Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
| inbox:toh:sagem:f_st3864op [2024/02/19 15:57] – [Info] rikka0w0 | inbox:toh:sagem:f_st3864op [2024/10/19 06:51] – [Photos] rikka0w0 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Sagem F@ST3864OP ====== | ====== Sagem F@ST3864OP ====== | ||
| - | ~~NOTOC~~ | ||
| - | |||
| - | /* This template is intended to be used via https:// | ||
| - | |||
| {{page> | {{page> | ||
| - | // | + | [[: |
| - | + | ||
| - | /*****/ | + | |
| - | /* How to add images ========> | + | |
| - | /*****/ | + | |
| {{ media: | {{ media: | ||
| Line 17: | Line 9: | ||
| < | < | ||
| </ | </ | ||
| + | |||
| + | ===== Hardware highlights ===== | ||
| + | ^ CPU ^ Ram ^ Flash ^ Network | ||
| + | | BCM63168D0, Dual-Core @400MHz | ||
| + | |||
| + | |||
| + | /*** if info available: uncomment and fill in | ||
| + | ===== Installation ===== | ||
| + | - → [[: | ||
| + | - → [[docs: | ||
| + | - → [[: | ||
| + | |||
| + | ==== Installing OpenWrt ==== | ||
| + | ***/ | ||
| + | |||
| + | |||
| + | /*** if info available: uncomment and fill in | ||
| + | ===== Debricking ===== | ||
| + | -> [[docs: | ||
| + | ***/ | ||
| + | |||
| ===== OpenWrt support ===== | ===== OpenWrt support ===== | ||
| - | <color red>**Not supported.**</ | + | <color red>**W.I.P.**</ |
| + | |||
| + | === Whats working === | ||
| + | - All ethernet ports. | ||
| + | - VLAN tagging of both internal (SoC) and external switches(BCM53124SKMMLG). | ||
| + | - All USB ports. | ||
| + | - Most LEDs, except for the Wifi indicator, the amber and the green LEDs near the WAN port. | ||
| + | === Whats NOT working === | ||
| + | - WAN-LAN hardware acceleration does not work at the moment, NAT speed is limited to around 144Mbps at full CPU load. | ||
| + | - Some LEDs (gpio-leds, see dts). | ||
| + | - WAN LEDs control needs improvement. | ||
| + | - PCIe, '' | ||
| + | - WiFi does not work at the moment. | ||
| + | - xDSL and FXS are unlikely to get supported. | ||
| /*** if info available: uncomment and fill in | /*** if info available: uncomment and fill in | ||
| Line 43: | Line 69: | ||
| - | ===== Hardware highlights ===== | ||
| - | ^ CPU ^ Ram ^ Flash ^ Network | ||
| - | | BCM63168D0, Dual-Core @400MHz | ||
| - | |||
| - | |||
| - | /*** if info available: uncomment and fill in | ||
| - | ===== Installation ===== | ||
| - | - → [[: | ||
| - | - → [[docs: | ||
| - | - → [[: | ||
| - | |||
| - | ==== Installing OpenWrt ==== | ||
| - | ***/ | ||
| - | |||
| - | |||
| - | /*** if info available: uncomment and fill in | ||
| - | ===== Debricking ===== | ||
| - | -> [[docs: | ||
| - | ***/ | ||
| Line 110: | Line 117: | ||
| ***/ | ***/ | ||
| + | ==== Boot OpenWrt in RAM ==== | ||
| + | - Open the case and connect the [[: | ||
| + | - Power on the device, keep pressing any key until you see the CFE prompt appears. | ||
| + | - Set the IPv4, netmask, and gateway of your PC to '' | ||
| + | - Connect any of the router LAN ports to your PC. | ||
| + | - Setup a TFTP server on your PC to serve the '' | ||
| + | - Use command '' | ||
| + | |||
| + | Use this command to safely browse the stock firmware files: | ||
| + | |||
| + | '' | ||
| + | |||
| + | ==== Installation ==== | ||
| + | <WRAP center round alert 60%> | ||
| + | < | ||
| + | |||
| + | Any help or information on this are welcomed. | ||
| + | </ | ||
| + | <WRAP center round important 60%> | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | This section explains a safer way of installing OpenWrt to a F@ST3864OP device. This method does not touch the CFE bootloader, and it is less likely to brick the router. | ||
| + | |||
| + | - You would need to prepare a USB-TTL serial adapter, open the case of the router, and solder the serial headers. | ||
| + | - Follow the [[: | ||
| + | - Setup a web server (e.g. '' | ||
| + | - On the OpenWrt shell, download the OpenWrt firmware to ramdisk ''/ | ||
| + | - Use sha256sum to check if the firmware file is intact. | ||
| + | - **Up to this step, you still can reboot the router with the stock firmware untouched.** | ||
| + | - Wipe the stock firmware and create a clean JFF2: '' | ||
| + | - Install OpenWrt firmware permanently to the NAND flash: '' | ||
| + | - Now reboot. If everything goes well, you will get a OpenWrt shell. | ||
| + | - **LuCI sysupgrade can be used from now on.** | ||
| + | |||
| + | Reference: [[: | ||
| ===== Hardware ===== | ===== Hardware ===== | ||
| ==== Info ==== | ==== Info ==== | ||
| Line 118: | Line 161: | ||
| ^ System-On-Chip | ^ System-On-Chip | ||
| ^ CPU/ | ^ CPU/ | ||
| - | ^ Flash-Chip | + | ^ Flash-Chip |
| ^ Flash size | 128MiB, blocksize: 64 pages, page size: 2048 bytes + 64-byte OOB data. | | ^ Flash size | 128MiB, blocksize: 64 pages, page size: 2048 bytes + 64-byte OOB data. | | ||
| - | ^ RAM | NT5CC64M16GP-DI, | + | ^ RAM |
| ^ Wireless | ^ Wireless | ||
| ^ Ethernet | ^ Ethernet | ||
| Line 128: | Line 171: | ||
| ^ JTAG | ??? | | ^ JTAG | ??? | | ||
| - | Datasheets: | + | Other ICs on the board: |
| - | * NT5CC64M16GP-DI: https:// | + | * [[https:// |
| - | * W29N01HVSINA: | + | * [[https:// |
| + | * [[https:// | ||
| + | * [[https:// | ||
| - | Other ICs on board: | + | CPU Pinout: |
| - | * 74HC164D: https:// | + | [[:docs:techref:hardware:soc:soc.broadcom.bcm63xx# |
| - | * LMX4181: https://www.renesas.com/ | + | |
| - | * SI32260-C-FM1: https://au.mouser.com/ | + | ==== Network ==== |
| - | | + | This router has 2 switches! The BCM63168D0 SOC has 8 internet interfaces, 3xFE, 1xGE, and 4xRGMII, all from a built-in switch. In this router, the GE port (id=3) is used for WAN RJ45 connection, and the first RGMII (id=4) goes to an external switch (BCM53125?) which then powers all accessible LAN ports. **Why didn't they just simply connect 4 PHYs at the RGMIIs to make 4xGE LAN ports?** |
| Note: | Note: | ||
| - | * CFE reports the external switch (BCM53124SKMMLG) as 53125, but the boot log of the stock firmware shows that it forces to use a 53115 driver. | + | * CFE reports the external switch (BCM53124SKMMLG) as [[https:// |
| - | ===== Flash Layout ===== | + | ==== Serial |
| + | -> [[docs: | ||
| + | There is an unsoldered 4-pin header (J708) near the power jack, which provides an interactive console. You can interrupt the boot process and enter the CFE bootloader console by pressing any key repeatedly, or wait for it boots and then login to the management console using the following credentials: | ||
| + | |||
| + | ^ Credential of an Australian Optus OEM F@ST3864OP || | ||
| + | ^ user | admin | | ||
| + | ^ password | 0ptU%1M5 | | ||
| + | |||
| + | If the above does not work, then try the other keys: | ||
| + | |||
| + | https:// | ||
| + | |||
| + | The management console offers a very limited set of commands, the sh command will drop you to a BusyBox Linux shell. | ||
| + | |||
| + | ^ Serial parameters for Sagem F@ST3864OP || | ||
| + | ^ Baudrate | 115200 | | ||
| + | ^ Setup| 8N1 | | ||
| + | ^ Voltage | 3.3V TTL| | ||
| + | |||
| + | ==== LEDs and buttons ==== | ||
| + | There are three types of LEDs on this device: | ||
| + | - Connected to a serial LED driver which then drives up to 8 LEDs via a 74HC164D. | ||
| + | - Connected to a SoC pin and controlled by a hardware LED control register. | ||
| + | - Connected to a SoC pin and controlled by Linux via gpio-leds. | ||
| + | |||
| + | LED and Button connections: | ||
| + | * WAN Port: Yellow(460+6, | ||
| + | * WLAN Led (D12): (460+4, gpio36) Logic XOR (460+5, gpio37), this is weird! | ||
| + | * Internet Led (D17): Green(480+8, | ||
| + | * DSL Bonding Led (D17): Green(480+9, | ||
| + | * Power Led (D15): Green(480+20, | ||
| + | * DSL (D7): Green(74HC164D@Q3) | ||
| + | * FXS (D11, Foreign Exchange Station, the phone ports, not to be confused with the xDSL port): Green(74HC164D@Q4), | ||
| + | * WPS Led (D13): Green(74HC164D@Q0), | ||
| + | * Reset button (SW5): (460+0, gpio32) | ||
| + | * WPS button (SW3): (460+1, gpio33) | ||
| + | * WLAN button (SW2): (460+2, gpio34) | ||
| + | * Some LEDs are driven by 74HC164D: | ||
| + | * Clock (CP) = gpio0 (/ | ||
| + | * DSA (Data input) = gpio1 (/ | ||
| + | * DSB (AND with DSA), MR(Output Async Reset) are pulled high. | ||
| + | |||
| + | ===== Flash Layout ===== | ||
| + | Stock firmware dump: | ||
| + | https:// | ||
| ==== Stock ==== | ==== Stock ==== | ||
| From OEM Bootlog: | From OEM Bootlog: | ||
| Line 157: | Line 246: | ||
| - | ^ F@ST3864OP Flash Layout | + | ^ F@ST3864OP Flash Layout |
| - | ^ Hardware | + | ^ Hardware |
| - | ^ Stock Label | **// | + | ^ Stock Label | **// |
| - | ^ Stock mtd device name | mtd3 | + | ^ Stock mtd device name | mtd3 |
| - | | Start | 0x0000000 | + | | Start | 0x0000000 |
| - | | <color magenta> | + | | <color magenta> |
| - | | ::: | ::: | ::: | ::: | 0x0520000 | + | | ::: | ::: | ::: | ::: |
| - | | End | 0x0020000 | + | | End | 0x0020000 |
| - | ^ OpenWrt Layer1 | + | ^ OpenWrt Layer1 |
| - | ^ OpenWrt Layer2 | + | ^ OpenWrt Layer2 |
| - | | Filesystem | + | | Filesystem |
| Line 191: | Line 280: | ||
| </ | </ | ||
| ==== Photos ==== | ==== Photos ==== | ||
| - | /* =====>>>>> | + | === PCB === |
| - | /* When uploading photos, **name them** intelligently. Nobody knows what 20100930_000602.jpg is! */ | + | {{:media: |
| - | /* e.g. {{:media:yourbrand:yourbrand_yourmodel_front.jpg? | + | {{:media:sagem:sagem_f_st3864_back_pcb.jpg?400|}} |
| - | /* Thanks, your wiki administration - Oct. 2015 */ | + | |
| - | + | ||
| - | **Insert photo of front of the casing** | + | |
| - | + | ||
| - | **Insert photo of back of the casing** | + | |
| - | + | ||
| - | **Insert photo of backside label** | + | |
| - | + | ||
| - | **Insert photo of PCB** | + | |
| ==== Opening the case ==== | ==== Opening the case ==== | ||
| Line 210: | Line 289: | ||
| </ | </ | ||
| - | ==== Serial ==== | ||
| - | -> [[docs: | ||
| - | There is an unsoldered 4-pin header (J708) near the power jack, which provides an interactive console. You can interrupt the boot process and enter the CFE bootloader console by pressing any key repeatedly, or wait for it boots and then login to the management console using the following credentials: | ||
| - | ^ Credential of an Australian Optus OEM F@ST3864OP || | ||
| - | ^ user | admin | | ||
| - | ^ password | 0ptU%1M5 | | ||
| - | If the above does not work, then try the other keys: | ||
| - | https:// | + | ===== Hardware Mods ===== |
| + | This may apply: | ||
| + | [[: | ||
| - | The management console offers a very limited set of commands, the sh command will drop you to a BusyBox Linux shell. | + | ==== Spare SPI Flash ==== |
| - | ^ Serial parameters for Sagem F@ST3864OP || | + | There' |
| - | ^ Baudrate | 115200 | | + | <WRAP bootlog>< |
| - | ^ Setup| 8N1 | | + | status = " |
| - | ^ Voltage | 3.3V TTL| | + | |
| - | ==== JTAG ==== | + | mydev@0{ |
| - | -> [[docs: | + | compatible |
| + | reg = <0>; | ||
| + | spi-max-frequency = <781000>; | ||
| + | }; | ||
| + | };</ | ||
| + | To use the '' | ||
| - | How to connect to the JTAG Port of this specific device:\\ | + | The SPI Flash can be accessed with '' |
| - | **Insert photo of PCB with markings for JTAG port** | + | |
| - | ===== Boot OpenWrt | + | <WRAP bootlog>< |
| + | flashrom v1.2 on Linux 5.4.188 (mips) | ||
| + | flashrom is free software, get the source code at https:// | ||
| - | - Open the case and connect serial console to a PC. | + | Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). |
| - | - Power on the device, keep pressing any key until you see the CFE prompt appears. | + | Using default 2000kHz clock. Use 'spispeed' |
| - | - Set the IPv4, netmask, and gateway of your PC to '' | + | Found Winbond flash chip " |
| - | - Connect any of the router LAN ports to your PC. | + | No operations were specified. |
| - | - Setup a TFTP server | + | |
| - | - Use command '' | + | |
| - | Use this command to safely browse the stock firmware files: | + | root@OpenWrt:/# echo -n -e \\x9F\\xFF\\xFF\\xFF | spi-pipe -d / |
| + | 00000000 | ||
| + | 00000004</ | ||
| - | '' | + | ==== PCIe ==== |
| + | It is believed that the SOC has PCI or PCIE buses and devices attached. The following came from the shell of the stock firmware: | ||
| - | ===== Installation ====== | + | < |
| - | < | + | # cd / |
| - | <color #ed1c24>**Flashing via CFE's 192.168.1.1 has not been tested and could brick your device!!!**< | + | # ls devices/ -al |
| + | drwxr-xr-x | ||
| + | drwxr-xr-x | ||
| + | lrwxrwxrwx | ||
| + | lrwxrwxrwx | ||
| + | lrwxrwxrwx | ||
| + | lrwxrwxrwx | ||
| + | # ls drivers -al | ||
| + | drwxr-xr-x | ||
| + | drwxr-xr-x | ||
| + | drwxr-xr-x | ||
| + | drwxr-xr-x | ||
| + | drwxr-xr-x | ||
| + | drwxr-xr-x | ||
| + | # cd / | ||
| + | # ls | ||
| + | pci0000: | ||
| + | # cd / | ||
| + | # ls | ||
| + | 8021q | ||
| + | adsldd | ||
| + | bcm_bpm | ||
| + | bcm_enet | ||
| + | bcm_ingqos | ||
| + | bcmarl | ||
| + | bcmfap | ||
| + | bcmvlan | ||
| + | bcmxtmcfg | ||
| + | block | ||
| + | bridge | ||
| + | chipinfo | ||
| + | dect nf_defrag_ipv4 | ||
| + | dectshim | ||
| + | ehci_hcd | ||
| + | endpointdd | ||
| + | fuse nf_nat_irc | ||
| + | ip6_tables | ||
| + | ip6table_mangle | ||
| + | ip_gre | ||
| + | ip_tables | ||
| + | ipt_MASQUERADE | ||
| + | ipt_REDIRECT | ||
| + | iptable_filter | ||
| + | iptable_mangle | ||
| + | iptable_nat | ||
| + | ipv6 pcmshim | ||
| + | ipw | ||
| + | kernel | ||
| - | Any help or information on this are welcomed. | + | # cat /proc/iomem |
| - | </WRAP> | + | 00000000-07ecdfff : System RAM |
| - | <WRAP center round important 60%> | + | 00010000-003f111f : Kernel code |
| - | <color # | + | 003f1120-004e897f : Kernel data |
| - | </ | + | 10000200-10000383 : brcmnand |
| + | 10002500-100025ff : ehci_hcd | ||
| + | 10002600-100026ff : ohci_hcd | ||
| + | 11000000-11efffff : bcm63xx pcie memory space | ||
| + | a0f00000-a0ffffff : bcm63xx pci memory space | ||
| + | # cat /proc/ | ||
| + | a2000000-a200ffff : bcm63xx pci IO space | ||
| + | </nowiki></ | ||
| - | This section explains | + | The following came from the '' |
| + | <WRAP bootlog>< | ||
| + | root@OpenWrt:/ | ||
| + | 00:00.0 PCI bridge: Broadcom Inc. and subsidiaries Device 6326 (rev 80) (prog-if 00 [Normal decode]) | ||
| + | Flags: fast devsel, IRQ 48 | ||
| + | Bus: primary=00, secondary=01, | ||
| + | I/O behind bridge: 00000000-00000fff [size=4K] | ||
| + | Memory behind bridge: [disabled] | ||
| + | Prefetchable memory behind bridge: [disabled] | ||
| + | Capabilities: | ||
| + | Capabilities: | ||
| + | Capabilities: | ||
| + | Kernel driver in use: pcieport | ||
| + | lspci: Unable | ||
| - | - You would need to prepare a USB-TTL serial adapter, open the case of the router, and solder the serial headers. | + | root@OpenWrt:/sys/bus/pci# ls devices/ -al |
| - | - Follow the '' | + | drwxr-xr-x 2 root |
| - | - Setup a web server (e.g. '' | + | drwxr-xr-x 5 root |
| - | - On the OpenWrt shell, download the OpenWrt firmware to ramdisk ''/ | + | lrwxrwxrwx |
| - | - Use sha256sum to check if the firmware file is intact. | + | |
| - | - **Up to this step, you still can reboot the router with the stock firmware untouched.** | + | |
| - | | + | |
| - | - Install OpenWrt firmware permanently to the NAND flash: '' | + | |
| - | - Now reboot. If everything goes well, you will get a OpenWrt shell. | + | |
| - | - **LuCI sysupgrade can be used from now on.** | + | |
| - | Reference: [[:toh:huawei: | + | root@OpenWrt:/ |
| - | ===== Hardware Mods ===== | + | drwxr-xr-x |
| - | This may apply: | + | drwxr-xr-x |
| - | [[:toh:sercomm:ad1018]] | + | drwxr-xr-x |
| + | drwxr-xr-x | ||
| + | drwxr-xr-x | ||
| + | drwxr-xr-x | ||
| - | CPU Pinout: | + | root@OpenWrt:/# cat /proc/iomem |
| - | [[:docs:techref:hardware:soc:soc.broadcom.bcm63xx]] | + | 00000000-07ffffff |
| + | 00010000-006327f3 | ||
| + | 006327f4-00731c3f | ||
| + | 01610000-01644757 | ||
| + | 100000b0-100000bf | ||
| + | 100000c0-100000c7 : 100000c0.pin-controller dirout | ||
| + | 100000c8-100000cf : 100000c0.pin-controller dat | ||
| + | 100000d0-100000d3 : 100000c0.pin-controller led | ||
| + | 100000d8-100000db : 100000c0.pin-controller mode | ||
| + | 100000dc-100000df : 100000c0.pin-controller ctrl | ||
| + | 100000f8-100000fb : 100000c0.pin-controller basemode | ||
| + | 10000180-10000197 : 10000180.serial serial@10000180 | ||
| + | 10000200-1000037f : 10000200.nand nand | ||
| + | 10000600-100007ff : 10000200.nand nand-cache | ||
| + | 10000800-10000f0b : 10000800.spi spi@10000800 | ||
| + | 10001000-100015ff : 10001000.spi spi@10001000 | ||
| + | 10001900-10001923 : 10001900.led-controller led-controller@10001900 | ||
| + | 11000000-11efffff : bcm63xx | ||
| + | b000009c-b00000a7 : bcm63xx-wdt | ||
| + | b0002500-b00025ff : ehci-platform | ||
| + | b0002500-b00025ff : ehci-platform ehci-platform | ||
| + | b0002600-b00026ff : ohci-platform | ||
| + | b0002600-b00026ff : ohci-platform ohci-platform | ||
| + | b000d800-b000d8ff : bcm63xx_enet_shared.0 | ||
| + | b000d800-b000d8ff : bcm63xx_enet_shared.0 bcm63xx_enet_shared.0 | ||
| + | b000da00-b000dbff : bcm63xx_enet_shared.0 | ||
| + | b000da00-b000dbff : bcm63xx_enet_shared.0 bcm63xx_enet_shared.0 | ||
| + | b000dc00-b000ddff : bcm63xx_enet_shared.0 | ||
| + | b000dc00-b000ddff : bcm63xx_enet_shared.0 bcm63xx_enet_shared.0 | ||
| + | b0700000-b070ffff : bcm63xx_enetsw.0 | ||
| + | </ | ||
| Line 1262: | Line 1436: | ||
| Source code: | Source code: | ||
| - | https:// | + | https:// |
| Before the cferam.000 is merged into '' | Before the cferam.000 is merged into '' | ||
| Line 1279: | Line 1453: | ||
| ===== Tags ===== | ===== Tags ===== | ||
| [[meta: | [[meta: | ||
| - | {{tag>EXAMPLETAG | + | {{tag>MIPS BCM63168 BCM63268 128nand 128ram wip unsupported}} |