MB connect line MDH 610

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

The MBConnect mbNET MD610 is an old security router that is used for interconnect IoT devices with a central server that you can also buy/rent from MBConnect. Once the router established a vpn connection to the server, you can connect to the router through a virtual vpn connection. The MD610 has 2x LAN ports and 2x serial ports which can be used for MPI or simple RS232/RS485.

This guide is only for the hardware revision 01. Newer revision has a different hardware.

Generic Router

Install OpenWrt (generic explanation)

If you're to lazy to build a own Openwrt image, you can use the generic image of the ADI Engineering Pronghorn SBC250 pronghorn_sbc250, the hardware is nearly the same. The installation is also nearly the same, but not with a serial connection, it is done for this router by TFTP or Telnet.

Flash Layout OEM:

Name FLASH addr Mem addr Length
RedBoot 0x50000000 0x50000000 0x00080000
zImage 0x50080000 0x50080000 0x00300000
ramdisk 0x50380000 0x50380000 0x00980000
config 0x50D00000 0x50D00000 0x00200000
customer 0x50F00000 0x50F00000 0x000C0000
RedBoot config 0x50FC0000 0x50FC0000 0x00001000
FIS directory 0x50FE0000 0x50FE0000 0x00020000

Flash Layout OpenWRT:

Name FLASH addr Mem addr Length
RedBoot 0x50000000 0x50000000 0x00080000
linux 0x50080000 0x00026C00 0x00160000
rootfs 0x501E0000 0x00026C00 0x005E0000
RedBoot config 0x50FC0000 0x50FC0000 0x00001000
FIS directory 0x50FE0000 0x50FE0000 0x00020000

If you already flashed the router, you only have the ability to reflash the OEM firmware with TFTP.

Specific values needed for tftp

Bootloader tftp server IPv4 address 192.168.1.3
Firmware tftp image Latest OpenWrt release (NOTE: Name must contain “tftp”)
TFTP transfer window Until it's done
TFTP window start approximately 10 seconds after power on
TFTP client required IP address DHCP

First way through a TFTP server and autoload:

  1. Put the following files in the tftp server store: openwrt-15.05-ixp4xx-generic-pronghorn-zImage and openwrt-15.05-ixp4xx-generic-squashfs.img. Rename the squashfs.img to “ramdisk.gz” and the openwrt-zImage to “zImage”
  2. Connect the LAN interface to your computer
  3. Power on the MD610
  4. Hold down the DIALOUT-Button for a few seconds until you see that the router is requesting the mentioned files.
  5. Wait until the transfer is completed. The router will restart after the transfer.

Second way with telnet, mostly copied from pronghorn_sbc250

By default the router has a telnet server running on port 9000. To access it you need to hold down the DIALOUT-Button until the “Connect” LED is on and repress the button shortly again. Once you the router has an IP from the dhcp, you need to connect quickly to the telnet. By default the boot script executes in 1 second. In this description we assume that your TFTP server is 192.168.1. Sometimes the telnet server is also accessible without pressing the dialout button. The router requests then automatic a IPv4 address via dhcp. Once the router have an IPv4 address, you only have 1 second to connect to the telnet server.

  1. Connect to the router with telnet port 9000
  2. @ the '== Executing boot script in 2.000 seconds - enter ^C to abort' prompt hit Control-C
  3. Use fconfig to set ip address and server ip address as per TFTP Server configuration
  4. Initialize flash: fis init
  5. Load the kernel image via TFTP: load -r -b %{FREEMEMLO} zImage
  6. Write image to flash: fis create linux
  7. View list: fis list
  8. Load root filesystem image via TFTP: load -r -b %{FREEMEMLO} -h 192.168.1.3 ramdisk.gz
  9. Write image to flash: fis create rootfs
  10. Open RedBoot's configuration: fconfig -d
  11. When prompted with Run script at boot, change the value to true
  12. Enter the following in the first line of the script enter: fis load linux
  13. Enter the second line: exec.
  14. Hit enter to finish the script with an empty line.
  15. Your last entry is the timeout for loading the script. It shouldn't take longer than 1 or 2 seconds.
  16. Keep hitting enter until you get this prompt: Update RedBoot non-volatile configuration - continue (y/n)?
  17. Type y and enter.
  18. Disconnect the power and plug it in again. The router should boot now with OpenWRT

generic.sysupgrade

FIXME These are generic instructions. Update with your router's specifics.

  • Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
  • Upload image file for sysupgrade to LuCI
  • Wait for reboot

If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line. There are two command line methods for upgrading:

  • sysupgrade
  • mtd

Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

sysupgrade

  • Login as root via SSH on 192.168.1.1, then enter the following commands:
cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
sysupgrade /tmp/xxx.abc

mtd

If sysupgrade does not support this router, use mtd.

  • Login as root via SSH on 192.168.1.1, then enter the following commands:
cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
mtd write /tmp/xxx.abc linux && reboot

Basic configuration Do whatever you want with the router.

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN EXAMPLE 192.168.1.1/24
eth0 WAN port DHCP/Static
eth1 LAN port DHCP/Static

hardware.button The router has two buttons, a Reset button and a Dialout button. The reset button is self explaining, it is linked internally to the GPIO pin number 9, which you can access from OpenWRT once it is booted. The dialout button is also accessible through GPIO pin number (?). This button is used in the OEM software to establish a wan connection with the build-in modem. You can configure the settings of the button in the OEM firmware web-interface.

The MB connect line MDH 610 has the following buttons:

BUTTON Event
Reset reset
Dialout GPIO event/RedBoot special

Front:

Back:
Insert photo of back of the casing

Backside label:
Insert photo of backside label

Note: This will void your warranty!

FIXME Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, screws, ...

  • To remove the cover and open the device, do a/b/c

Main PCB:
Insert photo of PCB

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
Insert photo of PCB with markings for serial port

FIXME Replace EXAMPLE by real values.

Serial connection parameters
for MB connect line MDH 610 HW.01
EXAMPLE 115200, 8N1

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

None so far.

COPY HERE THE BOOTLOG WITH THE ORIGINAL FIRMWARE


0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 4.9.214 (eicher@T-MobiKnecht) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7989-82fbd85747) ) #0 Thu Feb 27 21:25:59 2020 [ 0.000000] CPU: XScale-IXP42x Family [690541c2] revision 2 (ARMv5TE), cr=000039ff [ 0.000000] CPU: VIVT data cache, VIVT instruction cache [ 0.000000] Machine: Intel IXDPG425 [ 0.000000] Memory policy: Data cache writeback [ 0.000000] On node 0 totalpages: 16384 [ 0.000000] free_area_init_node: node 0, pgdat c03e4008, node_mem_map c3f79000 [ 0.000000] DMA zone: 128 pages used for memmap [ 0.000000] DMA zone: 0 pages reserved [ 0.000000] DMA zone: 16384 pages, LIFO batch:3 [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Memory: 60728K/65536K available (2894K kernel code, 154K rwdata, 748K rodata, 152K init, 196K bss, 4808K reserved, 0K cma-reserved) [ 0.000000] Virtual kernel memory layout: [ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB) [ 0.000000] fixmap : 0xffc00000 - 0xfff00000 (3072 kB) [ 0.000000] vmalloc : 0xc4800000 - 0xff800000 ( 944 MB) [ 0.000000] lowmem : 0xc0000000 - 0xc4000000 ( 64 MB) [ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB) [ 0.000000] .text : 0xc0008000 - 0xc02dbd10 (2896 kB) [ 0.000000] .init : 0xc0398000 - 0xc03be000 ( 152 kB) [ 0.000000] .data : 0xc03be000 - 0xc03e48c0 ( 155 kB) [ 0.000000] .bss : 0xc03e48c0 - 0xc0415bec ( 197 kB) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:64 [ 0.000023] sched_clock: 32 bits at 66MHz, resolution 15ns, wraps every 32212576760ns [ 0.000078] clocksource: OSTS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 28669193401 ns [ 0.000180] Calibrating delay loop... 531.66 BogoMIPS (lpj=2658304) [ 0.050189] pid_max: default: 32768 minimum: 301 [ 0.050423] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.050450] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.051731] CPU: Testing write buffer coherency: ok [ 0.052657] Setting up static identity map for 0x81e0 - 0x8230 [ 0.055725] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.055774] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.057082] NET: Registered protocol family 16 [ 0.058770] DMA: preallocated 256 KiB pool for atomic coherent allocations [ 0.060571] IXP4xx: Using 16MiB expansion bus window size [ 0.061352] PCI: IXP4xx is host [ 0.061374] PCI: IXP4xx Using direct access for memory space [ 0.061640] PCI host bridge to bus 0000:00 [ 0.061686] pci_bus 0000:00: root bus resource [io 0x0000-0xffff] [ 0.061712] pci_bus 0000:00: root bus resource [mem 0x48000000-0x4bffffff] [ 0.061736] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.061858] pci 0000:00:0e.0: [1033:0035] type 00 class 0x0c0310 [ 0.061910] pci 0000:00:0e.0: reg 0x10: [mem 0xfffff000-0xffffffff] [ 0.062028] pci 0000:00:0e.0: supports D1 D2 [ 0.062043] pci 0000:00:0e.0: PME# supported from D0 D1 D2 D3hot [ 0.062136] pci 0000:00:0e.0: dmabounce: registered device [ 0.062517] pci 0000:00:0e.1: [1033:0035] type 00 class 0x0c0310 [ 0.062563] pci 0000:00:0e.1: reg 0x10: [mem 0xfffff000-0xffffffff] [ 0.062656] pci 0000:00:0e.1: supports D1 D2 [ 0.062671] pci 0000:00:0e.1: PME# supported from D0 D1 D2 D3hot [ 0.062750] pci 0000:00:0e.1: dmabounce: registered device [ 0.063140] pci 0000:00:0e.2: [1033:00e0] type 00 class 0x0c0320 [ 0.063187] pci 0000:00:0e.2: reg 0x10: [mem 0xffffff00-0xffffffff] [ 0.063284] pci 0000:00:0e.2: supports D1 D2 [ 0.063299] pci 0000:00:0e.2: PME# supported from D0 D1 D2 D3hot [ 0.063380] pci 0000:00:0e.2: dmabounce: registered device [ 0.063767] PCI: bus0: Fast back to back transfers disabled [ 0.063807] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 [ 0.063887] pci 0000:00:0e.0: BAR 0: assigned [mem 0x48000000-0x48000fff] [ 0.063924] pci 0000:00:0e.1: BAR 0: assigned [mem 0x48001000-0x48001fff] [ 0.063955] pci 0000:00:0e.2: BAR 0: assigned [mem 0x48002000-0x480020ff] [ 0.092272] clocksource: Switched to clocksource OSTS [ 0.094248] NET: Registered protocol family 2 [ 0.095686] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.095744] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.095784] TCP: Hash tables configured (established 1024 bind 1024) [ 0.096028] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.096069] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.096486] NET: Registered protocol family 1 [ 0.096639] pci 0000:00:0e.0: enabling device (0140 -> 0142) [ 0.096908] pci 0000:00:0e.1: enabling device (0140 -> 0142) [ 0.097175] pci 0000:00:0e.2: enabling device (0140 -> 0142) [ 0.097391] PCI: CLS 32 bytes, default 32 [ 0.105397] IXP4xx Queue Manager initialized. [ 0.107539] Crashlog allocated RAM at address 0x3f00000 [ 0.109503] workingset: timestamp_bits=30 max_order=14 bucket_order=0 [ 0.130098] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.130130] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.152064] io scheduler noop registered [ 0.152096] io scheduler deadline registered (default) [ 0.224008] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled [ 0.226192] console [ttyS0] disabled [ 0.226308] serial8250.0: ttyS0 at MMIO 0xc8000000 (irq = 15, base_baud = 921600) is a XScale [ 0.772528] console [ttyS0] enabled [ 0.778317] IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000089 Chip ID 0x000018 [ 0.788685] Intel/Sharp Extended Query Table at 0x0031 [ 0.793894] Intel/Sharp Extended Query Table at 0x0031 [ 0.799076] Using buffer write method [ 0.802751] cfi_cmdset_0001: Erase suspend on write enabled [ 0.808328] erase region 0: offset=0x0,size=0x20000,blocks=128 [ 0.810438] Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0xfe0000 [ 0.933323] 5 RedBoot partitions found on MTD device IXP4XX-Flash.0 [ 0.939606] Creating 5 MTD partitions on "IXP4XX-Flash.0": [ 0.945212] 0x000000000000-0x000000080000 : "RedBoot" [ 0.954130] 0x000000080000-0x0000001e0000 : "linux" [ 0.963192] 0x0000001e0000-0x000000fc0000 : "rootfs" [ 0.971380] mtd: device 2 (rootfs) set to be root filesystem [ 0.977244] 1 squashfs-split partitions found on MTD device rootfs [ 0.983464] 0x000000780000-0x000000fc0000 : "rootfs_data" [ 0.993334] 0x000000fc0000-0x000000fc1000 : "RedBoot config" [ 1.003252] 0x000000fe0000-0x000001000000 : "FIS directory" [ 1.022461] libphy: IXP4xx MII Bus: probed [ 1.028612] eth0: MII PHY 5 on NPE-B [ 1.034302] eth1: MII PHY 4 on NPE-C [ 1.038551] i2c /dev entries driver [ 1.042717] ixp4xx_wdt: timer heartbeat 60 sec [ 1.049137] NET: Registered protocol family 10 [ 1.063443] NET: Registered protocol family 17 [ 1.067990] 8021q: 802.1Q VLAN Support v1.8 [ 1.072486] XScale DSP coprocessor detected. [ 1.079347] hctosys: unable to open rtc device (rtc0) [ 1.095930] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 1.103916] Freeing unused kernel memory: 152K [ 1.108364] This architecture does not have kernel memory protection. [ 2.141632] init: Console is alive [ 2.145619] init: - watchdog - [ 2.502301] random: fast init done [ 4.326800] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 4.622697] usbcore: registered new interface driver usbfs [ 4.628366] usbcore: registered new interface driver hub [ 4.633988] usbcore: registered new device driver usb [ 4.727821] JFS: nTxBlock = 475, nTxLock = 3805 [ 4.739484] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 4.761658] SCSI subsystem initialized [ 4.774510] ehci-platform: EHCI generic platform driver [ 4.788410] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 4.797733] ohci-platform: OHCI generic platform driver [ 4.808084] uhci_hcd: USB Universal Host Controller Interface driver [ 4.825584] usbcore: registered new interface driver usb-storage [ 4.833490] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 4.842898] init: - preinit - [ 6.815096] NPE-B: firmware's license can be found in /usr/share/doc/LICENSE.IPL [ 6.822596] NPE-B: firmware functionality 0x2, revision 0x2:1 [ 6.830624] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 7.842483] eth0: link up, speed 100 Mb/s, full duplex [ 7.847672] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 17.194552] mount_root: loading kmods from internal overlay [ 17.287225] kmodloader: loading kernel modules from //etc/modules-boot.d/* [ 17.297911] kmodloader: done loading kernel modules from //etc/modules-boot.d/* [ 17.818955] jffs2: notice: (915) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 17.835393] block: attempting to load /tmp/jffs_cfg/upper/etc/config/fstab [ 17.847551] block: extroot: not configured [ 25.367654] jffs2: notice: (913) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 25.643455] block: attempting to load /tmp/jffs_cfg/upper/etc/config/fstab [ 25.654612] block: extroot: not configured [ 25.660425] mount_root: switching to jffs2 overlay [ 25.755841] urandom-seed: Seeding with /etc/urandom.seed [ 25.932808] procd: - early - [ 25.935946] procd: - watchdog - [ 26.562462] eth0: link up, speed 100 Mb/s, full duplex [ 27.495338] procd: - watchdog - [ 27.499049] procd: - ubus - [ 27.637520] random: ubusd: uninitialized urandom read (4 bytes read) [ 27.655210] random: ubusd: uninitialized urandom read (4 bytes read) [ 27.662675] random: ubusd: uninitialized urandom read (4 bytes read) [ 27.673419] procd: - init - [ 28.311508] kmodloader: loading kernel modules from /etc/modules.d/* [ 28.337159] device-mapper: ioctl: 4.35.0-ioctl (2016-06-23) initialised: dm-devel@redhat.com [ 28.434065] loop: module loaded [ 28.465598] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 28.528156] nf_conntrack version 0.5.0 (1024 buckets, 4096 max) [ 28.892505] hidraw: raw HID events driver (C) Jiri Kosina [ 28.975215] u32 classifier [ 28.977945] input device check on [ 28.981596] Actions configured [ 29.004905] Mirror/redirect action on [ 29.144575] fuse init (API version 7.26) [ 29.185743] arp_tables: arp_tables: (C) 2002 David S. Miller [ 29.272184] Ebtables v2.0 registered [ 29.301558] ip_tables: (C) 2000-2006 Netfilter Core Team [ 29.576858] Netfilter messages via NETLINK v0.30. [ 29.603228] usbcore: registered new interface driver ums-alauda [ 29.626520] usbcore: registered new interface driver ums-cypress [ 29.647192] usbcore: registered new interface driver ums-datafab [ 29.676367] usbcore: registered new interface driver ums-freecom [ 29.696013] usbcore: registered new interface driver ums-isd200 [ 29.717378] usbcore: registered new interface driver ums-jumpshot [ 29.741603] usbcore: registered new interface driver ums-karma [ 29.762927] usbcore: registered new interface driver ums-sddr09 [ 29.786166] usbcore: registered new interface driver ums-sddr55 [ 29.817456] usbcore: registered new interface driver ums-usbat [ 29.842782] usbcore: registered new interface driver usbhid [ 29.848372] usbhid: USB HID core driver [ 29.889624] wireguard: WireGuard 0.0.20190601 loaded. See www.wireguard.com for information. [ 29.898192] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. [ 30.164114] xt_time: kernel timezone is -0000 [ 30.204942] ctnetlink v0.93: registering with nfnetlink. [ 30.225446] nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net> [ 30.419969] PPP generic driver version 2.4.2 [ 30.434724] NET: Registered protocol family 24 [ 30.451566] kmodloader: done loading kernel modules from /etc/modules.d/* [ 32.698792] urandom_read: 5 callbacks suppressed [ 32.698804] random: jshn: uninitialized urandom read (4 bytes read) [ 32.819948] random: ubusd: uninitialized urandom read (4 bytes read) [ 40.617831] eth0: link up, speed 100 Mb/s, full duplex [ 40.625219] br-lan: port 1(eth0) entered blocking state [ 40.630468] br-lan: port 1(eth0) entered disabled state [ 40.636635] device eth0 entered promiscuous mode [ 40.722558] br-lan: port 1(eth0) entered blocking state [ 40.727810] br-lan: port 1(eth0) entered forwarding state [ 40.733679] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 41.332605] NPE-C: firmware's license can be found in /usr/share/doc/LICENSE.IPL [ 41.340022] NPE-C: firmware functionality 0x5, revision 0x2:1 [ 41.348155] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready [ 41.682489] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready


Space for additional notes, links to forum threads or other resources.

  • ...

FIXME Add tags below, then remove this fixme.

How to add tags

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 11:13
  • by 127.0.0.1