Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[asbokid]

Aha!

That has uncovered the likely CPU in the D-Link DSL-2780.

The CPU is probably the Ralink rt3052.  Ralink bought TrendChip in 2010,  but were then swallowed up by MediaTek (who seem uncommitted to further DSL chipset development). [1] [2]

The Datasheet for the Ralink rt3052 is available here [3]

We can also see from the filename references to 'alpha' that the Taiwanese company, Alpha Networks, built the firmware for the device. [4]

cheers, a

EDIT: I spy a reference in the firmware to the RT2088.. another Router SoC from Ralink.  Not sure why that's there...

[1] http://www.ralinktech.com/en/02_products/product.php?sn=1045
[2] http://www.netcheif.com/../PDF/RT3052-product brief.pdf
[3] http://www.tracermcc.ru/foto/bender/RT3050_5x_V2.0_081408_0902.pdf
[4] http://www.alphanetworks.com/

[sheddyian]

Aha!

That has uncovered the CPU in the D-Link DSL-2780.

It is a Ralink rt3052. 

Yay!    (I think?  )

Ralink bought TrendChip in 2010,  but were then swallowed up by MediaTek (who  seem uncommitted to further development of the DSL CPE chipsets they inherited through the buyout).

We can also see from the filename references to 'alpha' that the Taiwanese company, Alpha Networks, built the firmware for the device.

Thanks, that's interesting.  The firmware is still being developed, as I'm running a beta that was issued a month or so back. 

Ian

[asbokid]

maybe try ps auxw to see what processes are running...

[sheddyian]

It appears the telnet client has truncated lines beyond 80 chars, but hope there's enough here of interest.

I noticed a couple of password / userid related things, so I've exchanged those bits with ***  8)

DSL-2780 # ps auxw
  PID  Uid     VmSize Stat Command
    1 0           300 S   init
    2 0               SWN [ksoftirqd/0]
    3 0               SW< [events/0]
    4 0               SW< [khelper]
    5 0               SW< [kthread]
   30 0               SW< [kblockd/0]
   43 0               SW< [kswapd0]
   44 0               SW  [pdflush]
   45 0               SW  [pdflush]
   46 0               SW< [aio/0]
  637 0               SW  [mtdblockd]
  674 0               SW< [dwc_otg]
  720 0           292 S < /sbin/udevd --daemon
  726 0           760 S   xmldb -n dlink_DSL-2780_A4LWFn1U_4f32r -t
  772 0               SW< [khubd]
 1146 0           284 S   syslogd -F sysact -F attack -F notice
 1193 0           304 S   /bin/alphaLogd
 1208 0           372 S   /bin/alphaHousekeeper
 1497 0           460 S   alphaWanAgent -t 10000 -u ****** -p ****** -U Login: -P
 1533 0           440 S   hostapd /var/run/hostapd.ra0.conf
 1537 0           248 S   /usr/sbin/wlxmlpatch
 1570 0           364 S   sh /var/run/http-loop.sh
 1576 0           868 S   httpd -s dlink_DSL-2780_A4LWFn1U_4f32r -f /var/etc/ht
 1624 0           208 S   portt
 1691 0           348 S   /bin/alphaInetd
 1714 0           304 S   /usr/sbin/stunnel /etc/stunnel.conf
 1738 0           384 S   alphaFlashAgent
 2039 0          1092 S   /usr/sbin/tr069 -f /var/tr069/tr069.xml
 2099 0           304 S   /sbin/getty -L console 115200 vt102
 2291 0           372 S   /bin/sh /var/run/ppp-loop-session1.sh
 2298 0           636 S   pppd file /etc/ppp/options.session1
 2478 0           416 S   udhcpd /var/run/udhcpd-br0.conf
 2654 0           380 S   /bin/alpha_dns_resolve
 2666 0           256 S   klogd -l br0 -w ppp0
 2695 0           332 S   dyndns -S 2 -u ****** -p ****** -i **.**.**.**.**
 8379 0           260 S   telnetd
 8380 0           380 S   /bin/sh
 8385 0           328 R   ps auxw

Hope that's of use!

Ian

[asbokid]

Hi sheddyian,

The firmware in your DSL-2780 appears to be built, in part, using the Jungo OpenRG toolkit, but incorporating code from Alpha Networks.

There's no obvious tool for getting bit-depth maps, etc.   Maybe try and find how that line data is obtained by other routers with the same chipset

On that point, the ADSL Analog Front End / Line Driver IC (AFE/LD) in the DSL-2780 remains unknown. The RaLink rt3052 System-on-Chip that powers the DSL-2780 is simply a router processor with an integrated ethernet switch controller and 802.11n transceiver. There is no AFE or LD on the silicon.

However, the MIPS32 core in the rt3052 does have instruction set extensions to support important DSP algorithms in hardware. According to Dominic Sweetman, author of See MIPS Run Linux [1],  the extensions in the MIPS DSP ASE provide SIMD parallel processing to accelerate vector operations, fixed point fractions, saturating arithmetic, and more. (see attached)

There are some other interesting bits-and-bobs in the DSL-2780. You have uncovered the presence of an XML database holding the low-level configuration of the router. That is a common feature of an OpenRG firmware build. The database is accessed using the xmldbc client, as per:

Code: [Select]

DSL-2780 # xmldbc -h
DSL-2780 # xmldbc -a -D /tmp/thexmldb.xml
DSL-2780 # cat /tmp/thexmldb.xml | more

The data stored in that XML database should contain runtime info - live line statistics, although probably not at the granularity of an individual tone.

There is also a (running) tool for tr069 remote management.  Lucky you are not with Sky: Rupert Murdoch loves to snoop where he shouldn't 

cheers, a

[1] http://www.amazon.co.uk/exec/obidos/tg/detail/-/0120884216/

[sheddyian]

Unfortunately, the DSL-2780 doesn't support more !

DSL-2780 # xmldbc -h
Usage: xmldbc version 2 [OPTIONS]
  -h                     show this help message.
  -H                     show version number.
  -v                     verbose mode.
  -a                     dump database include runtime and tmp.
  -i                     ignore external function (like runtime).
  -g {node path}         get value from {node path}.
  -s {node path} {value} set  {value} in {node path}.
  -d {node path}         delete {node path}.
  -l {XML file}          reload XML file to database.
  -f {XML file}          set XML file to database.
  -D {XML file}          dump database to XML file.
  -S {unix socket}       specify unix socket name, default is /var/run/xmldb_soc
k
  -A {ephp file}         embeded php parse.
  -V {name=value}        variable for ephp.
  -x {command}           set extended get/set command.
  -t {tag:sec:command}   schedule a timer.
  -k {tag}               kill timers by tag.

DSL-2780 # xmldbc -a -D /tmp/thexmldb.xml
DSL-2780 #
DSL-2780 # cat /tmp/thexmldb.xml | more
more: not found
DSL-2780 # cat: Write Error: Broken pipe

cat has a -u option, but it doesn't seem to be a "more" function.  Makes it rather hard to read as my screen buffer is way too small for the huge list of stuff in that .xml file!

Ian

[asbokid]

Unfortunately, the DSL-2780 doesn't support more !
...
cat has a -u option, but it doesn't seem to be a "more" function.  Makes it rather hard to read as my screen buffer is way too small for the huge list of stuff in that .xml file!

This is the command shell from Microsoft?  Maybe use a full-blown telnet client with an unlimited scrollback buffer and a log-to-disk function.. e.g. putty.  As a bonus, putty doesn't truncate lines either 

http://www.chiark.greenend.org.uk/~sgtatham/putty/

cheers, a

[sheddyian]

This is the command shell from Microsoft?  Maybe use a full-blown telnet client with an unlimited scrollback buffer and a log-to-disk function.. e.g. putty.  As a bonus, putty doesn't truncate lines either 

http://www.chiark.greenend.org.uk/~sgtatham/putty/

I've been away for a bit, but have just downloaded putty, not tried it yet though.  Yes, was using the standard command line telnet from Microsoft.  I also still use command line FTP on the occasions I need it   

Will have a go with putty later on and see if I can get the entire output of the xml file.  But will it be interesting? 

Ian

[burakkucat]

But will it be interesting? 

Ah, that depends who you are! 

[sheddyian]

Well, I finally got around to trying out putty, and getting a log file of the xml database from the DSL-2780.  See the zip file attached.

I've ****'d out any username/password stuff, and a few ip/MAC details, other than that it's as it was output.  I notice with interest there's mention of VOIP function, though I know nothing about this from either the user guide or any of the setup screens.  Wonder if this is a function provided by the router (would a router need to know if you were running voip on your PC?).

I'd be interested if you spot anything else that's interesting!

I noticed a mention of interleaving depth (think it was 64).  Is that interesting?

Ian

[asbokid]

sorry Ian,  I only just noticed your message from May 29.  The granularity of the line data in the 'real time' part of the XML database is coarse (just aggregate SNR, etc.) which is a shame.   Though it must be possible to obtain line data per tone from the hardware driver.   The interleave depth is quite high, same as mine, so that increases communications latency, but improves the likelihood of correcting errors.

cheers, a

[sheddyian]

No problem regarding delay, I took some time supplying the information you had asked to see

Is the interleave depth something I can change (or might want to change?) and how is it determined - based on line quality, or something the ISP sets?

I think I can get TalkTalk to turn it off, though my understanding is latency is something that bothers gamers more than others, and I'm really not a gamer!  (Briefly got into Angry Birds, but tired of it - latency has no affect there!)

It is a shame that seems to be no way of getting tone data.

Ian

[adam]

Hi

I thought I'd tag a question onto this thread, as it's fairly relevant. I'm looking for an alternative way to get some stats out of my DSL-2780 over telnet, as although routerstats lite works, the web interfaces dies after about 4 hours :-(

I can run the following command, among others to get the downstream snr:

DSL-2780 # xmldbc -i -g /runtime/dsl/downstream/snr_margin
7.4

which is perfect, just the info I'm looking for and simple to script, but the info is static and doesn't appear to change  I assume this info is read from the so called xml database.
I did a bit of digging to see how the web interface refreshes this info and have seen a method where the following URL is called:

http://admin:admin@192.168.1.1/STATUS/st_stat_wait.xgi?&set/runtime/dsl/set_ready=1

which can be simplified to: 192.168.1.1/STATUS/st_stat_wait.xgi

I found xgi in /sbin but I don't know what it is/does.

the following is the contents of st_stat_wait.htm

Code: [Select]

<html>
<html>
<?Include(/layout/_head.htm)?>
<?Include(/public/__head.js)?>
<?IncLang(msg_comm.js)?>
<script language="javascript">
var AjaxReq = null;

var currentURL=top.fPanel.location.href;


var thread;

function uiDoOnLoad()
{
thread=setInterval('get_nat_type()',1000);
}

function createRequest()
{
var request = null;
try { request = new XMLHttpRequest(); }
catch (trymicrosoft)
{
try { request = new ActiveXObject("Msxml2.XMLHTTP"); }
catch (othermicrosoft)
{
try { request = new ActiveXObject("Microsoft.XMLHTTP"); }
catch (failed) { request = null; }
}
}
if (request == null) alert("Error creating request object !");
return request;
}

function get_nat_type()
{
var  i = Math.random();
send_request("Summary_DSL_Gat.htm?id="+i,callback_get_nat_type);
}

function callback_get_nat_type()
{
var f = document.getElementById("frm");
if (AjaxReq != null && AjaxReq.readyState == 4 && AjaxReq.status == 200)
{
eval(AjaxReq.responseText);
if (AjaxReq.responseText.substring(1,2) !='"')
{
var cfginprogress=parseInt(AjaxReq.responseText.substring(1,2));
var  imprison=0;
if((cfginprogress==0)&&(imprison==0))
{
imprison=1;
window.clearInterval(thread);
top.fInfo.location.href="Summary_DSL.htm";
}
}
if (AjaxReq != null) delete AjaxReq;
}
}

function send_request(url, callback)
{
if (AjaxReq == null) AjaxReq = createRequest();
AjaxReq.open("GET", url, true);
AjaxReq.onreadystatechange = callback;
AjaxReq.send(null);
}
</script>
<body class="mybody" onload="uiDoOnLoad();">
<form name="frm" id="frm">
<?Include(/layout/_product.htm)?>
<?Include(/layout/_logo.htm)?>
<table border="0" cellpadding="2" cellspacing="1" width="838" align="center" bgcolor="#FFFFFF" bordercolordark="#000033">
<tr valign=top>
<td width=10%></td>
<td id="maincontent" width=80%>
<br>
<div id="box_header">
<h1></h1>
<table align=center>
<br>
<tr>
<td align=center><br><br></td>
</tr>
</table>
<!-- ________________________________ Main Content Start ______________________________ -->
<!-- ________________________________  Main Content End _______________________________ -->
</div>
<br>
</td>
<td width=10%>
</td>
</tr>
</table>
<?Include(/layout/_tail.htm)?>
<?Include(/layout/_copyright.htm)?>
</form>
</body>
</html>
Is there something in there refreshing the database?
My aim is to be able to refresh the database from the command line without using the web.

Any ideas?
Thanks

[asbokid]

Hi Adam,

Just a guess:  perhaps the database is updated from the hardware driver using something like:

Code: [Select]

xmldbc -s /runtime/dsl/set_ready 1

What is in the whole database?   What is returned by:

Code: [Select]

xmldbc -a -D /tmp/thexmldb.xml
cat /tmp/thexmldb.xml

Is there an XML node called set_ready ?

cheers, a

[adam]

Hello asbokid, thanks for the reply. Here is what I've tried

Code: [Select]

DSL-2780 # xmldbc -s /runtime/dsl/set_ready 1
dsl: not found

and I remember I've already tried:

Code: [Select]

xmldbc -i -s /runtime/dsl/set_ready 1
Which doesn't update the db.
The OP Ian has already, posted the xml db for this same firmware here http://forum.kitz.co.uk/index.php?action=dlattach;topic=11142.0;attach=6634 saves me **** all my details.

There is a node called set_ready (at the bottom)

Code: [Select]

<dsl>
                        <remote>
                                <mac>xxxxxxxxxxx</mac>
                        </remote>
                        <standard_type>3</standard_type>
                        <annex_type>0</annex_type>
                        <upstream>
                                <data_rate>853</data_rate>
                                <snr_margin>9.3</snr_margin>
                                <line_attenuation>27.8</line_attenuation>
                                <aca_transmitpower>12</aca_transmitpower>
                                <super_frame>3676</super_frame>
                                <rs_correctable_error>0</rs_correctable_error>
                                <total_cell>2322</total_cell>
                                <data_cell>20507</data_cell>
                                <bit_error>0</bit_error>
                                <maxattndata_rate>868</maxattndata_rate>
                                <interleaver_depth>4</interleaver_depth>
                        </upstream>
                        <downstream>
                                <data_rate>6655</data_rate>
                                <snr_margin>9.0</snr_margin>
                                <line_attenuation>53.0</line_attenuation>
                                <aca_transmitpower>0</aca_transmitpower>
                                <super_frame>3675</super_frame>
                                <rs_correctable_error>132</rs_correctable_error>
                                <total_cell>2646</total_cell>
                                <data_cell>108592</data_cell>
                                <bit_error>0</bit_error>
                                <maxattndata_rate>7452</maxattndata_rate>
                                <interleaver_depth>32</interleaver_depth>
                        </downstream>
                        <perf>
                                <nearend>
                                        <crc>0</crc>
                                        <hec_error>0</hec_error>
                                </nearend>
                                <farend>
                                        <crc>0</crc>
                                        <hec_error>0</hec_error>
                                </farend>
                        </perf>
                        <errored_second>0</errored_second>
                        <version>v1.5</version>
                        <status>1</status>
                        <line_state>3</line_state>
                        <set_ready>1</set_ready>
                        <data_path>2</data_path>
                </dsl>