifx_tapi (vmmc) 128 ptm 136 pts 180 usb 181 ifx_ppa 188 ttyUSB 189 usb_device 212 timer_drv 221 73m1966_TAPI 229 voip_timer_driver 238 dray_switch 239 iobank 240 ifx_gpio 241 ifx_rcu 242 ifx_ledc 244 ifx_exin 245 lte_driver 246 ifx_cgu 247 ifx_mps 248 ifx_led 249 mei_cpe 250 ifx_dma_core 251 ifx_wdt 252 ifx_pmu 253 ifx_pmcu 254 vpe Block devices: 1 ramdisk 259 blkext 7 loop 8 sd 31 mtdblock 65 sd 66 sd 67 sd 68 sd 69 sd 70 sd 71 sd 128 sd 129 sd 130 sd 131 sd 132 sd 133 sd 134 sd 135 sd root@vigor:/proc# lsmod Tainted: P lte_drv 71937 2 - Live 0xc28c9000 autofs4 22247 1 - Live 0xc22ae000 ifxusb_host 99942 0 - Live 0xc225e000 drv_timer 3197 0 - Live 0xc2228000 ifx_voip_timer_driver 2857 0 - Live 0xc221d000 drv_ter1x66 70520 0 - Live 0xc21f7000 drv_kpi2udp 3968 0 - Live 0xc21d0000 drv_vmmc 206154 0 - Live 0xc218c000 drv_tapi 195469 2 drv_kpi2udp,drv_vmmc, Live 0xc20fb000 nf_nat_sip 5520 0 - Live 0xc1a51000 nf_conntrack_sip 13645 1 nf_nat_sip, Live 0xc1a43000 ip_gre 13600 0 - Live 0xc10ff000 pptp 15776 0 - Live 0xc10ac000 gre 1234 2 ip_gre,pptp, Live 0xc109f000 sit 11072 0 - Live 0xc1093000 tun 12416 0 - Live 0xc1082000 drayfw 17773 8 - Live 0xc106e000 drayfw_core 487901 1 drayfw, Live 0xc0fc5000 drayswapi 22507 0 - Live 0xc0f29000 drv_dsl_cpe_api 110814 0 - Live 0xc02df000 drv_ifxos 15134 3 drv_vmmc,drv_tapi,drv_dsl_cpe_api, Live 0xc02a5000 ifx_ppa_api_proc 22684 0 - Live 0xc028f000 (P) ifx_ppa_api 103571 1 ifx_ppa_api_proc, Live 0xc025c000 (P) ifxmips_ppa_hal_vr9_a5 39815 0 - Live 0xc021e000 ifxmips_ppa_datapath_vr9_a5 171083 0 - Live 0xc01d4000 drayvr9iobank 10950 0 - Live 0xc00eb000 nls_utf8 912 0 - Live 0xc0076000 root@vigor:/opt/lantiq/bin# ls adsl.scr drv_ter1x66.ko inst_driver.sh alias_drv_mei_cpe.sh drv_vmmc.ko inst_drv_cpe_api.sh alias_dsl_cpe.sh dsl_cpe_control inst_drv_mei_cpe.sh debug_level.cfg dsl_cpe_pipe.sh mei_cpe_drv_test drv_dsl_cpe_api.ko dsl_retrain vdsl.scr drv_ifxos.ko dsl_status what.sh drv_kpi2udp.ko enable_ARC_JTAG.sh whatz.sh drv_tapi.ko ifx_mei_cpe_drv_init.sh root@vigor:/opt/ifx/downloads# ls BMCFw.BIN LICENSE vr9_bbd_fxo.bin vr9_firmware.bin COSICFw.BIN ar9_firmware.bin vr9_bbd_fxs.bin root@vigor:/opt/ifx/bin# ls drv_dsl_cpe_api.ko drv_tapi.ko dsl_cpe_control drv_ifxos.ko drv_ter1x66.ko dsl_cpe_pipe.sh drv_kpi2udp.ko drv_vmmc.ko inst_driver.sh
U-boot environment variables
This information was exposed in /tmp/ubootvars. It would appear it can netboot from 192.168.1.91, but I had no success with this.
With apologies for the poor formatting.
©bootcmd=run flash_flashbootdelay=1 baudrate=115200 preboot=echo; bootfile="uImage" mem=127M phym=128M serverip=192.168.1.91 netdev=eth0 console=ttyS0 baudrate=115200 tftppath= loadaddr=0x86000000 rootpath=/mnt/full_fsroot fsmtd=/dev/mtdblock3 nfsargs= setenv bootargs root=/dev/nfs rw nfsroot=$(serverip):$(rootpath) ramargs= setenv bootargs root=/dev/ram rwaddip= setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):onaddmisc= setenv bootargs $(bootargs) console=$(console),$(baudrate) ethaddr=$(ethaddr) phym=$(phym) mem=$(mem) panic=1 mtdparts=$(mtdparts) init=/etc/preinit quiet vpe1_load_addr=0x87f00000 vpe1_mem=1M ethwan=$(ethwan) flash_nfs=run nfsargs addip addmisc;bootm $(kernel_addr)net_nfs=tftp $(loadaddr) $(tftppath)$(bootfile);run nfsargs addip addmisc;bootmnet_flash=tftp $(loadaddr) $(tftppath)$(bootfile); run flashargs addip addmisc; bootmnet_ram=tftp $(loadaddr) $(tftppath)$(bootfile); run ramargs addip addmisc; bootmu-boot=u-boot.lqrootfs=rootfs.imgfirmware=firmware.imgfullimage=fullimage.imgtotalimage=totalimage.imgload=tftp $(loadaddr) $(u-boot)update=protect off 1:0-2;era 1:0-2;cp.b $(loadaddr) B0000000 $(filesize)flashargs= setenv bootargs root=$(rootfsmtd) rw rootfstype=jffs2flash_flash=nand read.jffs2 $(loadaddr) $(f_kernel_addr) $(f_kernel_size);run flashargs addip addmisc;bootm $(loadaddr)update_nandboot=tftp $(loadaddr) $(tftppath)u-boot-nand.bin; nand erase clean 0 0x08000000; nand write.partial $(loadaddr) 0 $(filesize)update_uboot=tftp $(loadaddr) $(tftppath)$(u-boot); nand write.partial $(loadaddr) 4000 $(filesize);resetupdate_kernel=tftpboot $(loadaddr) $(tftppath)$(bootfile);upgrade $(loadaddr) $(filesize)update_rootfs=tftpboot $(loadaddr) $(tftppath)$(rootfs);upgrade $(loadaddr) $(filesize)update_firmware=tftpboot $(loadaddr) $(tftppath)$(firmware);upgrade $(loadaddr) $(filesize)update_fullimage=tftpboot $(loadaddr) $(tftppath)$(fullimage);upgrade $(loadaddr) $(filesize)update_totalimage=tftpboot $(loadaddr) $(tftppath)$(totalimage);upgrade $(loadaddr) $(filesize)reset_uboot_config=nand write.partial 80400000 $(f_ubootconfig_addr) $(f_ubootconfig_size)reset_ddr_config=nand write.partial 80400000 $(f_ddrconfig_addr) $(f_ddrconfig_size)mtdparts=ifx_nand:512k(uboot),512k(firmware),4m(kernel),40m(rootfs),2560k(sysconfig),256k(ubootconfig),256k(fwdiag),2560k(sysconfigbak),40m(backupimg),38400k(storage)-(res)part0_begin=0x00000000part1_begin=0x00080000part2_begin=0x00100000part3_begin=0x00500000part4_begin=0x02D00000part5_begin=0x02F80000part6_begin=0x02FC0000part7_begin=0x03000000part8_begin=0x03280000part9_begin=0x05A80000total_part=10flash_end=0x07FFFFFFdata_block0=ubootdata_block1=firmwaredata_block2=kerneldata_block3=rootfsdata_block4=sysconfigdata_block5=ubootconfigdata_block6=fwdiagdata_block7=sysconfigbakdata_block8=backupimgdata_block9=storagetotal_db=10f_uboot_addr=0x00000000f_uboot_size=0x80000f_ubootconfig_addr=0x02F80000f_ubootconfig_size=0x40000f_ubootconfig_end=0x02FBFFFFf_kernel_end=0x004FFFFFf_sysconfig_addr=0x02D00000f_sysconfig_size=0x280000f_fwdiag_addr=0x02FC0000f_fwdiag_size=0x40000f_calibration_addr= IFX_CFG_FLASH_CALIBRATION_START_ADDRf_calibration_size=IFX_CFG_FLASH_CALIBRATION_CFG_SIZE f_ddrconfig_addr=0x0003ffb0 f_ddrconfig_size=24 f_ddrconfig_end=0x0003ffc8 f_sysconfigbak_addr=0x03000000 f_sysconfigbak_size=0x280000 f_sysconfigbak_end=0x0327FFFF f_backupimg_addr=0x03280000 f_backupimg_size=0x2700000 f_backupimg_end=0x0597FFFF bootver=DrayBoot-v1.2.5f _storage_addr=0x05A80000f _storage_size=0x2580000f _storage_end=0x07FFFFFF ethaddr=00:1d:aa:xx:xx:xx wan2_en=0 ethact=vr9 Switchipaddr=192.168.1.1 bootargs=root=/dev/mtdblock3 rw rootfstype=jffs2 ip=192.168.1.1:192.168.1.91::::eth0:on console=ttyS0,115200 ethaddr=00:1d:aa:xx:xx:xx phym=128M mem=127M panic=1 mtdparts=ifx_nand:512k(uboot),512k(firmware),4m(kernel),40m(rootfs),2560k(sysconfig),256k(ubootconfig),256k(fwdiag),2560k(sysconfigbak),40m(backupimg),38400k(storage)-(res) init=/etc/preinit quiet vpe1_load_addr=0x87f00000 vpe1_mem=1M ethwan=imagebackup=0stdin=serialstdout=serialstderr=serialfilesize=1643107fileaddr=86000000f_kernel_size=0x00180000f_kernel_addr=0x00100000kernel_addr=0x00100000f_kernel_crc=4FA91FA9f_rootfs_size=0x01460000f_rootfs_addr=0x00500000f_rootfs_end=0x01960000f_rootfs_crc=18C5D265f_firmware_size=0x00063000f_firmware_addr=0x00080000f_firmware_crc=4174CAE5
Installing OpenWrt
* TODO
The following is the binwalk of how a factory firmware upgrade file looks like:
DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 uImage header, header size: 64 bytes, header CRC: 0x33CDAFE3, created: Mon Jun 16 11:53:44 2014, image size: 23343240 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xE37826FD, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: none, image name: "Vigor Fullimage" 72 0x48 uImage header, header size: 64 bytes, header CRC: 0x11548912, created: Mon Jun 16 11:53:35 2014, image size: 1572800 bytes, Data Address: 0x80002000, Entry Point: 0x800061B0, data CRC: 0x4FA91FA9, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Vigor Linux-2.6.32.32" 136 0x88 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 4819712 bytes 1572936 0x180048 uImage header, header size: 64 bytes, header CRC: 0xE03C7FC6, created: Mon Jun 16 11:53:43 2014, image size: 21364736 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x18C5D265, OS: Linux, CPU: MIPS, image type: Filesystem Image, compression type: gzip, image name: "Vigor RootFS" 1573000 0x180088 JFFS2 filesystem, big endian 22937736 0x15E0088 uImage header, header size: 64 bytes, header CRC: 0xBC40B9F5, created: Mon Jun 16 11:53:44 2014, image size: 405504 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x4174CAE5, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "Vigor Firmware" 22937800 0x15E00C8 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 402021 bytes, 4 inodes, blocksize: 131072 bytes, created: Mon Jun 16 11:53:44 2014
If attempting to flash an image with manual tftp while in recovery mode with serial hooked up, the boot loader will not accept the image complaining about “Illegal filename”.
The profile used for compiling OpenWrt image for this device was “Lantiq VR9 - EASY80920NAND”.
I'm learning as I'm going here, but my next steps are to figure out how the buildroot assigns what data goes to which MTD during a flash, since I want kernel on mtd2 and rootfs on mtd3 -- I also believe I need the image to have the image name: “Vigor Fullimage”. Passing that, UBIFS should be used instead of JFFS2.
.. to be continued.