Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unable to access web server at 1.1.1.100 #5

Closed
JaredLThompson opened this issue Aug 23, 2023 · 17 comments
Closed

Unable to access web server at 1.1.1.100 #5

JaredLThompson opened this issue Aug 23, 2023 · 17 comments

Comments

@JaredLThompson
Copy link

Thank you for all the work on documenting this. I have the qsw-2104-s2-a switch, and started down the path of opening the case and connecting a serial port to the J1 header to understand why it wasn't recognizing my Finsar sfp+ module. I found this repo while looking, and attempted to follow the instructions in the Readme.

I am unable to access the webserver at 1.1.1.100. I have manually set my ip to 1.1.1.200, I have tried every port. It never maps 1.1.1.100 to an arp, and never connects.

Here is the output from the serial port:

BCM53158 SWITCH firmware Feb 22 2018
boot_src = M7. Initializing M7


Copyright 2015-2017 Broadcom Limited
         All rights reserved

Unit 0: ChipID: 53161 Rev 17
Unit 0: Straps: 00005041
Unit 0: PLL1 CH1 POSTDIV 13
LED Boot up -> 0s-3s
Unit 0: LED Refresh cycle config
Unit 0: LED Delay config
Unit 0: LED Strap load
Loading LED Firmware
.......
Unit 0: bootloader LED Start
Buffered Logs:
OTP_FLAGS = 0x8c


Broadcom ROBO OS Bootloader Version 2.4

Bootloader: QSPI flash Model: winbond Size: 128 Mbit

DEVFS: Initializing..
DEVFS: Device /dev/ttyS0 registered
DEVFS: Device /dev/flash0 registered
Press any key to interrupt Auto Boot
1. .0. .Autoboot starting...
Bootloader: Loading image at 1
Bootloader: Image Version SW-UT2206QG_1.00-0.07
Watchdog timeout value is 1250000000 (4a817c80)


Copyright 2015-2017 Broadcom Limited
         All rights reserved

ChipId: BCM53161 RevId: 17 
Version Regs: 
Software: ROBO_OS_REL_1_4_8 Build: Mon Nov 8 10:15:56 2021
MPU enabled
Unit 0: ChipID: 53161 Rev 17
Unit 0: Straps: 00005041
Unit 0: PLL1 CH1 POSTDIV 10
LED Boot up -> 3s-6s
Unit 0: LED Start
Buffered Logs:
OTP_FLAGS = 0x8c


Watchdog Setup with timeout 1250000000 (4a817c80)
Reading Primary Avenger OTP...
Starting Dynamic AVS Using ROs on Primary Avenger...
Applying Saved Core Voltage:9858 with saved DAC Code: 664.
dwl......avs.c:AvsSetDac=664, cur_dac=664 delta=0 
........avs.c:SetPVTctrl setting AVS_PVT_MNTR_CONFIG_PVT_MNTR_CTRL from 0x80 to 0x180 
SetAvsVoltage - Final Result: 1
Core Voltage After applying saved AVS results on Primary Avenger: 9837
cbxi_slictcam_init()
QSPI FLASH MPU region re-sized to 16 MB
sal_fs_init_all:114 File system initialized
sal_fs_init_all:122 File system obtained from TOC
sal_fs_init_all:128 File system initialized
cbxi_lin_init()
cbxi_encap_init()
cbx_port_init()
Unit 0 Mac init Ports: 8 9 10 11 12 13 14 15 
cbx_lag_init()
cbx_port_create()
Unit 0: PBMP_ALL(unit)=ff00
cbxi_trap_init()
cbxi_stg_init()
cbxi_vlan_init()
cbxi_l2_init()
cbxi_mcast_init()
cbx_mirror_init()
cbx_meter_init()
cbx_cosq_init()
cbx_stat_init()
cbx_cfp_init()
cbx_auth_init()
cbx_link_scan_init()
cbx_link_scan_enable_set()
cbx_pktio_init()
LWIP successfully initialized
LBD enabled 
QOS disabled 
port 8, pri=0, dp=0 
port 9, pri=1, dp=0 
port 10, pri=2, dp=0 
port 11, pri=3, dp=0 
port 12, pri=4, dp=0 
port 13, pri=5, dp=0 
extPhyIdentify: fport=8, phyaddr=1. id0=0x1c, id1=0xc848, type=3 ! 
rtlPhyInit: phyaddr=1 ! 
phyaddr=1, serdes = 0
extPhyIdentify: fport=9, phyaddr=2. id0=0x1c, id1=0xc848, type=3 ! 
rtlPhyInit: phyaddr=2 ! 
phyaddr=2, serdes = 0
extPhyIdentify: fport=10, phyaddr=3. id0=0x1c, id1=0xc848, type=3 ! 
rtlPhyInit: phyaddr=3 ! 
phyaddr=3, serdes = 0
extPhyIdentify: fport=11, phyaddr=4. id0=0x1c, id1=0xc848, type=3 ! 
rtlPhyInit: phyaddr=4 ! 
phyaddr=4, serdes = 0
extPhyIdentify: fport=12, phyaddr=5. id0=0xffff, id1=0xffff, type=0 ! 
extPhyIdentify: fport=13, phyaddr=6. id0=0xffff, id1=0xffff, type=0 ! 
LED Normal
Broadcom Cli Starting....

BCMCLI> Configuration File Description: '1.4.8.0'
Setting IP address to : 1.1.1.100
Setting Network Mask to : 255.255.255.0
Setting Gateway IP to : 1.1.1.1
app_user_account_cfg_load:85 Failed to parse userCfg
app_host_cfg_load:64 Failed to load TRUSTHOST configuration
app_sntp_cfg_load:98 Failed to load SNTP configuration
Failed to load Loopback Detection config from 'cfg:/config.jsn'

Loaded default config for Loopback Detection from '/json/config.jsn'

cfg_json_get:426 Invalid parameters
Starting web server on port :80
uport = 0, fport=8, flow =0 
uport = 1, fport=9, flow =0 
uport = 2, fport=10, flow =0 
uport = 3, fport=11, flow =0 
uport = 4, fport=12, flow =0 
uport = 5, fport=13, flow =0 
stop ip/arp traffic ! 
------->rand=0x5e36d9c2 , link=1
lbd=enabled, port 0 link up, wait 3 secs to forward traffic! 
port set attribute speed , port:8,speed:1000 (last_speed:0)
uport = 0, fport=8, flow =1 
found! i=0 
fport=12, data[0]=03, data[1]=04, data[3]=10, data[8]=00, data[12]=67 
found! i=0 
fport=13, data[0]=03, data[1]=04, data[3]=10, data[8]=00, data[12]=67 
lbd=enabled, port 3 link up, wait 3 secs to forward traffic! 
port set attribute speed , port:11,speed:1000 (last_speed:0)
lbd=enabled, port 4 link up, wait 3 secs to forward traffic! 
uport = 4, fport=12, flow =1 
lbd=enabled, port 5 link up, wait 3 secs to forward traffic! 
uport = 5, fport=13, flow =1 
lbd=enabled, port 0 , reach 3 secs, now forward traffic! 
lbd=enabled, port 3 , reach 3 secs, now forward traffic! 
lbd=enabled, port 4 , reach 3 secs, now forward traffic! 
lbd=enabled, port 5 , reach 3 secs, now forward traffic!

Is there a specific port you need to be connected to for the web server to work? I suspect that they made a change to the "-A" switch that blocks the web server from being accessed.

Here is the dump of my json/config.jsn file.

BCMCLI> cat /json/config.jsn
{"compCfgs":[{"sysCfg":{"cfg_descr":"1.4.8.0","dev_id":"I53162X","dev_name":"I53162X","dev_loc":"DurhamNC","dhcpv4":0,"ipv4":"192.168.1.10","subnet":"255.255.255.0","gw":"192.168.1.10","ssl":0,"l2Agetime":300,"sessTTL":5},"ECCFG":1},{"portCfg":[{"id":0,"descr":"","admin":1,"auto":1,"fdx":1,"speed":1000,"flow":1},{"id":1,"descr":"","admin":1,"auto":1,"fdx":1,"speed":1000,"flow":1},{"id":2,"descr":"","admin":1,"auto":1,"fdx":1,"speed":1000,"flow":1},{"id":3,"descr":"","admin":1,"auto":1,"fdx":1,"speed":1000,"flow":1},{"id":4,"descr":"","admin":1,"auto":1,"fdx":1,"speed":1000,"flow":1},{"id":5,"descr":"","admin":1,"auto":1,"fdx":1,"speed":1000,"flow":1}],"ECCFG":1},{"mirrorCfg":{"descr":"","destPort":255,"egressSrcPorts":"0x0","ingressSrcPorts":"0x0","egressSrcVLANs":[],"ingressSrcVLANs":[]},"ECCFG":1},{"vlanCfg":{"mode":"dot1q","dot1q":[{"vlan":1,"tag":"0x0","untag":"0x3fff"}],"portBased":[{"vlan":1,"mbr":"0x3fff"}]},"ECCFG":1},{"igmpSnoopCfg":{"global":{"admin":0,"grpMbrIntrvl":260,"rtrExpIntrvl":260,"blockUnknown":0},"vlanIntfCfg":[],"intfCfg":[]},"ECCFG":1},{"lldpCfg":{"tlvMask":"0x0000001F","intfCfg":[{"intf":0,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":1,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":2,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":3,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":4,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":5,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":6,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":7,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":8,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":9,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":10,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":11,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":12,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4},{"intf":13,"txMode":0,"rxMode":0,"reinit":2,"txIntvl":30,"txHold":4}]},"ECCFG":1},{"lagCfg":{"hash":"mac-dasa-vlan","lags":[]},"ECCFG":1},{"rstpCfg":{"bridge":{"maxAge":20,"fwdDelay":15,"priority":32768,"forceVer":2,"txHoldCount":6},"intfCfg":[{"id":0,"stpEnabled":0,"pathCost":200000,"priority":128,"adminEdge":0,"autoEdge":1,"mChk":0,"p2pMac":1},{"id":1,"stpEnabled":0,"pathCost":200000,"priority":128,"adminEdge":0,"autoEdge":1,"mChk":0,"p2pMac":1},{"id":2,"stpEnabled":0,"pathCost":200000,"priority":128,"adminEdge":0,"autoEdge":1,"mChk":0,"p2pMac":1},{"id":3,"stpEnabled":0,"pathCost":200000,"priority":128,"adminEdge":0,"autoEdge":1,"mChk":0,"p2pMac":1},{"id":4,"stpEnabled":0,"pathCost":200000,"priority":128,"adminEdge":0,"autoEdge":1,"mChk":0,"p2pMac":1},{"id":5,"stpEnabled":0,"pathCost":200000,"priority":128,"adminEdge":0,"autoEdge":1,"mChk":0,"p2pMac":1}]},"ECCFG":1},{"qosCfg":{"dot1p":[{"tc":0,"mask":"0x02"},{"tc":1,"mask":"0x01"},{"tc":2,"mask":"0x04"},{"tc":3,"mask":"0x08"},{"tc":4,"mask":"0x10"},{"tc":5,"mask":"0x20"},{"tc":6,"mask":"0x40"},{"tc":7,"mask":"0x80"}],"dscp":[{"tc":0,"mask":"0xfefebffbfbfbfbff"},{"tc":1,"mask":"0x400"},{"tc":2,"mask":"0x40000"},{"tc":3,"mask":"0x4000000"},{"tc":4,"mask":"0x400000000"},{"tc":5,"mask":"0x400000000000"},{"tc":6,"mask":"0x1000000000000"},{"tc":7,"mask":"0x100000000000000"}],"schedData":[{"port":0,"mode":1,"rrWeights":[128,128,128,128,128,128,128,128]},{"port":1,"mode":0},{"port":2,"mode":0},{"port":3,"mode":0},{"port":4,"mode":0},{"port":5,"mode":0},{"port":6,"mode":0},{"port":7,"mode":0},{"port":8,"mode":0},{"port":9,"mode":0},{"port":10,"mode":0},{"port":11,"mode":0},{"port":12,"mode":0},{"port":13,"mode":0}],"rateLimits":[]},"ECCFG":1},{"dosCfg":{"macLand":0,"ipDaEqSa":0,"tcpDpEqSp":0,"udpDpEqSp":0,"tcpNullScan":0,"tcpXmasScan":0,"tcpSynFinScan":0,"tcpSync":0,"tcpHdrFrag":0,"ipv4IcmpFrag":0,"ipv6IcmpFrag":0,"icmp4LongPing":0,"icmp6LongPing":0},"ECCFG":1},{"stormCfg":{"unicast":{"admin":0,"meas":"kbps","level":0},"multicast":{"admin":0,"meas":"kbps","level":0},"broadcast":{"admin":0,"meas":"kbps","level":0}},"ECCFG":1},{"autovoipCfg":{"well_known_ouis":[{"id":0,"oui":"00:01:E3"},{"id":1,"oui":"00:09:6E"},{"id":2,"oui":"00:03:6B"},{"id":3,"oui":"00:E0:BB"},{"id":4,"oui":"00:E0:75"},{"id":5,"oui":"00:D0:1E"},{"id":6,"oui":"00:0F:E2"},{"id":7,"oui":"00:60:B9"}],"port_oui_map":[]},"ECCFG":1}]}

I am going to connect an SOIC and download the firmware, I suspect it is slightly different.
@JaredLThompson
Copy link
Author

Here is the output from an interrupted auto boot:

BCM53158 SWITCH firmware Feb 22 2018
boot_src = M7. Initializing M7


Copyright 2015-2017 Broadcom Limited
         All rights reserved

Unit 0: ChipID: 53161 Rev 17
Unit 0: Straps: 00005041
Unit 0: PLL1 CH1 POSTDIV 13
LED Boot up -> 0s-3s
Unit 0: LED Refresh cycle config
Unit 0: LED Delay config
Unit 0: LED Strap load
Loading LED Firmware
.......
Unit 0: bootloader LED Start
Buffered Logs:
OTP_FLAGS = 0x8c


Broadcom ROBO OS Bootloader Version 2.4

Bootloader: QSPI flash Model: winbond Size: 128 Mbit

DEVFS: Initializing..
DEVFS: Device /dev/ttyS0 registered
DEVFS: Device /dev/flash0 registered
Press any key to interrupt Auto Boot
1. .Bootloader: Auto boot Interrupted, Launching Cli
Broadcom Cli Starting....

BCMCLI> help
config_get [<param>] (get all or given config)
config_set <param> <value> (set given config)
list (List all images)
getreg <register>
reboot (Reboot the system)
rz (receive a file via zmodem)
setreg <register> <value>
save (save boot config)

BCMCLI> 

BCMCLI> list
+-----------------------------------------------------------------+
| Image | Offset   | Len      |       Version                     |
+-----------------------------------------------------------------+
|  1    | 10060000 | 3092020 | SW-UT2206QG_1.00-0.07 |
|  2    | 103a0000 | 3092020 | SW-UT2206QG_1.00-0.07  |
+-----------------------------------------------------------------+

BCMCLI>

@danieltwagner
Copy link
Owner

Hi there. Looks like it is in fact

Setting IP address to : 1.1.1.100

However, later in the log you see

stop ip/arp traffic !

at which point it stops responding to all traffic. The long and short of it is that you need to be quick to make a web request. For my firmware (yours looks to be the same) it prints the stop ip line after one minute. When you interrupt the bootloader, try config_get and see what it says. I remember there being a stop_ip binary flag, if you set that (or it were to be set as factory default) then it wouldn't wait that one minute but stop listening immediately. You can then config_set it to 0 to allow it to listen for 1 minute.

@danieltwagner
Copy link
Owner

If that turns out to be the factory default for you then please feel free to submit a PR with updated documentation :)

@JaredLThompson
Copy link
Author

Here is the config_get:

BCMCLI> config_get
stop_on_wdt = 0(0x0)
wdt_timeout = 100(0x64)
countdown = 1(0x1)
reboot_after_upload = 1(0x1)
boot_image = 1(0x1)

BCMCLI>

@JaredLThompson
Copy link
Author

Looks like the same config_get as other posts I have seen. There is a very short amount of time between the starting web server, and the stop ip/arp traffic. Maybe my timing is just off, I will keep trying.

Starting web server on port :80
uport = 0, fport=8, flow =0 
uport = 1, fport=9, flow =0 
uport = 2, fport=10, flow =0 
uport = 3, fport=11, flow =0 
uport = 4, fport=12, flow =0 
uport = 5, fport=13, flow =0 
stop ip/arp traffic !

@danieltwagner
Copy link
Owner

danieltwagner commented Aug 23, 2023 •
edited
Loading

Had a quick look through old logs (no serial access right now) and they look very similar to what you have...
Ideally we'd start with a backup of your firmware before anything gets changed. a CH341a + SOIC clip should do the trick for a low cost.

Also, once you have a backup of your firmware you could try flashing my modified firmware (which would likely include config changes I had made at the time?) and see if that does the trick. Though obviously it'd be better to find out what changes one can make on the CLI without a programmer.

Try issuing a format_cfg when it has fully booted up and see if /json/config.jsn changes as a result, or if the boot sequence is slightly different. I've uploaded my initial console logs that I captured back then and you can see that initially I also had stop ip/arp traffic immediately at the start. Later, however, that prompt came later. Perhaps I inadvertently changed the config? getparam and setparam might also work but notice that in my logs I didn't use those with any success...

Edit: updated the cli.txt dump with more logs. Do a cat cfg:params.txt and see what that says?

@JaredLThompson
Copy link
Author

Here is the params.txt:

cat cfg:params.txt
mac_address:24:5E:BE:63:B3:59
serial_number:SW2104S27T2700008
stop_ip:1

Now I see the stop_ip parameter!

I am going to backup firmware (ordered the ch341_SOIC clip, will be here later today) and then flash your firmware. Thank you!

@JaredLThompson
Copy link
Author 

BCMCLI> getparam stop_ip
stop_ip => 1

BCMCLI> setparam stop_ip 0
Param stop_ip set to : 0

BCMCLI> getparam stop_ip
stop_ip => 0

After setting stop_ip to zero and rebooting, I can now access the web page. 👍🏻

@danieltwagner
Copy link
Owner

danieltwagner commented Aug 23, 2023 •
edited
Loading

Great to hear! Do you think that format_cfg had any influence on this? If so, we should probably document it...

@JaredLThompson
Copy link
Author

I didn't run format_cfg at all. Setting the stop_ip parameter is what allowed me to get into the web console. Once I set that stop_ip to 0, it behaved as you described, where I had 1 minute to call the web service. After 1 minute, it would send a "stop ip/arp traffic !" in the serial console.

@JaredLThompson
Copy link
Author

I can do a PR to update the Readme.

@danieltwagner
Copy link
Owner

Thanks for your feedback, I updated the readme to reference setting stop_ip via serial console.

@JaredLThompson
Copy link
Author

flash-qsw-2104-2s-a.bin.zip

Thank you @danieltwagner! I have uploaded my flash extract from my qsw-2104-s2-a. The md5 checksum is different than your extract, so I am uploading in case somebody else needs it.

@danieltwagner
Copy link
Owner

Mind if I add it to the repo?

@JaredLThompson
Copy link
Author

Not at all. Do you want me to do a PR?

@danieltwagner
Copy link
Owner

Sure, that way you'll show up as a contributor :)

@danieltwagner
Copy link
Owner

I added it just now

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@danieltwagner @JaredLThompson