SKY SR102
The Sky SR102 (Black) is an 400MHz dual-core Broadcom MIPS-based ADSL2+/VDSL2 router with 802.11bgn wireless and ADSL2+ support. It has a 4-port switch (3x LAN, 1x WAN) and (1x ADSL2+/VDSL2 port), The wireless antenna is integrated in the device but can be replaced with any half mini PCIe module.
There was also a re-branding of the same model and size with a NOW TV Green Logo. This is a NR701 https://i.imgur.com/5Cq38Sd.jpg
- SR102 GPL Source code: http://www1.sky.com/opensourcesoftware/SkyHub/sky_hub_downloads.html
- NR701 GPL Source code: http://www1.sky.com/opensourcesoftware/NowTvHub/NowTv_hub_downloads.html
- Manufacturer's / Distributor's site: http://www.sky.com/shop/broadband-talk/
The NowTV Hub Two (model NR801) is also based on this design with a similar layout of UART serial pins.
Supported Versions
Hardware Highlights
Installation
→ Install OpenWrt (generic explanation)
Please verify if below procedure is still valid now that stable release support is available and update as needed. --- tmomas 2020/01/27 17:27
You will need a TTL Serial Port or a Parallel Port (eJTAG) to change the firmware.
→ A Bootloder/CFE.
→ A compiled Firmware with the patch applied.
→ Openwrt Patch: sky-sr102-limited-support.patch (may need to remove the 'diff' & 'index' lines)
File Layout: CFE image (Pad it out to 64K if required) + the openwrt image + the 20 byte tag.
If you are using a Serial port, you will need to upload a flash burner program to the router.
bcm-image-burner.zip
Install/Start a mini HTTP server:
cd /var wget http://192.168.0.2:8000/openwrt-SKY-SR102-with-cfe.bin wget http://192.168.0.2:8000/bcm-burn-image chmod 0777 ./bcm-burn-image ./bcm-burn-image iamsure openwrt-SKY-SR102-with-cfe.bin
After it reboots, connect to the bootloader http://192.168.0.1 (or the command line) and upload the image again.
If you are using a Parallel Port, you will need to use a seperate CFE with default values already set (below).
eJTAG Burner
CFE
→ cfe Details about Broadcoms CFE's
You will need to replace the CFE/Bootloader, because the original SKY one causes a lot of configuration issues. Use the generic 'cfe63268.bin' from the GPL Source code. Or this one: CFE-generic.zip its the generic CFE with some default values set.
With new/generic CFE's, the internal config/nvram will be blank (0x580 to 0x97F). So you will need to connect a serial port to the router the first time you (re)power it up. And I suggest you select board type 15.
Footer TAG
The 20 byte tag contains the 'NOT' CRC32 of the full image above + 4 empty bytes (0x00) + DWORD 0x00063268. The other 8 bytes can be left as 0x00.
There are tools which can add the 20 byte footer onto the image, like 'addvtoken' which is supplied in the GPL Source Code.
Easy Option
Only do this if you can send and receive data on the UART interface.
If you wish to see/try a “whole image”, you can download here: openwrt-sr102-limited-whole-image.zip
This is the same as above, but contains the luci web interface: openwrt-sr102-limited-whole-image-with-luci.zip
After flashing the above image the router may seem like it was bricked if you cannot read UART output. Initially configuration through telnet wont be possible and you will need to configure it through serial. Consider this if you managed to flash blind without being able to see the UART output.
Upgrading OpenWrt
→ generic.sysupgrade
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
Basic configuration
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
Specific Configuration
Interfaces
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| br-lan | LAN | 192.168.1.1/24 |
| vlan1 (eth0.1) | LAN ports (1 to 4) | None |
Wireless
BCM435F is the pseudo-id used for the integrated wifi of BCM6362/63268 SoCs, for which no usable driver exists!
LAN
A LAN port can be switched to a WAN port via the Web Interface.
Switch port '8' is the integrated Gigabit connection to the Processor core, which is vlan tagged.
The WAN/PPPoE has not been tested with UK SKY Broadband, so you will need to add MER/DHCP 60/61 yourself.
Buttons
→ hardware.button on howto use and configure the hardware button(s).
| BUTTON | Event | GPIO |
|---|---|---|
| WPS | <KEY_WPS_BUTTON> (0x211) | (492) 1 - 0 |
| RESET | None | appears to be a low level reset |
Leds
| Label | GPIO (from 460) | On Value |
|---|---|---|
| lan 1, green | 1 | 1 |
| power, red | 2 | 1 |
| wifi, red | 3 | 1 |
| inet, red | 4 | 1 |
| inet, white | 5 | 0 |
| power, white | 6 | 0 |
| wifi, white | 8 | 0 |
| lan 2, red | 9 | 1 |
| lan 3, red | 10 | 1 |
| lan 4, red | 11 | 1 |
| lan 1, red | 12 | 1 |
| lan 2, green | 13 | 0 |
| lan 3, green | 14 | 1 |
| lan 4, green | 15 | 1 |
| hd, white | 18 | 0 |
Hardware
Info
| Instruction set | MIPS |
|---|---|
| Vendor | Broadcom |
| bootloader | cfe |
| Board ID | BSKYB_63168 |
| System-On-Chip | BCM63168 rev D0 |
| CPU @Frq | BMIPS4350 V8.0 @400MHz |
| Flash size | HS-SPI: 16384 KiB |
| Flash Chip | FL128SAIH30, compatible with S25FL128P |
| RAM size | 128 MiB |
| RAM Chip | K4B1G1646G-BCH9 / DDR3-1333 |
| Wireless | SoC-integrated: Broadcom BCM435F 802.11b/g/n (00:00.0 Class 0280: 14e4:435f) |
| switch | SoC-integrated: B53 common |
| USB | No |
| PSU | 5V DC Built into the router. Then a seperate voltage multiplier on the main PCB ! |
| Mini PCIe | Yes |
| Serial | Yes |
| JTAG | Yes |
Photos
Main PCB
Front & Back:
Serial
→ port.serial general information about the serial port, serial port cable, etc.
How to connect to the Serial Port of this specific device:
Connect the bottom 3 or 4 pins (from the header) to a TTL Serial Port. (115K200, 8, N, 1)
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc. → generic.debrick
The JTAG is the top pins of the picture above. This does not have basic JTAG Boundary Scan, because of the multi-core design. So you will need eJTAG instructions.
Here is a modified urjtag program to use in order to change the CFE. Then reboot & upload the firmware from the new Bootloader/CFE. eJTAG
If you want to connect to the flash chip directly, this might help:
The flash chip is located on the back of the board, the side opposite the heat-sink. It's a small black rectangle near the white spacer that is closest to the middle of the board.
Opening the Box
There are two screws. One in the back where the RJ45 ports are located. The other screw is hidden under a footpad at the bottom of the box. It is the one closer to the black cover, and closer to the front of the box.
There are also black plastic hooks visible through the top and bottom airflow grilles. Look carefully, and you'll notice them in groups of 2 and 3. They have the same color as the removable cover, a shiny black, which is darker than the gray color of the plastic that makes up the grille. Push them in while lifting the lid, to release them.
Hardware mods
→ if you are a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!
You can add a PCIe mini port on the PCB. This has been tested with a Broadcom WiFi card from an HP Laptop and works.
If you are having issues: You will probably need to add/bridge the missing capacitors C4400 & C4401 located near the CPU. Maybe R2012 as well.
Possibly adding a USB connector to the board: You will probably need to solder to the resistors R2023 & R2024 on the closest side to the CPU.
To provide the 5v power, you can use it direct from the PSU header connector.
I can trigger usb events, but can not get any useful communication. These are probably the 'FAULT' signals.
Wireless Mod and Power Supply Fix! by Andrew Mcneil
Bootlogs
OEM bootlog
From the first release:
HELO CPUI L1CI HELO CPUI L1CI DRAM ---- PHYS STRF 400H PHYE DDR3 SIZ4 SIZ3 SIZ2 DINT USYN LSYN MFAS LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN CFE version 1.0.38-114.185 for BCM963268 (32bit,SP,BE) Build Date: Fri Jan 01 00:00:01 BST 2015 (testy@matties) (This line is not original) Copyright (C) 2000-2011 Broadcom Corporation. HS Serial flash device: name S25FL128, id 0x0118 size 16384KB Total Flash size: 16384K with 256 sectors Flash split 10 : AuxFS[1638400] Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz Main Thread: TP0 Memory Test Passed Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 Board IP address : 192.168.0.1:ffffff00 Host IP address : 192.168.0.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-27) : BSKYB_63168 Number of MAC Addresses (1-32) : 10 Base MAC Address : 00:10:18:00:00:00 PSI Size (1-64) KBytes : 40 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 10 Main Thread Number [0|1] : 0 Booting from only image (0xb8040000) ... Found Signature! SIGNATURE OK Code Address: 0x80010000, Entry Address: 0x80267850 Decompression OK! Entry at 0x80267850 Closing network. Disabling Switch ports. Flushing Receive Buffers... 0 buffers found. Closing DMA Channels. Starting program at 0x80267850 Linux version 2.6.30 (IHR@drx590.amstrad.co.uk) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 SMP PREEMPT Fri Jul 26 16:29:15 BST 2013 HS Serial flash device: name S25FL128, id 0x0118 size 16384KB Copying CFE NVRAM contents to Firmware NVRAM contents b'cas NVRAM is not initialised Copying MAC Address Form Serialization Data to Firmware NVRAM BSKYB_63168 prom init CPU revision is: 0002a080 (Broadcom4350) DSL SDRAM reserved: 0x132000 Determined physical RAM map: memory: 07ece000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00007ece Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00007ece On node 0 totalpages: 32462 free_area_init_node: node 0, pgdat 8030ca60, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 222 pages used for memmap Normal zone: 28144 pages, LIFO batch:7 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32208 Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200 wait instruction: enabled Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes NR_IRQS:128 PID hash table entries: 512 (order: 9, 2048 bytes) console [ttyS0] enabled Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 125008k/129848k available (2428k kernel code, 4668k reserved, 649k data, 140k init, 0k highmem) Calibrating delay loop... 399.36 BogoMIPS (lpj=199680) Mount-cache hash table entries: 512 --Kernel Config-- SMP=1 PREEMPT=1 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 Broadcom Logger v0.1 Jul 26 2013 16:27:48 CPU revision is: 0002a080 (Broadcom4350) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Calibrating delay loop... 402.43 BogoMIPS (lpj=201216) Brought up 2 CPUs net_namespace: 828 bytes NET: Registered protocol family 16 kerSysFlashInit:: Writing New NVRAM contents to Flash Total Flash size: 16384K with 256 sectors Flash split 255 : AuxFS[1638400] PSI and Scratchpad will also be erased as the NVRAM is reinitialised Internal 1P2 VREG will be shutdown if unused...Used, leave it on (00008d17-00008781=1430>=300) registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10005fff] pci 0000:00:00.0: supports D1 D2 pci 0000:00:00.0: PME# supported from D0 D3hot D3cold pci 0000:00:00.0: PME# disabled pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:01:00.0: PME# disabled pci 0000:01:00.0: PCI bridge, secondary bus 0000:02 pci 0000:01:00.0: IO window: disabled pci 0000:01:00.0: MEM window: disabled pci 0000:01:00.0: PREFETCH window: disabled PCI: Setting latency timer of device 0000:01:00.0 to 64 skbFreeTask created successfully BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 Jul 26 2013 16:29:12 initialized Broadcom GBPM v0.1 Jul 26 2013 16:29:12 initialized NET: Registered protocol family 8 NET: Registered protocol family 20 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 3, 32768 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher squashfs: version 4.0 with LZMA457 ported by BRCM JFFS2 version 2.2. © 2001-2006 Red Hat, Inc. msgmni has been set to 244 io scheduler noop registered (default) PCI: Setting latency timer of device 0000:01:00.0 to 64 PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered NET: Registered protocol family 24 bcm963xx_mtd driver v2.0 File system address: 0xb8040100 Registered device mtd[BCM63XX RootFS] dev[0] Flash[0xb8040100,8794112] Registered device mtd[BCM63XX AuxFS] dev[1] Flash[0xb8e60000,1638400] Initalisg watchdog: WatchDogDefCount=2000000000 brcmboard: brcm_board_init entry SES: Button Interrupt 0x1 is enabled sesBtn_mapIntr: is_sesBtn_irq_shared=0, sesBtn_irq=1 SES: LED GPIO 0x8003 is enabled PCIe: No device found - Powering down Reset line is clear: normal enable case Serial: BCM63XX driver $Revision: 3.00 $ Magic SysRq enabled (type ^ h for list of supported commands) ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX Total # RxBds=1448 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized bcmPktDma_init: Broadcom Packet DMA Library initialized bcmxtmrt: Broadcom BCM3168D0 ATM/PTM Network Device v0.4 Jul 26 2013 16:29:01 IPSEC SPU: SUCCEEDED GACT probability NOT on Mirror/redirect action on u32 classifier input device check on Actions configured xt_time: kernel timezone is -0000 TCP cubic registered Initializing XFRM netlink socket NET: Registered protocol family 17 NET: Registered protocol family 15 Initializing MCPD Module Ebtables v2.0 registered ebt_time registered ebt_ftos registered ebt_wmm_mark registered 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly on device 31:0. Freeing unused kernel memory: 140k freed init started: BusyBox v1.17.2 (2013-07-26 16:32:02 BST) starting pid 164, tty '': '/etc/init.d/rcS' starting pid 168, tty '': '-/bin/sh' BusyBox v1.17.2 (2013-07-26 16:32:02 BST) built-in shell (ash) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules..... chipinfo: module license 'proprietary' taints kernel. Disabling lock debugging due to kernel taint brcmchipinfo: brcm_chipinfo_init entry Broadcom Ingress QoS Module Char Driver v0.1 Jul 26 2013 16:28:34 Registered<243> Broadcom Ingress QoS ver 0.1 initialized BPM: tot_mem_size=134217728B (128MB), buf_mem_size=20132655B (19MB), num of buffers=7445, buf size=2704 Broadcom BPM Module Char Driver v0.1 Jul 26 2013 16:28:27 Registered<244> [NTC bpm] bpm_set_status: BPM status : enabled NBUFF v1.0 Initialized Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 Jul 26 2013 16:28:35 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. Constructed Broadcom Packet Flow Cache v2.2 Jul 26 2013 16:28:35 chipId 0x631680D0 Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jul 26 2013 16:28:28 Registered <241> Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done FAP Debug values at 0xa5c9c5f0 0xa5d1c5f0 Allocated FAP0 GSO Buffers (0xA5CAA678) : 1048576 bytes @ 0xA5E00000 Allocated FAP1 GSO Buffers (0xA5D2A678) : 1048576 bytes @ 0xA5F00000 Allocated FAP0 TM SDRAM Queue Storage (a5caa67c) : 341376 bytes @ a5d80000 Allocated FAP1 TM SDRAM Queue Storage (a5d2a67c) : 341376 bytes @ a5800000 [NTC fapProto] fapReset : Reset FAP Protocol layer fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes [FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3968>, free <2688>, total<8192> [FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3968>, free <2688>, total<8192> [FAP0] PSM : addr<0x80002000>, used <23292>, free <1284>, total <24576> [FAP1] PSM : addr<0x80002000>, used <23292>, free <1284>, total <24576> [FAP0] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948 [FAP1] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948 [FAP0] GSO Buffer set to 0xA5E00000 [FAP1] GSO Buffer set to 0xA5F00000 [FAP0] FAP BPM Initialized. [FAP1] FAP BPM Initialized. bcmPktDma_bind: FAP Driver binding successfull [FAP0] FAP TM: ON [FAP1] FAP TM: ON bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCM63168D0 Ethernet Network Device v0.1 Jul 26 2013 16:28:52 Broadcom GMAC Char Driver v0.1 Jul 26 2013 16:28:58 Registered<249> Broadcom GMAC Driver v0.1 Jul 26 2013 16:28:58 Initialized fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000 ETH Init: Ch:0 - 200 tx BDs at 0xb0a20650 fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000 ETH Init: Ch:1 - 200 tx BDs at 0xb0820650 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184 ETH Init: Ch:0 - 600 rx BDs at 0xb0821910 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184 ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910 dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered eth1: MAC Address: 00:00:01:00:00:01 eth2: MAC Address: 00:00:01:00:00:01 eth3: MAC Address: 00:00:01:00:00:01 eth0: MAC Address: 00:00:01:00:00:01 NComm TMS V6.80 Kernel Module loaded. [NTC arl] arlEnable : Enabled ARL binding to FAP Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 Jul 26 2013 16:28:26 Registered <245> --SMP support wl: dsl_tx_pkt_flush_len=338 wl: high_wmark_tot=4839 PCI: Setting latency timer of device 0000:00:00.0 to 64 wl: passivemode=1 wl: napimode=0 wl0: allocskbmode=1 currallocskbsz=512 Neither SPROM nor OTP has valid image wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl:loading /etc/wlan/bcm6362_map.bin srom rev:8 wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32 wl0: Broadcom BCM435f 802.11 Wireless Controller 6.30.102.7.cpe4.12L08.4 dgasp: kerSysRegisterDyingGaspHandler: wl0 registered p8021ag: p8021ag_init entry Broadcom 802.1Q VLAN Interface, v0.1 Success ===== Release Version 2.1m.3173.R 130726_1629 ===== STATRTING WATCHDOG Host MIPS Clock divider pwrsaving is enabled DDR Self Refresh pwrsaving is enabled ssk:error:14.670:rutSntp_restart:145:SNTP command is: -s ntp1.isp.sky.com -s ntp2.isp.sky.com -t Greenwich Mean Time: Dublin, Edinburgh, Lisbon, London ip_tables: (C) 2000-2006 Netfilter Core Team Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (2028 buckets, 8112 max) dhcpd:error:16.254:read_leases:830:Unable to open /etc/udhcpd.leases for reading ssk:error:16.526:rutIpt_initFirewallChains:1857:Enter iptables: No chain/target/match by that name device eth1 entered promiscuous mode device eth2 entered promiscuous mode device eth3 entered promiscuous mode device eth0 entered promiscuous mode device wl0 entered promiscuous mode WLmngr Daemon is running optarg=0 shmId=0 br0: port 5(wl0) entering forwarding state wlevt is ready for new msg... BcmAdsl_Initialize=0xC0450C20, g_pFnNotifyCallback=0xC04928D4 lmemhdr[2]=0x100CE000, pAdslLMem[2]=0x100CE000 pSdramPHY=0xA7FFFFF8, 0x9F0005 0x900FA *** XfaceOffset: 0x5FF90 => 0x5FF90 *** *** PhySdramSize got adjusted: 0xE8B68 => 0x11F5B0 *** AdslCoreSharedMemInit: shareMemSize=76333(76336) AdslCoreHwReset: pLocSbSta=85b30000 bkupThreshold=3072 AdslCoreHwReset: AdslOemDataAddr = 0xA7FA7C24 ***BcmDiagsMgrRegisterClient: 0 *** dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered fapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22be0 bytes remaining 584 XTM Init: Ch:0 - 200 rx BDs at 0xb0a22be0 fapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a23220 bytes remaining 456 XTM Init: Ch:1 - 16 rx BDs at 0xb0a23220 bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system Scratch pad is not initialized. Scratch pad is not initialized. monitor task is initialized pid= 270 factory:error:21.238:transaction_setup:109:socket (Address family not supported by protocol) STATRTING LSNET fus:notice:21.496:cmsMdm_init:198:entered, eid=14(fus) shmid=0 fus:notice:21.496:oalShm_init:135:attaching to existing shmId=0 fus:notice:21.497:oalLck_init:114:attach existing done, semid=0 fus:notice:21.497:cmsMem_initSharedMemPointer:134:shm pool: 0x5881415c-0x58888000 wifimonitor:error:21.643:main:782:Not expecting any messages ssk:error:21.783:moveEthernetPortToLAN:331:eth0 WAN Interface not found ssk:error:21.783:moveEthernetPortToLAN:331:eth1 WAN Interface not found ssk:error:21.784:moveEthernetPortToLAN:331:eth2 WAN Interface not found ssk:error:21.784:moveEthernetPortToLAN:331:eth3 WAN Interface not found WAN mode: AUTO ADSL/Ethenet Discovery Note: Loading 6300 MDK (default) driver for 63168 chip Switch MDK: num_switches = 1 Switch MDK: unit = 0; phy_pbmp = 0xf; config_pbmp = 0xf Switch MDK link poll thread: unit=0; phypbmp=0xf fus:notice:22.129:main:625:Daily check counter value is 0 and Fus FVC Name=default fus:notice:22.129:main:630:Version is Default set it to [SKY-IHR-VDSL_16MB-2-1-m-3173-R] Setting SO_REUSE Scratch pad is not initialized. ADDR...OK. MUlticase Member ship added Scratch pad is not initialized. fus:notice:22.248:handleCMSMessage:488:system booted, exiting until WAN UP fus:notice:22.249:main:957:FUS shutting down... fus:notice:22.860:compressBuf:129:compressed len=7333 uncompressed len=26478 eth1 (switch port: 0) Link UP 100 mbps full duplex br0: port 1(eth1) entering forwarding state fus:notice:23.038:writeValidatedBufToConfigFlash:491:wrote config to primary config flash, ret=0 fus:notice:23.071:main:1005:exiting br0: port 5(wl0) entering disabled state device wl0 left promiscuous mode br0: port 5(wl0) entering disabled state device wl0 entered promiscuous mode br0: port 5(wl0) entering forwarding state ssk:error:23.507:checkAllWanLinkStatusLocked:1520:ERROR: Ethernet WAN Interface Not found ssk:error:23.508:checkAllWanLinkStatusLocked:1520:ERROR: Ethernet WAN Interface Not found ssk:error:23.509:checkAllWanLinkStatusLocked:1520:ERROR: Ethernet WAN Interface Not found LAN side tr69c:error:23.868:updateTr69cCfgInfo:835:could not build full path to (null) tr69c:error:24.170:updateTr69cCfgInfo:835:could not build full path to (null) killall: hspotap: no process killed br0: port 5(wl0) entering disabled state Setting SSID: "SKY12345" Setting SSID: "wl0_Guest1" Setting SSID: "wl0_Guest2" Setting SSID: "wl0_Guest3" wlctl: Unsupported device wl0 left promiscuous mode br0: port 5(wl0) entering disabled state device wl0 entered promiscuous mode br0: port 5(wl0) entering forwarding state acsd: scan in progress ... acsd: scan in progress ... skydhcpc:notice:26.125:findEthernetPortofReceivedFrame:2163:PortName=eth1 acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: selected channel spec: 0x1006 wlctl: Not Permitted wlctl: Undefined error WLMNGR-DAEMON:error:28.946:wlmngr_startWsc:1022: WPS########## Setting wps_device_pin to 87654321 skydhcpc:notice:30.733:findEthernetPortofReceivedFrame:2163:PortName=eth1 skydhcpc:notice:38.170:findEthernetPortofReceivedFrame:2163:PortName=eth1 skydhcpc:notice:53.597:findEthernetPortofReceivedFrame:2163:PortName=eth1 BCM963268 Broadband Router Login: admin Password: sky > sh BusyBox v1.17.2 (2013-07-26 16:32:02 BST) built-in shell (ash) Enter 'help' for a list of built-in commands. #
Notes
There is a custom firmware made from the GPL Source avaliable, to extend some options. SR102-customised-firmware
Integrated PCI WiFi Info
This info it taken from the customised firmware (RFU):
~ # lspci -k 00:00.0 Class 0280: 14e4:435f wl 00:09.0 Class 0c03: 14e4:6300 ohci_hcd 00:0a.0 Class 0c03: 14e4:6300 ehci_hcd 01:00.0 Class 0604: 14e4:6326 pcieport-driver ~ # ~ # ~ # ~ # cat /sys/bus/pci/devices/0000\:00\:00.0/ /sys/bus/pci/devices/0000:00:00.0/broken_parity_status /sys/bus/pci/devices/0000:00:00.0/class /sys/bus/pci/devices/0000:00:00.0/config /sys/bus/pci/devices/0000:00:00.0/device /sys/bus/pci/devices/0000:00:00.0/driver/ /sys/bus/pci/devices/0000:00:00.0/enable /sys/bus/pci/devices/0000:00:00.0/irq /sys/bus/pci/devices/0000:00:00.0/local_cpulist /sys/bus/pci/devices/0000:00:00.0/local_cpus /sys/bus/pci/devices/0000:00:00.0/modalias /sys/bus/pci/devices/0000:00:00.0/msi_bus /sys/bus/pci/devices/0000:00:00.0/net/ /sys/bus/pci/devices/0000:00:00.0/remove /sys/bus/pci/devices/0000:00:00.0/rescan /sys/bus/pci/devices/0000:00:00.0/resource /sys/bus/pci/devices/0000:00:00.0/resource0 /sys/bus/pci/devices/0000:00:00.0/subsystem/ /sys/bus/pci/devices/0000:00:00.0/subsystem_device /sys/bus/pci/devices/0000:00:00.0/subsystem_vendor /sys/bus/pci/devices/0000:00:00.0/uevent /sys/bus/pci/devices/0000:00:00.0/vendor ~ # ~ # cat /sys/bus/pci/devices/0000\:00\:00.0/vendor 0x14e4 ~ # cat /sys/bus/pci/devices/0000\:00\:00.0/device 0x435f ~ # cat /sys/bus/pci/devices/0000\:00\:00.0/class 0x028000 ~ # cat /sys/bus/pci/devices/0000\:00\:00.0/irq 15 ~ # cat /sys/bus/pci/devices/0000\:00\:00.0/local_cpulist 0-1 ~ # cat /sys/bus/pci/devices/0000\:00\:00.0/local_cpus 3 ~ # cat /sys/bus/pci/devices/0000\:00\:00.0/modalias pci:v000014E4d0000435Fsv000014E4sd000005A8bc02sc80i00 ~ # cat /sys/bus/pci/devices/0000\:00\:00.0/net/wl0/dev_id 0x0 ~ # cat /sys/bus/pci/devices/0000\:00\:00.0/resource 0x0000000010004000 0x0000000010005fff 0x0000000000020210 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 ~ # ~ # ~ # ~ # wl ver 6.30 RC102.7 wl0: Jan 28 2015 13:22:13 version 6.30.102.7.cpe4.12L08.4 ~ # wl revinfo vendorid 0x14e4 deviceid 0x435f radiorev 0xc2057000 chipnum 0x6362 chiprev 0x1 chippackage 0x0 corerev 0x16 boardid 0x5a8 boardvendor 0x14e4 boardrev P201 driverrev 0x61e6607 ucoderev 0x3100002 bus 0x0 phytype 0x4 phyrev 0x8 anarev 0x0 ~ # ~ # ~ # ~ # dmesg -c [sniped] pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10005fff] pci 0000:00:00.0: supports D1 D2 pci 0000:00:00.0: PME# supported from D0 D3hot D3cold pci 0000:00:00.0: PME# disabled pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff] pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff] pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:01:00.0: PME# disabled pci 0000:01:00.0: PCI bridge, secondary bus 0000:02 pci 0000:01:00.0: IO window: disabled pci 0000:01:00.0: MEM window: disabled pci 0000:01:00.0: PREFETCH window: disabled PCI: Setting latency timer of device 0000:01:00.0 to 64 [sniped] wl: dsl_tx_pkt_flush_len=338 wl: high_wmark_tot=4839 PCI: Setting latency timer of device 0000:00:00.0 to 64 wl: passivemode=1 wl: napimode=0 wl0: allocskbmode=1 currallocskbsz=512 Neither SPROM nor OTP has valid image wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl:loading /etc/wlan/bcm6362_map.bin srom rev:8 wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32 wl0: Broadcom BCM435f 802.11 Wireless Controller 6.30.102.7.cpe4.12L08.4 [sniped]