Actiontec R1000H Details - Canadian TV, Computing and Home Theatre Forums
 

Go Back   Canadian TV, Computing and Home Theatre Forums > Canadian Internet, Phone, TV and Wireless Service Providers > Bell Canada Enterprises (BCE) > Bell Aliant Home Phone, Internet, IPTV

Reply
 
Thread Tools Search this Thread Display Modes

Old 2011-05-23, 09:12 AM   #1
nuke12
 
Join Date: May 2011
Location: Quispamsis, NB
Posts: 174
Default Actiontec R1000H Details

I don't see another post here about Actiontec details, so I figured I'd pass along what I've learned.

Basic hardware

Processor BCM6368 http://pdf.eccn.com/pdfs/Datasheets/Broadcom/CM6368.pdf
Ram M13S2561616A-51 2 chips
Flash S29GL256P90TFCR1
HPNA CG3211QIR + CG3213QIR
2 headers J505 - 6 pins, J201 - 12 pins (no pins attached to the headers)

The unit is running Linux version 2.6.21.5 (GCC version 4.2.3)

The USB is functional and can mount either VFAT (FAT/FAT32) or EXT3.

As far as I can tell the R1000H is just an V1000H with the DSL port removed (RJ11) and running firmware made for Aliant.

The tool chain for the V1000H can be found here: http://opensource.actiontec.com/ It does compile and the compiled apps run on the R1000H.

The flash has at least the following partitions;
1) CFE (boot partition)
2) Root filesystem
3) Kernel image partition
4) Nvram data partition
Only the root filesystem partition + NVRAM seem directly accessible while the OS is running.

I tried to find a way into the R1000H to run my own commands but I've had no luck so far. The root filesystem is read-only and the other two mounted filesystems are built on RAM. Nothing that will survive a reboot.

Last edited by nuke12; 2011-05-23 at 01:40 PM.
nuke12 is offline  
Sponsored Links
Advertisement
 
Old 2011-05-23, 03:47 PM   #2
nuke12
 
Join Date: May 2011
Location: Quispamsis, NB
Posts: 174
Default

I'll post some more info, I found today. Some of this is guesses and assumptions from working with other devices.

DO NOT JUST TRUST THIS INFO. A meter or a scope is your friend.

I'm going to guess that J505 is the com port. People working with the V1000H report the following settings work;
Baud rate - 115200, 8N1, flow control - none

DO NOT JUST CONNECT A COMPUTER COM PORT TO THE UNIT. You need a level translator. The port is probably running at 3.3 or 5 volt TTL levels. The translators are easily found on Ebay.

The com port should provide access to the CFE boot loader.


My next guess is that J201 is the EJTAG port. The JTAG port will allow you to fully dump the flash (plus much more). You need to build a very basic device to connect to this port. Searches for HairyDairyMaid will provide help. This software URL should work. It supports both the processor (Version 1. Our's is a version 3) and the flash chip.
http://www.tiaowiki.com/w/TJTAG

The JTAG pinout might be close to this: http://www.interfacebus.com/Design_C..._JTAG_Bus.html but only consider the first 12 pins.

Remember, this is not our device and any testing has to be done in a nonintrusive manner.

I (personally) have no desire to replace Aliant's firmware but to only add changes that can't be done via the provided GUI.
nuke12 is offline  
Old 2011-05-24, 01:38 PM   #3
TekiusFanatikus
Rookie
 
Join Date: Feb 2010
Posts: 7
Default

Ever thought of getting another gateway such as a Netgear WRN3500L and have Tomato run on it?
TekiusFanatikus is offline  
Old 2011-05-24, 03:26 PM   #4
nuke12
 
Join Date: May 2011
Location: Quispamsis, NB
Posts: 174
Default

Fair question.

For myself, I have replaced the Actiontec with my own Linux router/firewall but I still see the Actiontec as unit that could be put to other uses. The GUI is not great but the underbelly (hardware) is pretty good.

For some, a unit like your Netgear WRN3500L with Tomato does not have HPNA to feed IPTV via coax to their STBs.

The Tomato firmware never just jumped on the WRN3500L. It took some people, doing a fair amount of work, to make that happen. Something like it will take, to make the R1000H into a useful unit.

You have to start somewhere. I'm just trying help, make the start.
nuke12 is offline  
Old 2011-05-25, 06:45 AM   #5
TekiusFanatikus
Rookie
 
Join Date: Feb 2010
Posts: 7
Default

I wasn't doging your efforts, not at all. Since I'm on Fiber Op as well, any advancements could benefit me too.

I'm missing some functionality on the gateway as well. I know that Tomato would be sufficient in my case.

Good luck to you.
TekiusFanatikus is offline  
Old 2011-05-25, 07:39 AM   #6
nuke12
 
Join Date: May 2011
Location: Quispamsis, NB
Posts: 174
Default

Quote:
Originally Posted by TekiusFanatikus View Post

Good luck to you.
Thank-you.

Normally, I would take something like this to the OpenWRT forums but the R1000H is not a consumer unit. It has a very limited audience. If something is to be done with it, it will probably have to happen in Atlantic Canada.

Progress on the V1000H will help but Actiontec sales pale compared to the likes of Linksys or Netgear.
nuke12 is offline  
Old 2011-05-29, 06:25 AM   #7
NO-CRTC
 
Join Date: Mar 2005
Location: Fredericton, N.B.
Posts: 570
Default Owners's Manual?

WOuld anyone have a pdf of an owner's manual for the actiontec modem/router? I'm trying to figure out why the big button on the front of mine flashes between red and green for a while, turns solid red, then disappears and turns off totally for a while. This has me puzzled.
Thank you.
__________________
Owner of Panasonic TC-P60ZT60
NO-CRTC is offline  
Old 2011-05-29, 09:58 AM   #8
nuke12
 
Join Date: May 2011
Location: Quispamsis, NB
Posts: 174
Default

Quote:
Originally Posted by NO-CRTC View Post
WOuld anyone have a pdf of an owner's manual for the actiontec modem/router? I'm trying to figure out why the big button on the front of mine flashes between red and green for a while, turns solid red, then disappears and turns off totally for a while. This has me puzzled.
Thank you.
I don't think it exists. I asked my installer for one and he said they didn't have them. Nothing on the Actiontec site either.

I called Bell Aliant with a question on the Advanced DMZ and was told it was an unsupported option. LOL I asked for a supervisor who directed me to the Actiontec support line.

Try Aliant and if that doesn't help, try Actiontec 1-888-436-0657. If they ask, say that Aliant tech support sent you.
nuke12 is offline  
Old 2011-05-29, 10:56 AM   #9
nuke12
 
Join Date: May 2011
Location: Quispamsis, NB
Posts: 174
Default

I'll post some more info.

First off this has to be one of the most cryptic SoC Linux installs I've worked with.

Most SoC devices run start-up scripts to get services etc. running. Not this device. It appears to do everything with libraries. Specifically a series called "libcms_X.so" located in /lib and /lib/public.

I've never seen it done this way before. As far as I can figure, they have linked "init" (actually busybox) to use their libs and this is how the unit starts up.

One library, is what greets when you first login via SSH. It gives you this mini-shell done with libcms_cli.so.

The unit will auto mount a VFAT partition but not an EXT3 partition. I hoped it might auto run a file on the VFAT partition. If it can, I've not found the correct file name so far.

If I can find a method to execute a single file off a USB stick on boot up, I can take over control of the device. So far, I've not found it.

Oh well. more looking.
nuke12 is offline  
Old 2011-05-29, 11:22 AM   #10
file
 
Join Date: Nov 2010
Location: Riverview, NB
Posts: 815
Default

From a licensing perspective they can't do that without providing the source. If they link against busybox and interact like that then the licensing of busybox (GPL version 2) applies and they would have to make the source of their libraries available.

Your comments have piqued my curiosity though and I may take the Actiontec off the shelf and poke at it some...
file is offline  
Old 2011-05-29, 11:33 AM   #11
file
 
Join Date: Nov 2010
Location: Riverview, NB
Posts: 815
Default

Have you typed 'sh' in the libcms_cli prompt to get to a busybox shell and tried executing from there?
file is offline  
Old 2011-05-29, 11:37 AM   #12
file
 
Join Date: Nov 2010
Location: Riverview, NB
Posts: 815
Default

Oh you mean on boot up... replace the rcS file in /etc/init.d?
file is offline  
Old 2011-05-29, 11:50 AM   #13
nuke12
 
Join Date: May 2011
Location: Quispamsis, NB
Posts: 174
Default

Quote:
Originally Posted by file View Post
From a licensing perspective they can't do that without providing the source. If they link against busybox and interact like that then the licensing of busybox (GPL version 2) applies and they would have to make the source of their libraries available.

Your comments have piqued my curiosity though and I may take the Actiontec off the shelf and poke at it some...
Maybe I'm saying it wrong? Busybox is making calls to their libs because of the lib linking.
nuke12 is offline  
Old 2011-05-29, 11:52 AM   #14
nuke12
 
Join Date: May 2011
Location: Quispamsis, NB
Posts: 174
Default

Quote:
Originally Posted by file View Post
Have you typed 'sh' in the libcms_cli prompt to get to a busybox shell and tried executing from there?
Oh ya. The mini-shell is pretty useless.
nuke12 is offline  
Old 2011-05-29, 11:55 AM   #15
nuke12
 
Join Date: May 2011
Location: Quispamsis, NB
Posts: 174
Default

Quote:
Originally Posted by file View Post
Oh you mean on boot up... replace the rcS file in /etc/init.d?
Can't. The file is on a read-only SquashFS. Need another way in.
nuke12 is offline  
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



All times are GMT -4. The time now is 06:09 AM.

Search Digital Home

Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.