ZTE ZXDSL 831II

ZTE ZXDSL 831 II

FCC approval date: 07 September 2010
Country of manuf.: China

Type: dsl modem

FCC ID: Q78-ZXDSL831II
US: ZTEDL05BZXDSL831

Power: 12 VDC, 0.5 A
Connector type: barrel

CPU1: Broadcom BCM6332 (240 MHz)
FLA1: 2 MiB2,097,152 B 16,384 Kib 2,048 KiB 16 Mib 0.00195 GiB  (Eon F16-100HIP)
RAM1: 8 MiB8,388,608 B 65,536 Kib 8,192 KiB 64 Mib 0.00781 GiB  (EtronTech EM638165TS-6G)

Expansion IFs: none specified
Serial: yes, internal, 4-pin header, populated, 3.3V TTL, (115200,8,N,1), XJ1

ETH chip1: Broadcom BCM6332
LAN speed: 100M
LAN ports: 1

Additional chips
DSL (ADSL2+) Line Driver;Broadcom;BCM6301;BROADCOM, 6301KSG, TD1117P1;1;
2A, 18V Synchronous Rectified Step-Down Converter;MPS;MP1482DS;;1;
DC/DC Switching Regulator;ATC;AP34063;;1;

Stock bootloader: CFE 1.0.37-10.1 BCM96338

Stock FW OS: Linux 2.6.8.1

Flags: ADSL2+

Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1304 additional devices
of which 10 are ZTE devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1324 additional devices
of which 8 are ZTE devices

Ethernet OUI: B0:75:D5

	FCC ID
ZTE ZXDSL 831CII	Q78-ZXDSL831II

	CPU1 brand	FLA1	RAM1
ZTE ZXDSL 831B	Globespan Virata	2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br />	8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
ZTE ZXDSL 831CII	TrendChip	2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br />	8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
ZTE ZXDSL 831II	Broadcom	2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br />	8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

ADSL CPE

Product page

"AZ29C V1.0" is silkscreened on at least one 831II's board.

Serial

Pinout

.. appears to be the following...

         XJ1
(RxD) (TxD) (GND) (3.3)

<--- to BCM6332

Credentials

They're the same as the HTTP admin credentials.

Username: admin
Password: admin

Info derived from

• boot log

CFE version 1.0.37-10.1 for BCM96338 (32bit,SP,BE)
Build Date: Tue Jun  1 15:21:05 CST 2010 (unive@Unive)
Copyright (C) 2000-2006 Broadcom Corporation.

Boot Address 0xbfc00000

Initializing Arena.
Initializing Devices.
serial flash device: name EN25F16, id 0x1c14, size 2048KB
Auto-negotiation timed-out
10 MB Half-Duplex (assumed)
CPU type 0x29010: 240MHz
Total memory: 8388608 bytes (8MB)

Total memory used by CFE:  0x80401000 - 0x805280C0 (1208512)
Initialized Data:          0x8041DA00 - 0x8041F8E0 (7904)
BSS Area:                  0x8041F8E0 - 0x804260C0 (26592)
Local Heap:                0x804260C0 - 0x805260C0 (1048576)
Stack Area:                0x805260C0 - 0x805280C0 (8192)
Text (code) segment:       0x80401000 - 0x8041D9F8 (117240)
Boot area (physical):      0x00529000 - 0x00569000
Relocation Factor:         I:00000000 - D:00000000

Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :
Run from flash/host (f/h)         : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Board Id (0-8)                    : 96332L-2M-8M
Number of MAC Addresses (1-32)    : 11
Base MAC Address                  : b0:75:d5:48:b9:4a
PSI Size (1-64) KBytes            : 24

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Booting from only image (0xbfc10000) ...
Code Address: 0x80001000, Entry Address: 0x801a0018
Decompression OK!
Entry at 0x801a0018
Closing network.
Starting program at 0x801a0018
Linux version 2.6.8.1 (dailybuild@sh01.wireline) 
(gcc version 3.4.2) #1 Mon Jun 21 17:21:42 CST 2010
serial flash device: name EN25F16, id 0x1c14, size 2048KB
96332L-2M-8M prom init
CPU revision is: 00029010
Determined physical RAM map:
 memory: 007a0000 @ 00000000 (usable)
On node 0 totalpages: 1952
  DMA zone: 1952 pages, LIFO batch:1
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB 2-way, linesize 16 bytes.
PID hash table entries: 32 (order 5: 256 bytes)
Using 120.000 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 5844k/7808k available 
(1446k kernel code, 1944k reserved, 209k data, 72k init, 0k highmem)
KLOB Pool 1 Initialized: 1048576 bytes <0x80600000 ... 0x80700000>
Calibrating delay loop... 239.20 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction...  unavailable.
NET: Registered protocol family 16
Total Flash size: 2048K with 512 sectors
File system address: 0xbfc10100
Can't analyze prologue code at 80169384
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v1.0
brcmboard: brcm_board_init entry
PressAndHoldReset interrupt[4] mapping succeeded!
Serial: BCM63XX driver $Revision: 1.1.1.1 $
ttyS0 at MMIO 0xfffe0300 (irq = 10) is a BCM63XX
blaadd: blaa_detect entry
adsl: adsl_init entry
Broadcom BCMPROCFS v1.0 initialized
Broadcom BCM6338A2 Ethernet Network Device v0.3 Jun 21 2010 17:20:36
Config Internal PHY Through MDIO
BCM63xx_ENET: Auto-negotiation timed-out
BCM63xx_ENET: 10 MB Half-Duplex (assumed)
eth0: MAC Address: B0:75:D5:48:B9:4A
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET: Registered protocol family 1
NET: Registered protocol family 17
Ebtables v2.0 registered
NET: Registered protocol family 8
NET: Registered protocol family 20
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 72k freed
init started:  BusyBox v1.00 (2010.06.21-09:23+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5

BusyBox v1.00 (2010.06.21-09:23+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

Loading drivers and kernel modules...

BcmAdsl_Initialize=0x800DE458, g_pFnNotifyCallback=0x80198804
AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00003981 adsl2=0x00000001
pSdramPHY=0xA07FFFF8, 0xFFFFFFFF 0xFFEFFFFF
AdslCoreHwReset: AdslOemDataAddr = 0xA07FB114
AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00003981 adsl2=0x00000001
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
app: atmctl start --pqs 125
ATM proc init !!!
app: atmctl operate vcc --add 0.8.81 aal5 1 llcencaps --addq 0.8.81 11 1
app: atmctl operate vcc --add 0.0.35 aal5 1 llcencaps --addq 0.0.35 11 1
app: atmctl operate vcc --add 0.8.35 aal5 1 llcencaps --addq 0.8.35 11 1
app: atmctl operate vcc --add 0.0.32 aal5 1 llcencaps --addq 0.0.32 11 1
app: atmctl operate vcc --add 0.0.100 aal5 1 llcencaps --addq 0.0.100 11 1
app: atmctl operate vcc --add 0.8.36 aal5 1 llcencaps --addq 0.8.36 11 1
app: atmctl operate vcc --add 0.0.33 aal5 1 llcencaps --addq 0.0.33 11 1
ip_tables: (C) 2000-2002 Netfilter core team
ip_conntrack version 2.1 (61 buckets, 0 max) - 376 bytes per conntrack
ip_conntrack_pptp version 2.1 loaded
ip_nat_pptp version 2.0 loaded
ip_ct_h323: init success
ip_nat_h323: init success
ip_conntrack_ipsec: module license 'Proprietary' taints kernel.
ip_conntrack_rtsp v0.01 loading
ip_nat_rtsp v0.01 loading

==>   Bcm963xx Software Version: ZXDSL 831IIV7.5.5a_Z29_OV   <==

app: brctl addbr br0
app: brctl stp br0 off
app: brctl setfd br0 0
app: ifconfig eth0 up
app: ifconfig br0 192.168.1.1 netmask 255.255.255.0 broadcast 192.168.1.255 up; 
brctl addif br0 eth0; ifconfig eth0 0.0.0.0 
device eth0 entered promiscuous mode
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
app: sendarp -s br0 -d br0
app: sendarp -s br0 -d eth0
BcmRfc2684_init interface is not up nas_0_8_81!
pvc2684ctl -a -v 0.8.81 &
app: pvc2684ctl -a -v 0.8.81 &
pvc2684d: Interface "nas_0_8_81" created sucessfully
pvc2684d: Communicating over ATM 0.8.81, encapsulation: LLC

app: ifconfig nas_0_8_81 hw ether b0:75:d5:48:b9:4b
app: ifconfig nas_0_8_81 up
app: brctl addif br0 nas_0_8_81
device nas_0_8_81 entered promiscuous mode
br0: port 2(nas_0_8_81) entering learning state
br0: topology change detected, propagating
br0: port 2(nas_0_8_81) entering forwarding state
app: sendarp -s br0 -d br0
BcmRfc2684_init interface is not up nas_0_0_35!
pvc2684ctl -a -v 0.0.35 &
app: pvc2684ctl -a -v 0.0.35 &
pvc2684d: Interface "nas_0_0_35" created sucessfully
pvc2684d: Communicating over ATM 0.0.35, encapsulation: LLC

app: ifconfig nas_0_0_35 hw ether b0:75:d5:48:b9:4c
app: ifconfig nas_0_0_35 up
app: brctl addif br0 nas_0_0_35
device nas_0_0_35 entered promiscuous mode
br0: port 3(nas_0_0_35) entering learning state
br0: topology change detected, propagating
br0: port 3(nas_0_0_35) entering forwarding state
app: sendarp -s br0 -d br0
BcmRfc2684_init interface is not up nas_0_8_35!
pvc2684ctl -a -v 0.8.35 &
app: pvc2684ctl -a -v 0.8.35 &
pvc2684d: Interface "nas_0_8_35" created sucessfully
pvc2684d: Communicating over ATM 0.8.35, encapsulation: LLC

app: ifconfig nas_0_8_35 hw ether b0:75:d5:48:b9:4d
app: ifconfig nas_0_8_35 up
app: brctl addif br0 nas_0_8_35
device nas_0_8_35 entered promiscuous mode
br0: port 4(nas_0_8_35) entering learning state
br0: topology change detected, propagating
br0: port 4(nas_0_8_35) entering forwarding state
app: sendarp -s br0 -d br0
BcmRfc2684_init interface is not up nas_0_0_32!
pvc2684ctl -a -v 0.0.32 &
app: pvc2684ctl -a -v 0.0.32 &
pvc2684d: Interface "nas_0_0_32" created sucessfully
pvc2684d: Communicating over ATM 0.0.32, encapsulation: LLC

app: ifconfig nas_0_0_32 hw ether b0:75:d5:48:b9:4e
app: ifconfig nas_0_0_32 up
app: brctl addif br0 nas_0_0_32
device nas_0_0_32 entered promiscuous mode
br0: port 5(nas_0_0_32) entering learning state
br0: topology change detected, propagating
br0: port 5(nas_0_0_32) entering forwarding state
app: sendarp -s br0 -d br0
BcmRfc2684_init interface is not up nas_0_0_100!
pvc2684ctl -a -v 0.0.100 &
app: pvc2684ctl -a -v 0.0.100 &
pvc2684d: Interface "nas_0_0_100" created sucessfully
pvc2684d: Communicating over ATM 0.0.100, encapsulation: LLC

app: ifconfig nas_0_0_100 hw ether b0:75:d5:48:b9:4f
app: ifconfig nas_0_0_100 up
app: brctl addif br0 nas_0_0_100
device nas_0_0_100 entered promiscuous mode
br0: port 6(nas_0_0_100) entering learning state
br0: topology change detected, propagating
br0: port 6(nas_0_0_100) entering forwarding state
app: sendarp -s br0 -d br0
BcmRfc2684_init interface is not up nas_0_8_36!
pvc2684ctl -a -v 0.8.36 &
app: pvc2684ctl -a -v 0.8.36 &
pvc2684d: Interface "nas_0_8_36" created sucessfully
pvc2684d: Communicating over ATM 0.8.36, encapsulation: LLC

app: ifconfig nas_0_8_36 hw ether b0:75:d5:48:b9:50
app: ifconfig nas_0_8_36 up
app: brctl addif br0 nas_0_8_36
device nas_0_8_36 entered promiscuous mode
br0: port 7(nas_0_8_36) entering learning state
br0: topology change detected, propagating
br0: port 7(nas_0_8_36) entering forwarding state
app: sendarp -s br0 -d br0
BcmRfc2684_init interface is not up nas_0_0_33!
pvc2684ctl -a -v 0.0.33 &
app: pvc2684ctl -a -v 0.0.33 &
pvc2684d: Interface "nas_0_0_33" created sucessfully
pvc2684d: Communicating over ATM 0.0.33, encapsulation: LLC

app: ifconfig nas_0_0_33 hw ether b0:75:d5:48:b9:51
app: ifconfig nas_0_0_33 up
app: brctl addif br0 nas_0_0_33
device nas_0_0_33 entered promiscuous mode
br0: port 8(nas_0_0_33) entering learning state
br0: topology change detected, propagating
br0: port 8(nas_0_0_33) entering forwarding state
app: sendarp -s br0 -d br0

****** cfm init end! ******
br0: port 1(eth0) entering disabled state

cat /proc/cpuinfo

> cat /proc/cpuinfo
system type             : 96332L-2M-8M
processor               : 0
cpu model               : BCM6338 V1.0
BogoMIPS                : 239.20
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : no
unaligned access                : 11
VCED exceptions         : not available
VCEI exceptions         : not available

ps aux

> ps aux
  PID  Uid     VmSize Stat Command
    1 admin       216 S   init
    2 admin           SWN [ksoftirqd/0]
    3 admin           SW< [events/0]
    4 admin           SW< [khelper]
    5 admin           SW< [kblockd/0]
    6 admin           SW  [pdflush]
    7 admin           SW  [pdflush]
    8 admin           SW  [kswapd0]
    9 admin           SW< [aio/0]
   10 admin           SW  [mtdblockd]
   17 admin       292 S   -sh
   41 admin       972 S   cfm
  211 admin       196 S   pvc2684d
  422 admin      1108 S   httpd
  473 admin      1024 S   consoled
  478 admin       264 S   sh -c ps aux
  479 admin       252 R   ps aux

cat /proc/meminfo

> cat /proc/meminfo
MemTotal:         5936 kB
MemFree:           332 kB
Buffers:           408 kB
Cached:           2156 kB
SwapCached:          0 kB
Active:           1580 kB
Inactive:         1476 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:         5936 kB
LowFree:           332 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               0 kB
Writeback:           0 kB
Mapped:           1600 kB
Slab:              548 kB
Committed_AS:     1884 kB
PageTables:        140 kB
VmallocTotal:  1048560 kB
VmallocUsed:       588 kB
VmallocChunk:  1047968 kB

cat /proc/mtd

> cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00144000 00004000 "Physically mapped flash"