Sagem F@ST4353

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

This DSL modem was supplied by Belong Australia to FTTP customers, branded as “Belong 4353 modem” on its label. It features 4 LAN ports and 1 WAN port, all of which support up to 1 Gbps connections. It also supports 2.4G and 5G Wifi. There is a USB 2.0 port on its back.

Belong 4353

OpenWrt support

WIP, Github pull request: https://github.com/openwrt/openwrt/pull/20602

Prebuilt OpenWrt 24.10 and CFE firmwares are available here: https://github.com/rikka0w0/openwrt/releases/tag/openwrt-24.10-fast4353

The following table summarizes ways of running OpenWrt on this device:

Storage Bootloader RAM-boot “initramfs.elf” Permanent installation Soldering USB-Serial adapter SPI flasher
NAND stock CFE N/A N/A Not required Not required Not required
stock U-Boot Supported, but requires patching Not at the moment Not required Required Not required
SPI flash CFE Supported Supported Required Better to have Better to have 1)

Hardware highlights

CPU Ram Flash Network WLAN USB Serial JTag
BCM63167D0, Dual-Core @400MHz 256 MiB 256 MiB NAND 4x 1G LAN, 1x 1G WAN ac/bgn 1 x 2.0 Yes ?

Hardware

Info

Architecture BMIPS
Vendor Sagemcom
Bootloader CFE (1st stage) + U-Boot (2nd stage)
System-On-Chip BCM63167D0
CPU/Speed Core 400MHz, DDR: 400MHz, Bus: 200MHz
Flash-Chip ESMT F59L2G81A
Flash size 256 MiB, blocksize: 64 pages, page size: 2048 bytes + 64-byte OOB data
RAM 256 MiB
Wireless SoC built-in supports 2.4GHz, PCIe BCM43602KMLG for 5GHz
Ethernet 1x WAN, 4x LAN, all support 10/100/1000
Switch SOC built-in switch + external BCM53134SKFBG
USB 1x 2.0
Serial Yes, unpopulated headers, 115200-8N1, 3.3V
JTAG ???
  1. BCM43602KMLG and its three front-end ICs (SKY85712) are protected by a shield and a heatsink.
  2. There is an MP111 on the PCB.
  3. There is a BCM8303 on the PCB, potentially for the xDSL.

Photos

The PCB seen when the case is opened (after the SPI flash mod):

The spare SPI flash footprint before modding:

The other side of the PCB:

5G Wifi and NAND:

Bootstrap Resistors

Upon powering on, the voltage level of GPIO21 determines where to locate the bootloader, see BCM61368 pinout.

On this device, R94 determines this initial voltage level. R94 is a 3k 0402-sized resistor located near the power LEDs.

By default, R94 pulls GPIO21 to GND, so that the device boots from NAND. To boot from the SPI flash, simply disconnect or desolder R94.

This picture shows a jumper used to toggle R94 and select the boot source:

Serial

→ port.serial general information about the serial port, serial port cable, etc.

There is an unsoldered 4-pin header (CN4) near the two bulk capacitors. Pinout is labeled on the PCB as 3.3, Rx, Tx, GND, from the board edge to the center.

Serial parameters for Sagem F@ST4353
Baudrate 115200
Setup 8N1
Voltage 3.3V TTL

By default, neither the stock firmware nor the stock bootloader provides an interactive console. You can only see the boot log, but you cannot interrupt the boot process. To walkaround this, see the "Enable the U-Boot Console" section.

SPI Flash Mod

There's an unsoldered SPI flash (accepts both SOIC16 and SOIC8) on the board that connects to HSSPI.CS0. We can utilize this feature to install OpenWrt to our own SPI flash and leave the stock NAND flash untouched. This is a great idea because using a 2nd bootloader on an SPI flash makes the device almost unbrickable.

KNOWN Compatible SPI Flashes:

  1. GD25Q128, 16MB
  2. W25Q64, 8MB (CFE works, but may not be enough to install OpenWrt)

The general road map will be:

  1. Build CFE or download the prebuilt binary
  2. Install CFE on the SPI flash, either use a flash programmer or RAM-boot an OpenWrt
  3. Boot to CFE from the SPI flash
  4. Install OpenWrt to SPI flash

Write CFE to the SPI Flash with a programmer

This is my preferred approach, as you don't have to touch the unlocked stock bootloaders.

However, you do need an SPI Flash programmer. A CH341 or FT2232-based board will work with the well-known flashrom utility: 

# Pad cfe63268.bin to 0x3000 bytes with 0xFF
( cat cfe63268.bin; dd if=/dev/zero bs=1 count=$((0x30000-$(stat -c%s cfe63268.bin))) status=none | tr '\0' '\377' ) > cfe63268.padded.bin

echo '00000:2FFFF' > flashrom_layout.txt
sudo flashrom -p ft2232_spi:type=2232H,port=A,divisor=4 -c "GD25B128B/GD25Q128B" -w --layout flashrom_layout.txt --image cfe:cfe63268.padded.bin

Sometimes the flashrom utility shipped with your Linux distribution is outdated and does not support the --image argument that we need. If that's the case, build the latest flashrom with the following commands: 

sudo apt-get install -y \
 gcc meson ninja-build pkg-config python3-sphinx \
 libcmocka-dev libpci-dev libusb-1.0-0-dev libftdi1-dev libjaylink-dev \
 libssl-dev
git clone "https://review.coreboot.org/flashrom"
pushd flashrom
meson setup -Dprogrammer=all builddir
meson compile -C builddir
popd

Even if you don't have a dedicated flash programmer, you may still use other router boards to program the SPI flash.

Once flashed, solder the SPI flash to the PCB and desolder R94. Apply power, and you should boot to the CFE shell.

Write CFE to the SPI Flash from RAM-Boot OpenWrt

This is similar to the AD1018 SPI flash mod. You will need to:

  1. Get ssh access and U-Boot shell access on the stock firmware, see stock firmware patches.
  2. Solder the SPI flash to the PCB, but don't desolder R94 yet.
  3. Setup a TFTP server on you PC
  4. RAM-Boot OpenWrt initramfs.elf image from the U-Boot shell using command tftpboot openwrt-xxx-bmips-bcm63268-sagem_fast-4353-uboot-nand-initramfs.elf
  5. Connect the router to your PC and start an HTTP server on your PC that serves the CFE binary: python3 -m http.server -b 0.0.0.0
  6. Write CFE to the flash and reboot: wget http://192.168.1.100:8000/cfe63268.bin && mtd -e cfe write ./cfe63268.bin cfe.
  7. Desolder R94
  8. Now you should boot to the CFE shell.

CFE First-Boot Setup

In a new CFE installation, it will prompt you to select a board profile. For this device, we chose 963268SV2_EXTSW ------ 06 by setting 6 as the board ID.

It will also ask you for some more information:

  1. Number of MAC Addresses (1-64) : 10
  2. Base MAC Address : 00:18:10:00:00:00
  3. PSI Size (1-512) KBytes : 40
  4. Everything else: put 0

Some LEDs may not work as expected, but it doesn't matter.

Install OpenWrt to SPI Flash from CFE

Connect the router to your PC, set the PC's network interface IP to 192.168.1.100/24

Open your browser, navigate to http://192.168.1.1/, flash openwrt-xxx-bmips-bcm63268-sagem_fast-4353-cfe-spi-nor-squashfs-cfe.bin, don't select any misc partition, then wait until the router boots into OpenWrt.

Alternatively, you can install OpenWrt from the CFE shell with the f command, a TFTP server is required on the PC. The r openwrt-xxx-bmips-bcm63268-sagem_fast-4353-cfe-spi-nor-initramfs.elf command allows you to RAM-Boot OpenWrt.

Stock Firmware

Upon examining the boot log, it is found that the stock firmware contains two bootloaders. The first-stage CFE bootloader initializes the system and then transfers control to the second-stage U-Boot bootloader. U-Boot handles the actual firmware booting, upgrading, and recovery. However, the U-Boot shell was disabled by default, as indicated in the boot log: “Hit any key to stop autoboot: 0”.

This section explains how to obtain root access on the device and unlock the U-Boot shell.

Getting SSH Access

The stock firmware and bootloader are locked. The serial console is non-interactive, which is of no use at all. This section introduces a method for obtaining full access to the stock firmware.

  1. Boot to the stock firmware.
  2. Open your browser and log in with the username admin and the password Belong (case-sensitive). This is labeled on the bottom of the router.
  3. Open the developer tools and go to the Console tab . In Chrome, press F12. In Edge, press CTRL+SHIFT+I.
  4. Run this command in the console to get a JSON array that details all the user profiles: 
    $.xmo.getValuesTree("Device/UserAccounts/Users");

    Each element in the array represents a user profile. Our fields of interest are: uid, Login (the user name), and RemoteAccesses.

  5. Examine the RemoteAccesses JSON object in each user profile. Search for a user profile that has a RemoteAccesses JSON object whose Service field is SSH, which should look like this:
    {
    "uid": 2,
    "Enabled": false,
    "Service": "SSH",
    "Port": 22,
    "WiFiRestriction": "ACCESS_DISABLE_NO_SECURITY",
    "WANRestriction": "ACCESS_DISABLE",
    "MNGRestriction": "ACCESS_DISABLE",
    "LANRestriction": "ACCESS_DISABLE",
    "HostRestrictions": [],
    "ExpirationEnable": false,
    "ExpirationDate": "",
    "ExpirationTime": 0,
    "ExpirationWindow": 0
}

    Note down the uid of the user profile (in my case, 6) and the SSH service (in my case, 2).

  6. Enable the SSH service by running these two commands in the browser console:
    $.xmo.setValuesTree(true, "Device/UserAccounts/Users/User[@uid='6']/RemoteAccesses/RemoteAccess[@uid='2']/Enabled");
$.xmo.setValuesTree("ACCESS_ENABLE_ALL", "Device/UserAccounts/Users/User[@uid='6']/RemoteAccesses/RemoteAccess[@uid='2']/LANRestriction");

    Replace the uids as needed for your case.

  7. Set a text-based SSH password:
    $.xmo.setValuesTree("password", "Device/UserAccounts/Users/User[@uid='6']/ClearTextPassword");

    Replace the uid and the password (case-sensitive) as needed for your case.

  8. Verify settings by running the command in step 4 again. Note that the SSH password won't be visible in the ClearTextPassword field.
  9. Reboot the device.
  10. SSH into the device from your PC. I'm using the built-in SSH client of Windows 11 24H2, and it doesn't like the very old SSH server on the router. I have to SSH with this command:
    ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa -oMACs=hmac-sha1 assist@10.0.0.138 -v

    where 10.0.0.138 is the router IP. You will be prompted for the password. In my case, it will be password.

  11. Add this to ~/.ssh/config to avoid typing the long command everytime: 
    Host 4353
        HostName 10.0.0.138
        User assist
        KexAlgorithms +diffie-hellman-group1-sha1
        HostKeyAlgorithms ssh-rsa
        PubkeyAcceptedAlgorithms +ssh-rsa
        MACs hmac-sha1
        StrictHostKeyChecking no
        UserKnownHostsFile=/dev/null

    Now, you can ssh into the router with ssh 4353.

  12. The su password is root.
  13. Running htop may throw Error opening terminal: xterm-256color. To fix this, run:
    ln -s /usr/share/terminfo/x/xterm-color /usr/share/terminfo/x/xterm-256color

Adding an SFTP server

Interestingly, the stock firmware includes the opkg command, but you cannot install OpenWrt packages directly, because Sagemcom has changed the allowed architecture list. To overcome this, we can add these lines to the end of /etc/opkg.conf: 

arch all 1
arch noarch 1
arch brcm63xx 9
arch sagemcom 10

Run opkg print-architecture and see if brcm63xx is in the list.

Some non-kernel packages from Barrier Breaker 14.07 and Chaos Calmer 15.05.1 work on the stock firmware. You may have to fix some dependencies yourself.

To simplify file transfer between the PC and the router, Barrier Breaker 14.07's openssh-sftp-server can be installed by running: 

opkg install http://archive.openwrt.org/barrier_breaker/14.07/brcm63xx/smp/packages/packages/openssh-sftp-server_6.6p1-1_brcm63xx.ipk

It should complete without any errors. Chaos Calmer 15.05.1's openssh-sftp-server will also work, but the installation throws an error that can be safely ignored.

To prevent the router from updating itself, you can disconnect it from the internet and use a USB drive to transfer the openssh-sftp-server ipk file to the router.

Log in to the router with sftp 4353 to transfer files.

Enable the U-Boot console

WARNING: You CAN brick your router if you don't understand what's going on here. You have been warned!

The U-Boot console was disabled by default. If you examine the stock boot log, there is a line 'Using default environment,' which suggests that there is no modifiable U-Boot environmental variable partition. A user-writable U-Boot environmental variable partition is protected against data corruption via CRC or a similar mechanism, but the “default environment” is compiled into the U-Boot blob itself and does not have any CRC checks.

  1. The stock firmware lacks ubinfo, so we use this command to find out the name of all UBI partitions:
    root@mygateway:~#  for d in /sys/class/ubi/ubi0_*; do printf "%s -> %s\n" "$(basename "$d")" "$(cat "$d/name")"; done
ubi0_0 -> secondaryboot
ubi0_1 -> uboot
ubi0_2 -> permanent_param
ubi0_3 -> operational
ubi0_4 -> rescue
ubi0_5 -> filesystem1
ubi0_6 -> gui
  2. Dump the U-Boot partition:
    dd if=/dev/ubi0_1 of=/tmp/uboot.bin

    and transfer the dumped file to the PC. Create a backup of the dumped U-Boot partition.

  3. Use a binary editor (e.g. HxD) to open the dumped U-Boot image.
  4. Search for string bootdelay=0. In my case, I found two occurrences, one at 0x70011, the other at 0x722C9. Change 0 to 9 in all of them and then save as another file (e.g., uboot_patched.bin).
  5. Transfer the patched U-Boot image back to the router with sftp.
  6. Flash the patched U-Boot image:
    ubiupdatevol /dev/ubi0_1 /tmp/uboot_patched.bin
  7. Reboot the router, and you will see Hit any key to stop autoboot: 9.
  8. Now, press any key to interrupt the U-Boot and drop to the shell.
  9. However, the firmware OS's serial console is still not interactive.

Flash Layout

F@ST4353 Flash Layout
Hardware 256MiB NAND
Label bcmfs bcmfs_update ubi data
mtd device name mtd0 and mtd4 mtd1 mtd2 mtd3
Start 0x0000000 0x0020000 0x00C0000 0xFB00000
Size 0x0020000 0x00A0000 0xFA40000 0x0400000
End 0x0020000 0x00C0000 0xFB00000 0xFF00000
Usage CFE Bootloader and NVRAM ??? UBI filesystem ???
UBI partitions of mtd2
Label secondaryboot uboot permanent_param operational rescue filesystem1 gui
mtd device name mtd5 mtd6 mtd7 mtd9 mtd12 mtd13 mtd14
UBI partition device /dev/ubi0_0 /dev/ubi0_1 /dev/ubi0_2 /dev/ubi0_3 /dev/ubi0_4 /dev/ubi0_5 /dev/ubi0_6
Usage ??? U-Boot Bootloader ??? The current firmware The backup firmware Contains modifiable data ???
Logical partitions inside the operational and the rescue UBI partition
Label firm_header kernel rootfs
mtd device name mtd9 mtd10 mtd11
Offset within the UBI partition 0x000000 0x01F000 0x002B1800
Size 0x01F000 0x2B1800 0x0156F000
Usage ??? Stock kernel The read-only lower layer (squashfs) of the overlay rootfs

The filesystem1 UBI partition will be mounted to /opt/filesystem1. /opt/filesystem1/rootfs contains the upper writable layer of the overlay rootfs. /opt/filesystem1/data contains some config files.

assist@mygateway:/tmp$ cat /proc/mtd dev: size erasesize name mtd0: 00020000 00020000 "bcmfs" mtd1: 000a0000 00020000 "bcmfs_update" mtd2: 0fa40000 00020000 "ubi" mtd3: 00400000 00020000 "data" mtd4: 00020000 00020000 "nvram" mtd5: 00044000 0001f000 "secondaryboot" mtd6: 00088978 0001f000 "uboot" mtd7: 000019e8 0001f000 "permanent_param" mtd8: 01820800 0001f000 "operational" mtd9: 0001f000 0001f000 "firm_header" mtd10: 002b1800 0001f000 "kernel" mtd11: 0156f000 0001f000 "rootfs" mtd12: 01820800 0001f000 "rescue" mtd13: 00ba0000 0001f000 "filesystem1" mtd14: 00000000 0001f000 "gui" mtd15: 00000000 00000000 "gui_header" mtd16: 00000000 00000000 "guifs" root@mygateway:/opt/filesystem1# mount rootfs on / type rootfs (rw) /dev/root on /opt/squashfs type squashfs (ro,relatime) proc on /proc type proc (rw,relatime) sysfs on /sys type sysfs (rw,relatime) tmpfs on /tmp type tmpfs (rw,nosuid,nodev,relatime,size=129386496,mode=1777) devfs on /dev type tmpfs (rw,relatime,size=512K) devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000) ubi!filesystem1 on /opt/filesystem1 type ubifs (rw,sync,relatime) none on / type unionfs (rw,relatime,dirs=/opt/filesystem1/rootfs=rw:/opt/squashfs=ro) debugfs on /sys/kernel/debug type debugfs (rw,relatime) none on /proc/bus/usb type usbfs (rw,relatime) root@mygateway:/opt/filesystem1# ls -alh /dev/root lrwxrwxrwx 1 root root 10 Jan 1 1970 /dev/root -> mtdblock11


Per-partition dump of the stock firmware: https://github.com/rikka0w0/fast3864op-hacks/releases/tag/F%40ST4353

Bootlogs

OEM bootlog

HELO CPUI L1CI HELO CPUI L1CI 4.1603-1.0.38-116.141 DRAM ---- PHYS STRF 400H PHYE DDR3 SIZ4 SIZ3 DINT USYN LSYN MFAS LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN Version cfe-rom: 7.28.13.1 FPS0 SVOL NGEO FVLY FVLY RVOL J2EP Base: 4.16_03 CFE version 1.0.38-116.141 for BCM963268 (32bit,SP,BE) Build Date: Tue Feb 13 17:17:20 CST 2018 (stefenhuang@sz01017.ads.local) Copyright (C) 2000-2013 Broadcom Corporation. Version cfe-ram: 7.28.13.1 Boot Strap Register: 0x1ff97bf Chip ID: BCM63167D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz Main Thread: TP0 Memory Test Passed Total Memory: 268435456 bytes (256MB) Boot Address: 0xb8000000 NextLevelBoot U-boot @ 0x8ff00000 NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes NAND flash device: , id 0xc8da block 128KB size 262144KB Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host/tftp (f/h/c) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Default host ramdisk file name : Default ramdisk store address : Board Id (0-48) : F@ST4353 Number of MAC Addresses (1-32) : 10 Base MAC Address : 00:10:18:00:00:00 PSI Size (1-64) KBytes : 48 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 0 Main Thread Number [0|1] : 0 WLan Feature : 0x00 External switch id = 5075 CFE - Switch Port 3 is disabled Initializing UBI to launch u-boot! Running UbiScan... Found 454 UBI logical blocks on NAND already found a layout volume with higher sqnum UBI Layout volume is on logical block 7d5 initialize_ubi...cferam reading uboot ======================= !!! UBI volume uboot has id 1 read 559480 bytes from UBI volume 1 Ubi U-Boot Entry at 0x8ff00000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 0 buffers found Closing DMA Channels Starting program at 0x8ff00000 U-Boot 2011.12 Version: 7.28.13.1-full (Feb 13 2018 - 17:17:13) Copyright (C) 2011 - 2013 Sagemcom All rights reserved gpio in: 0x404fdb1f board type: 00020010 board memsize : 0x10000000 CPU: Broadcom BCM63167D0 DRAM: 256 MiB NAND: DevId c8da9095 may not be supported. Will use config info Spare Area Size = 16B/512B ECC level changed to 4 OOB size changed to 16 256 MiB Using default environment Board type from nvram is F@ST4353. Net: External switch id = 53125 BCM63xxx Hit any key to stop autoboot: 0 sb3: sb3_sagem_init() sb3: action: 1007 sb3: sb3_wait_for_magic() sb3: action: 1002 sb3: sb3_boot( operational ) sb3: top available addr 0x8f8b0000, ram available = 0xf4b0000 Creating 1 MTD partitions on "nand0": 0x0000000c0000-0x00000fb00000 : "mtd=1" UBI: attaching mtd1 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 126976 bytes UBI: smallest flash I/O unit: 2048 UBI: VID header offset: 2048 (aligned 2048) UBI: data offset: 4096 UBI: attached mtd1 to ubi0 UBI: MTD device name: "mtd=1" UBI: MTD device size: 250 MiB UBI: number of good PEBs: 2002 UBI: number of bad PEBs: 0 UBI: max. allowed volumes: 128 UBI: wear-leveling threshold: 256 UBI: number of internal volumes: 1 UBI: number of user volumes: 7 UBI: available PEBs: 1313 UBI: total number of reserved PEBs: 689 UBI: number of PEBs reserved for bad PEB handling: 20 UBI: max/mean erase counter: 5/1 sb3: read image operational size=1820800 to address=8e080000 sb3_load_ubivol: max_load_size=256573440 Read 25298944 bytes from volume operational to 8e080000 gsdf ident string OK gsdf size OK gsdf auth_hash OK sb3: image operational has gsdf format gsdf ident string OK gsdf size OK gsdf auth_hash OK found a root CA certificate in section 0 root certificate OK (SAGEMCOM GTW Devices Sign Firmware CA) signature OK section list OK gsdf head_hash OK gsdf data_hash OK sb3: image operational signature OK BCM63xx : unregistering Ethernet driver Disabling Switch ports. Flushing Receive Buffers... 0 buffers found. Closing DMA Channels. sb3: No pre-boot commands sb3: setting kernel args bootm 8E081000 ## Booting kernel from Legacy Image at 8e081000 ... Image Name: scOS SG7M100000110 (8a.80.7) Created: 2018-02-23 2:29:20 UTC Image Type: MIPS Linux Kernel Image (gzip compressed) Data Size: 2818048 Bytes = 2.7 MiB Load Address: 80010000 Entry Point: 8046b3e0 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... Linux version 3.4.11-rt19 (g503759@shz01020) (gcc version 4.6.2 (GCC) ) #3 SMP PREEMPT Fri Feb 23 10:29:03 CST 2018 F@ST4353 prom init CPU revision is: 0002a080 (Broadcom BMIPS4350) DSL SDRAM reserved: 0x132000 Determined physical RAM map: memory: 0fece000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x0000fece Movable zone start PFN for each node Early memory PFN ranges 0: 0x00000000 -> 0x0000fece On node 0 totalpages: 65230 free_area_init_node: node 0, pgdat 80582150, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 478 pages used for memmap Normal zone: 60656 pages, LIFO batch:15 PERCPU: Embedded 7 pages/cpu @81203000 s5392 r8192 d15088 u32768 pcpu-alloc: s5392 r8192 d15088 u32768 alloc=8*4096 pcpu-alloc: [0] 0 [0] 1 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 64720 Kernel command line: ro noinitrd root=mtd:rootfs init=/etc/preinit ro rootfstype=squashfs console=ttyS0,115200 rootfs_offset=0x002b1800 rootfs_size=0x0156f000 mtdparts=nand:768k(bcm),5120k@-5120k(data),-@768k(partAll) ubi.mtd=ubi part_main=partAll part_boot=partAll image_ubivol=operational board_type=000200f0 console=ttyS0,115200 earlyprintk debug init=/etc/preinit irqaffinity=0 UBI image volume: "operational" PID hash table entries: 1024 (order: 0, 4096 bytes) Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Memory: 252488k/260920k available (4519k kernel code, 8432k reserved, 1059k data, 220k init, 0k highmem) Preemptible hierarchical RCU implementation. NR_IRQS:128 console [ttyS0] enabled Calibrating delay loop... 397.31 BogoMIPS (lpj=198656) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 --Kernel Config-- SMP=1 PREEMPT=1 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 Broadcom Logger v0.1 Feb 22 2018 21:15:11 CPU revision is: 0002a080 (Broadcom BMIPS4350) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Brought up 2 CPUs NET: Registered protocol family 16 Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (00008fe9-00008fe7=2<300) registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb PCI host bridge to bus 0000:00 pci_bus 0000:00: root bus resource [mem 0xa0f00000-0xa0ffffff] pci_bus 0000:00: root bus resource [io 0xa2000000-0xa200ffff] pci 0000:00:00.0: [14e4:435f] type 00 class 0x028000 pci 0000:00:00.0: reg 10: [mem 0x10004000-0x10005fff] pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310 pci 0000:00:09.0: reg 10: [mem 0x10002600-0x100026ff] pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320 pci 0000:00:0a.0: reg 10: [mem 0x10002500-0x100025ff] PCI host bridge to bus 0000:01 pci_bus 0000:01: root bus resource [mem 0x11000000-0x11efffff] pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0] pci 0000:01:00.0: [14e4:6326] type 01 class 0x060400 pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:02:00.0: [14e4:aa52] type 00 class 0x028000 pci 0000:02:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit] pci 0000:02:00.0: reg 18: [mem 0x00000000-0x003fffff 64bit] pci 0000:02:00.0: supports D1 D2 pci 0000:01:00.0: BAR 8: assigned [mem 0x11000000-0x115fffff] pci 0000:02:00.0: BAR 2: assigned [mem 0x11000000-0x113fffff 64bit] pci 0000:02:00.0: BAR 0: assigned [mem 0x11400000-0x11407fff 64bit] pci 0000:01:00.0: PCI bridge to [bus 02-02] pci 0000:01:00.0: bridge window [mem 0x11000000-0x115fffff] PCI: Enabling device 0000:01:00.0 (0000 -> 0002) bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated bcmleg_spi bcmleg_spi.0: master is unqueued, this is deprecated skbFreeTask created successfully gbpm_do_work scheduled BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 Feb 22 2018 21:19:31 initialized Broadcom GBPM v0.1 Feb 22 2018 21:19:31 initialized NET: Registered protocol family 8 NET: Registered protocol family 20 Switching to clocksource MIPS NET: Registered protocol family 2 IP route cache hash table entries: 2048 (order: 1, 8192 bytes) TCP established hash table entries: 8192 (order: 4, 65536 bytes) TCP bind hash table entries: 8192 (order: 4, 65536 bytes) TCP: Hash tables configured (established 8192 bind 8192) TCP: reno registered UDP hash table entries: 128 (order: 0, 4096 bytes) UDP-Lite hash table entries: 128 (order: 0, 4096 bytes) NET: Registered protocol family 1 PCI: CLS mismatch (64 != 16), using 16 bytes bcm_tstamp initialized, (hpt_freq=200000000 2us_div=200 2ns_mult=5 2ns_shift=0) exFAT: Version 1.2.9 squashfs: version 4.0 (2009/01/31) Phillip Lougher Registering unionfs 2.5.12 (for 3.4.70) jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. fuse init (API version 7.18) msgmni has been set to 493 io scheduler noop registered (default) Broadcom NAND controller (BrcmNand Controller) mtd->oobsize=0, mtd->eccOobSize=0 NAND_CS_NAND_XOR=00000000 B4: NandSelect=40000001, nandConfig=16152300, chipSelect=0 brcmnand_read_id: CS0: dev_id=c8da9095 After: NandSelect=40000001, nandConfig=16152300 DevId c8da9095 may not be supported. Will use config info Spare Area Size = 16B/512B Block size=00020000, erase shift=17 NAND Config: Reg=16152300, chipSize=256 MB, blockSize=128K, erase_shift=11 busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff timing1 not adjusted: 6574845b timing2 not adjusted: 00001e96 ECC level changed to 4 OOB size changed to 16 BrcmNAND mfg 0 0 UNSUPPORTED NAND CHIP 256MB on CS0 Found NAND on CS0: ACC=e3441010, cfg=16152300, flashId=c8da9095, tim1=6574845b, tim2=00001e96 BrcmNAND version = 0x0400 256MB @00000000 brcmnand_scan: B4 nand_select = 40000001 brcmnand_scan: After nand_select = 40000001 handle_acc_control: default CORR ERR threshold 1 bits ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16 page_shift=11, bbt_erase_shift=17, chip_shift=28, phys_erase_shift=17 Brcm NAND controller version = 4.0 NAND flash size 256MB @10000000 ECC layout=brcmnand_oob_bch4_2k brcmnand_scan: mtd->oobsize=64 brcmnand_scan: oobavail=35, eccsize=512, writesize=2048 brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=4, eccbytes=7 -->brcmnand_default_bbt brcmnand_default_bbt: bbt_td = bbt_slc_bch4_main_descr Bad block table Bbt0 found at page 0001ffc0, version 0x01 for chip on CS0 Bad block table 1tbB found at page 0001ff80, version 0x01 for chip on CS0 brcmnand_reset_corr_threshold: default CORR ERR threshold 1 bits for CS0 brcmnand_reset_corr_threshold: CORR ERR threshold changed to 3 bits for CS0 brcmnandCET: Status -> Deferred Master size=10000000 rootfs_ofs=0xffffffff, part1ofs=0x00000080, part2ofs=0x0001f600 Part[0] name=bcmfs, size=20000, ofs=0 Part[1] name=bcmfs_update, size=a0000, ofs=20000 Part[2] name=ubi, size=fa40000, ofs=c0000 Part[3] name=data, size=400000, ofs=fb00000 Part[4] name=nvram, size=20000, ofs=0 Creating 5 MTD partitions on "brcmnand.0": 0x000000000000-0x000000020000 : "bcmfs" 0x000000020000-0x0000000c0000 : "bcmfs_update" 0x0000000c0000-0x00000fb00000 : "ubi" 0x00000fb00000-0x00000ff00000 : "data" 0x000000000000-0x000000020000 : "nvram" UBI: attaching mtd2 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 126976 bytes UBI: smallest flash I/O unit: 2048 UBI: VID header offset: 2048 (aligned 2048) UBI: data offset: 4096 UBI: max. sequence number: 1256 UBI: attached mtd2 to ubi0 UBI: MTD device name: "ubi" UBI: MTD device size: 250 MiB UBI: number of good PEBs: 2002 UBI: number of bad PEBs: 0 UBI: number of corrupted PEBs: 0 UBI: max. allowed volumes: 128 UBI: wear-leveling threshold: 4096 UBI: number of internal volumes: 1 UBI: number of user volumes: 7 UBI: available PEBs: 1313 UBI: total number of reserved PEBs: 689 UBI: number of PEBs reserved for bad PEB handling: 20 UBI: max/mean erase counter: 5/1 UBI: image sequence number: 0 UBI: background thread "ubi_bgt0d" started, PID 235 Add UBI volume partitions: name=secondaryboot Add UBI volume partitions: name=uboot Add UBI volume partitions: name=permanent_param Add UBI volume partitions: name=operational Creating 3 MTD partitions on "operational": 0x000000000000-0x00000001f000 : "firm_header" 0x00000001f000-0x0000002d0800 : "kernel" mtd: partition "kernel" doesn't end on an erase block -- force read-only 0x0000002b1800-0x000001820800 : "rootfs" mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only Add UBI volume partitions: name=rescue Add UBI volume partitions: name=filesystem1 Add UBI volume partitions: name=gui Creating 2 MTD partitions on "gui": 0x000000000000-0x00000001f000 : "gui_header" mtd: partition "gui_header" is out of reach -- disabled 0x000000000000-0x000000000000 : "guifs" mtd: partition "guifs" is out of reach -- disabled tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> PPP generic driver version 2.4.2 PPP BSD Compression module registered PPP Deflate Compression module registered NET: Registered protocol family 24 usbcore: registered new interface driver cdc_ether usbcore: registered new interface driver sierra_net usbcore: registered new interface driver usblp usbcore: registered new interface driver usbserial usbserial: USB Serial Driver core usbcore: registered new interface driver sierra USB Serial support registered for Sierra USB modem i2c /dev entries driver brcmboard: brcm_board_init entry SES: Button Interrupt 0x3 is enabled SES: LED GPIO 0x800f is enabled DYING GASP IRQ Initialized and Enabled Serial: BCM63XX driver $Revision: 3.00 $ Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported commands) ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX Total # RxBds=1448 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized bcmPktDma_init: Broadcom Packet DMA Library initialized Laser_Dev: error getting SCL and SDA GPIOs i2c-gpio i2c-gpio.0: using pins 0 (SDA) and 0 (SCL) IPSEC SPU: SUCCEEDED GACT probability NOT on Mirror/redirect action on u32 classifier input device check on Actions configured TCP: cubic registered Initializing XFRM netlink socket NET: Registered protocol family 10 NET: Registered protocol family 17 NET: Registered protocol family 15 Bridge firewalling registered Initializing MCPD Module Ebtables v2.0 registered ebt_time registered ebt_ftos registered ebt_wmm_mark registered L2TP core: blog_l2tp_rcv_check L2TP core driver, V2.0 PPPoL2TP kernel driver, V2.0 8021q: 802.1Q VLAN Support v1.8 VFS: Mounted root (squashfs filesystem) readonly on device 31:11. Freeing unused kernel memory: 220k freed kernel.hotplug = /sbin/mdev - preinit - - regular preinit - - init - mkdir: can't create directory '/opt/conf': No such file or directory remove filesystem2 Mount filesystem1 UBIFS: recovery needed UBIFS: recovery completed UBIFS: mounted UBI device 0, volume 5, name "filesystem1" UBIFS: file system size: 11046912 bytes (10788 KiB, 10 MiB, 87 LEBs) UBIFS: journal size: 1015809 bytes (992 KiB, 0 MiB, 6 LEBs) UBIFS: media format: w4/r0 (latest is w4/r0) UBIFS: default compressor: lzo UBIFS: reserved for root: 521772 bytes (509 KiB) filesystem2 linked on filesystem1 Switch root file system to unionfs Mount smackfs ok ! Init smack configuration ok ! Registering temperature sensor i2c i2c-0: new_device: Instantiated device lm75 at 0x48 Tue Jan 1 00:00:00 UTC 2013 unionfs: new lower inode mtime (bindex=1, name=tmp) bsp_gpio_data: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint Driver LED and BUTTON init ..... [HAL-BSP]: kSysButtonManaged[41]: WARNING -> Button name >= Max(9) [HAL-BSP]: kSysButtonManaged[41]: WARNING -> Button name >= Max(9) [HAL-BSP]: kSysButtonManaged[41]: WARNING -> Button name >= Max(9) Driver LED and BUTTON ok ..... nf_ct_rtsp: Successfully created nf_conntrack_rtsp task Broadcom Ingress QoS Module Char Driver v0.1 Feb 22 2018 19:36:06 Registered<243> Broadcom Ingress QoS ver 0.1 initialized BPM: tot_mem_size=268435456B (256MB), buf_mem_size <15%> =40265310B (38MB), num of buffers=19972, buf size=2016 Broadcom BPM Module Char Driver v0.1 Feb 22 2018 19:35:55 Registered<244> bcmxtmrt: Broadcom BCM3167D0 ATM/PTM Network Device v0.9 Feb 22 2018 19:38:27 NBUFF v1.0 Initialized Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 Feb 22 2018 19:36:06 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. [FHW] pktDbgLvl[0xc04cc350]=0 [FHW] fhw_construct: Initialized Fcache HW accelerator layer state flwStatsThread created Constructed Broadcom Packet Flow Cache v2.2 Feb 22 2018 19:36:06 chipId 0x631670D0 Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Feb 22 2018 19:35:56 Registered <241> Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done FAP Debug values at 0xac124270 0xac1a4270 fapGso_LoopBkThread created successfully Allocated FAP0 SWQ_HOST2FAP_GSO_LOOPBACK_Q mem=afa88000 : 16384 bytes Allocated FAP0 SWQ_FAP2HOST_GSO_LOOPBACK_Q mem=afb08000 : 16384 bytes GSO LOOPBACK Cached HOST2FAP Q INFO: Swq =b0825ef0 qStart=afa88000 qEnd=afa8c000 msgSize=4 dqm=18 fapId=0 GSO LOOPBACK Cached FAP2HOST Q INFO: Swq =b0825ec0 qStart=afb08000 qEnd=afb0c000 msgSize=2 dqm=19 fapId=0 Allocated FAP0 SWQ_FAP2HOST_WFD_Q mem=af33e000 : 7200 bytes Allocated FAP1 SWQ_FAP2HOST_WFD_Q mem=ac09e000 : 7200 bytes Allocated FAP0 SWQ_FAP2HOST_WFD_Q mem=acbac000 : 7200 bytes Allocated FAP1 SWQ_FAP2HOST_WFD_Q mem=acbae000 : 7200 bytes Allocated FAP0 TM SDRAM Queue Storage (ac135300) : 390144 bytes @ ac200000 Allocated FAP1 TM SDRAM Queue Storage (ac1b5300) : 390144 bytes @ ac280000 [NTC fapProto] fapReset : Reset FAP Protocol layer [FAP0] DSPRAM : stack <0x80000000><1792>, global <0x80000700><4576>, free <1824>, total<8192> [FAP1] DSPRAM : stack <0x80000000><1792>, global <0x80000700><4576>, free <1824>, total<8192> [FAP0] PSM : addr<0x80002000>, used <24464>, free <112>, total <24576> [FAP1] PSM : addr<0x80002000>, used <24464>, free <112>, total <24576> [FAP0] DQM : availableMemory 14668 bytes, nextByteAddress 0xE00048B0 [FAP1] DQM : availableMemory 14668 bytes, nextByteAddress 0xE00048B0 [FAP0] Initializing FAP4KE GSO LOOPBACK on fapIdx=0 ... [FAP1] IC Timer started [FAP0] SWQ: HOST2FAP_GSO_LOOPBACK [FAP1] FAP4KE WFD Init Done... [FAP0] >>>>------------------ [FAP0] swq =80007ef0 msgSize =4 words , maxDepth=1024 [FAP0] qStart =afa88000 qEnd=afa8c000 [FAP0] rdPtr =afa88000 wrPtr=afa88000 count=0 [FAP0] swq->interrupts 0 processed =0 dropped =0 [FAP0] Associated DQM=18 dir HOST2FAP [FAP0] ------------------<<<< [FAP0] SWQ: FAP2HOST_GSO_LOOPBACK [FAP0] >>>>------------------ [FAP0] swq =80007ec0 msgSize =2 words , maxDepth=2048 [FAP0] qStart =afb08000 qEnd=afb0c000 [FAP0] rdPtr =afb08000 wrPtr=afb08000 count=0 [FAP0] swq->interrupts 0 processed =0 dropped =0 [FAP0] Associated DQM=19 dir FAP2HOST [FAP0] ------------------<<<< [FAP0] FAP4KE GSO LOOPBACK Init Done... [FAP0] IC Timer started [FAP0] FAP4KE WFD Init Done... [FAP1] FAP BPM Initialized. [FAP0] FAP BPM Initialized. Broadcom Packet Flow Cache HW acceleration enabled. fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes bcmPktDma_bind: FAP Driver binding successfull [FAP1] FAP TM: ON [FAP0] FAP TM: ON bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCM63167D0 Ethernet Network Device v0.1 Feb 22 2018 19:38:17 Broadcom GMAC Char Driver v0.1 Feb 22 2018 19:38:25 Registered<249> Broadcom GMAC Driver v0.1 Feb 22 2018 19:38:25 Initialized fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000 ETH Init: Ch:0 - 200 tx BDs at 0xb0a20650 fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000 ETH Init: Ch:1 - 200 tx BDs at 0xb0820650 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184 ETH Init: Ch:0 - 600 rx BDs at 0xb0821910 [FAP0] enetRxChannel 0 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184 ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910 [FAP1] enetRxChannel 1 dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered eth0: <Ext sw port: 0> <Logical : 08> PHY_ID <0x20180000 : 0x00> MAC : 00:00:00:00:00:01 eth1: <Ext sw port: 1> <Logical : 09> PHY_ID <0x20180001 : 0x01> MAC : 00:00:00:00:00:01 eth2: <Ext sw port: 2> <Logical : 10> PHY_ID <0x20180002 : 0x02> MAC : 00:00:00:00:00:01 eth3: <Ext sw port: 3> <Logical : 11> PHY_ID <0x20180003 : 0x03> MAC : 00:00:00:00:00:01 eth4: <Int sw port: 3> <Logical : 03> PHY_ID <0x00000004 : 0x04> MAC : 00:00:00:00:00:01 Ethernet Auto Power Down and Sleep: Enabled All Port Bit Map: 0x0f08: eth4,eth0,eth1,eth2,eth3 Chip WAN Only Ports 0000, Defined WAN Only Ports 0000, WAN Only Port Result: 0x0000: Chip WAN Preffered Ports 0000, Defined WAN Preffered Ports 0000, WAN Preffered Port Result: 0x0000: Chip LAN Only Ports 0000, Defined LAN Only Ports 0000, LAN Only Port Result: 0x0000: WAN/LAN Both Capable Ports 0x0f08:eth4,eth0,eth1,eth2,eth3 [NTC arl] arlEnable : Enabled ARL binding to FAP Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 Feb 22 2018 19:35:55 Registered <245> Wifi Forwarding Driver is initialized! DHD_FKB_POOL size is:1280 and entry size:2016 fkbpool address range: 8b800000 <-> 8ba76000 DHD_PKTTAG POOL size is:1280 and entry size:48 dhd_module_init in dhd_queue_budget = 256 dhd_sta_threshold = 2048 dhd_if_threshold = 65536 no wifi platform data, skip dhdpcie_chipmatch: Unsupported vendor 14e4 device 435f dhdpcie_pci_probe: chipmatch failed!! PCI_PROBE: bus 2, slot 0,vendor 14E4, device AA52(good PCI location) dhdpcie_init: can't find adapter info for this chip PCI: Enabling device 0000:02:00.0 (0000 -> 0002) DHD: dongle ram size is set to 983040(orig 983040) at 0x180000 dhd:0: fw path:/etc/wlan/dhd nv path:(null) dhd_attach: wl0: pre-allocated buffer mode is enabled (allocskbsz=2048) dhd_attach(): thread:dhd_watchdog_thread:2b8 started dhd_attach(): thread:dhd0_dpc:2b9 started dhd_deferred_work_init: work queue initialized wfd_bind: Dev wl%d wfd_idx 0 wl_radio_idx 0 Type fkb configured WFD thread wfd0-thrd minQId/maxQId (20/1073741844), status (0) qmask 0x3 Instantiating WFD 0 thread dhd:0: fw path:/etc/wlan/dhd nv path:(null) dhd_bus_download_firmware: firmware path=/etc/wlan/dhd, nvram path= dhdpcie_ramsize_adj: Enter dhdpcie_download_code_file: download firmware /etc/wlan/dhd/43602a1/rtecdc.bin wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl: ID=pci/2/0/ wl: ID=pci/2/0/ wl: loading /etc/wlan/bcm43602_map.bin wl: updating srom from flash... Replace or append with internal Mac Address dhdpcie_bus_write_vars: Download, Upload and compare of NVRAM succeeded. PCIe shared addr (0x001eafdc) read took 42023 usec before dongle is ready DMA RX offset from shared Area 0 dhdpcie_readshared: Dongle advertizes 2 size indices dhdpcie_readshared: Host support DMAing indices: H2D:1 - D2H:1. FW supports it H2D DMA WR INDX : array size 268 = 2 * 134 D2H DMA RD INDX : array size 6 = 2 * 3 D2H DMA WR INDX : array size 6 = 2 * 3 H2D DMA RD INDX : array size 268 = 2 * 134 ring_info_raw: 56 fc a3 26 00 8c ac 26 00 98 ad 26 00 a4 ae 26 00 aa ae 26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 86 00 00 00 dhdpcie_readshared: max H2D queues 134 dhd_bus_start: Initializing 134 h2drings dhd_bus_cmn_writeshared: 0000: 00 00 2e 0f 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 80 35 0c 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 e0 bf 0c 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 c0 24 0f 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 00 25 0f 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 00 e0 0b 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 14 10 00 dhd_bus_cmn_writeshared: 0000: 80 06 36 0b 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 aa c6 0b 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 ac c6 0b 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 80 07 36 0b 00 00 00 00 Attach flowrings pool for 132 rings CUR_ETHERADDR : 6 00 00 00 00 00 01 dhd_sync_with_dongle: GET_REVINFO device 0xbc430000, vendor 0xe4140000, chipnum 0x52aa0000 Dongle Host Driver, version 7.14.164.15.cpe4.16L04.1-kdb +++++ Added gso loopback support for dev=wl0 <8bc69000> wfd_registerdevice Successfully registered dev wl0 ifidx 0 wfd_idx 0 Broadcom PCI Device 0x6326 has allocated with driver pcieport dhd_module_init out --SMP support wl: dsl_tx_pkt_flush_len=338 wl: norm_wmark_tot=10043, pktc_wmark_tot=10043 wl: passivemode=1 wl: napimode=0 Neither SPROM nor OTP has valid image wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl: ID=sb/0/ wl: ID=sb/0/ wl: loading /etc/wlan/bcm6362_map.bin srom rev:8 wl1: allocskbmode=1 currallocskbsz=2300 wfd_bind: Dev wl%d wfd_idx 1 wl_radio_idx 1 Type skb configured WFD thread wfd1-thrd minQId/maxQId (21/1073741845), status (0) qmask 0xc Instantiating WFD 1 thread +++++ Added gso loopback support for dev=wl1 <8bc6b000> wfd_registerdevice Successfully registered dev wl1 ifidx 0 wfd_idx 1 wl1: Broadcom BCM435f 802.11 Wireless Controller 7.14.164.15.cpe4.16L04.1-kdb dgasp: kerSysRegisterDyingGaspHandler: wl1 registered Bad rebount count =2 Check restore default by button POLARITY = Low BUT_STATE = 1 Check restore default by flags find: /usr/share/gui-*/www/gui/version.txt: No such file or directory Invalid RSA or empty external GUI image 'checkfirmware' unavailable, not checking image Starting firewall-utils: OK Run swmdk Run hg6d Energy Efficient Ethernet: Enabled --OUTPUT_DROP--IN= OUT=bcmsw SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=76 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 bcmxtmcfg: DS xDSL G.inp Mode = DISABLED bcmxtmcfg: xDSL G.Fast Mode = DISABLED fapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22be0 bytes remaining 584 XTM Init: Ch:0 - 200 rx BDs at 0xb0a22be0 fapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a23220 bytes remaining 456 XTM Init: Ch:1 - 16 rx BDs at 0xb0a23220 bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system bcmxtmcfg: Out of sequence call to XTM_ASM_HANDLER::Uninitialize(). Recovering. bcmxtmcfg: ATM Bonding configured in system. Fallback mode = Enabled bcmxtmcfg: Bonding State is DATA_IDLE bcmxtmcfg: SID MODE SET to 12 BIT MODE bcmxtmcfg: ATM Bonding Mgmt Log Area = 8959f514 *** dslThread dslPid=975 BcmAdsl_Initialize=0xC0672050, g_pFnNotifyCallback=0xC06AD1A0 lmemhdr[2]=0x100CE000, pAdslLMem[2]=0x100CE000 pSdramPHY=0xAFFFFFF8, 0x408068A6 0x44084480 *** XfaceOffset: 0x5FF90 => 0x5FF90 *** *** PhySdramSize got adjusted: 0xF5C24 => 0x129BB0 *** AdslCoreSharedMemInit: shareMemSize=33840(33840) AdslCoreHwReset: pLocSbSta=86c60000 bkupThreshold=3072 AdslCoreHwReset: AdslOemDataAddr = 0xAFFB4648 VersionInfo: A2pv6F039x6.d26e ***BcmDiagsMgrRegisterClient: 0 *** dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM PCI: Enabling device 0000:00:09.0 (0000 -> 0002) hub 1-0:1.0: over-current condition on port 2


OpenWrt bootlog

NOTE: I made some changes to the CFE so that its internal states are more visible. The default CFE build prints much less information.

CPUI L1CI HELO CPUI L1CI 5.0204patch2xpon-1.0.38-162.103 DRAM ---- PHYS STRF 400H PHYE DDR3 SIZ4 SIZ3 DINT USYN LSYN MFAS LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN Boot Strap Register: 0x1ff9fbf Rikka0w0: decompressLZMA in@0x80004084=0x0000EA97, out=@0x80A01000=0x01700000 Rikka0w0: decompressLZMA origsize=0x000486F0 Rikka: cfe_launch = 0x80A01000 Base: 5.2_04patch2xpon CFE version 1.0.38-162.103 for BCM963268 (32bit,SP,BE) Build Date: Fri Oct 31 05:03:58 AEDT 2025 (rikka@i9-13900ks-wsl) Copyright (C) 2000-2015 Broadcom Corporation. Boot Strap Register: 0x1ff9fbf Chip ID: BCM63167_D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz Main Thread: TP0 Memory Test Passed Total Memory: 268435456 bytes (256MB) Boot Address: 0xb8000000 Rikka0w0 xprintf HS Serial flash device: GD25LQ128, id 0xc818 sector 64KB size 16384KB [kerSysFlashInit] fInfo.flash_rootfs_start_offset = 0x00030000 Flash not used for Auxillary File System [getTagFromPartition] getTagFromPartition(imageNumber=1) [getTagFromPartition] pBase=0xB8000000 reserverdBytersAuxfs=0x00000000 sectSize=0x00010000 [getTagFromPartition] Img1 flash_get_blk() of 0xB8030000 [getTagFromPartition] blk=0x00000003 pSectAddr=0x80A4A00C [getTagFromPartition] getTagFromPartition(imageNumber=2) [getTagFromPartition] pBase=0xB8000000 reserverdBytersAuxfs=0x00000000 sectSize=0x00010000 [getTagFromPartition] blk=0x00000080 pSectAddr=0x80A4A10C [getTagFromPartition] getTagFromPartition(imageNumber=1) [getTagFromPartition] pBase=0xB8000000 reserverdBytersAuxfs=0x00000000 sectSize=0x00010000 [getTagFromPartition] Img1 flash_get_blk() of 0xB8030000 [getTagFromPartition] blk=0x00000003 pSectAddr=0x80A4A00C [getTagFromPartition] getTagFromPartition(imageNumber=2) [getTagFromPartition] pBase=0xB8000000 reserverdBytersAuxfs=0x00000000 sectSize=0x00010000 [getTagFromPartition] blk=0x00000080 pSectAddr=0x80A4A10C Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host/tftp (f/h/c) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Default host ramdisk file name : Default ramdisk store address : Default DTB file name : Board Id : 963268SV2_EXTSW Number of MAC Addresses (1-64) : 10 Base MAC Address : 00:18:10:00:00:00 PSI Size (1-128) KBytes : 40 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 0 Main Thread Number [0|1] : 0 WLan Feature : 0x00 Initalizing switch low level hardware. Software Resetting Switch ... Done. Waiting MAC port Rx/Tx to be enabled by hardware ...Done. Disable Switch All MAC port Rx/Tx Software Resetting Switch ... Done. External switch id = 5075 Waiting MAC port Rx/Tx to be enabled by hardware ...Done. Disable all Switch MAC Rx/Tx *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 [getTagFromPartition] getTagFromPartition(imageNumber=1) [getTagFromPartition] pBase=0xB8000000 reserverdBytersAuxfs=0x00000000 sectSize=0x00010000 [getTagFromPartition] Img1 flash_get_blk() of 0xB8030000 [getTagFromPartition] blk=0x00000003 pSectAddr=0x80A4A00C [getTagFromPartition] getTagFromPartition(imageNumber=2) [getTagFromPartition] pBase=0xB8000000 reserverdBytersAuxfs=0x00000000 sectSize=0x00010000 [getTagFromPartition] blk=0x00000080 pSectAddr=0x80A4A10C bootCompressedImage [getTagFromPartition] getTagFromPartition(imageNumber=1) [getTagFromPartition] pBase=0xB8000000 reserverdBytersAuxfs=0x00000000 sectSize=0x00010000 [getTagFromPartition] Img1 flash_get_blk() of 0xB8030000 [getTagFromPartition] blk=0x00000003 pSectAddr=0x80A4A00C [getTagFromPartition] getTagFromPartition(imageNumber=2) [getTagFromPartition] pBase=0xB8000000 reserverdBytersAuxfs=0x00000000 sectSize=0x00010000 [getTagFromPartition] blk=0x00000080 pSectAddr=0x80A4A10C Rikka0w0: pTag1=0x80a4a00c, pTag2=0x00000000, pCurTag=0x80a4a00c Rikka0w0: pCurTag->rootfsAddress=3217228032 Rikka0w0: BOOT_OFFSET=0xf8400000 Rikka0w0: IMAGE_OFFSET=0x00000000 Rikka0w0: TAG_LEN=0x00000100 Booting from only image (0xb8030000) ... Code Address1: 0x80000000, Entry Address: 0x80010000 Rikka0w0: decompressLZMA in@0x80D5DD2C=0x002FE599, out=@0x80000000=0x01700000 Rikka0w0 LZMA: Prossible old LZMA format, trying to decompress.. Decompression LZ4 image OK! Entry at 0x80010000 QAQ Starting program at 0x80010000 Rikka0w0: [0] = 0x40809000 Rikka0w0: [4] = 0x40809800 Rikka0w0: [8] = 0x40806800 [ 0.000000] Linux version 6.6.110 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r28977-6099cd1c53) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Thu Oct 30 15:24:46 2025 [ 0.000000] CPU0 revision is: 0002a080 (Broadcom BMIPS4350) [ 0.000000] MIPS: machine is Sagemcom F@ST 4353 [ 0.000000] 256MB of RAM installed [ 0.000000] earlycon: bcm63xx_uart0 at MMIO 0x10000180 (options '115200n8') [ 0.000000] printk: bootconsole [bcm63xx_uart0] enabled [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Reserving 0KB of memory at 4194303KB for kdump [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] percpu: Embedded 12 pages/cpu s18592 r8192 d22368 u49152 [ 0.000000] Kernel command line: earlycon [ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear) [ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear) [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 64960 [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 248064K/262144K available (8302K kernel code, 650K rwdata, 1000K rodata, 1240K init, 222K bss, 14080K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 [ 0.000000] rcu: Hierarchical RCU implementation. [ 0.000000] Tracing variant of Tasks RCU enabled. [ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies. [ 0.000000] NR_IRQS: 256 [ 0.000000] irq_bcm6345_l1: registered BCM6345 L1 intc (IRQs: 128) [ 0.000000] irq_bcm6345_l1: CPU0 (irq = 2) [ 0.000000] irq_bcm6345_l1: CPU1 (irq = 3) [ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention. [ 0.000000] brcm,bcm63268 detected @ 400 MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns [ 0.000002] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns [ 0.008320] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656) [ 0.074658] pid_max: default: 32768 minimum: 301 [ 0.107919] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.115468] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.148739] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2. [ 0.159180] rcu: Hierarchical SRCU implementation. [ 0.164061] rcu: Max phase no-delay instances is 1000. [ 0.170867] smp: Bringing up secondary CPUs ... [ 0.177230] SMP: Booting CPU1... [ 13.558742] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 13.558782] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 13.559060] CPU1 revision is: 0002a080 (Broadcom BMIPS4350) [ 0.240709] Synchronize counters for CPU 1: [ 0.261393] SMP: CPU1 is running [ 0.261413] done. [ 0.271299] smp: Brought up 1 node, 2 CPUs [ 0.290465] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.300686] futex hash table entries: 512 (order: 3, 32768 bytes, linear) [ 0.320973] pinctrl core: initialized pinctrl subsystem [ 0.333253] NET: Registered PF_NETLINK/PF_ROUTE protocol family [ 0.340323] thermal_sys: Registered thermal governor 'step_wise' [ 0.377556] clocksource: Switched to clocksource MIPS [ 0.419546] NET: Registered PF_INET protocol family [ 0.425197] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear) [ 0.436145] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear) [ 0.444864] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 0.452861] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear) [ 0.460830] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear) [ 0.468387] TCP: Hash tables configured (established 2048 bind 2048) [ 0.476753] MPTCP token hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.485251] UDP hash table entries: 256 (order: 1, 8192 bytes, linear) [ 0.492069] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear) [ 0.501164] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 0.507099] PCI: CLS 0 bytes, default 16 [ 0.519149] workingset: timestamp_bits=14 max_order=16 bucket_order=2 [ 0.527773] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.533743] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.562549] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252) [ 0.578652] bcm63xx-power-controller 1000184c.power-controller: registered 14 power domains [ 0.590912] 10000180.serial: ttyS0 at MMIO 0x10000180 (irq = 8, base_baud = 1562500) is a bcm63xx_uart [ 0.600816] printk: console [ttyS0] enabled [ 0.600816] printk: console [ttyS0] enabled [ 0.609604] printk: bootconsole [bcm63xx_uart0] disabled [ 0.609604] printk: bootconsole [bcm63xx_uart0] disabled [ 0.658080] bcm2835-rng 10002880.rng: hwrng registered [ 0.672640] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xda [ 0.679254] nand: ESMT NAND 256MiB 3,3V 8-bit [ 0.683676] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 0.691562] bcm6368_nand 10000200.nand: detected 256MiB total, 128KiB blocks, 2KiB pages, 16B OOB, 8-bit, Hamming ECC [ 0.704770] Bad block table found at page 131008, version 0x01 [ 0.713845] Bad block table found at page 130944, version 0x01 [ 0.721922] 4 fixed-partitions partitions found on MTD device brcmnand.0 [ 0.728909] Creating 4 MTD partitions on "brcmnand.0": [ 0.734166] 0x000000000000-0x000000020000 : "bcmfs" [ 0.743838] OF: Bad cell count for /ubus/nand@10000200/nandcs@0/partitions [ 0.751509] 0x000000020000-0x0000000c0000 : "bcmfs_update" [ 0.759787] 0x0000000c0000-0x00000fb00000 : "ubi" [ 0.769215] 0x00000fb00000-0x00000ff00000 : "stock_data" [ 0.820945] spi-nor spi1.0: gd25q128 (16384 Kbytes) [ 0.828061] 2 fixed-partitions partitions found on MTD device spi1.0 [ 0.835098] Creating 2 MTD partitions on "spi1.0": [ 0.840097] 0x000000000000-0x000000030000 : "cfe" [ 0.846422] 0x000000030000-0x000001000000 : "firmware" [ 0.854980] mtdsplit_bcm63xx: CFE image tag found at 0x0 with version 7, board type 963268SV2_EXTSW [ 0.864480] 2 bcm63xx-fw partitions found on MTD device firmware [ 0.870735] Creating 2 MTD partitions on "firmware": [ 0.875806] 0x000000000100-0x0000002fe6a8 : "kernel" [ 0.880970] mtd: partition "kernel" doesn't start on an erase/write block boundary -- force read-only [ 0.893792] 0x0000002fe6a8-0x000000fd0000 : "rootfs" [ 0.899016] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only [ 0.911481] mtd: setting mtd7 (rootfs) as root device [ 0.916797] 1 squashfs-split partitions found on MTD device rootfs [ 0.923226] 0x0000007e0000-0x000000fd0000 : "rootfs_data" [ 0.937901] bcm63xx-hsspi 10001000.spi: Broadcom 63XX High Speed SPI Controller driver [ 1.026291] bcm6368-mdio-mux 107000b0.mdio: Broadcom BCM6368 MDIO mux bus [ 1.035123] bcm53xx mdio_mux-0.1:1e: found switch: BCM53134, rev 2 [ 1.041745] bcm53xx mdio_mux-0.1:1e: failed to register switch: -517 [ 1.049099] b53-switch 10700000.switch: found switch: BCM63268, rev 0 [ 1.059508] bcm6368-enetsw 1000d800.ethernet: mtd mac 00:10:18:00:00:00 [ 1.178870] bcm6368-enetsw 1000d800.ethernet: eth0 at 0xb000d800, IRQ 0 [ 1.188069] bcm7038-wdt 1000009c.watchdog: Registered BCM7038 Watchdog [ 1.203065] NET: Registered PF_INET6 protocol family [ 1.213282] Segment Routing with IPv6 [ 1.217168] In-situ OAM (IOAM) with IPv6 [ 1.221490] NET: Registered PF_PACKET protocol family [ 1.226705] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 1.241115] 8021q: 802.1Q VLAN Support v1.8 [ 1.527699] random: crng init done [ 1.588217] registering PCI controller with io_map_base unset [ 1.594513] PCI host bridge to bus 0000:00 [ 1.598838] pci_bus 0000:00: root bus resource [mem 0x11000000-0x11efffff] [ 1.605892] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 1.614174] pci 0000:00:00.0: [14e4:6326] type 01 class 0x060400 [ 1.620514] pci 0000:00:00.0: PME# supported from D0 D3hot [ 1.629548] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 1.638174] pci 0000:01:00.0: [14e4:aa52] type 00 class 0x028000 [ 1.644367] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit] [ 1.651427] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x003fffff 64bit] [ 1.658647] pci 0000:01:00.0: supports D1 D2 [ 1.663034] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link) [ 1.678916] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01 [ 1.685703] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01 [ 1.692619] pci 0000:00:00.0: BAR 8: assigned [mem 0x11000000-0x115fffff] [ 1.699651] pci 0000:01:00.0: BAR 2: assigned [mem 0x11000000-0x113fffff 64bit] [ 1.707159] pci 0000:01:00.0: BAR 0: assigned [mem 0x11400000-0x11407fff 64bit] [ 1.714732] pci 0000:00:00.0: PCI bridge to [bus 01] [ 1.719813] pci 0000:00:00.0: bridge window [mem 0x11000000-0x115fffff] [ 1.726943] pcieport 0000:00:00.0: enabling device (0000 -> 0002) [ 1.733569] pcieport 0000:00:00.0: PME: Signaling with IRQ 40 [ 1.741513] bcm53xx mdio_mux-0.1:1e: found switch: BCM53134, rev 2 [ 1.748181] bcm53xx mdio_mux-0.1:1e: failed to register switch: -517 [ 1.755221] b53-switch 10700000.switch: found switch: BCM63268, rev 0 [ 1.918838] b53-switch 10700000.switch: Using legacy PHYLIB callbacks. Please migrate to PHYLINK! [ 1.931195] b53-switch 10700000.switch wan (uninitialized): PHY [mdio_mux-0.0:04] driver [Generic PHY] (irq=POLL) [ 1.945797] bcm6368-enetsw 1000d800.ethernet eth0: entered promiscuous mode [ 1.953374] DSA: tree 0 setup [ 1.957664] bcm53xx mdio_mux-0.1:1e: found switch: BCM53134, rev 2 [ 2.061264] bcm53xx mdio_mux-0.1:1e: Using legacy PHYLIB callbacks. Please migrate to PHYLINK! [ 2.072609] bcm53xx mdio_mux-0.1:1e: Configured port 8 for rgmii [ 2.080223] bcm53xx mdio_mux-0.1:1e lan1 (uninitialized): PHY [dsa-1.0:00] driver [Generic PHY] (irq=POLL) [ 2.093645] bcm53xx mdio_mux-0.1:1e lan2 (uninitialized): PHY [dsa-1.0:01] driver [Generic PHY] (irq=POLL) [ 2.106394] bcm53xx mdio_mux-0.1:1e lan3 (uninitialized): PHY [dsa-1.0:02] driver [Generic PHY] (irq=POLL) [ 2.120038] bcm53xx mdio_mux-0.1:1e lan4 (uninitialized): PHY [dsa-1.0:03] driver [Generic PHY] (irq=POLL) [ 2.134680] b53-switch 10700000.switch extsw: entered promiscuous mode [ 2.141736] DSA: tree 1 setup [ 2.148666] UBI error: unable to read from mtd2 [ 2.153596] clk: Disabling unused clocks [ 2.167151] VFS: Mounted root (squashfs filesystem) readonly on device 31:7. [ 2.183145] Freeing unused kernel image (initmem) memory: 1240K [ 2.189233] This architecture does not have kernel memory protection. [ 2.195839] Run /sbin/init as init process [ 3.208243] init: Console is alive [ 3.212344] init: - watchdog - [ 5.265954] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 5.382411] usbcore: registered new interface driver usbfs [ 5.388311] usbcore: registered new interface driver hub [ 5.393965] usbcore: registered new device driver usb [ 5.402064] gpio_button_hotplug: loading out-of-tree module taints kernel. [ 5.467652] ehci-platform 10002500.usb: EHCI Host Controller [ 5.473518] ehci-platform 10002500.usb: new USB bus registered, assigned bus number 1 [ 5.481986] ehci-platform 10002500.usb: irq 11, io mem 0x10002500 [ 5.517684] ehci-platform 10002500.usb: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 5.528267] hub 1-0:1.0: USB hub found [ 5.532238] hub 1-0:1.0: 2 ports detected [ 5.553728] ohci-platform 10002600.usb: Generic Platform OHCI controller [ 5.560806] ohci-platform 10002600.usb: new USB bus registered, assigned bus number 2 [ 5.569219] ohci-platform 10002600.usb: irq 12, io mem 0x10002600 [ 5.653882] hub 2-0:1.0: USB hub found [ 5.658010] hub 2-0:1.0: 2 ports detected [ 5.684238] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 5.701534] init: - preinit - [ 8.163356] b53-switch 10700000.switch extsw: configuring for fixed/rgmii link mode [ 8.175406] bcm53xx mdio_mux-0.1:1e lan1: configuring for phy/gmii link mode [ 8.177657] b53-switch 10700000.switch extsw: Link is Up - 1Gbps/Full - flow control off Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 12.338030] bcm53xx mdio_mux-0.1:1e lan1: Link is Up - 1Gbps/Full - flow control off [ 12.756030] mount_root: jffs2 not ready yet, using temporary tmpfs overlay [ 12.770214] urandom-seed: Seed file not found (/etc/urandom.seed) [ 12.947714] bcm53xx mdio_mux-0.1:1e lan1: Link is Down [ 12.976365] procd: - early - [ 12.979918] procd: - watchdog - [ 13.697465] procd: - watchdog - [ 13.702383] procd: - ubus - [ 13.869548] procd: - init - Please press Enter to activate this console. [ 15.327711] kmodloader: loading kernel modules from /etc/modules.d/* [ 17.115657] Loading modules backported from Linux version v6.12.52-0-g2b2cbdcede38 [ 17.123564] Backport generated by backports.git v6.1.110-1-35-g410656ef [ 17.724556] urngd: v1.0.2 started. [ 17.793550] PPP generic driver version 2.4.2 [ 17.801883] NET: Registered PF_PPPOX protocol family [ 17.832440] usbcore: registered new interface driver brcmfmac [ 17.838671] brcmfmac 0000:01:00.0: enabling device (0000 -> 0002) [ 17.968006] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43602-pcie for chip BCM43602/1 [ 17.978959] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac43602-pcie.sagem,fast-4353-cfe-spi-nor.bin failed with error -2 [ 17.991741] brcmfmac 0000:01:00.0: Falling back to sysfs fallback for: brcm/brcmfmac43602-pcie.sagem,fast-4353-cfe-spi-nor.bin [ 18.168355] kmodloader: done loading kernel modules from /etc/modules.d/* [ 19.008317] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac43602-pcie.txt failed with error -2 [ 19.018546] brcmfmac 0000:01:00.0: Falling back to sysfs fallback for: brcm/brcmfmac43602-pcie.txt [ 19.188179] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac43602-pcie.clm_blob failed with error -2 [ 19.198870] brcmfmac 0000:01:00.0: Falling back to sysfs fallback for: brcm/brcmfmac43602-pcie.clm_blob [ 19.416773] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac43602-pcie.txcap_blob failed with error -2 [ 19.427760] brcmfmac 0000:01:00.0: Falling back to sysfs fallback for: brcm/brcmfmac43602-pcie.txcap_blob [ 20.007699] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [ 20.019160] brcmfmac: brcmf_c_process_txcap_blob: no txcap_blob available (err=-2) [ 20.028143] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43602/1 wl0: Sep 18 2015 03:30:01 version 7.35.177.56 (r587209) FWID 01-6cb8e269 [ 53.538493] b53-switch 10700000.switch extsw: Link is Down [ 53.615746] b53-switch 10700000.switch extsw: configuring for fixed/rgmii link mode [ 53.626974] b53-switch 10700000.switch extsw: Link is Up - 1Gbps/Full - flow control off [ 53.651083] bcm53xx mdio_mux-0.1:1e lan1: configuring for phy/gmii link mode [ 53.664026] switch: port 1(lan1) entered blocking state [ 53.669616] switch: port 1(lan1) entered disabled state [ 53.675073] bcm53xx mdio_mux-0.1:1e lan1: entered allmulticast mode [ 53.681628] b53-switch 10700000.switch extsw: entered allmulticast mode [ 53.688482] bcm6368-enetsw 1000d800.ethernet eth0: entered allmulticast mode [ 53.723421] bcm53xx mdio_mux-0.1:1e lan1: entered promiscuous mode [ 54.093706] bcm53xx mdio_mux-0.1:1e lan2: configuring for phy/gmii link mode [ 54.101488] 8021q: adding VLAN 0 to HW filter on device lan2 [ 54.157789] switch: port 2(lan2) entered blocking state [ 54.163254] switch: port 2(lan2) entered disabled state [ 54.169033] bcm53xx mdio_mux-0.1:1e lan2: entered allmulticast mode [ 54.288302] bcm53xx mdio_mux-0.1:1e lan2: entered promiscuous mode [ 54.430589] bcm53xx mdio_mux-0.1:1e lan3: configuring for phy/gmii link mode [ 54.438638] 8021q: adding VLAN 0 to HW filter on device lan3 [ 54.485281] switch: port 3(lan3) entered blocking state [ 54.490809] switch: port 3(lan3) entered disabled state [ 54.496300] bcm53xx mdio_mux-0.1:1e lan3: entered allmulticast mode [ 54.548980] bcm53xx mdio_mux-0.1:1e lan3: entered promiscuous mode [ 54.679813] bcm53xx mdio_mux-0.1:1e lan4: configuring for phy/gmii link mode [ 54.687480] 8021q: adding VLAN 0 to HW filter on device lan4 [ 54.706209] switch: port 4(lan4) entered blocking state [ 54.711892] switch: port 4(lan4) entered disabled state [ 54.717327] bcm53xx mdio_mux-0.1:1e lan4: entered allmulticast mode [ 54.729323] bcm53xx mdio_mux-0.1:1e lan4: entered promiscuous mode [ 54.809219] b53-switch 10700000.switch wan: configuring for phy/gmii link mode [ 54.820116] switch: port 5(wan) entered blocking state [ 54.825444] switch: port 5(wan) entered disabled state [ 54.831050] b53-switch 10700000.switch wan: entered allmulticast mode [ 55.028288] b53-switch 10700000.switch wan: entered promiscuous mode [ 56.818806] bcm53xx mdio_mux-0.1:1e lan1: Link is Up - 1Gbps/Full - flow control off [ 56.826892] switch: port 1(lan1) entered blocking state [ 56.832345] switch: port 1(lan1) entered forwarding state [ 57.010015] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0 [ 57.027917] jffs2_build_filesystem(): unlocking the mtd device... [ 57.028057] done. [ 57.036365] jffs2_build_filesystem(): erasing all blocks after the end marker... [ 89.997686] done. [ 90.007345] jffs2: notice: (2328) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 90.300622] overlayfs: upper fs does not support tmpfile. BusyBox v1.36.1 (2025-10-30 15:24:46 UTC) built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt 24.10-SNAPSHOT, r28977-c9a9273334 ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@OpenWrt:~#


Notes

  1. Available U-Boot commands:
    f4353 > help
?       - alias for 'help'
base    - print or set address offset
bcmled  - bcmled led_hex_value

boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cie     - displays the CIE parameter
cie_set - sets the CIE parameter
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dfa     - displays the DFA parameter
dfa_set - sets the DFA parameter
dhcp    - boot image via network using DHCP/TFTP protocol
editenv - edit environment variable
env     - environment handling commands
flag    - displays the factory flags
flag_set- sets one factory flag
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
go      - start application at address 'addr'
help    - print command description/usage
iminfo  - print header information for application image
itest   - return true/false on integer compare
loop    - infinite loop on address range
ls      - list files in a directory (default /)
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
sb      - secure boot
secure_set- sets the bootloader in secure mode
setenv  - set environment variables
sleep   - delay execution for some time
source  - run script from memory
tftpboot- boot image via network using TFTP protocol
ubi     - ubi commands
ubifsload- load file from an UBIFS filesystem
ubifsls - list files in a directory
ubifsmount- mount UBIFS volume
ubifsumount- unmount UBIFS volume
version - print monitor, compiler and linker version
waitForMagic- Test WAIT_FOR_MAGIC function

    There is an interesting waitForMagic- Test WAIT_FOR_MAGIC function, which could be Sagemcom's way of interrupting the boot process or flashing new firmwares.

  2. OpenWrt forum discussion of Belong 4353

See Also

  1. ezruneko/masvoz-sagemcom-fast-5355-hacks: Sagemcom F@ST 5355 Router Research
  2. Sagemcom F@st 5350 GV – Unlocking | O3 Labs
  3. Sorry Telstra but this is my F@ST 5355 router | by ThaFresh | Medium
  4. Sagemcom F@ST 5355 Hacking - Modems/Routers
  5. Lyrebirds/sagemcom-fast-3890-exploit
  6. mattimustang/optus-sagemcom-fast-3864-hacks: Advanced tools and tips for the Optus Sagemcom F@st 3864 broadband router

Tags

, , , ,
1)
If you don't have a SPI flash programmer, you need to RAM-Boot OpenWrt on the stock U-Boot to write CFE to the SPI flash, patching the stock U-Boot will be required.
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2025/11/03 07:14
  • by rikka0w0