Thomson TG703
The TG703 is marketed under the brand Technicolor, formerly known as Thomson. The manufacturer described it as an “integrated access device” combining ADSL2+ modem, VoIP FXS and WiFi b/g/n.
These devices are commonly distributed by an ISP to double-play or triple-play customers. The firmware seems to be based on the previous Thomson firmware.
Not sure, if and how the firmware can be changed.
Hardware
Architecture | MIPS |
---|---|
Vendor | Lantiq |
bootloader | ? |
System-On-Chip | AR9 |
CPU/Speed | 34Kc@333 ? |
Flash-Chip | S25FL054P |
Flash size | 8 MB |
RAM | 64 MB |
Wireless | Ralink RT3070 802.11b/g/n (onboard) |
Ethernet | Broadcom BCM53101 w/ vlan support swconfig |
Internet | ADSL2+ |
USB | NO |
Serial | Yes (J611) |
JTAG | Yes (J609) |
Photos
Serial
→ port.serial general information about the serial port, serial port cable, etc.
The Serial Port on this device is at the connector J611 (unpopulated) but in order to use it you will have to solder a bridge, or a small resistor (100R), to pads marked R3 and R5.
Pinout
Pin# | Fn |
---|---|
2 | GND |
3 | RX |
4 | TX |
Bootlog dump
ROM VER: 1.1.3 CFG 05 ROM VER: 1.1.3 CFG 05 Tuning DDR Loading Preloader ............................. Gateway initialization sequence started. Version BL: 1.1.3 Multicore disable; Booting Linux kernel BOOTING THE LINUX KERNEL Starting the kernel @ 0x80217000 Extra parameters passed to Linux: [0]: bootloader [1]: memsize=0x3FDD000 Infineon Amazon_S base1 = 00002000, size1 = 03dfe000 base2 = 03e00000, size2 = 00100000 base3 = 03f00000, size3 = 000df000 chip_cp1_base = a3e00000 mips_hpt_frequency:166666666, counter_resolution = : Linux version 2.6.20.19 (buildmgm@edgmwbuild03.edegem.eu.thmulti.com) (gcc version 3.4.6) #1 Tue Feb 19 03:39:32 CET 2013 CPU revision is: 0001954c Determined physical RAM map: memory: 03dfe000 @ 00002000 (usable) memory: 00100000 @ 03e00000 (reserved) memory: 000df000 @ 03f00000 (usable) On node 0 totalpages: 16351 DMA zone: 127 pages used for memmap DMA zone: 0 pages reserved DMA zone: 16224 pages, LIFO batch:3 Normal zone: 0 pages used for memmap Built 1 zonelists. Total pages: 16224 Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs 1 MIPSR2 register sets available Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 16kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). Cache parity protection disabled Setting up vectored interrupts vec_vi[0]:0x8024c200: 0x34007c vec_vi[1]:0x8024c400: 0x34007c vec_vi[2]:0x8024c600: 0x34007c vec_vi[3]:0x8024c800: 0x34007c vec_vi[4]:0x8024ca00: 0x34007c vec_vi[5]:0x8024cc00: 0x34007c vec_vi[6]:0x8024ce00: 0x34007c vec_vi[7]:0x8024d000: 0x34007c PID hash table entries: 256 (order: 8, 1024 bytes) Using 166.667 MHz high precision timer. Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 57396k/64372k available (1818k kernel code, 6916k reserved, 312k data, 116k init, 0k highmem) Calibrating delay loop... 221.18 BogoMIPS (lpj=110592) Mount-cache hash table entries: 512 NET: Registered protocol family 16 usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 2048 bind 1024) TCP reno registered Infineon Technologies DMA driver version 1.0.0 Infineon Technologies PMU driver version 0.0.1 Wired TLB entries for Linux read_c0_wired() = 0 VFS: Disk quotas dquot_6.5.1 Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) squashfs: version 3.4 (2008/08/26) Phillip Lougher squashfs: LZMA suppport for slax.org by jro JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc. io scheduler noop registered (default) Infineon Technologies GPTU driver version 1.0.0 gptu: totally 1 16-bit timers/counters gptu: misc_register on minor 63 gptu: succeeded to request irq 118 Infineon Technologies port driver version 1.0.2 Infineon Technologies CGU driver version 1.0.0 cgu: misc_register on minor = 62 ttyS0 at MMIO 0xbe100400 (irq = 98) is a IFX_ASC ttyS1 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC Infineon Technologies ASC driver version 1.0.0 block2mtd: version $Revision: 1.30 $ kthread ifx_ssc: ifx_ssc_thread_init pid 44 Infineon Technologies Synchronous Serial Controller (SSC) driver version 1.5.1 kthread ifx_ssc: amazon_s_sscAllocConnection: device amazon_s-sflash register sucessfully! MTD driver for SPI flash. Probing for Serial flash ... Creating 4 MTD partitions on "amazon_s-sflash": 0x00040000-0x000f0000 : "userfs" 0x00020000-0x00040000 : "mtdss" 0x001c7960-0x00800000 : "rootfs" mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only 0x000f0010-0x001c7960 : "kernel" mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only Infineon Technologies Synchronous SPI flash driver version 1.0.5 NET: Registered protocol family 26 TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> Time: MIPS clocksource has been installed. VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 116k freed init started: BusyBox v1.00 (2013.02.19-02:40+0000) multi-call binary init started: BusyBox v1.00 (2013.02.19-02:40+0000) multi-call binary Starting pid 60, console /dev/ttyS1: '/etc/init.d/rcS' dev: size erasesize name mtd0: 000b0000 00010000 "userfs" mtd1: 00020000 00010000 "mtdss" mtd2: 006386a0 00010000 "rootfs" mtd3: 000d7950 00010000 "kernel" Using /nmon/nmon.ko nmon: no version for "struct_module" found: kernel tainted. nmon: module license 'unspecified' taints kernel. loading geniodb kernel modules... Button: Character device registered successfully. SWWD: Enable guarding (ticks: 400 threshold: 280) NET: Registered protocol family 3 NET: Registered protocol family 9 NET: Registered protocol family 6 NET: Registered protocol family 4 NET: Registered protocol family 5 NET: Registered protocol family 18 NET: Registered protocol family 25 Using /lib/modules/2.6.20.19/kernel/drivers/net/wireless/ralink/rt3070ap.ko Symbol usb_register_driver is being used by a non-GPL module, which will not be allowed in the future Please see the file Documentation/feature-removal-schedule.txt in the kernel source tree for more details. Symbol usb_deregister is being used by a non-GPL module, which will not be allowed in the future Please see the file Documentation/feature-removal-schedule.txt in the kernel source tree for more details. usbcore: registered new interface driver rt2870 Using /lib/modules/2.6.20.19/kernel/drivers/usb/host/dwc_otg_host1.ko dwc_otg1: version 2.2-RC3 USB_WLAN_HOST_SUPPORT dwc_otg1 dwc_otg1: DWC OTG Controller dwc_otg1 dwc_otg1: new USB bus registered, assigned bus number 1 dwc_otg1 dwc_otg1: irq 54, io mem 0x00000000 DWC_otg: Init: Power Port (0) Port 1 pin 13 has been reserved by driver module LED!!! Can't enable USB1 5.5V power via P1.13 (GPIO29)!! usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected Loading voice modules... Using /lib/modules/2.6.20.19/kernel/drivers/tapi/src/drv_tapi/src/drv_tapi.ko dwc_otg_hcd_handle_port_intr=======set hfir ea60 IFX TAPI, version 3.10.1.0, (c) 2001-2009 Infineon Technologies AG Using /lib/modules/2.6.20.19/kernel/drivers/tapi/src/drv_vmmc/src/drv_vmmc.ko <6>usb 1-1: new high speed USB device using dwc_otg1 and address 2 dwc_otg_hcd_handle_port_intr=======set hfir 7530 IFX MIPS34KEc MPS driver, version 2.1.1.1, (c) 2006-2009 Infineon Technologies AG IFX VMMC device driver, version 1.6.1.3, (c) 2006-2009 Infineon Technologies AG modprobe: could not parse modules.dep <6>usb 1-1: configuration #1 chosen from 1 choice Ralink: Allocating HTTX buffer 0 (61444 bytes) Ralink: Allocating HTTX buffer 1 (61444 bytes) Ralink: Allocating HTTX buffer 2 (61444 bytes) Ralink: Allocating HTTX buffer 3 (61444 bytes) Ralink: Allocating RX buffer 0 (24576 bytes) === pAd = 813dd8c0, size = 93616 === Device ipsec not present. Device ikanos not present. Starting pid 240, console /dev/ttyS1: '/etc/init.d/rc' Switching to RUNLEVEL 1 ... route: SIOC[ADD|DEL]RT: File exists linux application start ... wait for linux_appl to initialize (1) wait for linux_appl to initialize (2) wait for linux_appl to initialize (3) ************* ERROR RECORD ************* 000000:00:00.000000 Application NMON started after POWERON. ****************** END ***************** appl_init: BUILD VERIFIED! wait for linux_appl to initialize (4) wait for linux_appl to initialize (5) wait for linux_appl to initialize (6) wait for linux_appl to initialize (7) dip_init() : button[FACTORY_RESET] has number[1] wait for linux_appl to initialize (8) End of initialisation start storagepl ... /etc/rc1.d/S45storagepl: 17: /usr/bin/storagepl: not found storagepl is started linuxappl: start loading after [ 1048ms ] Could not read ex-RIP, code 0x10003 S67stopload: wait until configuration load reaches phase 9... S67stopload: wait until configuration load reaches phase 9 (now -1, 1s) S67stopload: wait until configuration load reaches phase 9 (now -1, 2s) WARNING: Unknown Parameter Type brgroup WARNING: Unknown Parameter Type brgroup S67stopload: wait until configuration load reaches phase 9 (now -1, 3s) IOCTL: ADSLIOCTL_SET_TMM_SET_DIAG_MODE S67stopload: wait until configuration load reaches phase 9 (now -1, 4s) The OBC bridge interface cannot be removed from this VLAN, because OBC is defined as untagged. S67stopload: wait until configuration load reaches phase 9 (now -1, 5s) S67stopload: wait until configuration load reaches phase 9 (now 3, 6s) S67stopload: wait until configuration load reaches phase 9 (now 3, 7s) S67stopload: wait until configuration load reaches phase 9 (now 3, 8s) S67stopload: wait until configuration load reaches phase 9 (now 3, 9s) S67stopload: wait until configuration load reaches phase 9 (now 3, 10s) S67stopload: wait until configuration load reaches phase 9 (now 3, 11s) IOCTL: ADSLIOCTL_SET_TMM_SET_DIAG_MODE ADSL configuration: adslmultimode = adsl2plus syslog = disabled S67stopload: wait until configuration load reaches phase 9 (now 3, 12s) The OBC bridge interface cannot be removed from this VLAN, because OBC is defined as untagged. No queues configured => QoS disabled. Value of parameter rate [0,1000] out of range Bad value for parameter 'rate -2127495168' Failed to set invalid IP interface Failed to set invalid IP interface Failed to set invalid IP interface Failed to add host a4:b1:e9:**:**:** Failed to set invalid IP interface Failed to set invalid IP interface Failed to set invalid IP interface Failed to set invalid IP interface S67stopload: wait until configuration load reaches phase 9 (now 3, 13s) Service code already in use for another service mbus error: (set object) error for parameter 'Voice.Services.Service.bargein.ActivationCode': Invalid parameter value (Invalid parameter value) mbus error: parameter(s) set failed (no error) Service code already in use for another service mbus error: (set object) error for parameter 'Voice.Services.Service.internalcall.ActivationCode': Invalid parameter value (Invalid parameter value) mbus error: parameter(s) set failed (no error) Service code already in use for another service mbus error: (set object) error for parameter 'Voice.Services.Service.warmline.ActivationCode': Invalid parameter value (Invalid parameter value) mbus error: parameter(s) set failed (no error) S67stopload: wait until configuration load reaches phase 9 (now 3, 14s) vpe1_mem = 1024 KB vpe1_load_addr = 0xa3e00000 VPE loader: VPE1 running successfully S67stopload: wait until configuration load reaches phase 9 (now 3, 15s) S67stopload: wait until configuration load reaches phase 9 (now 6, 16s) S67stopload: wait until configuration load reaches phase 9 (now 6, 17s) S67stopload: configuration load reached phase 9... nlplugd start ... Initializing. Starting netlink plugin Daemonize netlink plugin udhcpcd start ... monitoripd start ... Starting power manager... Username :
BOOTP
If you power the device while holding down the reset button, it will try to boot using BOOTP.
Version BL: 1.1.3 BOOTP reason : BLFLAG_BTN_PRESSED Ctrl: BOOTP initiated.
Binary header validation
When booting over BOOTP the device checks binary header. If it is not supported it keeps retrying.
Version BL: 1.1.3 BOOTP reason : BLFLAG_INV_DOWNLOAD Ctrl: BOOTP initiated. Ctrl: BOOTP Reply received! ***** Own IP = 192.168.10.20 () ***** Server = 192.168.10.99 () ***** Mask = 255.255.255.0 ***** Filename = openwrt-lantiq-xway-avm_fritz7312-initramfs-kernel.bin Ctrl: TFTP started (Rx:openwrt-lantiq-xway-avm_fritz7312-initramfs-kernel.bin). [ERROR] : This headertype is not supported [ERROR]: Streambuffer Init Failed! [ERROR] : BLI2 verify update fini ! ***Reseting the board*** Tuning DDR Loading Preloader ............................. Gateway initialization sequence started. Version BL: 1.1.3 BOOTP reason : BLFLAG_INV_DOWNLOAD Ctrl: BOOTP initiated.