Zyxel P-661HNU-F1 serial console

No idea how many of these devices are still around but in any case here it is an article which explains to you how to interact with the serial console of this old ZyXEL ADSL router.

Displaying IMG_20181212_232136.jpg
Zyxel P-661HNU-F1 connected to an Arduino UNO R3

What you need:
1. A computer
2. Zyxel P-661HNU-F1
3. an Arduino UNO R3 or any USB to serial cable
4. a few wire jumpers

Setup:
1. An Arduino Uno REV3 (or clone with the atmega16u2)
2. Using a Jumper wire, connect the Reset Pin to Ground on the Arduino
3. Connect the RX(0) and TX(1) and the Arduino ground through to the router/device.
4. Use your favorite Serial capable program to talk to the router/device, as long as you use 115200 as speed, 8 bit and no parity in the configuration. For more info please have a look at https://oldwiki.archive.openwrt.org/doc/hardware/port.serial


Screenshot_20181212-005850.png
Arduino R3 to router serial port connection

Finally here itis the output of the serial console. The next steps are to find the root password to get in… since admin/1234 default password doesn’t seem to work and maybe flashing an openwrt image on it.


ROM VER: 1.1.3
CFG 05
U-Boot 1.1.5-ARX168 1.1.5(Sep 25 2010)
Boot from SPI
AR9 BOARD
CLOCK CPU 333M RAM 166M
DRAM: 64 MB
spi_init_f finsihed
relocate_code start
relocate_code finish.
SPI Device: MX25L12845E 0xC2 (MX) 0x20 0x18
Parameters: num sectors = 256, sector size = 65536, write size = 256
Status: 0x00
Flash: 16 MB
spi_init_f finsihed
*** Warning – bad CRC, using default environment
In: serial
Out: serial
Err: serial
Net:
switch chip id=2599
amazon_s Switch
Executing script at 82b80250
Z-Boot Autoscript file
Starting application at 0x82A80000 …
Hit any key to stop autoboot: 0
….MRD_CERT_1 check =0
MRD_CERT_2 check =0
…………………………………………………………………………………………………………………………………………..## Booting image at 0090007c …
…………….. Image Name: MIPS Linux-2.6.20
Created: 2014-06-05 7:38:12 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1175450 Bytes = 1.1 MB
Load Address: 80002000
Entry Point: 8037c000
Verifying Checksum … OK
Uncompressing Kernel Image … OK
Starting kernel …
Infineon xDSL CPE AR9
mips_hpt_frequency = 166666666, counter_resolution = 2
Linux version 2.6.20.19
(peter@ubuntu) (gcc version 3.4.6 (OpenWrt-2.0)) #52 Fri May 30 00:09:50 PDT 2014
phym = 04000000, mem = 03e00000, max_pfn = 00003e00
Reserving memory for CP1 @0xa3e00000, size 0x00200000
CPU revision is: 0001954c
Determined physical RAM map:
User-defined physical RAM map:
memory: 03e00000 @ 00000000 (usable)
Initrd not found or empty – disabling initrd
Built 1 zonelists. Total pages: 15748
Kernel command line: root=/dev/mtdblock0 console=ttyS1,115200 phym=64M mem=62M panic=1 vpe1_load_addr=0x83e00000M vpe1_mem=2M vpe1_wired_tlb_entries=1
1 MIPSR2 register sets available
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
Lantiq ICU driver, version 3.0.1, (c) 2001-2010 Lantiq Deutschland GmbH
PID hash table entries: 256 (order: 8, 1024 bytes)
Using 166.667 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 58872k/63488k available (2885k kernel code, 4560k reserved, 670k data, 180k init, 0k highmem)
Security Framework v1.0.0 initialized
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Lantiq PCI host controller driver, version 1.1.5, (c) 2001-2010 Lantiq Deutschland GmbH
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 2048 bind 1024)
TCP reno registered
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 118
gptu: succeeded to request irq 119
gptu: succeeded to request irq 120
gptu: succeeded to request irq 121
gptu: succeeded to request irq 122
gptu: succeeded to request irq 123
IFX DMA driver, version ifxmips_dma_core.c:v1.0.7
,(c)2009 Infineon Technologies AG
Lantiq CGU driver, version 1.0.9, (c) 2001-2010 Lantiq Deutschland GmbH
Wired TLB entries for Linux read_c0_wired() = 0
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (SUMMARY) (C) 2001-2006 Red Hat, Inc.
fuse init (API version 7.8)
yaffs May 30 2014 00:06:58 Installing.
Infineon Technologies DEU driver version 1.0.1
IFX DEU DES initialized (multiblock).
IFX DEU AES initialized (multiblock).
IFX DEU ARC4 initialized (multiblock).
IFX DEU SHA1 initialized.
IFX DEU MD5 initialized.
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
LANTIQ PMCU Device Driver Version 0.9.1
ifx_pmu_init: Major 251
Lantiq PMU driver, version 1.0.6, (c) 2001-2010 Lantiq Deutschland GmbH
Lantiq GPIO driver, version 1.2.12, (c) 2001-2010 Lantiq Deutschland GmbH
Infineon Technologies RCU driver version 1.0.6
Lantiq LED Controller driver, version 1.0.4, (c) 2001-2010 Lantiq Deutschland GmbH
IFX MEI Version 5.00.04<6>ttyS0 at MMIO 0xbe100400 (irq = 98) is a IFX_ASC
ttyS1 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC
Lantiq ASC (UART) driver, version 1.0.5, (c) 2001-2010 Lantiq Deutschland GmbH
RAMDISK driver initialized: 1 RAM disks of 12288K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
IFX SWITCH API, Version 0.8.7.1
SWAPI: Registered character device [switch_api] with major no [81]
Lantiq SSC driver, version 2.1.5, (c) 2001-2010 Lantiq Deutschland GmbH
Creating 5 MTD partitions on “ifx_sflash”:
0x00020000-0x00f40000 : “rootfs,kernel”
0x00f40000-0x00f50000 : “mrd_romd”
0x00f50000-0x00fc0000 : “systemconfig”
0x00fc0000-0x00fe0000 : “mrd_cert1”
0x00fe0000-0x01000000 : “mrd_cert2”
Lantiq SPI flash driver, version 1.1.8, (c) 2001-2010 Lantiq Deutschland GmbH
drivers/char/ifxmips_gpio.c:721:ifx_gpio_pin_reserve: Pin ID 10 (port 0, pin 10) has been reserved by module SFLASH from kernel!
ifx_dataflash_init status error 255
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
pegasus: v0.6.14 (2006/09/27), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new interface driver pegasus
Registered led device: internet_led
Registered led device: broadband_led
Registered led device: internet_red_led
Registered led device: wps_red_led
Registered led device: ledc_4
Registered led device: ledc_5
Registered led device: ledc_6
Registered led device: voip_led
Registered led device: ledc_8
Registered led device: wps_led
Registered led device: usbdev_led
Registered led device: ledc_11
Registered led device: ledc_12
Registered led device: ledc_13
Registered led device: ledc_14
Registered led device: wireless_led
Lantiq LED driver, version 1.0.14, (c) 2001-2010 Lantiq Deutschland GmbH
Mirror/redirect action on
u32 classifier
Performance counters on
input device check on
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (496 buckets, 3968 max)
nf_ct_ftp: registering helper for pf: 2 port: 21
nf_ct_ftp: registering helper for pf: 10 port: 21
ip_conntrack_rtsp v0.6.21 loading
ZLD: zy_sm_init() register hooks successful.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
ebt_ulog: not logging via ulog since somebody else already registered for PF_BRIDGE
NET: Registered protocol family 8
atmpvc_init() failed with -17
lec.c: May 30 2014 00:08:10 initialized
mpc.c: May 30 2014 00:08:08 initialized
802.1Q VLAN Support v1.8 Ben Greear greearb@candelatech.com
All bugs added by David S. Miller davem@redhat.com
ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation jketreno@linux.intel.com
VFS: Mounted root (squashfs filesystem) readonly.
Time: MIPS clocksource has been installed.
Freeing unused kernel memory: 180k freed
init started: BusyBox v1.10.4 (2014-06-05 00:50:04 PDT)
starting pid 162, tty ”: ‘/etc/init.d/rcS’
Algorithmics/MIPS FPU Emulator v1.5
Run init.d/rcS!
/etc/init.d/rcS: line 7: cannot create /etc/mtab: Read-only file system
tar: removing leading ‘/’ from member names
ifconfig: SIOCGIFFLAGS: No such device
Trying to mount NOR flash as JFFS2 for configuration files
Running all S1 scripts in /etc/init.d/etc/init.d/rcS: line 115: TIMEZONE_CONFIG=/mnt/Config: not found
Starting syslog-ng…
load hidden_flash_access.ko
init memory page
register_chrdev
init_hidden_flash_access_module() SUCCESS
===> Dump Default Romfile and FW Info
have set module idCopied 65536 bytes from address 0x00000000 in flash to /tmp/romddump
check ROMD failed
mcputil.c:dump ROMD partition failed
Nothing to dump ROM-D!
read 5 byte
Run S1_10ethernet to load Ethernet module
First get MAC address=B0B2DC53EA48
Create MAC = B0:B2:DC:53:EA:48
Create MAC = B0:B2:dc:53:ea:49
Create MAC = B0:B2:dc:53:ea:4a
Create MAC = B0:B2:dc:53:ea:4b
Create MAC = B0:B2:dc:53:ea:4c
Create MAC = B0:B2:dc:53:ea:4d
Create MAC = B0:B2:dc:53:ea:4e
sh: 1: unknown operand
sh: 2: unknown operand
<4>ifxmips_ppa_hal_ar9_a5: module license ‘unspecified’ taints kernel.
Loading A5 (MII0/1 + ATM) driver …… <3>drivers/char/ifxmips_gpio.c:721:ifx_gpio_pin_reserve: Pin ID 32 (port 2, pin 0) has been reserved by module PPA from kernel!
Succeeded!
PPE datapath driver info:
Version ID: 32.3.7.0.0.0.4
Family : AR9
DR Type : Normal Data Path | Indirect-Fast Path
Interface : MII0 | MII1 | ATM
Mode : N/A
Release : 0.0.4
PPE firmware info:
Version ID: 5.2.4.6.1.1
Family : AR9
FW Type : Acceleration
Interface : MII0/1 + ATM
Mode : Bridging + IPv4 Routing
Release : 1.1
========> PPE_EXTRA_PARAM is ethwan=0
sh: 1: unknown operand
PPA API — init successfully
sh: 1: unknown operand
LAN SETTINGS
IP Verify: enable
UDP Verify: enable
TCP/UDP Error Drop: disable
DROP on HIT: disable
MC Drop on HIT: disable
WAN SETTifx_ppa_init – init succeeded
INGS
IP Verify: enable
UDP Verify: enable
TCP/UDP Error Drop: disable
DROP on HIT: disable
MC Drop on HIT: disable
INTERFACES
Number of LAN IF: 0
Number of WAN IF: 0
OTHER
Max. LAN Entries: 192
Max. WAN Entries: 192
Max. MC Entries: 64
Max. Bridge Entries: 512
Min. Hits: 1
Insert BTN IO module
GPIO phy addr:1e100b10, len:58, vir addr: be100b10
LED phy addr:1e100bb0, len:14, vir addr: be100bb0
init_gpio_reg
/proc/btn_io is created
init_btn_io_module() SUCCESS, Major Numer is 220
Enable BTN_timer.
Run S1_12xdsl to load xdsl module
read 5 byte
Wan pin select is 1 (0:Ethernet wan, 1:DSL wan)
Lantiq CPE API Driver version: DSL CPE API V4.2.0
Predefined debug level: 3
debug: get wan mode ADSL
Bring up ADSL
read 7799 byte
0
wait dsl_cpe_control
Modem is not ready!DSL_CPE: TCP messages debug server: Address: 0.0.0.0
DSL_CPE: TCP_IP Socket is Listening
DSL_CPE: TCP CLI debug server: Address: 0.0.0.0
DSL_CPE: TCP_IP Socket for CLI is Listening
ADSL Annex A (support Annex M also)
nReturn=0
nReturn=0
Loads switch module S17
Insert switch control module
Setting default TANTOS registers:
Product Code 0x2599
Loading tantos driver…
Kernel module version: v2.0
Driver version: v3.0beta2
Date code: 2006-11-08
tantos proc initialization okay!
BRIDGE_DEV=br0
Unknow command type is 103
command error !
device eth0 is not a slave of br0
device eth0.10 entered promiscuous mode
eth0.10: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
br0: port 1(eth0.10) entering learning state
Enabling IP forwarding
Bringing up interface lo
params = lo 127.0.0.1
starting ftpd… done
Starting ZLD CCC(Common Configuration Center)…
RESET CCC LOG LEVEL: 6
RESET CCC LOG LEVEL: 6
RESET CCC LOG LEVEL: 6
nReturn=0
read 7799 byte
read 16 byte
touch: invalid option — t
BusyBox v1.10.4 (2014-06-05 00:50:04 PDT) multi-call binary
Usage: touch [-c] FILE [FILE…]
Update the last-modified date on the given FILE[s]
Options:
-c Do not create any files
finish download certificate
rm: cannot remove ‘/etc/allcert/all.pem’: No such file or directory
BE DHCPCLIENT init
Starting mini_httpd…
Can not find httpd /usr/apache2/bin/apachectl
socket: Address family not supported by protocol
starting pid 751, tty ”: ‘/sbin/getty 115200 ttyS1’
(none) login: disable led
NET: Registered protocol family 10
eth0.10: add 33:33:00:00:00:01 mcast address to master interface
eth0.10: add 33:33:ff:53:ea:4f mcast address to master interface
resetAllPPPDUnitNumberStatus():
pppdUnitNumberInUsed[0]=0
pppdUnitNumberInUsed[1]=0
pppdUnitNumberInUsed[2]=0
pppdUnitNumberInUsed[3]=0
pppdUnitNumberInUsed[4]=0
pppdUnitNumberInUsed[5]=0
pppdUnitNumberInUsed[6]=0
pppdUnitNumberInUsed[7]=0
eth0.10: dev_set_promiscuity(master, -1)
device eth0 left promiscuous mode
device eth0.10 left promiscuous mode
br0: port 1(eth0.10) entering disabled state
eth0.10: del 33:33:ff:53:ea:4f mcast address from vlan interface
eth0.10: del 33:33:ff:53:ea:4f mcast address from master interface
eth0.10: del 33:33:00:00:00:01 mcast address from vlan interface
eth0.10: del 33:33:00:00:00:01 mcast address from master interface
device eth0 is not a slave of br0
device eth0.3901 entered promiscuous mode
eth0.3901: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
br0: port 1(eth0.3901) entering learning state
eth0.3901: add 33:33:00:00:00:01 mcast address to master interface
eth0.3901: add 33:33:ff:53:ea:4f mcast address to master interface
cat: can’t open ‘/var/tmp/hosts’: No such file or directory
Starting celld daemon……
Enter user spacestopping p910nd… done
nReturn=0
Password for ‘root’ changed
Password for ‘supervisor’ changed
Password for ‘admin’ changed
Password for ‘user’ changed
cat: can’t open ‘/tmp/schedule/*.sche’: No such file or directory
killall: crond: no process killed
killall: updatedd: no process killed
PCI: Setting latency timer of device 0000:00:0e.0 to 64
=== pAd = c02ab000, size = 543600 ===
<– RTMPAllocAdapterBlock, Status=0pAd->CSRBaseAddress =0xb8000000, csr_addr=0xb8000000!
$LOCAL_ADMIN_MAC=B2:B2:DC:53:EA:4c
RX DESC a2763000 size = 2048
<– RTMPAllocTxRxRingMemory, Status=0
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Phy Mode = 9
Phy Mode = 9
NVM is Efuse and its size =3c[3c0-3fb]
Phy Mode = 9
MCS Set = ff ff 00 00 01
Main bssid = b2:b2:dc:53:ea:4c
<==== rt28xx_init, Status=0
0x1300 = 00064300
/proc/driver/wlan_short_cut created
Init RALINK_FP_Handle
device ra0 entered promiscuous mode
device ra1 entered promiscuous mode
device ra2 entered promiscuous mode
device ra3 entered promiscuous mode
Remove RALINK_FP_Handle
/proc/driver/wlan_short_cut removed
br0: port 2(ra0) entering disabled state
br0: port 3(ra1) entering learning state
br0: port 4(ra2) entering learning state
br0: port 5(ra3) entering learning state
rm: cannot remove ‘/etc/igmpv3.conf’: No such file or directory
eth0: no IPv6 routers present
br0: no IPv6 routers present
Jan 1 02:00:34 ccc_be: beSysMtnReloadConfig(): Loading beVpnConfigLoad…
Stopping strongSwan IPsec failed: starter is not running
Stopping strongSwan IPsec failed: starter is not running
eth0.3901: no IPv6 routers present
Initializing XFRM netlink socket
Starting strongSwan 4.2.8 IPsec [starter]…
no default route – cannot cope with %defaultroute!!!
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
stopping ftpd… done
starting ftpd… br0: topology change detected, propagating
br0: port 1(eth0.3901) entering forwarding state
done
mini_httpd: exiting due to signal 15
Action 4 device ifb1 ifindex 3
HTB: quantum of class 10001 is big. Consider r2q change.
DSL[00]: ERROR – Function is only available in the SHOWTIME!
DSL[00]: ERROR – Function is only available in the SHOWTIME!
iptables: No chain/target/match by that name
Chain ‘LOCAL_INPUT’ doesn’t exist.
iptables: No chain/target/match by that name
killall: upnpd: no process killed
insmod: can’t open ‘/lib/modules/2.6.20.19/kernel/drivers/usb/class/usblp.ko’: No such file or directory
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial Driver core
drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1
br0: topology change detected, propagating
br0: port 3(ra1) entering forwarding state
br0: topology change detected, propagating
br0: port 4(ra2) entering forwarding state
br0: topology change detected, propagating
br0: port 5(ra3) entering forwarding state
Initializing USB Mass Storage driver…
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
insmod: can’t open ‘/lib/modules/2.6.20.19/kernel/drivers/usb/class//cdc-acm.ko’: No such file or directory
Jan 1 00:00:47 ccc_mr: cccRegModule(): register tr69FE
usbcore: registered new interface driver cdc_ether
IFXUSB: ifxusb_hcd: version 3.2 B110610
IFXUSB: USB core #0 soft-reset
IFXUSB: USB core #0 soft-reset
ifxusb_hcd ifxusb_hcd: IFX USB Controller
ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 1
ifxusb_hcd ifxusb_hcd: irq 54, io mem 0xbe101000
IFXUSB: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
IFXUSB: USB core #1 soft-reset
IFXUSB: USB core #1 soft-reset
ifxusb_hcd ifxusb_hcd: IFX USB Controller
ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 2
ifxusb_hcd ifxusb_hcd: irq 83, io mem 0xbe106000
IFXUSB: Init: Power Port (0)
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
[PMCU/PPE]: Unregistration: incorrect callee for unregisteration!!
ZySM: TCP session matching has already been disabled
ZySM: UDP session matching has already been disabled
ifb1: no IPv6 routers present
mini_httpd: exiting due to signal 15
mini_httpd_ssl: exiting due to signal 15
killall: webipqd: no process killed
killall: zyTimeZoneUpdater: no process killed
mini_httpd: exiting due to signal 15
mini_httpd_ssl: exiting due to signal 15
disable led
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login: root
Password:
Login incorrect
P-661HNU-F1 login: admin
Password:
Login incorrect
P-661HNU-F1 login: admin
Password:
process ‘/sbin/getty 115200 ttyS1’ (pid 751) exited. Scheduling for restart.
starting pid 2417, tty ”: ‘/sbin/getty 115200 ttyS1’
P-661HNU-F1 login: DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
P-661HNU-F1 login: admin
Password:
Login incorrect
P-661HNU-F1 login: root
Password: DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
Login incorrect
P-661HNU-F1 login: root
Password:
process ‘/sbin/getty 115200 ttyS1’ (pid 2417) exited. Scheduling for restart.
starting pid 2438, tty ”: ‘/sbin/getty 115200 ttyS1’
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login: root
Password:
Login incorrect
P-661HNU-F1 login: DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
process ‘/sbin/getty 115200 ttyS1’ (pid 2438) exited. Scheduling for restart.
starting pid 2449, tty ”: ‘/sbin/getty 115200 ttyS1’
P-661HNU-F1 login: DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
Restore to factory default
The system is going down NOW!
Sending SIGTERM to all processes
mini_httpd: exiting due to signal 15
mini_httpd_ssl
Disable BTN_timer.
: exiting due to signal 15
Jan 1 02:18:28 pluto[1203]: ADNS process terminated by signal 15
Sending SIGKILL to all processes
Requesting system reboot
Res
ROM VER: 1.1.3
CFG 05
U-Boot 1.1.5-ARX168 1.1.5(Sep 25 2010)
Boot from SPI
AR9 BOARD
CLOCK CPU 333M RAM 166M
DRAM: 64 MB
spi_init_f finsihed
relocate_code start
relocate_code finish.
SPI Device: MX25L12845E 0xC2 (MX) 0x20 0x18
Parameters: num sectors = 256, sector size = 65536, write size = 256
Status: 0x00
Flash: 16 MB
spi_init_f finsihed
*** Warning – bad CRC, using default environment
In: serial
Out: serial
Err: serial
Net:
switch chip id=2599
amazon_s Switch
Executing script at 82b80250
Z-Boot Autoscript file
Starting application at 0x82A80000 …
Hit any key to stop autoboot: 0
….MRD_CERT_1 check =0
MRD_CERT_2 check =0
…………………………………………………………………………………………………………………………………………..## Booting image at 0090007c …
…………….. Image Name: MIPS Linux-2.6.20
Created: 2014-06-05 7:38:12 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1175450 Bytes = 1.1 MB
Load Address: 80002000
Entry Point: 8037c000
Verifying Checksum … OK
Uncompressing Kernel Image … OK
Starting kernel …
Infineon xDSL CPE AR9
mips_hpt_frequency = 166666666, counter_resolution = 2
Linux version 2.6.20.19
(peter@ubuntu) (gcc version 3.4.6 (OpenWrt-2.0)) #52 Fri May 30 00:09:50 PDT 2014
phym = 04000000, mem = 03e00000, max_pfn = 00003e00
Reserving memory for CP1 @0xa3e00000, size 0x00200000
CPU revision is: 0001954c
Determined physical RAM map:
User-defined physical RAM map:
memory: 03e00000 @ 00000000 (usable)
Initrd not found or empty – disabling initrd
Built 1 zonelists. Total pages: 15748
Kernel command line: root=/dev/mtdblock0 console=ttyS1,115200 phym=64M mem=62M panic=1 vpe1_load_addr=0x83e00000M vpe1_mem=2M vpe1_wired_tlb_entries=1
1 MIPSR2 register sets available
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
Lantiq ICU driver, version 3.0.1, (c) 2001-2010 Lantiq Deutschland GmbH
PID hash table entries: 256 (order: 8, 1024 bytes)
Using 166.667 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 58872k/63488k available (2885k kernel code, 4560k reserved, 670k data, 180k init, 0k highmem)
Security Framework v1.0.0 initialized
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Lantiq PCI host controller driver, version 1.1.5, (c) 2001-2010 Lantiq Deutschland GmbH
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 2048 bind 1024)
TCP reno registered
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 118
gptu: succeeded to request irq 119
gptu: succeeded to request irq 120
gptu: succeeded to request irq 121
gptu: succeeded to request irq 122
gptu: succeeded to request irq 123
IFX DMA driver, version ifxmips_dma_core.c:v1.0.7
,(c)2009 Infineon Technologies AG
Lantiq CGU driver, version 1.0.9, (c) 2001-2010 Lantiq Deutschland GmbH
Wired TLB entries for Linux read_c0_wired() = 0
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (SUMMARY) (C) 2001-2006 Red Hat, Inc.
fuse init (API version 7.8)
yaffs May 30 2014 00:06:58 Installing.
Infineon Technologies DEU driver version 1.0.1
IFX DEU DES initialized (multiblock).
IFX DEU AES initialized (multiblock).
IFX DEU ARC4 initialized (multiblock).
IFX DEU SHA1 initialized.
IFX DEU MD5 initialized.
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
LANTIQ PMCU Device Driver Version 0.9.1
ifx_pmu_init: Major 251
Lantiq PMU driver, version 1.0.6, (c) 2001-2010 Lantiq Deutschland GmbH
Lantiq GPIO driver, version 1.2.12, (c) 2001-2010 Lantiq Deutschland GmbH
Infineon Technologies RCU driver version 1.0.6
Lantiq LED Controller driver, version 1.0.4, (c) 2001-2010 Lantiq Deutschland GmbH
IFX MEI Version 5.00.04<6>ttyS0 at MMIO 0xbe100400 (irq = 98) is a IFX_ASC
ttyS1 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC
Lantiq ASC (UART) driver, version 1.0.5, (c) 2001-2010 Lantiq Deutschland GmbH
RAMDISK driver initialized: 1 RAM disks of 12288K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
IFX SWITCH API, Version 0.8.7.1
SWAPI: Registered character device [switch_api] with major no [81]
Lantiq SSC driver, version 2.1.5, (c) 2001-2010 Lantiq Deutschland GmbH
Creating 5 MTD partitions on “ifx_sflash”:
0x00020000-0x00f40000 : “rootfs,kernel”
0x00f40000-0x00f50000 : “mrd_romd”
0x00f50000-0x00fc0000 : “systemconfig”
0x00fc0000-0x00fe0000 : “mrd_cert1”
0x00fe0000-0x01000000 : “mrd_cert2”
Lantiq SPI flash driver, version 1.1.8, (c) 2001-2010 Lantiq Deutschland GmbH
drivers/char/ifxmips_gpio.c:721:ifx_gpio_pin_reserve: Pin ID 10 (port 0, pin 10) has been reserved by module SFLASH from kernel!
ifx_dataflash_init status error 255
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
pegasus: v0.6.14 (2006/09/27), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new interface driver pegasus
Registered led device: internet_led
Registered led device: broadband_led
Registered led device: internet_red_led
Registered led device: wps_red_led
Registered led device: ledc_4
Registered led device: ledc_5
Registered led device: ledc_6
Registered led device: voip_led
Registered led device: ledc_8
Registered led device: wps_led
Registered led device: usbdev_led
Registered led device: ledc_11
Registered led device: ledc_12
Registered led device: ledc_13
Registered led device: ledc_14
Registered led device: wireless_led
Lantiq LED driver, version 1.0.14, (c) 2001-2010 Lantiq Deutschland GmbH
Mirror/redirect action on
u32 classifier
Performance counters on
input device check on
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (496 buckets, 3968 max)
nf_ct_ftp: registering helper for pf: 2 port: 21
nf_ct_ftp: registering helper for pf: 10 port: 21
ip_conntrack_rtsp v0.6.21 loading
ZLD: zy_sm_init() register hooks successful.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
ebt_ulog: not logging via ulog since somebody else already registered for PF_BRIDGE
NET: Registered protocol family 8
atmpvc_init() failed with -17
lec.c: May 30 2014 00:08:10 initialized
mpc.c: May 30 2014 00:08:08 initialized
802.1Q VLAN Support v1.8 Ben Greear greearb@candelatech.com
All bugs added by David S. Miller davem@redhat.com
ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation jketreno@linux.intel.com
VFS: Mounted root (squashfs filesystem) readonly.
Time: MIPS clocksource has been installed.
Freeing unused kernel memory: 180k freed
init started: BusyBox v1.10.4 (2014-06-05 00:50:04 PDT)
starting pid 162, tty ”: ‘/etc/init.d/rcS’
Algorithmics/MIPS FPU Emulator v1.5
Run init.d/rcS!
/etc/init.d/rcS: line 7: cannot create /etc/mtab: Read-only file system
tar: removing leading ‘/’ from member names
ifconfig: SIOCGIFFLAGS: No such device
Trying to mount NOR flash as JFFS2 for configuration files
Running all S1 scripts in /etc/init.d/etc/init.d/rcS: line 115: TIMEZONE_CONFIG=/mnt/Config: not found
Starting syslog-ng…
load hidden_flash_access.ko
init memory page
register_chrdev
init_hidden_flash_access_module() SUCCESS
===> Dump Default Romfile and FW Info
have set module idCopied 65536 bytes from address 0x00000000 in flash to /tmp/romddump
check ROMD failed
mcputil.c:dump ROMD partition failed
Nothing to dump ROM-D!
read 5 byte
Run S1_10ethernet to load Ethernet module
First get MAC address=B0B2DC53EA48
Create MAC = B0:B2:DC:53:EA:48
Create MAC = B0:B2:dc:53:ea:49
Create MAC = B0:B2:dc:53:ea:4a
Create MAC = B0:B2:dc:53:ea:4b
Create MAC = B0:B2:dc:53:ea:4c
Create MAC = B0:B2:dc:53:ea:4d
Create MAC = B0:B2:dc:53:ea:4e
sh: 1: unknown operand
sh: 2: unknown operand
<4>ifxmips_ppa_hal_ar9_a5: module license ‘unspecified’ taints kernel.
Loading A5 (MII0/1 + ATM) driver …… <3>drivers/char/ifxmips_gpio.c:721:ifx_gpio_pin_reserve: Pin ID 32 (port 2, pin 0) has been reserved by module PPA from kernel!
Succeeded!
PPE datapath driver info:
Version ID: 32.3.7.0.0.0.4
Family : AR9
DR Type : Normal Data Path | Indirect-Fast Path
Interface : MII0 | MII1 | ATM
Mode : N/A
Release : 0.0.4
PPE firmware info:
Version ID: 5.2.4.6.1.1
Family : AR9
FW Type : Acceleration
Interface : MII0/1 + ATM
Mode : Bridging + IPv4 Routing
Release : 1.1
========> PPE_EXTRA_PARAM is ethwan=0
sh: 1: unknown operand
PPA API — init successfully
sh: 1: unknown operand
LAN SETTINGS
IP Verify: enable
UDP Verify: enable
TCP/UDP Error Drop: disable
DROP on HIT: disable
MC Drop on HIT: disable
WAN SETTifx_ppa_init – init succeeded
INGS
IP Verify: enable
UDP Verify: enable
TCP/UDP Error Drop: disable
DROP on HIT: disable
MC Drop on HIT: disable
INTERFACES
Number of LAN IF: 0
Number of WAN IF: 0
OTHER
Max. LAN Entries: 192
Max. WAN Entries: 192
Max. MC Entries: 64
Max. Bridge Entries: 512
Min. Hits: 1
Insert BTN IO module
GPIO phy addr:1e100b10, len:58, vir addr: be100b10
LED phy addr:1e100bb0, len:14, vir addr: be100bb0
init_gpio_reg
/proc/btn_io is created
init_btn_io_module() SUCCESS, Major Numer is 220
Enable BTN_timer.
Run S1_12xdsl to load xdsl module
read 5 byte
Wan pin select is 1 (0:Ethernet wan, 1:DSL wan)
Lantiq CPE API Driver version: DSL CPE API V4.2.0
Predefined debug level: 3
debug: get wan mode ADSL
Bring up ADSL
read 8184 byte
0
wait dsl_cpe_control
Modem is not ready!DSL_CPE: TCP messages debug server: Address: 0.0.0.0
DSL_CPE: TCP_IP Socket is Listening
DSL_CPE: TCP CLI debug server: Address: 0.0.0.0
DSL_CPE: TCP_IP Socket for CLI is Listening
ADSL Annex A (support Annex M also)
nReturn=0
nReturn=0
Loads switch module S17
Insert switch control module
Setting default TANTOS registers:
Product Code 0x2599
Loading tantos driver…
Kernel module version: v2.0
Driver version: v3.0beta2
Date code: 2006-11-08
tantos proc initialization okay!
BRIDGE_DEV=br0
Unknow command type is 103
command error !
device eth0 is not a slave of br0
device eth0.10 entered promiscuous mode
eth0.10: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
br0: port 1(eth0.10) entering learning state
Enabling IP forwarding
Bringing up interface lo
params = lo 127.0.0.1
starting ftpd… [meiPollForDbgDone 413]: PollforDbg fail!
done
Starting ZLD CCC(Common Configuration Center)…
RESET CCC LOG LEVEL: 6
RESET CCC LOG LEVEL: 6
RESET CCC LOG LEVEL: 6
nReturn=0
read 8184 byte
read 16 byte
touch: invalid option — t
BusyBox v1.10.4 (2014-06-05 00:50:04 PDT) multi-call binary
Usage: touch [-c] FILE [FILE…]
Update the last-modified date on the given FILE[s]
Options:
-c Do not create any files
finish download certificate
rm: cannot remove ‘/etc/allcert/all.pem’: No such file or directory
BE DHCPCLIENT init
Starting mini_httpd…
Can not find httpd /usr/apache2/bin/apachectl
socket: Address family not supported by protocol
starting pid 751, tty ”: ‘/sbin/getty 115200 ttyS1’
(none) login: NET: Registered protocol family 10
eth0.10: add 33:33:00:00:00:01 mcast address to master interface
eth0.10: add 33:33:ff:53:ea:4f mcast address to master interface
resetAllPPPDUnitNumberStatus():
pppdUnitNumberInUsed[0]=0
pppdUnitNumberInUsed[1]=0
pppdUnitNumberInUsed[2]=0
pppdUnitNumberInUsed[3]=0
pppdUnitNumberInUsed[4]=0
pppdUnitNumberInUsed[5]=0
pppdUnitNumberInUsed[6]=0
pppdUnitNumberInUsed[7]=0
ifconfig: nas1: error fetching interface information: Device not found
nReturn=0
cp: cannot stat ‘/etc/sysconfig/network-scripts/wan-multi/ifcfg-eth0’: No such file or directory
ifconfig: bad address ‘1500’
device nas1 is not a slave of br0
eth0.10: add 33:33:00:00:00:02 mcast address to master interface
eth0.10: add 33:33:ff:00:00:00 mcast address to master interface
eth0.10: dev_set_promiscuity(master, -1)
device eth0 left promiscuous mode
device eth0.10 left promiscuous mode
br0: port 1(eth0.10) entering disabled state
eth0.10: del 33:33:ff:00:00:00 mcast address from vlan interface
eth0.10: del 33:33:ff:00:00:00 mcast address from master interface
eth0.10: del 33:33:00:00:00:02 mcast address from vlan interface
eth0.10: del 33:33:00:00:00:02 mcast address from master interface
eth0.10: del 33:33:ff:53:ea:4f mcast address from vlan interface
eth0.10: del 33:33:ff:53:ea:4f mcast address from master interface
eth0.10: del 33:33:00:00:00:01 mcast address from vlan interface
eth0.10: del 33:33:00:00:00:01 mcast address from master interface
device eth0 is not a slave of br0
device eth0.3901 entered promiscuous mode
eth0.3901: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
br0: port 1(eth0.3901) entering learning state
eth0.3901: add 33:33:00:00:00:01 mcast address to master interface
eth0.3901: add 33:33:ff:53:ea:4f mcast address to master interface
cat: can’t open ‘/var/tmp/hosts’: No such file or directory
Starting celld daemon……
Enter user spacestopping p910nd… done
eth0.3901: add 33:33:ff:00:00:00 mcast address to master interface
Password for ‘root’ changed
Password for ‘supervisor’ changed
Password for ‘admin’ changed
Password for ‘user’ changed
cat: can’t open ‘/tmp/schedule/*.sche’: No such file or directory
killall: crond: no process killed
killall: updatedd: no process killed
PCI: Setting latency timer of device 0000:00:0e.0 to 64
=== pAd = c02ab000, size = 543600 ===
<– RTMPAllocAdapterBlock, Status=0pAd->CSRBaseAddress =0xb8000000, csr_addr=0xb8000000!
$LOCAL_ADMIN_MAC=B2:B2:DC:53:EA:4c
RX DESC a1216000 size = 2048
<– RTMPAllocTxRxRingMemory, Status=0
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Phy Mode = 9
Phy Mode = 9
NVM is Efuse and its size =3c[3c0-3fb]
Phy Mode = 9
MCS Set = ff ff 00 00 01
SYNC – BBP R4 to 20MHz.l
Main bssid = b2:b2:dc:53:ea:4c
<==== rt28xx_init, Status=0
0x1300 = 00064320
/proc/driver/wlan_short_cut created
Init RALINK_FP_Handle
device ra0 entered promiscuous mode
device ra1 entered promiscuous mode
device ra2 entered promiscuous mode
device ra3 entered promiscuous mode
Remove RALINK_FP_Handle
/proc/driver/wlan_short_cut removed
br0: port 2(ra0) entering disabled state
br0: port 3(ra1) entering learning state
br0: port 4(ra2) entering learning state
br0: port 5(ra3) entering learning state
RX DESC a2612000 size = 2048
<– RTMPAllocTxRxRingMemory, Status=0
Phy Mode = 9
Phy Mode = 9
Phy Mode = 9
MCS Set = ff ff 00 00 01
Main bssid = b2:b2:dc:53:ea:4c
<==== rt28xx_init, Status=0
0x1300 = 00064320
/proc/driver/wlan_short_cut created
Init RALINK_FP_Handle
br0: port 2(ra0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0.3901) entering forwarding state
rm: cannot remove ‘/etc/igmpv3.conf’: No such file or directory
sh: cannot create /proc/sys/net/ipv4/conf/nas1/force_igmp_version: nonexistent directory
Jan 1 02:00:48 ccc_be: beSysMtnReloadConfig(): Loading beVpnConfigLoad…
Stopping strongSwan IPsec failed: starter is not running
Stopping strongSwan IPsec failed: starter is not running
Initializing XFRM netlink socket
Starting strongSwan 4.2.8 IPsec [starter]…
no default route – cannot cope with %defaultroute!!!
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
stopping ftpd… done
starting ftpd… done
br0: topology change detected, propagating
br0: port 3(ra1) entering forwarding state
br0: topology change detected, propagating
br0: port 4(ra2) entering forwarding state
br0: topology change detected, propagating
br0: port 5(ra3) entering forwarding state
mini_httpd: exiting due to signal 15
Action 4 device ifb1 ifindex 3
Action 4 device ifb1 ifindex 3
HTB: quantum of class 10001 is big. Consider r2q change.
DSL[00]: ERROR – Function is only available in the SHOWTIME!
DSL[00]: ERROR – Function is only available in the SHOWTIME!
iptables: No chain/target/match by that name
Chain ‘LOCAL_INPUT’ doesn’t exist.
iptables: No chain/target/match by that name
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
killall: upnpd: no process killed
insmod: can’t open ‘/lib/modules/2.6.20.19/kernel/drivers/usb/class/usblp.ko’: No such file or directory
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial Driver core
drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1
Initializing USB Mass Storage driver…
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
insmod: can’t open ‘/lib/modules/2.6.20.19/kernel/drivers/usb/class//cdc-acm.ko’: No such file or directory
usbcore: registered new interface driver cdc_ether
Jan 1 00:01:01 ccc_mr: cccRegModule(): register tr69FE
IFXUSB: ifxusb_hcd: version 3.2 B110610
IFXUSB: USB core #0 soft-reset
IFXUSB: USB core #0 soft-reset
ifxusb_hcd ifxusb_hcd: IFX USB Controller
ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 1
ifxusb_hcd ifxusb_hcd: irq 54, io mem 0xbe101000
IFXUSB: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Jan 1 00:01:02 ccc_das: cccDasHandleSet(): value is changed
[PMCU/PPE]: Unregistration: incorrect callee for unregisteration!!
IFXUSB: USB core #1 soft-reset
IFXUSB: USB core #1 soft-reset
ifxusb_hcd ifxusb_hcd: IFX USB Controller
ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 2
ifxusb_hcd ifxusb_hcd: irq 83, io mem 0xbe106000
IFXUSB: Init: Power Port (0)
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
ZySM: TCP session matching has already been disabled
ZySM: UDP session matching has already been disabled
mini_httpd: exiting due to signal 15
mini_httpd_ssl: exiting due to signal 15
killall: webipqd: no process killed
killall: zyTimeZoneUpdater: no process killed
mini_httpd: exiting due to signal 15
mini_httpd_ssl: exiting due to signal 15
disable led
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
P-661HNU-F1 login: DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login:
P-661HNU-F1 login: DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
P-661HNU-F1 login:
P-661HNU-F1 login: admin
Password:
Login incorrect
P-661HNU-F1 login: root
Password:
Login incorrect
P-661HNU-F1 login:
process ‘/sbin/getty 115200 ttyS1’ (pid 751) exited. Scheduling for restart.
starting pid 3685, tty ”: ‘/sbin/getty 115200 ttyS1’
P-661HNU-F1 login: DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
P-661HNU-F1 login: DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
P-661HNU-F1 login: admin
Password:
Login incorrect
P-661HNU-F1 login: root
Password:
Login incorrect
P-661HNU-F1 login: DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
process ‘/sbin/getty 115200 ttyS1’ (pid 3685) exited. Scheduling for restart.
starting pid 6036, tty ”: ‘/sbin/getty 115200 ttyS1’
P-661HNU-F1 login: usr/apache2/bin/apachectlDSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
Password:
Restore to factory default
The system is going down NOW!
Sending SIGTERM
Disable BTN_timer.
to all processes
mini_httpd: exiting due tmini_httpd_ssl: exiting due to signal 15
Jan 1 02:22:42 pluto[1415]: shutting down interface br0/br0 192.168.1.1
Jan 1 02:22:43 pluto[1415]: ADNS process terminated by signal 15
Jan 1 02:22:42 upnpd[1858]: DeleteAllPortMappings: UpnpNotifyExt(deviceHandle,uuid:871623e4-bfde-11d3-8900-b0b2dc53ea4f,urn:upnp-org:serviceId:WANIPConn1,propSet)
PortMappingNumberOfEntries: 0
Sending SIGKILL to all processes
Requesting system reboot
Res
ROM VER: 1.1.3
CFG 05
U-Boot 1.1.5-ARX168 1.1.5(Sep 25 2010)
Boot from SPI
AR9 BOARD
CLOCK CPU 333M RAM 166M
DRAM: 64 MB
spi_init_f finsihed
relocate_code start
relocate_code finish.
SPI Device: MX25L12845E 0xC2 (MX) 0x20 0x18
Parameters: num sectors = 256, sector size = 65536, write size = 256
Status: 0x00
Flash: 16 MB
spi_init_f finsihed
*** Warning – bad CRC, using default environment
In: serial
Out: serial
Err: serial
Net:
switch chip id=2599
amazon_s Switch
Executing script at 82b80250
Z-Boot Autoscript file
Starting application at 0x82A80000 …
Hit any key to stop autoboot: 0
….MRD_CERT_1 check =0
MRD_CERT_2 check =0
…………………………………………………………………………………………………………………………………………..## Booting image at 0090007c …
…………….. Image Name: MIPS Linux-2.6.20
Created: 2014-06-05 7:38:12 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1175450 Bytes = 1.1 MB
Load Address: 80002000
Entry Point: 8037c000
Verifying Checksum … OK
Uncompressing Kernel Image … OK
Starting kernel …
Infineon xDSL CPE AR9
mips_hpt_frequency = 166666666, counter_resolution = 2
Linux version 2.6.20.19
(peter@ubuntu) (gcc version 3.4.6 (OpenWrt-2.0)) #52 Fri May 30 00:09:50 PDT 2014
phym = 04000000, mem = 03e00000, max_pfn = 00003e00
Reserving memory for CP1 @0xa3e00000, size 0x00200000
CPU revision is: 0001954c
Determined physical RAM map:
User-defined physical RAM map:
memory: 03e00000 @ 00000000 (usable)
Initrd not found or empty – disabling initrd
Built 1 zonelists. Total pages: 15748
Kernel command line: root=/dev/mtdblock0 console=ttyS1,115200 phym=64M mem=62M panic=1 vpe1_load_addr=0x83e00000M vpe1_mem=2M vpe1_wired_tlb_entries=1
1 MIPSR2 register sets available
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
Lantiq ICU driver, version 3.0.1, (c) 2001-2010 Lantiq Deutschland GmbH
PID hash table entries: 256 (order: 8, 1024 bytes)
Using 166.667 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 58872k/63488k available (2885k kernel code, 4560k reserved, 670k data, 180k init, 0k highmem)
Security Framework v1.0.0 initialized
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Lantiq PCI host controller driver, version 1.1.5, (c) 2001-2010 Lantiq Deutschland GmbH
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 2048 bind 1024)
TCP reno registered
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 118
gptu: succeeded to request irq 119
gptu: succeeded to request irq 120
gptu: succeeded to request irq 121
gptu: succeeded to request irq 122
gptu: succeeded to request irq 123
IFX DMA driver, version ifxmips_dma_core.c:v1.0.7
,(c)2009 Infineon Technologies AG
Lantiq CGU driver, version 1.0.9, (c) 2001-2010 Lantiq Deutschland GmbH
Wired TLB entries for Linux read_c0_wired() = 0
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (SUMMARY) (C) 2001-2006 Red Hat, Inc.
fuse init (API version 7.8)
yaffs May 30 2014 00:06:58 Installing.
Infineon Technologies DEU driver version 1.0.1
IFX DEU DES initialized (multiblock).
IFX DEU AES initialized (multiblock).
IFX DEU ARC4 initialized (multiblock).
IFX DEU SHA1 initialized.
IFX DEU MD5 initialized.
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
LANTIQ PMCU Device Driver Version 0.9.1
ifx_pmu_init: Major 251
Lantiq PMU driver, version 1.0.6, (c) 2001-2010 Lantiq Deutschland GmbH
Lantiq GPIO driver, version 1.2.12, (c) 2001-2010 Lantiq Deutschland GmbH
Infineon Technologies RCU driver version 1.0.6
Lantiq LED Controller driver, version 1.0.4, (c) 2001-2010 Lantiq Deutschland GmbH
IFX MEI Version 5.00.04<6>ttyS0 at MMIO 0xbe100400 (irq = 98) is a IFX_ASC
ttyS1 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC
Lantiq ASC (UART) driver, version 1.0.5, (c) 2001-2010 Lantiq Deutschland GmbH
RAMDISK driver initialized: 1 RAM disks of 12288K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
IFX SWITCH API, Version 0.8.7.1
SWAPI: Registered character device [switch_api] with major no [81]
Lantiq SSC driver, version 2.1.5, (c) 2001-2010 Lantiq Deutschland GmbH
Creating 5 MTD partitions on “ifx_sflash”:
0x00020000-0x00f40000 : “rootfs,kernel”
0x00f40000-0x00f50000 : “mrd_romd”
0x00f50000-0x00fc0000 : “systemconfig”
0x00fc0000-0x00fe0000 : “mrd_cert1”
0x00fe0000-0x01000000 : “mrd_cert2”
Lantiq SPI flash driver, version 1.1.8, (c) 2001-2010 Lantiq Deutschland GmbH
drivers/char/ifxmips_gpio.c:721:ifx_gpio_pin_reserve: Pin ID 10 (port 0, pin 10) has been reserved by module SFLASH from kernel!
ifx_dataflash_init status error 255
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
pegasus: v0.6.14 (2006/09/27), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new interface driver pegasus
Registered led device: internet_led
Registered led device: broadband_led
Registered led device: internet_red_led
Registered led device: wps_red_led
Registered led device: ledc_4
Registered led device: ledc_5
Registered led device: ledc_6
Registered led device: voip_led
Registered led device: ledc_8
Registered led device: wps_led
Registered led device: usbdev_led
Registered led device: ledc_11
Registered led device: ledc_12
Registered led device: ledc_13
Registered led device: ledc_14
Registered led device: wireless_led
Lantiq LED driver, version 1.0.14, (c) 2001-2010 Lantiq Deutschland GmbH
Mirror/redirect action on
u32 classifier
Performance counters on
input device check on
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (496 buckets, 3968 max)
nf_ct_ftp: registering helper for pf: 2 port: 21
nf_ct_ftp: registering helper for pf: 10 port: 21
ip_conntrack_rtsp v0.6.21 loading
ZLD: zy_sm_init() register hooks successful.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
ebt_ulog: not logging via ulog since somebody else already registered for PF_BRIDGE
NET: Registered protocol family 8
atmpvc_init() failed with -17
lec.c: May 30 2014 00:08:10 initialized
mpc.c: May 30 2014 00:08:08 initialized
802.1Q VLAN Support v1.8 Ben Greear greearb@candelatech.com
All bugs added by David S. Miller davem@redhat.com
ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation jketreno@linux.intel.com
VFS: Mounted root (squashfs filesystem) readonly.
Time: MIPS clocksource has been installed.
Freeing unused kernel memory: 180k freed
init started: BusyBox v1.10.4 (2014-06-05 00:50:04 PDT)
starting pid 162, tty ”: ‘/etc/init.d/rcS’
Algorithmics/MIPS FPU Emulator v1.5
Run init.d/rcS!
/etc/init.d/rcS: line 7: cannot create /etc/mtab: Read-only file system
tar: removing leading ‘/’ from member names
ifconfig: SIOCGIFFLAGS: No such device
Trying to mount NOR flash as JFFS2 for configuration files
Running all S1 scripts in /etc/init.d/etc/init.d/rcS: line 115: TIMEZONE_CONFIG=/mnt/Config: not found
Starting syslog-ng…
load hidden_flash_access.ko
init memory page
register_chrdev
init_hidden_flash_access_module() SUCCESS
===> Dump Default Romfile and FW Info
have set module idCopied 65536 bytes from address 0x00000000 in flash to /tmp/romddump
check ROMD failed
mcputil.c:dump ROMD partition failed
Nothing to dump ROM-D!
read 5 byte
Run S1_10ethernet to load Ethernet module
First get MAC address=B0B2DC53EA48
Create MAC = B0:B2:DC:53:EA:48
Create MAC = B0:B2:dc:53:ea:49
Create MAC = B0:B2:dc:53:ea:4a
Create MAC = B0:B2:dc:53:ea:4b
Create MAC = B0:B2:dc:53:ea:4c
Create MAC = B0:B2:dc:53:ea:4d
Create MAC = B0:B2:dc:53:ea:4e
sh: 1: unknown operand
sh: 2: unknown operand
<4>ifxmips_ppa_hal_ar9_a5: module license ‘unspecified’ taints kernel.
Loading A5 (MII0/1 + ATM) driver …… <3>drivers/char/ifxmips_gpio.c:721:ifx_gpio_pin_reserve: Pin ID 32 (port 2, pin 0) has been reserved by module PPA from kernel!
Succeeded!
PPE datapath driver info:
Version ID: 32.3.7.0.0.0.4
Family : AR9
DR Type : Normal Data Path | Indirect-Fast Path
Interface : MII0 | MII1 | ATM
Mode : N/A
Release : 0.0.4
PPE firmware info:
Version ID: 5.2.4.6.1.1
Family : AR9
FW Type : Acceleration
Interface : MII0/1 + ATM
Mode : Bridging + IPv4 Routing
Release : 1.1
========> PPE_EXTRA_PARAM is ethwan=0
sh: 1: unknown operand
PPA API — init successfully
sh: 1: unknown operand
LAN SETTINGS
IP Verify: enable
UDP Verify: enable
TCP/UDP Error Drop: disable
DROP on HIT: disable
MC Drop on HIT: disable
WAN SETTifx_ppa_init – init succeeded
INGS
IP Verify: enable
UDP Verify: enable
TCP/UDP Error Drop: disable
DROP on HIT: disable
MC Drop on HIT: disable
INTERFACES
Number of LAN IF: 0
Number of WAN IF: 0
OTHER
Max. LAN Entries: 192
Max. WAN Entries: 192
Max. MC Entries: 64
Max. Bridge Entries: 512
Min. Hits: 1
Insert BTN IO module
GPIO phy addr:1e100b10, len:58, vir addr: be100b10
LED phy addr:1e100bb0, len:14, vir addr: be100bb0
init_gpio_reg
/proc/btn_io is created
init_btn_io_module() SUCCESS, Major Numer is 220
Enable BTN_timer.
Run S1_12xdsl to load xdsl module
read 5 byte
Wan pin select is 1 (0:Ethernet wan, 1:DSL wan)
Lantiq CPE API Driver version: DSL CPE API V4.2.0
Predefined debug level: 3
debug: get wan mode ADSL
Bring up ADSL
read 8184 byte
0
wait dsl_cpe_control
Modem is not ready!DSL_CPE: TCP messages debug server: Address: 0.0.0.0
DSL_CPE: TCP_IP Socket is Listening
DSL_CPE: TCP CLI debug server: Address: 0.0.0.0
DSL_CPE: TCP_IP Socket for CLI is Listening
ADSL Annex A (support Annex M also)
nReturn=0
nReturn=0
Loads switch module S17
Insert switch control module
Setting default TANTOS registers:
Product Code 0x2599
Loading tantos driver…
Kernel module version: v2.0
Driver version: v3.0beta2
Date code: 2006-11-08
tantos proc initialization okay!
BRIDGE_DEV=br0
Unknow command type is 103
command error !
device eth0 is not a slave of br0
device eth0.10 entered promiscuous mode
eth0.10: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
br0: port 1(eth0.10) entering learning state
Enabling IP forwarding
Bringing up interface lo
params = lo 127.0.0.1
starting ftpd… done
Starting ZLD CCC(Common Configuration Center)…
RESET CCC LOG LEVEL: 6
RESET CCC LOG LEVEL: 6
RESET CCC LOG LEVEL: 6
nReturn=0
read 8184 byte
read 16 byte
touch: invalid option — t
BusyBox v1.10.4 (2014-06-05 00:50:04 PDT) multi-call binary
Usage: touch [-c] FILE [FILE…]
Update the last-modified date on the given FILE[s]
Options:
-c Do not create any files
BE DHCPCLIENT init
finish download certificate
rm: cannot remove ‘/etc/allcert/all.pem’: No such file or directory
Starting mini_httpd…
Can not find httpd /usr/apache2/bin/apachectl
socket: Address family not supported by protocol
starting pid 755, tty ”: ‘/sbin/getty 115200 ttyS1’
(none) login: NET: Registered protocol family 10
eth0.10: add 33:33:00:00:00:01 mcast address to master interface
eth0.10: add 33:33:ff:53:ea:4f mcast address to master interface
resetAllPPPDUnitNumberStatus():
pppdUnitNumberInUsed[0]=0
pppdUnitNumberInUsed[1]=0
pppdUnitNumberInUsed[2]=0
pppdUnitNumberInUsed[3]=0
pppdUnitNumberInUsed[4]=0
pppdUnitNumberInUsed[5]=0
pppdUnitNumberInUsed[6]=0
pppdUnitNumberInUsed[7]=0
ifconfig: nas1: error fetching interface information: Device not found
nReturn=0
cp: cannot stat ‘/etc/sysconfig/network-scripts/wan-multi/ifcfg-eth0’: No such file or directory
ifconfig: bad address ‘1500’
device nas1 is not a slave of br0
eth0.10: add 33:33:00:00:00:02 mcast address to master interface
eth0.10: add 33:33:ff:00:00:00 mcast address to master interface
eth0.10: dev_set_promiscuity(master, -1)
device eth0 left promiscuous mode
device eth0.10 left promiscuous mode
br0: port 1(eth0.10) entering disabled state
eth0.10: del 33:33:ff:00:00:00 mcast address from vlan interface
eth0.10: del 33:33:ff:00:00:00 mcast address from master interface
eth0.10: del 33:33:00:00:00:02 mcast address from vlan interface
eth0.10: del 33:33:00:00:00:02 mcast address from master interface
eth0.10: del 33:33:ff:53:ea:4f mcast address from vlan interface
eth0.10: del 33:33:ff:53:ea:4f mcast address from master interface
eth0.10: del 33:33:00:00:00:01 mcast address from vlan interface
eth0.10: del 33:33:00:00:00:01 mcast address from master interface
device eth0 is not a slave of br0
device eth0.3901 entered promiscuous mode
eth0.3901: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
br0: port 1(eth0.3901) entering learning state
eth0.3901: add 33:33:00:00:00:01 mcast address to master interface
eth0.3901: add 33:33:ff:53:ea:4f mcast address to master interface
cat: can’t open ‘/var/tmp/hosts’: No such file or directory
Starting celld daemon……
Enter user spacestopping p910nd… done
eth0.3901: add 33:33:ff:00:00:00 mcast address to master interface
Password for ‘root’ changed
Password for ‘supervisor’ changed
Password for ‘admin’ changed
Password for ‘user’ changed
cat: can’t open ‘/tmp/schedule/*.sche’: No such file or directory
killall: crond: no process killed
killall: updatedd: no process killed
PCI: Setting latency timer of device 0000:00:0e.0 to 64
=== pAd = c02ab000, size = 543600 ===
<– RTMPAllocAdapterBlock, Status=0pAd->CSRBaseAddress =0xb8000000, csr_addr=0xb8000000!
$LOCAL_ADMIN_MAC=B2:B2:DC:53:EA:4c
RX DESC a3932000 size = 2048
<– RTMPAllocTxRxRingMemory, Status=0
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Phy Mode = 9
Phy Mode = 9
NVM is Efuse and its size =3c[3c0-3fb]
Phy Mode = 9
MCS Set = ff ff 00 00 01
SYNC – BBP R4 to 20MHz.l
Main bssid = b2:b2:dc:53:ea:4c
<==== rt28xx_init, Status=0
0x1300 = 00064320
/proc/driver/wlan_short_cut created
Init RALINK_FP_Handle
device ra0 entered promiscuous mode
device ra1 entered promiscuous mode
device ra2 entered promiscuous mode
device ra3 entered promiscuous mode
Remove RALINK_FP_Handle
/proc/driver/wlan_short_cut removed
br0: port 2(ra0) entering disabled state
br0: port 3(ra1) entering learning state
br0: port 4(ra2) entering learning state
br0: port 5(ra3) entering learning state
RX DESC a26be000 size = 2048
<– RTMPAllocTxRxRingMemory, Status=0
Phy Mode = 9
Phy Mode = 9
Phy Mode = 9
MCS Set = ff ff 00 00 01
Main bssid = b2:b2:dc:53:ea:4c
<==== rt28xx_init, Status=0
0x1300 = 00064320
/proc/driver/wlan_short_cut created
Init RALINK_FP_Handle
br0: port 2(ra0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0.3901) entering forwarding state
rm: cannot remove ‘/etc/igmpv3.conf’: No such file or directory
sh: cannot create /proc/sys/net/ipv4/conf/nas1/force_igmp_version: nonexistent directory
Jan 1 02:00:48 ccc_be: beSysMtnReloadConfig(): Loading beVpnConfigLoad…
Stopping strongSwan IPsec failed: starter is not running
Stopping strongSwan IPsec failed: starter is not running
Initializing XFRM netlink socket
Starting strongSwan 4.2.8 IPsec [starter]…
no default route – cannot cope with %defaultroute!!!
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
modprobe: cannot parse modules.dep
stopping ftpd… done
starting ftpd… br0: topology change detected, propagating
br0: port 3(ra1) entering forwarding state
br0: topology change detected, propagating
br0: port 4(ra2) entering forwarding state
br0: topology change detected, propagating
br0: port 5(ra3) entering forwarding state
done
mini_httpd: exiting due to signal 15
Action 4 device ifb1 ifindex 3
Action 4 device ifb1 ifindex 3
HTB: quantum of class 10001 is big. Consider r2q change.
DSL[00]: ERROR – Function is only available in the SHOWTIME!
DSL[00]: ERROR – Function is only available in the SHOWTIME!
iptables: No chain/target/match by that name
Chain ‘LOCAL_INPUT’ doesn’t exist.
iptables: No chain/target/match by that name
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
killall: upnpd: no process killed
insmod: can’t open ‘/lib/modules/2.6.20.19/kernel/drivers/usb/class/usblp.ko’: No such file or directory
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial Driver core
drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1
Initializing USB Mass Storage driver…
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
insmod: can’t open ‘/lib/modules/2.6.20.19/kernel/drivers/usb/class//cdc-acm.ko’: No such file or directory
Jan 1 00:01:01 ccc_mr: cccRegModule(): register tr69FE
usbcore: registered new interface driver cdc_ether
Jan 1 00:01:01 ccc_das: cccDasHandleSet(): value is changed
IFXUSB: ifxusb_hcd: version 3.2 B110610
IFXUSB: USB core #0 soft-reset
IFXUSB: USB core #0 soft-reset
ifxusb_hcd ifxusb_hcd: IFX USB Controller
ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 1
ifxusb_hcd ifxusb_hcd: irq 54, io mem 0xbe101000
IFXUSB: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
IFXUSB: USB core #1 soft-reset
IFXUSB: USB core #1 soft-reset
ifxusb_hcd ifxusb_hcd: IFX USB Controller
ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 2
ifxusb_hcd ifxusb_hcd: irq 83, io mem 0xbe106000
IFXUSB: Init: Power Port (0)
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
[PMCU/PPE]: Unregistration: incorrect callee for unregisteration!!
ZySM: TCP session matching has already been disabled
ZySM: UDP session matching has already been disabled
mini_httpd: exiting due to signal 15
mini_httpd_ssl: exiting due to signal 15
killall: webipqd: no process killed
killall: zyTimeZoneUpdater: no process killed
mini_httpd: exiting due to signal 15
mini_httpd_ssl: exiting due to signal 15
disable led
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
DSL[00]: Reboot on training timeout (60)!!!
nReturn=0
P-661HNU-F1 login: 

My branded router comes with these users: root, admin, user and supervisor. As for now an admin, user and supervisor use the very same password, but root makes use of a different one.
Any of these accounts but root on the router make use of ZySH.

ZySH commands can be completed by pressing TAB or you can get the help with ?. Eventually press enter to run the command.

P-661HNU-F1 login: admin
Password:
No entry for terminal type “vt102”;
using dumb terminal settings.
ZySH>?
clear – Reset functions
configure – Enter configuration mode
copy – Copy from one file to another
disable – Exit privileged EXEC mode
exit – Close an active terminal session
history – Display or clear CLI history
reboot – Shutdown and perform a cold restart
release – Perform an immediate release of a Dynamic Host Co
nfiguration Protocol (DHCP) lease for an interfac
e
renew – Perform an immediate renewal of a Dynamic Host Co
nfiguration Protocol (DHCP) lease for an interfac
e
show – Show running system information

ZySH> configure?
terminal – Configure from the terminal
ZySH>configure terminal
config$
cwmp – Starting to configure TR-069 cwmp agent
do –
end – Exit from configuration mode
exit – Exit configuration mode to the next highest mode
in the CLI mode hierarchy
history – Display or clear CLI history
interface – Select an interface to configure
ip –
no – Negate a command or set its defaults
ppp – Configure PPPoE
service – Turn on/off the specified service
wlan – Enter WLAN configure
xdsl – xDSL
config$ wlan
config-wlan$
authenticate – Configure authentication mode
beacon – Specify the beacon period
broadcast-key – Specify the time interval between rotations of th
e broadcast encryption key
broadcast-ssid – Enable broadcasting the SSID
channel – Set radio channel frequency <0-14>
do –
dot11 – Configure 802.11
dot1x – Configure 802.1x
enable – Enable Wireless Main SSID
encryption – Encryption configuration
end – Exit from configuration mode
exit – Exit configuration mode to the next highest mode
in the CLI mode hierarchy
fragment-threshold – Specify the size at which packets are fragmented
history – Display or clear CLI history
macfilter – Enable MAC-Filter
no – Negate a command or set its defaults
radius-server –
rts – Specify Request-To-Send (RTS) threshold
ssid – Set interface’s service set identifier (SSID)
world-mode – Specify 802.11d Regulatory Domain String
wpa-compatible – Enable WPA-compatible
wpa-psk –
wps – Configure Wi-Fi Protected Setup (WPS)
config$ exit
config$ interface?
br0 –
nas1 –
ppp9

Z-Boot script which runs at boot can be stopped by pressing any key in the console just after had switched on the device. In this way you access to many other commands which seems to be locked on my router.

U-Boot 1.1.5-ARX168 1.1.5(Sep 25 2010)
Boot from SPI
AR9 BOARD
CLOCK CPU 333M RAM 166M
DRAM: 64 MB
spi_init_f finsihed
relocate_code start
relocate_code finish.
SPI Device: MX25L12845E 0xC2 (MX) 0x20 0x18
Parameters: num sectors = 256, sector size = 65536, write size = 256
Status: 0x00
Flash: 16 MB
spi_init_f finsihed
*** Warning – bad CRC, using default environment
In: serial
Out: serial
Err: serial
Net:
switch chip id=2599
amazon_s Switch
Executing script at 82b80250
Z-Boot Autoscript file
Starting application at 0x82A80000 …
Hit any key to stop autoboot: 3
ZHAL> ?
ATBT x block0 write enable (1=enable, other=disable)
ATWM x set MAC address in working buffer
ATEN x,(y) set BootExtension Debug Flag (y=password)
ATSE show the seed of password generator
ATWZ a(,b,c) write ZyXEL MAC addr, Country code, EngDbgFlag
ATCB copy from FLASH ROM to working buffer
ATCL clear working buffer
ATSB save working buffer to FLASH ROM
ATBU dump manufacturer related data in working buffer
ATSH dump manufacturer related data in ROM
ATCO x set country code in working buffer
ATFL x set EngDebugFlag in working buffer
ATVD x set vendor name in working buffer
ATPN x set product name in working buffer
ATFE x,y,… set feature bits in working buffer
ATSN x set serial number in working buffer
ATTL MRD_CERT partition utility
ATGO boot up whole system
ATGU go back to U-Boot command line mode
ATRT (x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations
ATUR x,y upgrade RAS image (imgAddr, filename)
ATUB x,y upgrade ZyU-Boot image (imgAddr, filename)
ATWH x write HW version
ATHV x set HW version in working buffer
ATCR Clean MRD_CERT1/2(Romfile)
ATCS Clean System config partition

ZHAL> ATSE
product cmdkey error
ZHAL> ATGU
Permission denied

ZHAL> ATSH
………………………………………………………………………………………………………………………………………………ZLD Version : P-661HNU-F1_Elisa10_TSX17F0
Bootbase Version : U-Boot 1.1.5-ARX168 1.1.5(Sep 25 2010)
Vender Name : ZyXEL Communications Corp.
Product Model : P-661HNU-F1
Serial Number : S120Y20040143
First MAC Address : B0B2DC53EA48
Last MAC Address : B0B2DC53EA4F
MAC Address Quantity : 08
Default Country Code : d5
Boot Module Debug Flag : 00
RootFS Checksum : 000020f5
Kernel Checksum : 0000c633
RomFile Checksum : 00007d3e
Main Feature Bits : 00
HW Version : 000
Other Feature Bits :
02 00 00 05 08 01 00 ff-f8 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
01 08 30 30 30 53 31 32-30 59 32 30
ZHAL> ATBU
Permission denied

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.