Hi All,
maybe someone has a good idea for my problem, since I bricked my Technicolor DGA4132
What did I do so far?
- Got the DGA4132 flashed with 1.0.5
- Downgrade to 1.0.3
- root with autoflash_gui
- gui installed via ssh shell (don't know exactly which version, some link from the forum)
- Update to Version 1.1.0
After that, all was good it seems. But I wanted to use the device as a simple Modem.
So I disabled ppp+nat under the "Internet" Tab and enabled the bridge-Mode under the "Broadband" Tab.
Big Mistake, it seems...
After that the box reboots and only the most lefthandsided Status LED was enlighted, after the bootloader was done (when the bootlader was active the front LAN LED was blinking as well)
No access by lan was possible, neither with a fixed IP Adress nor a DHCP Server of the device said anything.
I reflashed the device several times with tftp+bootp with both Versions (1.0.3 + 1.1.0) which went well, according to the
Output of the serial console, but nothing changed in the behaviour
With the serial Monitor I see the device IS booting (not explicitly crashing), I can also see when I provide a boot from bank1 or bank2 (bank 3 results in a boot failure since there seems nothing to be)
After the boot process, if I look with tcpdump or netdiscover on the Client NIC I see some very strange MAC Address:
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
52.52.51.53 00:26:86:00:00:00 3 180 Quantenna Communcations, Inc.
The 52.52.51.53 is pingable, but no port is open, so neither http/https nor ssh or telnet is able to connect.
If the 1.1.0 firmware is used, I also see dmesg-Log-Entries of the iptables which blocks all accesses I try.
Currently the 1.0.3 is acive and the flash and boot-log looks like this:
Technicolor Gateway
(c) 2017, All rights reserved
Gateway initialization sequence started
Boot Loader Version : 17.19.1062-0000000-20170512080206-5bebd9fb97718f93b20bca231a620df630da9918
Boot Loader OID : 59156bce30d40f7fd11860f1
CPU : BCM63138B0
RAM : 512MB
Flash : 250MB NAND
Board Mnemonic : VBNT-S
Market ID : FFFC
Variant ID : TI
Entering BOOT-P mode (reason: BUTTON_PUSH )
BOOTP Reply received
Local IP: 192.168.1.101
BOOTP Server IP: 192.168.1.22
TFTP Server IP: 192.168.1.22
Filename: AGTHP_1.0.3_CLOSED.rbi
TFTP started
*** 25021 kB received ***
TFTP finished
Testing started
*** 81920 kB tested ***
Testing finished
Flashing started
*** 81920 kB programmed ***
Flashing finished
Resetting the gateway
----
BTRM
V1.6
[...]
MAIN
4.1603-1.0.38-116.174
DRAM
NVRAM memcfg 0x427
MCB chksum 0xf67f5b05
DDR3-1600 CL11 512MB
MemsysInit lpe2_custom 0p10 20140709
DDR3
807120CC 80003000 00000070 016028BC
MCB rev=0x00020201 Ref ID=0x028BC Sub Bld=0x016
ZQ Cal LP PHY
p_term=0x06 n_term=0x06 p_drive=0x10 n_drive=0x10
PLL Ref(Hz)=0x02FAF080 UI STEPS=0x04F
DDR CLK(MHz)=0x31F WL CLK dly(ps)=0x0C8 bitT(ps)=0x271 VDLsize(fs)=0x1EE7 CLK_VDL=0x021
Changed Byte Lane LDE
Changed Byte Lane LDE
Add/Ctl Alignment
no adjustment
memsys_init call phy init returns 0x00000000
MEMC init size 2 clock 6
MemsysInit lpe2_custom 0p10 20140709
DDR3
807120CC 80003000 000003E0 016028BC
MCB rev=0x00020201 Ref ID=0x028BC Sub Bld=0x016
SHMOO 28nm 0p9 20140709
80003000 80002500 00000000 00020000 00000000
ROSC Auto clk counter start
Found inflection point
ROSC final result:
nRing Osc Meas check
rosc 0x00 = 0x0000006E clk_count = 0x00000359 scb_clk = 0x0064 MHz
rosc 0x01 = 0x00000081 clk_count = 0x00000359 scb_clk = 0x0064 MHz
rosc 0x02 = 0x00000073 clk_count = 0x00000359 scb_clk = 0x0064 MHz
rosc 0x03 = 0x000000C3 clk_count = 0x00000359 scb_clk = 0x0064 MHz
rosc 0x04 = 0x000000FD clk_count = 0x00000359 scb_clk = 0x0064 MHz
rosc 0x05 = 0x000000C4 clk_count = 0x00000359 scb_clk = 0x0064 MHz
rosc 0x06 = 0x00000088 clk_count = 0x00000359 scb_clk = 0x0064 MHz
rosc 0x07 = 0x0000005A clk_count = 0x00000359 scb_clk = 0x0064 MHz
rosc 0x08 = 0x000000AD clk_count = 0x00000359 scb_clk = 0x0064 MHz
rosc 0x09 = 0x0000006C clk_count = 0x00000359 scb_clk = 0x0064 MHz
rosc 0x0A = 0x0000005E clk_count = 0x00000359 scb_clk = 0x0064 MHz
rosc 0x0B = 0x0000006F clk_count = 0x00000359 scb_clk = 0x0064 MHz
ROSC Auto clk counter finished
[...]
PASS
Technicolor Gateway
(c) 2017, All rights reserved
Gateway initialization sequence started
Boot Loader Version : 17.19.1062-0000000-20170512080206-5bebd9fb97718f93b20bca231a620df630da9918
Boot Loader OID : 59156bce30d40f7fd11860f1
CPU : BCM63138B0
RAM : 512MB
Flash : 250MB NAND
Board Mnemonic : VBNT-S
Market ID : FFFC
Variant ID : TI
Booting : Bank 1
SW Version : 17.1.7812-0001019-20170704142146-f19db08ab5c86434318a24c8ee86cbce5ab51da6
Starting the Linux kernel
Enabling watchdog
Code Address: 0x00008000, Entry Address: 0x00008000
Decompression OK!
Entry at 0x00008000
Closing network.
Starting program at 0x00008000
[ 0.000000] Booting Linux on physical CPU 0
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 3.4.11-rt19 (repowrt-builder@452a29f7d412) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2013.05 r48709) ) #1 SMP PREEMPT S7
[ 0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine: BCM963138
[ 0.000000] Prozone memory from command line 1ffe0000
[ 0.000000] bootconsole [earlycon0] enabled
[ 0.000000] Memory policy: ECC disabled, Data cache writealloc
[ 0.000000] creating a MT_MEMORY_NONCACHED device at physical address of 0x1ffc0000 to virtual address at 0xdffc0000 with size of 0x40000 byte forD
[ 0.000000] creating a MT_MEMORY_NONCACHED device at physical address of 0x0fd00000 to virtual address at 0xcfd00000 with size of 0x300000 byte foL
[ 0.000000] creating a MT_MEMORY_NONCACHED device at physical address of 0x0e800000 to virtual address at 0xce800000 with size of 0x1400000 byte fm
[ 0.000000] creating a MT_MEMORY_NONCACHED device at physical address of 0x0e400000 to virtual address at 0xce400000 with size of 0x400000 byte foc
[ 0.000000] On node 0 totalpages: 123648
[ 0.000000] free_area_init_node: node 0, pgdat c047a6e0, node_mem_map c1000000
|...]
[ 0.956000] *** AdslCoreSetSdramTrueSize: data[0]=0xFFE60E27 data[1]=0x19F1D8 ***
[ 40.964000] *** PhySdramSize got adjusted: 0x12139C => 0x19F1D8 ***
[ 40.970000] AdslCoreSharedMemInit: shareMemSize=331264(331264)
[ 40.976000] __AdslCoreHwReset: pAdslX=0xfc76ff90
[ 40.981000] __AdslCoreHwReset: pAdslX->sdramBaseAddr=0x0000e1af, pAdslX->gfcTable[]=0x0000e1cf, adslCorePhyDesc.sdramImageAddr=0xcfe10000
[ 41.008000] AdslCoreHwReset: pLocSbSta=d4d98000 bkupThreshold=3072
[ 41.014000] AdslCoreHwReset: AdslOemDataAddr = 0xCFF11574, time=16 ms
[ 41.021000] VersionInfo: A2pvbH042u.d26o
[ 41.025000] ***BcmDiagsMgrRegisterClient: 0 ***
[ 41.029000] dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
[ 44.383000] AutoGreeen changed to disabled
[ 44.398000] Energy Efficient Ethernet changed to disabled
[ 44.411000] Ethernet Auto Power Down and Sleep: Disabled
[ 45.396000] Runner port mirroring is not supported
[ 46.022000] ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 46.028000] device eth0 entered promiscuous mode
[ 46.051000] ADDRCONF(NETDEV_UP): br-lan: link is not ready
[ 46.066000] ADDRCONF(NETDEV_UP): eth1: link is not ready
[ 46.071000] device eth1 entered promiscuous mode
[ 46.080000] ADDRCONF(NETDEV_UP): eth2: link is not ready
[ 46.085000] device eth2 entered promiscuous mode
[ 46.104000] ADDRCONF(NETDEV_UP): eth3: link is not ready
[ 46.109000] device eth3 entered promiscuous mode
[ 46.120000] device eth5 entered promiscuous mode
[ 46.125000] br-lan: port 5(eth5) entered forwarding state
[ 46.130000] br-lan: port 5(eth5) entered forwarding state
[ 46.137000] ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[ 46.149000] ADDRCONF(NETDEV_UP): ptm0: link is not ready
[ 46.154000] netdev path : ptm0.835 -> ptm0
[ 46.161000] ADDRCONF(NETDEV_UP): ptm0.835: link is not ready
[ 46.167000] device ptm0.835 entered promiscuous mode
[ 46.171000] device ptm0 entered promiscuous mode
[ 46.180000] netdev path : wl1_1 -> eth5
[ 46.202000] ADDRCONF(NETDEV_UP): eth4: link is not ready
[ 46.524000] Runner port mirroring is not supported
[ 46.563000] device wl0 entered promiscuous mode
[ 47.306000] eth0 (Ext switch port: 0) (Logical Port: 8) Link UP 1000 mbps full duplex
[ 47.316000] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 47.322000] br-lan: port 1(eth0) entered forwarding state
[ 47.327000] br-lan: port 1(eth0) entered forwarding state
[ 48.136000] br-lan: port 5(eth5) entered forwarding state
[ 49.329000] br-lan: port 1(eth0) entered forwarding state
[ 52.311000] br_netlink_mcpd.c: Setting registration type 0 pid to 3060
[unreadable ASCII ART]
(Modified Gui RootScript) (Christo)
=== IMPORTANT =======================================
Checking root...
Root detected! Doing nothing.
Firmware in Bank_1... Not transferring...
-----------------------------------------------------
After the "Not transferring" no output is generated, despite some information about connecting the ethernet ports.
Despite the tftp flash, the root-script is still "valid" and run... isn't the complete mtd deleted when flashed?
If no, that is not a real fail-safe option any more and you gotta be very careful regarding to any changes in the filesystem :-(
I'd like to delete or reset the mtd partition, but with the serial connection I don't get a shell at all - which is really a bummer....
Did I locked me out forever or does anyone of you know what I could try next?
(The FULL log is attached, since it was too long to be posted)
Cheers,
UxG