F@ST3864OP is a xDSL modem with four 1Gbps LAN ports, 2.4g+5g Wifi and FXS. It can also work as a normal router which connects to the internet via a 1Gbps WAN port. In Australia, this modem was provided by Optus as an NBN modem.
WAN-LAN traffic overloads the CPU, as the hardware NAT offloading is not supported yet. WAN-LAN speed is around 144Mbps.
CPU | Ram | Flash | Network | WLAN | USB | Serial | JTag |
---|---|---|---|---|---|---|---|
BCM63168D0, Dual-Core @400MHz | 128 MiB | 128 MiB NAND | 4x 1G LAN, 1x 1G WAN | bgn | 2 x 2.0 | Yes | ? |
W.I.P.
lspci
shows no device attached but the root PCIEe bridge. There should be some PCIe device attached by looking at the stock boot log.192.168.1.100
, 255.255.255.0
, and 192.168.1.1
, respectively.openwrt-bmips-bcm63268-sagem_fast-3864op-initramfs.elf
OpenWrt image.openwrt-bmips-bcm63268-sagem_fast-3864op-initramfs.elf
to boot an OpenWrt instance in RAM.Use this command to safely browse the stock firmware files:
mount -t jffs2 -o ro /dev/mtdblock1 /mnt/mtd1/
Flashing via CFE's 192.168.1.1 has not been tested and could brick your device!!!
Any help or information on this are welcomed.
Using LuCI sysupgrade to install on a fresh OEM device bricks it, use the following steps to install or recover.
This section explains a safer way of installing OpenWrt to a F@ST3864OP device. This method does not touch the CFE bootloader, and it is less likely to brick the router.
python3 -m http.server
) on your PC that serves the OpenWrt firmware openwrt-bmips-bcm63268-sagem_fast-3864op-squashfs-cfe.bin
./tmp
: cd /tmp && wget http://192.168.1.100:8000/openwrt-bmips-bcm63268-sagem_fast-3864op-squashfs-cfe.bin
flash_erase -j /dev/mtd6 0 982
, where /dev/mtd6
is the 'wfi' partition. You can find out which mtd is the wfi partition by using command cat /proc/mtd
. After this step, the stock firmware is gone.nandwrite -p /dev/mtd6 /tmp/openwrt-bmips-bcm63268-sagem_fast-3864op-squashfs-cfe.bin
Reference: hg253s_v2
Architecture | BMIPS |
---|---|
Vendor | Sagemcom |
Bootloader | CFE |
System-On-Chip | BCM63168D0 |
CPU/Speed | Core 400MHz, DDR: 400MHz, Bus: 200MHz |
Flash-Chip | W29N01HVSINA, TSOP1 package |
Flash size | 128MiB, blocksize: 64 pages, page size: 2048 bytes + 64-byte OOB data. |
RAM | NT5CC64M16GP-DI, DDR3 128MiB |
Wireless | built-in? Need more investigation |
Ethernet | 1x WAN, 4x LAN, all support 10/100/1000 |
Switch | SOC built-in switch + external BCM53124SKMMLG |
USB | 2x USB 2.0, one front, one rear |
Serial | Yes, unpopulated headers, 115200-8N1, 3.3V |
JTAG | ??? |
Other ICs on the board:
CPU Pinout: bcm63168_pinout
This router has 2 switches! The BCM63168D0 SOC has 8 internet interfaces, 3xFE, 1xGE, and 4xRGMII, all from a built-in switch. In this router, the GE port (id=3) is used for WAN RJ45 connection, and the first RGMII (id=4) goes to an external switch (BCM53125?) which then powers all accessible LAN ports. Why didn't they just simply connect 4 PHYs at the RGMIIs to make 4xGE LAN ports?
Note:
→ port.serial general information about the serial port, serial port cable, etc.
There is an unsoldered 4-pin header (J708) near the power jack, which provides an interactive console. You can interrupt the boot process and enter the CFE bootloader console by pressing any key repeatedly, or wait for it boots and then login to the management console using the following credentials:
Credential of an Australian Optus OEM F@ST3864OP | |
---|---|
user | admin |
password | 0ptU%1M5 |
If the above does not work, then try the other keys:
https://github.com/mattimustang/optus-sagemcom-fast-3864-hacks
The management console offers a very limited set of commands, the sh command will drop you to a BusyBox Linux shell.
Serial parameters for Sagem F@ST3864OP | |
---|---|
Baudrate | 115200 |
Setup | 8N1 |
Voltage | 3.3V TTL |
There are three types of LEDs on this device:
LED and Button connections:
Stock firmware dump: https://github.com/rikka0w0/fast3864op-hacks
From OEM Bootlog:
Creating 6 MTD partitions on "brcmnand.0": 0x000000020000-0x000003d80000 : "rootfs" 0x000003d80000-0x000007ae0000 : "rootfs_update" 0x000007b00000-0x000007f00000 : "data" 0x000000000000-0x000000020000 : "nvram" 0x000000020000-0x000003d80000 : "image" 0x000003d80000-0x000007ae0000 : "image_update"
F@ST3864OP Flash Layout | ||||||
---|---|---|---|---|---|---|
Hardware | 128MiB NAND W29N01HVSINA | |||||
Stock Label | nvram | rootfs jffs2 filesystem | rootfs_update empty jffs2 | hidden1 | data jffs2 filesystem | hidden2 |
Stock mtd device name | mtd3 | mtd0 (mtd4) | mtd1 (mtd5) | - | mtd2 | - |
Start | 0x0000000 | 0x0020000 | 0x3D80000 | 0x7AE0000 | 0x7B00000 | 0x7F00000 |
Size | 0x0020000 | 0x3D60000 | 0x3D60000 | 0x0020000 | 0x0400000 | 0x0100000 |
0x0520000 | ||||||
End | 0x0020000 | 0x3D80000 | 0x7AE0000 | 0x7B00000 | 0x7F00000 | 0x8000000 |
OpenWrt Layer1 | mtd0 cferom_nvram | mtd1 stock_rootfs | mtd2 stock_rootfs_update | mtd3 stock_hidden1 | mtd4 stock_data | mtd5 stock_hidden2 |
OpenWrt Layer2 | mtd6 wfi | |||||
Filesystem | CFE Bootloader | wfi-split, OpenWrt firmware, contains part of the CFE bootloader, kernel, and rootfs. | ? | JFFS2 | ? |
7 fixed-partitions partitions found on MTD device brcmnand.0 Creating 7 MTD partitions on "brcmnand.0": 0x000000000000-0x000000020000 : "cferom_nvram" 0x000000020000-0x000003d80000 : "stock_rootfs" 0x000003d80000-0x000007ae0000 : "stock_rootfs_update" 0x000007ae0000-0x000007b00000 : "stock_hidden1" 0x000007b00000-0x000007f00000 : "stock_data" 0x000007f00000-0x000008000000 : "stock_hidden2" 0x000000020000-0x000007ae0000 : "wfi" cferam: bootflag1=0 5 bcm-wfi-split-fw partitions found on MTD device wfi Creating 5 MTD partitions on "wfi": 0x000000000000-0x000000040000 : "cferam" 0x000000040000-0x000003d60000 : "firmware" 0x000000040000-0x000000540000 : "kernel" 0x000000540000-0x000003d60000 : "ubi" 0x000003d60000-0x000007ac0000 : "img2"
Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, screws, ...
This may apply: ad1018
There's an unsoldered SPI Flash (SOIC16) on the bottom of the board that connects to HSSPI.CS0
. It is known that a SOIC8 Winbond “W25Q64” soldered with jumper wires works with spidev
driver. Custom firmware compilation is required with the following appended to the dts:
&hsspi { status = "okay"; mydev@0{ compatible = "rohm,dh2228fv"; reg = <0>; spi-max-frequency = <781000>; }; };
To use the spidev
driver in the latest kernel (6.6 as of Sep 19, 2024), one has to use a specific device name (“rohm,dh2228fv” in this case), the old “linux, spidev” no longer works. Not sure if it is a kernel bug or not.
The SPI Flash can be accessed with flashrom-spi
and spi-tools
(available in the OpenWRT opkg repo):
root@OpenWrt:/# flashrom-spi -p linux_spi:dev=/dev/spidev1.0 flashrom v1.2 on Linux 5.4.188 (mips) flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Using default 2000kHz clock. Use 'spispeed' parameter to override. Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) on linux_spi. No operations were specified. root@OpenWrt:/# echo -n -e \\x9F\\xFF\\xFF\\xFF | spi-pipe -d /dev/spidev1.0 -b4 -n1 | hexdump -C 00000000 ff ef 40 17 |..@.| 00000004
It is believed that the SOC has PCI or PCIE buses and devices attached. The following came from the shell of the stock firmware:
# cd /sys/bus/pci # ls devices/ -al drwxr-xr-x 2 admin root 0 Jul 10 04:02 . drwxr-xr-x 5 admin root 0 Jul 10 04:00 .. lrwxrwxrwx 1 admin root 0 Jul 10 04:02 0000:00:00.0 -> ../../../devices/pci0000:00/0000:00:00.0 lrwxrwxrwx 1 admin root 0 Jul 10 04:02 0000:00:09.0 -> ../../../devices/pci0000:00/0000:00:09.0 lrwxrwxrwx 1 admin root 0 Jul 10 04:02 0000:00:0a.0 -> ../../../devices/pci0000:00/0000:00:0a.0 lrwxrwxrwx 1 admin root 0 Jul 10 04:02 0000:01:00.0 -> ../../../devices/pci0000:01/0000:01:00.0 # ls drivers -al drwxr-xr-x 6 admin root 0 Jul 10 04:02 . drwxr-xr-x 5 admin root 0 Jul 10 04:00 .. drwxr-xr-x 2 admin root 0 Jul 10 04:03 ehci_hcd drwxr-xr-x 2 admin root 0 Jul 10 04:03 ohci_hcd drwxr-xr-x 2 admin root 0 Jul 10 04:03 pcieport drwxr-xr-x 2 admin root 0 Jul 10 04:03 wl # cd /sys/devices/ # ls pci0000:00 pci0000:01 platform system virtual # cd /sys/module # ls 8021q l2tp_core pwrmngtd adsldd l2tp_ppp qcserial bcm_bpm nciTMSkmod rcutree bcm_enet nf_conntrack sch_htb bcm_ingqos nf_conntrack_ftp scsi_mod bcmarl nf_conntrack_h323 spurious bcmfap nf_conntrack_ipv4 tcp_cubic bcmvlan nf_conntrack_irc ubi bcmxtmcfg nf_conntrack_pptp ubifs block nf_conntrack_proto_gre usb_storage bridge nf_conntrack_rtsp usb_wwan chipinfo nf_conntrack_tftp usbcore dect nf_defrag_ipv4 usblp dectshim nf_nat usbserial ehci_hcd nf_nat_ftp wl endpointdd nf_nat_h323 xt_DSCP fuse nf_nat_irc xt_LOG ip6_tables nf_nat_pptp xt_SKIPLOG ip6table_mangle nf_nat_proto_gre xt_TCPMSS ip_gre nf_nat_rtsp xt_conntrack ip_tables nf_nat_tftp xt_dscp ipt_MASQUERADE nfnetlink xt_limit ipt_REDIRECT nfnetlink_queue xt_mac iptable_filter option xt_mark iptable_mangle p8021ag xt_multiport iptable_nat pcie_aspm xt_state ipv6 pcmshim xz_dec ipw pktflow kernel printk # cat /proc/iomem 00000000-07ecdfff : System RAM 00010000-003f111f : Kernel code 003f1120-004e897f : Kernel data 10000200-10000383 : brcmnand 10002500-100025ff : ehci_hcd 10002600-100026ff : ohci_hcd 11000000-11efffff : bcm63xx pcie memory space a0f00000-a0ffffff : bcm63xx pci memory space # cat /proc/ioports a2000000-a200ffff : bcm63xx pci IO space
The following came from the lspci
command on a OpenWRT port (old target bcm63xx):
root@OpenWrt:/sys/class/gpio# lspci -v 00:00.0 PCI bridge: Broadcom Inc. and subsidiaries Device 6326 (rev 80) (prog-if 00 [Normal decode]) Flags: fast devsel, IRQ 48 Bus: primary=00, secondary=01, subordinate=01, sec-latency=0 I/O behind bridge: 00000000-00000fff [size=4K] Memory behind bridge: [disabled] Prefetchable memory behind bridge: [disabled] Capabilities: [48] Power Management version 3 Capabilities: [ac] Express Root Port (Slot-), MSI 00 Capabilities: [100] Advanced Error Reporting Kernel driver in use: pcieport lspci: Unable to load libkmod resources: error -12 root@OpenWrt:/sys/bus/pci# ls devices/ -al drwxr-xr-x 2 root root 0 Jan 1 1970 . drwxr-xr-x 5 root root 0 Jan 1 1970 .. lrwxrwxrwx 1 root root 0 Jan 1 1970 0000:00:00.0 -> ../../../devices/pci0000:00/0000:00:00.0 root@OpenWrt:/sys/bus/pci# ls drivers/ -al drwxr-xr-x 6 root root 0 Jul 11 10:51 . drwxr-xr-x 5 root root 0 Jan 1 1970 .. drwxr-xr-x 2 root root 0 Jul 11 10:52 b43-pci-bridge drwxr-xr-x 2 root root 0 Jul 11 10:52 bcma-pci-bridge drwxr-xr-x 2 root root 0 Jul 11 10:52 brcmfmac drwxr-xr-x 2 root root 0 Jul 11 10:52 pcieport root@OpenWrt:/# cat /proc/iomem 00000000-07ffffff : System RAM 00010000-006327f3 : Kernel code 006327f4-00731c3f : Kernel data 01610000-01644757 : Kernel bss 100000b0-100000bf : 10000200.nand nand-int-base 100000c0-100000c7 : 100000c0.pin-controller dirout 100000c8-100000cf : 100000c0.pin-controller dat 100000d0-100000d3 : 100000c0.pin-controller led 100000d8-100000db : 100000c0.pin-controller mode 100000dc-100000df : 100000c0.pin-controller ctrl 100000f8-100000fb : 100000c0.pin-controller basemode 10000180-10000197 : 10000180.serial serial@10000180 10000200-1000037f : 10000200.nand nand 10000600-100007ff : 10000200.nand nand-cache 10000800-10000f0b : 10000800.spi spi@10000800 10001000-100015ff : 10001000.spi spi@10001000 10001900-10001923 : 10001900.led-controller led-controller@10001900 11000000-11efffff : bcm63xx PCIe memory space b000009c-b00000a7 : bcm63xx-wdt b0002500-b00025ff : ehci-platform b0002500-b00025ff : ehci-platform ehci-platform b0002600-b00026ff : ohci-platform b0002600-b00026ff : ohci-platform ohci-platform b000d800-b000d8ff : bcm63xx_enet_shared.0 b000d800-b000d8ff : bcm63xx_enet_shared.0 bcm63xx_enet_shared.0 b000da00-b000dbff : bcm63xx_enet_shared.0 b000da00-b000dbff : bcm63xx_enet_shared.0 bcm63xx_enet_shared.0 b000dc00-b000ddff : bcm63xx_enet_shared.0 b000dc00-b000ddff : bcm63xx_enet_shared.0 bcm63xx_enet_shared.0 b0700000-b070ffff : bcm63xx_enetsw.0
Base: 4.14_04 CFE version 8.353.1 for BCM963268 (32bit,SP,BE) Build Date: Sat Jul 23 18:46:20 CST 2016 (cookiechen@SZ01007.DONGGUAN.CN) Copyright (C) 2005-2011 SAGEM Corporation. Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz Main Thread: TP0 Memory Test Passed Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 NAND flash device: , id 0xeff1 block 128KB size 131072KB External switch id = 53125 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host/tftp (f/h/c) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Boot image (0=latest, 1=previous) : 0 Default host ramdisk file name : Default ramdisk store address : Board Id (0-38) : F@ST3864V2 Number of MAC Addresses (1-32) : 11 Base MAC Address : d8:d7:75:13:03:72 PSI Size (1-64) KBytes : 40 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 0 Main Thread Number [0|1] : 0 GPON Serial Number : "BRCM12345678" GPON Password : " " Voice Board Configuration (0-0) : SI32261 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 Booting from latest image (0xb8020000) ... Decompression OK! Entry at 0x803e3840 Closing network. Disabling Switch ports. Flushing Receive Buffers... 0 buffers found Closing DMA Channels Starting program at 0x803e3840 Linux version 3.4.11-rt19 (cookiechen@SZ01007.DONGGUAN.CN) (gcc version 4.6.2 (Buildroot 2011.11) ) #1 SMP PREEMPT Sat Jul 23 18:52:40 CST 2016 F@ST3864V2 prom init CPU revision is: 0002a080 (Broadcom BMIPS4350) DSL SDRAM reserved: 0x132000 Determined physical RAM map: memory: 07ece000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00007ece Movable zone start PFN for each node Early memory PFN ranges 0: 0x00000000 -> 0x00007ece On node 0 totalpages: 32462 free_area_init_node: node 0, pgdat 804e7f80, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 222 pages used for memmap Normal zone: 28144 pages, LIFO batch:7 PERCPU: Embedded 7 pages/cpu @81103000 s5088 r8192 d15392 u32768 pcpu-alloc: s5088 r8192 d15392 u32768 alloc=8*4096 pcpu-alloc: [0] 0 [0] 1 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32208 Kernel command line: ro noinitrd irqaffinity=0 PID hash table entries: 512 (order: -1, 2048 bytes) Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Memory: 123180k/129848k available (3972k kernel code, 6668k reserved, 990k data, 216k init, 0k highmem) Preemptible hierarchical RCU implementation. NR_IRQS:128 console [ttyS0] enabled Allocating memory for DSP module core and initialization code Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0 Calibrating delay loop... 397.31 BogoMIPS (lpj=198656) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 --Kernel Config-- SMP=1 PREEMPT=1 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 Broadcom Logger v0.1 Jul 23 2016 18:47:19 CPU revision is: 0002a080 (Broadcom BMIPS4350) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Brought up 2 CPUs NET: Registered protocol family 16 Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (0000821f-00008226=-7<300) registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb PCI host bridge to bus 0000:00 pci_bus 0000:00: root bus resource [mem 0xa0f00000-0xa0ffffff] pci_bus 0000:00: root bus resource [io 0xa2000000-0xa200ffff] pci 0000:00:00.0: [14e4:435f] type 00 class 0x028000 pci 0000:00:00.0: reg 10: [mem 0x10004000-0x10005fff] pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310 pci 0000:00:09.0: reg 10: [mem 0x10002600-0x100026ff] pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320 pci 0000:00:0a.0: reg 10: [mem 0x10002500-0x100025ff] PCI host bridge to bus 0000:01 pci_bus 0000:01: root bus resource [mem 0x11000000-0x11efffff] pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0] pci 0000:01:00.0: [14e4:6326] type 01 class 0x060400 pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:01:00.0: PCI bridge to [bus 02-02] bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated bcmleg_spi bcmleg_spi.0: master is unqueued, this is deprecated skbFreeTask created successfully BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 Jul 23 2016 18:52:25 initialized Broadcom GBPM v0.1 Jul 23 2016 18:52:25 initialized NET: Registered protocol family 8 NET: Registered protocol family 20 Switching to clocksource MIPS NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 3, 32768 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP: reno registered UDP hash table entries: 128 (order: 0, 4096 bytes) UDP-Lite hash table entries: 128 (order: 0, 4096 bytes) NET: Registered protocol family 1 PCI: CLS mismatch (64 != 16), using 16 bytes bcm_tstamp initialized, (hpt_freq=200000000 2us_div=200 2ns_mult=5 2ns_shift=0) squashfs: version 4.0 (2009/01/31) Phillip Lougher jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. fuse init (API version 7.18) msgmni has been set to 240 io scheduler noop registered (default) Broadcom NAND controller (BrcmNand Controller) mtd->oobsize=0, mtd->eccOobSize=0 NAND_CS_NAND_XOR=00000000 B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0 brcmnand_read_id: CS0: dev_id=eff10095 After: NandSelect=40000001, nandConfig=15142200 DevId eff10095 may not be supported. Will use config info Spare Area Size = 16B/512B Block size=00020000, erase shift=17 NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11 busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff timing1 not adjusted: 6574845b timing2 not adjusted: 00001e96 ECC level changed to 15 OOB size changed to 16 BrcmNAND mfg 0 0 UNSUPPORTED NAND CHIP 128MB on CS0 Found NAND on CS0: ACC=f7ff1010, cfg=15142200, flashId=eff10095, tim1=6574845b, tim2=00001e96 BrcmNAND version = 0x0400 128MB @00000000 brcmnand_scan: B4 nand_select = 40000001 brcmnand_scan: After nand_select = 40000001 page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17 Brcm NAND controller version = 4.0 NAND flash size 128MB @18000000 ECC layout=brcmnand_oob_bch4_4k brcmnand_scan: mtd->oobsize=64 brcmnand_scan: oobavail=50, eccsize=512, writesize=2048 brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=15, eccbytes=3 -->brcmnand_default_bbt brcmnand_default_bbt: bbt_td = bbt_main_descr Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0 Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0 brcmnandCET: Status -> Deferred Creating 6 MTD partitions on "brcmnand.0": 0x000000020000-0x000003d80000 : "rootfs" 0x000003d80000-0x000007ae0000 : "rootfs_update" 0x000007b00000-0x000007f00000 : "data" 0x000000000000-0x000000020000 : "nvram" 0x000000020000-0x000003d80000 : "image" 0x000003d80000-0x000007ae0000 : "image_update" PPP generic driver version 2.4.2 PPP BSD Compression module registered PPP Deflate Compression module registered NET: Registered protocol family 24 usbcore: registered new interface driver cdc_ether usbcore: registered new interface driver cdc_ncm ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) ehci_hcd 0000:00:0a.0: setting latency timer to 64 ehci_hcd 0000:00:0a.0: EHCI Host Controller ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1 ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500 ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00 hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected generic_probe wake up Monitor!! message received before monitor task is initialized kerSysSendtoMonitorTask ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver PCI: Enabling device 0000:00:09.0 (0000 -> 0002) ohci_hcd 0000:00:09.0: setting latency timer to 64 ohci_hcd 0000:00:09.0: OHCI Host Controller ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2 ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600 hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected generic_probe wake up Monitor!! message received before monitor task is initialized kerSysSendtoMonitorTask usbcore: registered new interface driver usblp usbcore: registered new interface driver usbserial usbcore: registered new interface driver usbserial_generic USB Serial support registered for generic usbserial: USB Serial Driver core usbcore: registered new interface driver ipwtty USB Serial support registered for IPWireless converter usbcore: registered new interface driver option USB Serial support registered for GSM modem (1-port) usbcore: registered new interface driver qcserial USB Serial support registered for Qualcomm USB modem brcmboard: brcm_board_init entry SES: Button Interrupt 0x1 is enabled SES: LED GPIO 0xc000 is enabled Enable wifi on/off irq 0x2 success Serial: BCM63XX driver $Revision: 3.00 $ Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported commands) ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX Total # RxBds=1448 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized bcmPktDma_init: Broadcom Packet DMA Library initialized bcmxtmrt: Broadcom BCM3168D0 ATM/PTM Network Device v0.5 Jul 23 2016 18:52:02 IPSEC SPU: SUCCEEDED GACT probability NOT on Mirror/redirect action on u32 classifier input device check on Actions configured gre: GRE over IPv4 demultiplexor driver TCP: cubic registered Initializing XFRM netlink socket NET: Registered protocol family 10 IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 NET: Registered protocol family 15 Initializing MCPD Module Ebtables v2.0 registered ebt_time registered ebt_ftos registered ebt_wmm_mark registered L2TP core driver, V2.0 PPPoL2TP kernel driver, V2.0 8021q: 802.1Q VLAN Support v1.8 VFS: Mounted root (jffs2 filesystem) readonly on device 31:0. Freeing unused kernel memory: 216k freed init started: BusyBox v1.17.2 (2016-07-23 18:57:58 CST) starting pid 271, tty '': '/bin/sh -l -c "bcm_boot_launcher start"' mount: mounting none on /proc/bus/usb failed: No such file or directory ip_gre: GRE over IPv4 tunneling driver Mounting filesystems... jffs2: Empty flash at 0x00026898 ends at 0x00027000 jffs2: Empty flash at 0x000346f8 ends at 0x00034800 Configuring system... Loading drivers and kernel modules... chipinfo: module license 'proprietary' taints kernel. Disabling lock debugging due to kernel taint brcmchipinfo: brcm_chipinfo_init entry Broadcom Ingress QoS Module Char Driver v0.1 Jul 23 2016 18:48:36 Registered<243> Broadcom Ingress QoS ver 0.1 initialized BPM: tot_mem_size=134217728B (128MB), buf_mem_size <15%> =20132655B (19MB), num of buffers=9986, buf size=2016 Broadcom BPM Module Char Driver v0.1 Jul 23 2016 18:47:37 Registered<244> NBUFF v1.0 Initialized Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 Jul 23 2016 18:48:38 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. [FHW] pktDbgLvl[0xc0100390]=0 [FHW] fhw_construct: Initialized Fcache HW accelerator layer state flwStatsThread created Constructed Broadcom Packet Flow Cache v2.2 Jul 23 2016 18:48:38 chipId 0x631680D0 Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jul 23 2016 18:48:06 Registered <241> Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done FAP Debug values at 0xa5e217a0 0xa5ea17a0 fapGso_LoopBkThread created successfully Allocated FAP0 SWQ_HOST2FAP_GSO_LOOPBACK_Q mem=a5c64000 : 16384 bytes Allocated FAP0 SWQ_FAP2HOST_GSO_LOOPBACK_Q mem=a5dc4000 : 16384 bytes GSO LOOPBACK Cached HOST2FAP Q INFO: Swq =b0825ee0 qStart=a5c64000 qEnd=a5c68000 msgSize=4 dqm=18 fapId=0 GSO LOOPBACK Cached FAP2HOST Q INFO: Swq =b0825ec0 qStart=a5dc4000 qEnd=a5dc8000 msgSize=2 dqm=19 fapId=0 Allocated FAP0 TM SDRAM Queue Storage (a5e32830) : 390144 bytes @ a5f00000 Allocated FAP1 TM SDRAM Queue Storage (a5eb2830) : 390144 bytes @ a5f80000 [NTC fapProto] fapReset : Reset FAP Protocol layer [FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><4280>, free <2376>, total<8192> [FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><4280>, free <2376>, total<8192> [FAP0] PSM : addr<0x80002000>, used <24320>, free <256>, total <24576> [FAP1] PSM : addr<0x80002000>, used <24320>, free <256>, total <24576> [FAP0] DQM : availableMemory 14660 bytes, nextByteAddress 0xE000489C [FAP1] DQM : availableMemory 14660 bytes, nextByteAddress 0xE000489C [FAP0] Initializing FAP4KE GSO LOOPBACK on fapIdx=0 ... [FAP0] SWQ: HOST2FAP_GSO_LOOPBACK [FAP0] >>>>------------------ [FAP0] swq =80007ee0 msgSize =4 words , maxDepth=1024 [FAP0] qStart =a5c64000 qEnd=a5c68000 [FAP0] rdPtr =a5c64000 wrPtr=a5c64000 count=0 [FAP0] processed =0 dropped =0 [FAP0] Associated DQM=18 dir HOST2FAP [FAP0] ------------------<<<< [FAP0] SWQ: FAP2HOST_GSO_LOOPBACK [FAP0] >>>>------------------ [FAP0] swq =80007ec0 msgSize =2 words , maxDepth=2048 [FAP0] qStart =a5dc4000 qEnd=a5dc8000 [FAP0] rdPtr =a5dc4000 wrPtr=a5dc4000 count=0 [FAP0] processed =0 dropped =0 [FAP0] Associated DQM=19 dir FAP2HOST [FAP0] ------------------<<<< [FAP0] FAP4KE GSO LOOPBACK Init Done... [FAP1] FAP BPM Initialized. [FAP0] FAP BPM Initialized. Broadcom Packet Flow Cache HW acceleration enabled. fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes bcmPktDma_bind: FAP Driver binding successfull [FAP0] FAP TM: ON [FAP1] FAP TM: ON bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCM63168D0 Ethernet Network Device v0.1 Jul 23 2016 18:51:43 Broadcom GMAC Char Driver v0.1 Jul 23 2016 18:51:57 Registered<249> Broadcom GMAC Driver v0.1 Jul 23 2016 18:51:57 Initialized fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000 ETH Init: Ch:0 - 200 tx BDs at 0xb0a20650 fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000 ETH Init: Ch:1 - 200 tx BDs at 0xb0820650 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184 ETH Init: Ch:0 - 600 rx BDs at 0xb0821910 [FAP0] enetRxChannel 0 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184 ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910 [FAP1] enetRxChannel 1 dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered eth0: MAC Address: D8:D7:75:13:03:72 eth1: MAC Address: D8:D7:75:13:03:72 eth2: MAC Address: D8:D7:75:13:03:72 eth3: MAC Address: D8:D7:75:13:03:72 eth4: MAC Address: D8:D7:75:13:03:72 NComm TMS V6.80 Kernel Module loaded. [NTC arl] arlEnable : Enabled ARL binding to FAP Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 Jul 23 2016 18:47:36 Registered <245> Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. --SMP support wl: dsl_tx_pkt_flush_len=338 wl: norm_wmark_tot=3552, pktc_wmark_tot=2048 Initializing WLCSM Module wl 0000:00:00.0: setting latency timer to 64 wl: passivemode=1 wl0: creating kthread wl0-kthrd wl0: creating timer kthread wl0-tmr-kthrd wl: napimode=0 Neither SPROM nor OTP has valid image wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl:loading /etc/wlan/bcm6362_map.bin srom rev:8 wl0: allocskbmode=1 currallocskbsz=512 +++++ Added gso loopback support for dev=wl0 <85da7800> wl0: Broadcom BCM435f 802.11 Wireless Controller 6.37.14.4803.cpe4.14L04.0-kdb dgasp: kerSysRegisterDyingGaspHandler: wl0 registered dect: Loading BCM/SC24200 DECT Stack dect: Version: , Build date: 2013/11/25, 11:54 Loading DECT Shim driver Initialize DECT Shim layer.... Obtained board id string (SI32261) Obtained Base board id string (F@ST3864V2)Successfully obtained voice parameters ####################SUCCESS: DECT PLL IS LOCKED################# dect shm irq status: 0x00000080, i: 1 DECT PLL init completed successfully DECT_CTRL->dect_shm_pll_reg_0 : 0x210064C0 DECT_CTRL->dect_shm_pll_reg_1 : 0x00501015 DECT_CTRL->dect_shm_pll_reg_2 : 0x60000000 DECT_CTRL->dect_shm_pll_reg_3 : 0x11181808 dect_shm_dma_ddr_saddr_tx_s0 : 0x00c10000 dect_shm_dma_ddr_saddr_tx_s1 : 0x00c10140 dect_shm_dma_ddr_saddr_tx_s2 : 0x00c10280 dect_shm_dma_ddr_saddr_tx_s3 : 0x00c103c0 dect_shm_dma_ddr_saddr_rx_s0 : 0x00c07000 dect_shm_dma_ddr_saddr_rx_s1 : 0x00c07140 dect_shm_dma_ddr_saddr_rx_s2 : 0x00c07280 dect_shm_dma_ddr_saddr_rx_s3 : 0x00c073c0 dect_shm_dma_ahb_saddr_tx_s01 : 0x0a200de0 dect_shm_dma_ahb_saddr_tx_s23 : 0x11a01560 dect_shm_dma_ahb_saddr_rx_s01 : 0x08400c00 dect_shm_dma_ahb_saddr_rx_s23 : 0x0fc01380 dect_shm_dma_offset_addr_tx_s01 : 0x00000000 dect_shm_dma_offset_addr_rx_s01 : 0x00000000 dect_shm_dma_xfer_size_tx : 0x28282828 dect_shm_dma_xfer_size_rx : 0x28282828 dect_shm_dma_buf_size_tx : 0x02020202 dect_shm_dma_buf_size_rx : 0x02020202 dect_shm_dma_xfer_cntr_tx : 0x00000000 dect_shm_dma_xfer_cntr_rx : 0x00000000 dect_shm_dma_ctrl : 0x030088ff Loading PCM shim driver Endpoint: endpoint_init entry Endpoint: endpoint_init COMPLETED p8021ag: p8021ag_init entry Broadcom 802.1Q VLAN Interface, v0.1 PCIe: No device found - Powering down Starting SWMDK... Note: Loading 6300 MDK (default) driver for 63168 chip Note: Forcing 53115 driver for 53125 Switch MDK: num_switches = 2 Switch MDK: unit = 0; phy_pbmp = 0x8; config_pbmp = 0x18 Switch MDK: unit = 1; phy_pbmp = 0x1e; config_pbmp = 0x1e swmdk:error:27.558:link_poll_function:1026:Switch MDK link poll thread: unit=0; phypbmp=0x8 config_pbmp=0x18 Saving kernel bootup messages for dumpsysinfo... Starting CMS smd... ===== Release Version 8.353.1 (build timestamp 160723_1855) ===== /bin/smd:error:27.803:symbol_to_value:372:Could not find symbol TELNETD2_PORT in eid_symbol_table Initializing CMS MDM in Hybrid98+181 mode eth3 (Ext switch port: 4) (Logical Port: 12) Link UP 100 mbps full duplex message received before monitor task is initialized kerSysSendtoMonitorTask ssk:error:35.198:lck_checkBeforeEntry:225:lBOS: Enter bosInit BOS: Exit bosInit endpoint_open COMPLETED ock required during cmsObj_getNextInSubTreeFlags Host MIPS Clock divider pwrsaving is enabled DDR Self Refresh pwrsaving is enabled Netfilter messages via NETLINK v0.30. ip_tables: (C) 2000-2006 Netfilter Core Team ip6_tables: (C) 2000-2006 Netfilter Core Team device eth0 entered promiscuous mode /bin/smd:error:42.563:collectApp:1460:Could not collect radvd (pid=702 timeout=5000ms), ret=9809. Kill it with SIGKILL. ADDRCONF(NETDEV_UP): eth0: link is not ready device eth1 entered promiscuous mode ADDRCONF(NETDEV_UP): eth1: link is not ready device eth2 entered promiscuous mode ADDRCONF(NETDEV_UP): eth2: link is not ready device eth3 entered promiscuous mode br0: port 4(eth3) entered forwarding state br0: port 4(eth3) entered forwarding state *** dslThread dslPid=929 BcmAdsl_Initialize=0xC02A4050, g_pFnNotifyCallback=0xC02DF0F0 lmemhdr[2]=0x100CE000, pAdslLMem[2]=0x100CE000 pSdramPHY=0xA7FFFFF8, 0x68CC 0xDEADBEEF *** XfaceOffset: 0x5FF90 => 0x5FF90 *** *** PhySdramSize got adjusted: 0xF3AAC => 0x127ED0 *** AdslCoreSharedMemInit: shareMemSize=41232(41232) AdslCoreHwReset: pLocSbSta=84a40000 bkupThreshold=3072 AdslCoreHwReset: AdslOemDataAddr = 0xA7FB2560 VersionInfo: A2pv6F039p.d26b ***BcmDiagsMgrRegisterClient: 0 *** dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered fapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22be0 bytes remaining 584 XTM Init: Ch:0 - 200 rx BDs at 0xb0a22be0 fapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a23220 bytes remaining 456 XTM Init: Ch:1 - 16 rx BDs at 0xb0a23220 bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system ADDRCONF(NETDEV_UP): eth4: link is not ready insmod: can't insert '/lib/modules/3.4.11-rt19/kernel/net/ipv4/netfilter/ip_tables.ko': File exists insmod: can't insert '/lib/modules/3.4.11-rt19/kernel/net/ipv4/netfilter/iptable_filter.ko': File exists Config Id fromonitor task is initialized pid= 471 m Backup PSI is: F5350_Optus_11.conf Jump out of script process because of backup PSI patch unavailable ssk:error:47.767:initVodslBoundIpIfWanSideUpLocked:851:Failed to get WAN Connection object starting pid 987, tty '': '-/bin/sh -l -c consoled' ssk:error:47.946:ssk_main:994:cannot handle msg type 0x10000802 from 20 (flags=0x2000f4d0) insmod: can't insert '/lib/modules/3.4.11-rt19/kernel/net/ipv4/ip_gre.ko': File exists BCM963268 Broadband Router WLmngr Daemon is running wlevt is ready for new msg... killall: hspotap: no process killed killall: bsd: no process killed acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: selected channel spec: 0x100b There is no Predefined DevicePin in CFE WPS Device PIN = 16694248 Setting SSID: "OPTUS_130372" Setting SSID: "wl0_Guest1" Setting SSID: "wl0_Guest2" Setting SSID: "wl0_Guest3" device wl0 is not a slave of br0 device wl0 entered promiscuous mode br0: port 5(wl0) entered forwarding state br0: port 5(wl0) entered forwarding state mdmLibCtx idx =92 Login: admin Password: > sh BusyBox v1.17.2 (2016-07-23 18:57:58 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. # mtdinfo -a Count of MTD devices: 6 Present MTD devices: mtd0, mtd1, mtd2, mtd3, mtd4, mtd5 Sysfs interface supported: yes mtd0 Name: rootfs Type: nand Eraseblock size: 131072 bytes, 128.0 KiB Amount of eraseblocks: 491 (64356352 bytes, 61.4 MiB) Minimum input/output unit size: 2048 bytes Sub-page size: 2048 bytes OOB size: 64 bytes Character device major/minor: 90:0 Bad blocks are allowed: true Device is writable: true mtd1 Name: rootfs_update Type: nand Eraseblock size: 131072 bytes, 128.0 KiB Amount of eraseblocks: 491 (64356352 bytes, 61.4 MiB) Minimum input/output unit size: 2048 bytes Sub-page size: 2048 bytes OOB size: 64 bytes Character device major/minor: 90:2 Bad blocks are allowed: true Device is writable: true mtd2 Name: data Type: nand Eraseblock size: 131072 bytes, 128.0 KiB Amount of eraseblocks: 32 (4194304 bytes, 4.0 MiB) Minimum input/output unit size: 2048 bytes Sub-page size: 2048 bytes OOB size: 64 bytes Character device major/minor: 90:4 Bad blocks are allowed: true Device is writable: true mtd3 Name: nvram Type: nand Eraseblock size: 131072 bytes, 128.0 KiB Amount of eraseblocks: 1 (131072 bytes, 128.0 KiB) Minimum input/output unit size: 2048 bytes Sub-page size: 2048 bytes OOB size: 64 bytes Character device major/minor: 90:6 Bad blocks are allowed: true Device is writable: true mtd4 Name: image Type: nand Eraseblock size: 131072 bytes, 128.0 KiB Amount of eraseblocks: 491 (64356352 bytes, 61.4 MiB) Minimum input/output unit size: 2048 bytes Sub-page size: 2048 bytes OOB size: 64 bytes Character device major/minor: 90:8 Bad blocks are allowed: true Device is writable: true mtd5 Name: image_update Type: nand Eraseblock size: 131072 bytes, 128.0 KiB Amount of eraseblocks: 491 (64356352 bytes, 61.4 MiB) Minimum input/output unit size: 2048 bytes Sub-page size: 2048 bytes OOB size: 64 bytes Character device major/minor: 90:10 Bad blocks are allowed: true Device is writable: true # ls /dev/mtd* /dev/mtd0 /dev/mtd3 /dev/mtdblock2 /dev/mtdblock5 /dev/mtd1 /dev/mtdblock0 /dev/mtdblock3 /dev/mtdblock6 /dev/mtd2 /dev/mtdblock1 /dev/mtdblock4 /dev/mtdblock7 # mount rootfs on / type rootfs (rw) mtd:rootfs on / type jffs2 (ro,relatime) proc on /proc type proc (rw,relatime) tmpfs on /var type tmpfs (rw,relatime,size=420k) tmpfs on /mnt type tmpfs (rw,relatime,size=16k) sysfs on /sys type sysfs (rw,relatime) debugfs on /sys/kernel/debug type debugfs (rw,relatime) mtd:data on /data type jffs2 (rw,relatime) none on /proc/bus/usb type usbfs (rw,relatime)
HELO CPUI L1CI HELO CPUI L1CI 4.1404-1.0.38-117.113 DRAM ---- PHYS STRF 400H PHYE DDR3 SIZ4 SIZ3 SIZ2 DINT USYN LSYN MFAS LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN FPS0 BT00 0001 STOP NAN9 NAN3 RFS1 NAN5 Base: 4.14_04 CFE version 8.353.1 for BCM963268 (32bit,SP,BE) Build Date: Sat Jul 23 18:46:20 CST 2016 (cookiechen@SZ01007.DONGGUAN.CN) Copyright (C) 2005-2011 SAGEM Corporation. Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz Main Thread: TP0 Memory Test Passed Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 NAND flash device: , id 0xeff1 block 128KB size 131072KB External switch id = 53125 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host/tftp (f/h/c) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Boot image (0=latest, 1=previous) : 0 Default host ramdisk file name : Default ramdisk store address : Board Id (0-38) : F@ST3864V2 Number of MAC Addresses (1-32) : 11 Base MAC Address : d8:d7:75:13:03:72 PSI Size (1-64) KBytes : 40 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 0 Main Thread Number [0|1] : 0 GPON Serial Number : "BRCM12345678" GPON Password : " " Voice Board Configuration (0-0) : SI32261 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 Booting from latest image (0xb8020000) ... Decompression OK! Entry at 0x81000000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 179 buffers found Closing DMA Channels Starting program at 0x81000000 [ 0.000000] Linux version 6.1.77 (rikka@zbook14g2) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r25136-6497cdba09) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Sat Feb 17 15:28:34 2024 [ 0.000000] CPU0 revision is: 0002a080 (Broadcom BMIPS4350) [ 0.000000] MIPS: machine is Sagemcom F@st3864OP [ 0.000000] 128MB of RAM installed [ 0.000000] earlycon: bcm63xx_uart0 at MMIO 0x10000180 (options '115200n8') [ 0.000000] printk: bootconsole [bcm63xx_uart0] enabled [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Reserving 0KB of memory at 4194303KB for kdump [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] percpu: Embedded 11 pages/cpu s13984 r8192 d22880 u45056 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480 [ 0.000000] Kernel command line: earlycon [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 118692K/131072K available (7298K kernel code, 619K rwdata, 1560K rodata, 1268K init, 219K bss, 12380K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 [ 0.000000] rcu: Hierarchical RCU implementation. [ 0.000000] Tracing variant of Tasks RCU enabled. [ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies. [ 0.000000] NR_IRQS: 256 [ 0.000000] irq_bcm6345_l1: registered BCM6345 L1 intc (IRQs: 128) [ 0.000000] irq_bcm6345_l1: CPU0 (irq = 2) [ 0.000000] irq_bcm6345_l1: CPU1 (irq = 3) [ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention. [ 0.000000] brcm,bcm63268 detected @ 400 MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns [ 0.000002] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns [ 0.008233] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656) [ 0.074649] pid_max: default: 32768 minimum: 301 [ 0.081602] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.089116] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.103942] cblist_init_generic: Setting adjustable number of callback queues. [ 0.111407] cblist_init_generic: Setting shift to 1 and lim to 1. [ 0.118387] rcu: Hierarchical SRCU implementation. [ 0.123321] rcu: Max phase no-delay instances is 1000. [ 0.129982] smp: Bringing up secondary CPUs ... [ 0.136376] SMP: Booting CPU1... [ 11.676032] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 11.676070] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 11.676350] CPU1 revision is: 0002a080 (Broadcom BMIPS4350) [ 1.136908] Synchronize counters for CPU 1: [ 1.157622] SMP: CPU1 is running [ 1.157641] done. [ 1.167499] smp: Brought up 1 node, 2 CPUs [ 1.182799] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 1.192985] futex hash table entries: 512 (order: 3, 32768 bytes, linear) [ 1.200289] pinctrl core: initialized pinctrl subsystem [ 1.208490] NET: Registered PF_NETLINK/PF_ROUTE protocol family [ 1.249948] clocksource: Switched to clocksource MIPS [ 1.258602] NET: Registered PF_INET protocol family [ 1.264284] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 1.273552] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear) [ 1.282233] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 1.290223] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 1.298110] TCP bind hash table entries: 1024 (order: 2, 16384 bytes, linear) [ 1.305554] TCP: Hash tables configured (established 1024 bind 1024) [ 1.312446] UDP hash table entries: 256 (order: 1, 8192 bytes, linear) [ 1.319186] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear) [ 1.327040] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 1.333069] PCI: CLS 0 bytes, default 16 [ 1.343740] workingset: timestamp_bits=14 max_order=15 bucket_order=1 [ 1.361659] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 1.367635] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 1.392697] bcm63xx-power-controller 1000184c.power-controller: registered 14 power domains [ 1.403635] 10000180.serial: ttyS0 at MMIO 0x10000180 (irq = 8, base_baud = 1562500) is a bcm63xx_uart [ 1.413350] printk: console [ttyS0] enabled [ 1.413350] printk: console [ttyS0] enabled [ 1.421939] printk: bootconsole [bcm63xx_uart0] disabled [ 1.421939] printk: bootconsole [bcm63xx_uart0] disabled [ 1.470366] bcm2835-rng 10002880.rng: hwrng registered [ 1.480908] bcm6368_nand 10000200.nand: there is not valid maps for state default [ 1.489784] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xf1 [ 1.496407] nand: Winbond W29N01HV [ 1.499859] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 1.507723] bcm6368_nand 10000200.nand: detected 128MiB total, 128KiB blocks, 2KiB pages, 16B OOB, 8-bit, Hamming ECC [ 1.520298] Bad block table found at page 65472, version 0x01 [ 1.527554] Bad block table found at page 65408, version 0x01 [ 1.535429] 7 fixed-partitions partitions found on MTD device brcmnand.0 [ 1.542424] OF: Bad cell count for /ubus/nand@10000200/nandcs@0/partitions [ 1.549495] OF: Bad cell count for /ubus/nand@10000200/nandcs@0/partitions [ 1.557137] Creating 7 MTD partitions on "brcmnand.0": [ 1.562496] 0x000000000000-0x000000020000 : "cferom_nvram" [ 1.570911] OF: Bad cell count for /ubus/nand@10000200/nandcs@0/partitions [ 1.578652] 0x000000020000-0x000003d80000 : "stock_rootfs" [ 1.587062] 0x000003d80000-0x000007ae0000 : "stock_rootfs_update" [ 1.596163] 0x000007ae0000-0x000007b00000 : "stock_hidden1" [ 1.605038] 0x000007b00000-0x000007f00000 : "stock_data" [ 1.612732] 0x000007f00000-0x000008000000 : "stock_hidden2" [ 1.620827] 0x000000020000-0x000007ae0000 : "wfi" [ 2.140021] random: crng init done [ 2.264455] cferam: bootflag1=0 [ 2.421003] 5 bcm-wfi-split-fw partitions found on MTD device wfi [ 2.427241] Creating 5 MTD partitions on "wfi": [ 2.431953] 0x000000000000-0x000000040000 : "cferam" [ 2.438771] 0x000000040000-0x000003d60000 : "firmware" [ 2.446288] 0x000000040000-0x000000540000 : "kernel" [ 2.453312] 0x000000540000-0x000003d60000 : "ubi" [ 2.460471] 0x000003d60000-0x000007ac0000 : "img2" [ 2.557541] bcm6368-mdio-mux 107000b0.mdio: Broadcom BCM6368 MDIO mux bus [ 2.566013] bcm53xx mdio_mux-0.1:1e: found switch: BCM53125, rev 4 [ 2.572726] bcm53xx mdio_mux-0.1:1e: failed to register switch: -517 [ 2.580463] b53-switch 10700000.switch: found switch: BCM63268, rev 0 [ 2.589304] bcm6368-enetsw 1000d800.ethernet: mtd mac d8:d7:75:13:03:72 [ 2.711103] bcm6368-enetsw 1000d800.ethernet: eth0 at 0xb000d800, IRQ 0 [ 2.719799] bcm7038-wdt 1000009c.watchdog: Registered BCM7038 Watchdog [ 2.729605] NET: Registered PF_INET6 protocol family [ 2.738667] Segment Routing with IPv6 [ 2.742584] In-situ OAM (IOAM) with IPv6 [ 2.746758] NET: Registered PF_PACKET protocol family [ 2.752654] 8021q: 802.1Q VLAN Support v1.8 [ 3.013139] registering PCI controller with io_map_base unset [ 3.019372] PCI host bridge to bus 0000:00 [ 3.023635] pci_bus 0000:00: root bus resource [mem 0x11000000-0x11efffff] [ 3.030727] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 3.038889] pci 0000:00:00.0: [14e4:6326] type 01 class 0x060400 [ 3.045164] pci 0000:00:00.0: PME# supported from D0 D3hot [ 3.054116] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 3.062847] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01 [ 3.069669] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01 [ 3.076533] pci 0000:00:00.0: PCI bridge to [bus 01] [ 3.082127] pcieport 0000:00:00.0: PME: Signaling with IRQ 40 [ 3.090810] bcm53xx mdio_mux-0.1:1e: found switch: BCM53125, rev 4 [ 3.097265] bcm53xx mdio_mux-0.1:1e: failed to register switch: -517 [ 3.104313] b53-switch 10700000.switch: found switch: BCM63268, rev 0 [ 3.251119] b53-switch 10700000.switch: Using legacy PHYLIB callbacks. Please migrate to PHYLINK! [ 3.263184] b53-switch 10700000.switch wan (uninitialized): PHY [mdio_mux-0.0:04] driver [Generic PHY] (irq=POLL) [ 3.280231] device eth0 entered promiscuous mode [ 3.285102] DSA: tree 0 setup [ 3.289359] bcm53xx mdio_mux-0.1:1e: found switch: BCM53125, rev 4 [ 3.466115] bcm53xx mdio_mux-0.1:1e: Using legacy PHYLIB callbacks. Please migrate to PHYLINK! [ 3.477527] bcm53xx mdio_mux-0.1:1e: Configured port 8 for rgmii [ 3.485252] bcm53xx mdio_mux-0.1:1e lan4 (uninitialized): PHY [dsa-1.0:01] driver [Generic PHY] (irq=POLL) [ 3.499708] bcm53xx mdio_mux-0.1:1e lan3 (uninitialized): PHY [dsa-1.0:02] driver [Generic PHY] (irq=POLL) [ 3.513283] bcm53xx mdio_mux-0.1:1e lan2 (uninitialized): PHY [dsa-1.0:03] driver [Generic PHY] (irq=POLL) [ 3.526897] bcm53xx mdio_mux-0.1:1e lan1 (uninitialized): PHY [dsa-1.0:04] driver [Generic PHY] (irq=POLL) [ 3.542205] device extsw entered promiscuous mode [ 3.547256] DSA: tree 1 setup [ 3.554341] UBI: auto-attach mtd10 [ 3.557847] ubi0: attaching mtd10 [ 4.104051] ubi0: scanning is finished [ 4.128067] ubi0: attached mtd10 (name "ubi", size 56 MiB) [ 4.133807] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 4.140880] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 4.147833] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 4.155020] ubi0: good PEBs: 449, bad PEBs: 0, corrupted PEBs: 0 [ 4.161197] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128 [ 4.168620] ubi0: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 1708097443 [ 4.178042] ubi0: available PEBs: 0, total reserved PEBs: 449, PEBs reserved for bad PEB handling: 20 [ 4.187624] ubi0: background thread "ubi_bgt0d" started, PID 335 [ 4.196565] block ubiblock0_0: created from ubi0:0(rootfs) [ 4.202317] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem [ 4.218973] VFS: Mounted root (squashfs filesystem) readonly on device 254:0. [ 4.235256] Freeing unused kernel image (initmem) memory: 1268K [ 4.241366] This architecture does not have kernel memory protection. [ 4.247947] Run /sbin/init as init process [ 5.156932] init: Console is alive [ 5.161229] init: - watchdog - [ 6.740766] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 6.855812] usbcore: registered new interface driver usbfs [ 6.861676] usbcore: registered new interface driver hub [ 6.867267] usbcore: registered new device driver usb [ 6.930031] ehci-platform 10002500.usb: EHCI Host Controller [ 6.935874] ehci-platform 10002500.usb: new USB bus registered, assigned bus number 1 [ 6.944387] ehci-platform 10002500.usb: irq 10, io mem 0x10002500 [ 6.979992] ehci-platform 10002500.usb: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 6.990417] hub 1-0:1.0: USB hub found [ 6.994374] hub 1-0:1.0: 2 ports detected [ 7.015732] ohci-platform 10002600.usb: Generic Platform OHCI controller [ 7.022807] ohci-platform 10002600.usb: new USB bus registered, assigned bus number 2 [ 7.031116] ohci-platform 10002600.usb: irq 11, io mem 0x10002600 [ 7.105798] hub 2-0:1.0: USB hub found [ 7.109762] hub 2-0:1.0: 2 ports detected [ 7.141968] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 7.160470] init: - preinit - [ 9.265867] b53-switch 10700000.switch extsw: configuring for fixed/rgmii link mode [ 9.273984] b53-switch 10700000.switch extsw: Link is Up - 1Gbps/Full - flow control off [ 9.278973] bcm53xx mdio_mux-0.1:1e lan1: configuring for phy/gmii link mode [ 9.290492] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 9.297247] IPv6: ADDRCONF(NETDEV_CHANGE): extsw: link becomes ready Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 11.735417] UBIFS (ubi0:1): Mounting in unauthenticated mode [ 11.741770] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 495 [ 11.827767] UBIFS (ubi0:1): recovery needed [ 12.013190] UBIFS (ubi0:1): recovery completed [ 12.018221] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data" [ 12.026351] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 12.036562] UBIFS (ubi0:1): FS size: 47742976 bytes (45 MiB, 376 LEBs), max 386 LEBs, journal size 2412544 bytes (2 MiB, 19 LEBs) [ 12.048592] UBIFS (ubi0:1): reserved for root: 2255018 bytes (2202 KiB) [ 12.055387] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID CF6C009E-936B-4C3B-9972-991947625859, small LPT model [ 12.073832] mount_root: switching to ubifs overlay [ 12.101343] urandom-seed: Seeding with /etc/urandom.seed [ 12.354120] procd: - early - [ 12.357602] procd: - watchdog - [ 13.158015] procd: - watchdog - [ 13.162996] procd: - ubus - [ 13.416171] procd: - init - Please press Enter to activate this console. [ 14.889111] kmodloader: loading kernel modules from /etc/modules.d/* [ 15.786339] Loading modules backported from Linux version v6.5-0-g2dde18cd1d8f [ 15.793806] Backport generated by backports.git v5.15.92-1-56-g5fb2ccb6b9e8 [ 16.264590] PPP generic driver version 2.4.2 [ 16.272404] NET: Registered PF_PPPOX protocol family [ 16.301618] Broadcom 43xx driver loaded [ Features: NL ] [ 16.321953] kmodloader: done loading kernel modules from /etc/modules.d/* [ 17.344711] urngd: v1.0.2 started. [ 36.815112] b53-switch 10700000.switch extsw: Link is Down [ 36.977978] b53-switch 10700000.switch extsw: configuring for fixed/rgmii link mode [ 36.986223] b53-switch 10700000.switch extsw: Link is Up - 1Gbps/Full - flow control off [ 36.994857] IPv6: ADDRCONF(NETDEV_CHANGE): extsw: link becomes ready [ 37.012918] bcm53xx mdio_mux-0.1:1e lan1: configuring for phy/gmii link mode [ 37.034539] switch: port 1(lan1) entered blocking state [ 37.040112] switch: port 1(lan1) entered disabled state [ 37.126262] device lan1 entered promiscuous mode [ 37.710192] bcm53xx mdio_mux-0.1:1e lan2: configuring for phy/gmii link mode [ 37.718045] 8021q: adding VLAN 0 to HW filter on device lan2 [ 37.793109] switch: port 2(lan2) entered blocking state [ 37.798501] switch: port 2(lan2) entered disabled state [ 37.829770] device lan2 entered promiscuous mode [ 38.062224] bcm53xx mdio_mux-0.1:1e lan3: configuring for phy/gmii link mode [ 38.070070] 8021q: adding VLAN 0 to HW filter on device lan3 [ 38.102888] switch: port 3(lan3) entered blocking state [ 38.108279] switch: port 3(lan3) entered disabled state [ 38.119725] device lan3 entered promiscuous mode [ 38.332057] bcm53xx mdio_mux-0.1:1e lan4: configuring for phy/gmii link mode [ 38.339677] 8021q: adding VLAN 0 to HW filter on device lan4 [ 38.372331] switch: port 4(lan4) entered blocking state [ 38.377707] switch: port 4(lan4) entered disabled state [ 38.388471] device lan4 entered promiscuous mode [ 38.601601] b53-switch 10700000.switch wan: configuring for phy/gmii link mode [ 38.631781] switch: port 5(wan) entered blocking state [ 38.637068] switch: port 5(wan) entered disabled state [ 38.840165] device wan entered promiscuous mode [ 41.870595] bcm53xx mdio_mux-0.1:1e lan2: Link is Up - 1Gbps/Full - flow control off [ 41.878638] switch: port 2(lan2) entered blocking state [ 41.884065] switch: port 2(lan2) entered forwarding state [ 41.899154] IPv6: ADDRCONF(NETDEV_CHANGE): switch: link becomes ready [ 41.920312] IPv6: ADDRCONF(NETDEV_CHANGE): switch.1: link becomes ready [ 41.927821] IPv6: ADDRCONF(NETDEV_CHANGE): switch.2: link becomes ready BusyBox v1.36.1 (2024-02-17 15:28:34 UTC) built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt SNAPSHOT, r25136+1-6497cdba09 ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@OpenWrt:/#
Source code:
https://github.com/rikka0w0/openwrt-fast3864op/tree/fast3864_master_20240315
Before the cferam.000 is merged into
This is no longer required after June 25, 2024.
https://github.com/openwrt/bcm63xx-cfe.git
, we need to supply our cferam.000 manually:
mkdir -p build_dir/target-mips_mips32_musl/linux-bmips_bcm63268/bcm63xx-cfe/sagem,fast-3864-op
wget -O build_dir/target-mips_mips32_musl/linux-bmips_bcm63268/bcm63xx-cfe/sagem,fast-3864-op/cferam.000 https://github.com/openwrt/bcm63xx-cfe/raw/0b956812e3564920905e4185d1cb17b3a8819b43/sagem,fast-3864-op/cferam.000
https://forum.openwrt.org/t/help-with-cfe-on-bcm63168d0-based-actiontec-f2250/85240/13
https://forum.openwrt.org/t/help-with-cfe-on-bcm63168d0-based-actiontec-f2250/85240/12