Comments (6)
0xmatia
commented on June 8, 2024
4
Hi @ch0wner, have you managed to extract the key or/and enable Telnet?
from bcm2-utils.
jclehner
commented on June 8, 2024
1
The config file you sent me is indeed encrypted, and first 4 bytes are actually a length prefix. It won't be possible to decrypt it without a firmware dump.
Also, I unscrewed two screws at the bottom of the device, but then seems like some clips from the inside are holding it together, do you have any knowledge on how to gain access to the board without breaking the plastic case? I wanted to take a peek and see If I could spot some serial interface that I could perhaps leverage to extract the firmware.
According to the device's FCC application there are at least two serial headers, one of them already soldered (and most likely the eCos console). As far as opening, you might have to use a careful dose of force to pry the case apart.
from bcm2-utils.
g0x69lbo
commented on June 8, 2024
@jclehner I can send you the file via email if you would like to inspect it. I saw the commit 65624dd, so I guess this is not the first time you encountered this problem.
Also, just from interest, If you have a script or could provide some guidance how you would you will attempt to decrypt the binary blob without the firmware that would be really cool. If its password protected, can we extract the password hash and try to bruteforce it?
I saw in some other issues about this model they referenced that the backup is encrypted using 0x80 static xor key. I attempted to use bcm2cfg to decrypt but it didn't work:
bcm2cfg -vvv -k 0x80 decrypt backupsettings.conf decypted.conf bcm2cfg -vvv -k 0x80 info backupsettings.conf from bcm2-utils.
jclehner
commented on June 8, 2024
@jclehner I can send you the file via email if you would like to inspect it.
My email address can be found here.
Decrypting the file without a firmware binary won't be possible, unless it uses some pseudo-encryption like xor 0x80. Most firmwares use either DES or AES, so brute-force isn't really an option.
Attempted to query using SNMP and guessed the community string with no luck.
You might have better luck resetting the device to factory defaults and disconnecting the coax cable. On some devices, this enables SNMP access (and possibly allows you to enable Telnet).
from bcm2-utils.
g0x69lbo
commented on June 8, 2024
My email address can be found here.
Alright, I sent you the file.
Decrypting the file without a firmware binary won't be possible, unless it uses some pseudo-encryption like
xor 0x80. Most firmwares use either DES or AES, so brute-force isn't really an option.
Just as I thought
You might have better luck resetting the device to factory defaults and disconnecting the coax cable. On some devices, this enables SNMP access (and possibly allows you to enable Telnet).
I attempted this now, after the router had powered-up I perform another network scan. this time telnet was closed and ssh was filtered . Logged into the web UI with the default admin credentials and there wasn't any firewall configurations to disable.
I then attempted the snmp queries as described at issue #7, unfortunately even with the COAX cable disconnected it seems the snmpd is not running.
Here you can see the router replies ICMP destination unreachable for port 161;
What do you think I should try next?
Also, I unscrewed two screws at the bottom of the device, but then seems like some clips from the inside are holding it together, do you have any knowledge on how to gain access to the board without breaking the plastic case? I wanted to take a peek and see If I could spot some serial interface that I could perhaps leverage to extract the firmware.
As I mentioned this router is currently in use and I couldn't put my hands on a spare one right now (as they are not sold on the market, only provided by ISP)
from bcm2-utils.
g0x69lbo
commented on June 8, 2024
Hey, it's been a while since I had time for this. But today I finally put my hands on this router again and connected to the UART consoles. 2 consoles seem alive, and one dead. Probably one is for the eCos and one for the bootloader.
Unfortunately, the console and the bootloader has been disabled therefore I couldn't progress anywhere from here.
Here's the console logs:
Bootloader (?)
Aeolus version 0.10
Boot Args:
ubi.mtd=linuxapps2 root=ubi0:rootfs ro noinitrd rootfstype=ubifs console=ttyS0,115200 ubifs_apps apps=ubifs:linuxapps2 ubifs_data data=ubifs:rgnv product_name=BCM93384WVG wdog debug
product_name: BCM93384WVG
check dtb at 80001500
no match on BCM933843MWVG
check dtb at 80004598
no match on BCM93384MWVG
check dtb at 800078a8
matched BCM93384WVG using dtb at 800078a8
Flash partitions:
0. linuxapps : 00000000 00020000 00000000 04a40000
1. image1 : 00000000 04a60000 00000000 00d00000
2. image2 : 00000000 05760000 00000000 00d00000
3. linux : 00000000 06460000 00000000 00480000
4. linuxkfs : 00000000 06900000 00000000 011e0000
5. rgnv : 00000000 07ae0000 00000000 01200000
6. linuxapps2: 00000000 08d00000 00000000 04a60000
7. linux2 : 00000000 0d760000 00000000 00480000
8. linuxkfs2 : 00000000 0dc00000 00000000 011e0000
9. rgnv2 : 00000000 0ede0000 00000000 01220000
Updated flash partitions with / parts
Chip ID: BCM3384?-B0
CPU speed: 1000 MHZ
Starting watchdog
[ 0.000000] Linux version 3.14.28-rg5.8.0mp3 ([email protected]) (gcc version 4.8.4 20140811 (prerelease) (Broadcom stbgcc-4.8-1.0) ) #1 SMP Mon Aug 3 11:28:04 CST 2020
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00025a11 (Broadcom BMIPS5000)
[ 0.000000] FPU revision is: 00130001
[ 0.000000] MIPS: machine is Broadcom BCM93384WVG
[ 0.000000] ATW MEMC UBUS SIZE CLIENTS
[ 0.000000] 0 08000000 00000000 04000000 0081bf09
[ 0.000000] 1 00000000 08000000 08000000 0081bf09
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 06000000 @ 00000000 (usable)
[ 0.000000] memory: 10000000 @ 20000000 (usable)
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x1fffffff]
[ 0.000000] HighMem [mem 0x20000000-0x2fffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x05ffffff]
[ 0.000000] node 0: [mem 0x20000000-0x2fffffff]
[ 0.000000] On node 0 totalpages: 90112
[ 0.000000] free_area_init_node: node 0, pgdat 807d5d00, node_mem_map 8100a000
[ 0.000000] Normal zone: 1024 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 24576 pages, LIFO batch:3
[ 0.000000] HighMem zone: 512 pages used for memmap
[ 0.000000] HighMem zone: 65536 pages, LIFO batch:15
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 64 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 128 bytes.
[ 0.000000] PERCPU: Embedded 7 pages/cpu @8160f000 s7296 r8192 d13184 u32768
[ 0.000000] pcpu-alloc: s7296 r8192 d13184 u32768 alloc=8*4096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 89088
[ 0.000000] Kernel command line: ubi.mtd=linuxapps2 root=ubi0:rootfs ro noinitrd rootfstype=ubifs console=ttyS0,115200 ubifs_apps apps=ubifs:linuxapps2 ubifs_data data=ubifs:rgnv product_name=BCM93384WVG wdog debug
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Memory: 345360K/360448K available (6403K kernel code, 305K rwdata, 1236K rodata, 236K init, 399K bss, 15088K reserved, 262144K highmem)
[ 0.000000] SLUB: HWalign=128, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] NR_IRQS:128
[ 0.000000] irq_bcm7120_l2: registered BCM7120 L2 intc (mem: 0xb4e00038, parent IRQ(s): 1)
[ 0.000000] irq_bcm7120_l2: registered BCM7120 L2 intc (mem: 0xb4e00058, parent IRQ(s): 1)
[ 0.000000] irq_bcm7120_l2: registered BCM7120 L2 intc (mem: 0xb04b0060, parent IRQ(s): 1)
[ 0.000000] irq_bcm3384_nand: registered irq-word intc (mem: 0xb4e000f0, num IRQ(s): 8)
[ 0.000000] irq_bcm3384_pci: registered pci intc (mem: 0xb2808300, num IRQ(s): 9)
[ 0.000000] irq_bcm3384_pci: registered pci intc (mem: 0xb2a08300, num IRQ(s): 9)
[ 0.000000] Calibrating delay loop... 663.55 BogoMIPS (lpj=331776)
[ 0.010000] pid_max: default: 32768 minimum: 301
[ 0.011000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.012000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.019000] SMP: Booting CPU1...
[ 0.020000] CPU1 revision is: 00025a11 (Broadcom BMIPS5000)
[ 0.020000] FPU revision is: 00130001
[ 0.020000] Primary instruction cache 32kB, VIPT, 4-way, linesize 64 bytes.
[ 0.020000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.020000] MIPS secondary cache 256kB, 8-way, linesize 128 bytes.
[ 0.031000] Synchronize counters for CPU 1: done.
[ 0.031000] SMP: CPU1 is running
[ 0.032000] Brought up 2 CPUs
[ 0.033000] devtmpfs: initialized
[ 0.035000] pinctrl core: initialized pinctrl subsystem
[ 0.036000] regulator-dummy: no parameters
[ 0.037000] NET: Registered protocol family 16
[ 0.040000] irq: no irq domain found for /pinctrl_gpio@14e00100 !
[ 0.041000] irq: no irq domain found for /pinctrl_gpio@14e00100 !
[ 0.042000] irq: no irq domain found for /pinctrl_gpio@14e00100 !
[ 0.059000] bio: create slab <bio-0> at 0
[ 0.061000] bcm3384-pinctrl-gpio 14e00100.pinctrl_gpio: 147 GPIO's, each with 8 functions
[ 0.062000] vreg-wifi-pwr: 3300 mV
[ 0.063000] vreg-wifi-rf-pwr: 4200 mV
[ 0.064000] vreg-ethsw-pwr: 3300 mV
[ 0.065000] SCSI subsystem initialized
[ 0.066000] usbcore: registered new interface driver usbfs
[ 0.067000] usbcore: registered new interface driver hub
[ 0.068000] usbcore: registered new device driver usb
[ 0.069000] cfg80211: Calling CRDA to update world regulatory domain
[ 0.272000] brcm-pci 12800000.pcie: could not get clock
[ 0.288000] brcm-pci 12800000.pcie: link up, 2.5 Gbps x1
[ 0.289000] PCI host bridge to bus 0000:00
[ 0.290000] pci_bus 0000:00: root bus resource [mem 0xd0000000-0xdfffffff]
[ 0.291000] pci_bus 0000:00: root bus resource [mem 0x00000400-0x000007ff]
[ 0.292000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.293000] pci 0000:00:00.0: [14e4:3384] type 01 class 0x060400
[ 0.294000] brcm-pci 12800000.pcie: found device 14e4:3384 on bus 0, slot 0, pin 1 (irq 13)
[ 0.295000] pci 0000:00:00.0: PME# supported from D0 D3hot
[ 0.296000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 0.297000] pci 0000:01:00.0: [14e4:a8db] type 00 class 0x028000
[ 0.298000] brcm-pci 12800000.pcie: found device 14e4:a8db on bus 1, slot 0, pin 1 (irq 13)
[ 0.299000] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit]
[ 0.300000] pci 0000:01:00.0: supports D1 D2
[ 0.301000] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[ 0.302000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[ 0.303000] pci 0000:00:00.0: BAR 8: assigned [mem 0xd0000000-0xd00fffff]
[ 0.304000] pci 0000:01:00.0: BAR 0: assigned [mem 0xd0000000-0xd0007fff 64bit]
[ 0.305000] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 0.306000] pci 0000:00:00.0: bridge window [mem 0xd0000000-0xd00fffff]
[ 0.307000] brcm-pci 12a00000.pcie: could not get clock
[ 0.323000] brcm-pci 12a00000.pcie: link up, 5.0 Gbps x1
[ 0.324000] PCI host bridge to bus 0000:02
[ 0.325000] pci_bus 0000:02: root bus resource [mem 0xe0000000-0xefffffff]
[ 0.326000] pci_bus 0000:02: root bus resource [mem 0x00000800-0x00000bff]
[ 0.327000] pci_bus 0000:02: No busn resource found for root bus, will use [bus 02-ff]
[ 0.328000] pci 0000:02:00.0: [14e4:3384] type 01 class 0x060400
[ 0.329000] brcm-pci 12a00000.pcie: found device 14e4:3384 on bus 2, slot 0, pin 1 (irq 15)
[ 0.330000] pci 0000:02:00.0: PME# supported from D0 D3hot
[ 0.331000] pci 0000:02:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 0.332000] pci 0000:03:00.0: [14e4:4360] type 00 class 0x028000
[ 0.333000] brcm-pci 12a00000.pcie: found device 14e4:4360 on bus 3, slot 0, pin 1 (irq 15)
[ 0.334000] pci 0000:03:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit]
[ 0.335000] pci 0000:03:00.0: supports D1 D2
[ 0.336000] pci_bus 0000:03: busn_res: [bus 03-ff] end is updated to 03
[ 0.337000] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 03
[ 0.338000] pci 0000:02:00.0: BAR 8: assigned [mem 0xe0000000-0xe00fffff]
[ 0.339000] pci 0000:03:00.0: BAR 0: assigned [mem 0xe0000000-0xe0007fff 64bit]
[ 0.340000] pci 0000:02:00.0: PCI bridge to [bus 03]
[ 0.341000] pci 0000:02:00.0: bridge window [mem 0xe0000000-0xe00fffff]
[ 0.342000] Switched to clocksource MIPS
[ 0.346000] NET: Registered protocol family 2
[ 0.351000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.357000] TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
[ 0.364000] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.370000] TCP: reno registered
[ 0.373000] UDP hash table entries: 256 (order: 1, 8192 bytes)
[ 0.379000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[ 0.386000] NET: Registered protocol family 1
[ 0.390000] RPC: Registered named UNIX socket transport module.
[ 0.396000] RPC: Registered udp transport module.
[ 0.401000] RPC: Registered tcp transport module.
[ 0.406000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.412000] PCI: CLS 0 bytes, default 128
[ 0.417000] futex hash table entries: 512 (order: 4, 65536 bytes)
[ 0.423000] bounce pool size: 64 pages
[ 0.433000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.439000] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[ 0.444000] fuse init (API version 7.22)
[ 0.448000] msgmni has been set to 162
[ 0.453000] io scheduler noop registered (default)
[ 0.498000] 14e00520.serial: ttyS0 at MMIO 0x14e00520 (irq = 9, base_baud = 1687500) is ap+H▒▒ 0.507000] console [ttyS0] enabled
[ 0.507000] console [ttyS0] enabled
[ 0.512000] bootconsole [early0] disabled
[ 0.512000] bootconsole [early0] disabled
[ 0.521000] BBSI initialization...
[ 0.527000] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xda
[ 0.533000] nand: Macronix MX30LF2G18AC
[ 0.537000] nand: 256MiB, SLC, page size: 2048, OOB size: 64
[ 0.543000] brcmnand 14e02200.nand: 256MiB total, 128KiB blocks, 2KiB pages, 16B OOB, 8-bit, BCH-4
[ 0.543000]
[ 0.554000] Bad block table found at page 131008, version 0x01
[ 0.561000] Bad block table found at page 130944, version 0x01
[ 0.568000] nand_read_bbt: bad block at 0x000004840000
[ 0.573000] 10 ofpart partitions found on MTD device 14e02200.nand
[ 0.580000] Creating 10 MTD partitions on "14e02200.nand":
[ 0.585000] 0x000000020000-0x000004a60000 : "linuxapps"
[ 0.591000] 0x000004a60000-0x000005760000 : "image1"
[ 0.596000] 0x000005760000-0x000006460000 : "image2"
[ 0.602000] 0x000006460000-0x0000068e0000 : "linux"
[ 0.607000] 0x000006900000-0x000007ae0000 : "linuxkfs"
[ 0.612000] 0x000007ae0000-0x000008ce0000 : "rgnv"
[ 0.617000] 0x000008d00000-0x00000d760000 : "linuxapps2"
[ 0.623000] 0x00000d760000-0x00000dbe0000 : "linux2"
[ 0.629000] 0x00000dc00000-0x00000ede0000 : "linuxkfs2"
[ 0.634000] 0x00000ede0000-0x000010000000 : "rgnv2"
[ 0.640000] bcm63xx_hsspi_probe called..
[ 0.645000] PPP generic driver version 2.4.2
[ 0.650000] NET: Registered protocol family 24
[ 0.654000] usbcore: registered new interface driver asix
[ 0.660000] usbcore: registered new interface driver ax88179_178a
[ 0.666000] usbcore: registered new interface driver cdc_ether
[ 0.672000] usbcore: registered new interface driver rndis_host
[ 0.678000] usbcore: registered new interface driver cdc_ncm
[ 0.684000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 0.691000] ehci-pci: EHCI PCI platform driver
[ 0.695000] ehci-platform: EHCI generic platform driver
[ 0.701000] ehci-platform 15400300.usb: EHCI Host Controller
[ 0.706000] ehci-platform 15400300.usb: new USB bus registered, assigned bus number 1
[ 0.715000] ehci-platform 15400300.usb: irq 41, io mem 0x15400300
[ 0.727000] ehci-platform 15400300.usb: USB 2.0 started, EHCI 1.00
[ 0.734000] hub 1-0:1.0: USB hub found
[ 0.737000] hub 1-0:1.0: 2 ports detected
[ 0.742000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 0.748000] ohci-pci: OHCI PCI platform driver
[ 0.753000] ohci-platform: OHCI generic platform driver
[ 0.758000] ohci-platform 15400400.usb: Generic Platform OHCI controller
[ 0.765000] ohci-platform 15400400.usb: new USB bus registered, assigned bus number 2
[ 0.773000] ohci-platform 15400400.usb: irq 40, io mem 0x15400400
[ 0.834000] hub 2-0:1.0: USB hub found
[ 0.838000] hub 2-0:1.0: 2 ports detected
[ 0.843000] usbcore: registered new interface driver usblp
[ 0.849000] usbcore: registered new interface driver usb-storage
[ 0.855000] usbcore: registered new interface driver usbserial
[ 0.861000] usbcore: registered new interface driver usbserial_generic
[ 0.867000] usbserial: USB Serial support registered for generic
[ 0.874000] usbcore: registered new interface driver option
[ 0.879000] usbserial: USB Serial support registered for GSM modem (1-port)
[ 0.887000] i2c /dev entries driver
[ 0.891000] bcm7038-wdt 104b01cc.watchdog: Registered Broadcom Watchdog
[ 0.919000] brcm-fpm: FPM with 1 pool(s)
[ 0.923000] brcm-fpm: FPM chunk_size=512
[ 0.928000] brcm-dqm: DQM device gfap with 64 Q's
[ 0.933000] brcm-dqm: DQM device g2u with 32 Q's
[ 0.938000] gfap_startup_ioprocessor: Waiting for core GFAP 4ke to respond via mailbox.
[ 0.947000] gfap_startup_ioprocessor: GFAP IOP Core: Configured and Ready after 0 ms!
[ 0.955000] gfapcomms_channelinit: init success!
[ 0.959000] gfapcomms_channelenable: enable success!
[ 0.964000] GFAP: Configuring UNIMAC1 for Eth switch connection.
[ 0.971000] gfapcomms_ethernet_config: Send Gfap ethConfig
[ 0.982000] gfapcomms_ethernet_config: Send Gfap ethConfig
[ 0.993000] bcmgfap_probe: Network interface (13c00000.gfap), initialized successfully!
[ 1.001000] bcmunimac_probe: instance 0, 12c00000.unimac
[ 1.006000] Missing skip_mbdma_init property!
[ 1.011000] mbdma_init: mbdma base = b2c00000
[ 1.015000] bcmunimac_probe: instance 1, 12c02000.unimac
[ 1.021000] Missing mbdma_channel0_rx_macid property!
[ 1.026000] Missing mbdma_channel0_tx_macid property!
[ 1.031000] Missing mbdma_channel1_rx_macid property!
[ 1.036000] Missing mbdma_channel1_tx_macid property!
[ 1.041000] BCMUNIMAC: Skipping MBDMA init.
[ 1.044000] hub 1-0:1.0: over-current condition on port 2
[ 1.051000] ethsw_arl_cache: ports up mask 0
[ 1.056000] ethsw_init_spi: Device name: ethsw
[ 1.540000] ethsw_3384: reg_base: 0xb2c02600
[ 1.544000] ethsw_3384: Device ID 5075
[ 1.568000] ethsw_core: Ethsw core initialized
[ 1.576000] libphy: ethsw_mdio: probed
[ 1.580000] ethsw_phy: MDIO bus registration succeeded
[ 1.585000] ethsw_phy: Ethsw PHY initialized
[ 1.589000] ethsw_api: Port 0 config reset
[ 1.593000] ethsw_api: Port 0 config set: auto_neg = 1, full_duplex = 1, speed = 2
[ 1.606000] ethsw_api: Port 0 disabled
[ 1.610000] ethsw_api: Port 1 config reset
[ 1.615000] ethsw_api: Port 1 config set: auto_neg = 1, full_duplex = 1, speed = 2
[ 1.628000] ethsw_api: Port 1 disabled
[ 1.631000] ethsw_api: Port 2 config reset
[ 1.636000] ethsw_api: Port 2 config set: auto_neg = 1, full_duplex = 1, speed = 2
[ 1.649000] hub 2-0:1.0: over-current condition
[ 1.653000] ethsw_api: Port 2 disabled
[ 1.657000] ethsw_api: Port 3 config reset
[ 1.661000] ethsw_api: Port 3 config set: auto_neg = 1, full_duplex = 1, speed = 2
[ 1.675000] ethsw_api: Port 3 disabled
[ 1.678000] ethsw_proc: /proc/driver/ethsw dir and files created
[ 1.685000] ethsw_proc: Ethsw proc initialized
[ 1.689000] rpc_service_init: initializing rpc_init service
[ 1.695000] rpc_register_functions registered rpc_init service with 1 functions
[ 1.702000] rpc_service_init: initializing rpc_misc service
[ 1.708000] rpc_service_init: skipping inactive rpc_flash service
[ 1.714000] rpc_service_init: skipping inactive rpc_nonvol service
[ 1.721000] rpc_service_init: initializing rpc_erouter service
[ 1.727000] rpc_service_init: skipping inactive rpc_erouter_pm service
[ 1.733000] rpc_service_init: initializing rpc_wpsctl service
[ 1.739000] rpc_service_init: skipping inactive rpc_bash service
[ 1.745000] rpc_service_init: skipping inactive rpc_testu service
[ 1.752000] dev-name = rg-cm
[ 1.754000] dqm = g2u
[ 1.757000] tx-q = 2h
[ 1.759000] rx-q = 3h
[ 1.761000] rpc_probe sent handshake message
[ 1.766000] dev-name = svm-cm
[ 1.769000] dqm = g2u
[ 1.771000] tx-q = 14h
[ 1.774000] rx-q = 15h
[ 1.776000] rpc_probe sent handshake message
[ 1.780000] dev-name = stb-cm
[ 1.783000] dqm = g2u
[ 1.786000] tx-q = 6h
[ 1.788000] rx-q = 7h
[ 1.790000] rpc_probe sent handshake message
[ 1.795000] rpc_register_functions registered rpc_misc service with 11 functions
[ 1.803000] GACT probability NOT on
[ 1.806000] Mirror/redirect action on
[ 1.810000] u32 classifier
[ 1.813000] input device check on
[ 1.816000] Actions configured
[ 1.820000] gre: GRE over IPv4 demultiplexor driver
[ 1.825000] ip_gre: GRE over IPv4 tunneling driver
[ 1.831000] TCP: cubic registered
[ 1.835000] NET: Registered protocol family 10
[ 1.841000] ip6_gre: GRE over IPv6 tunneling driver
[ 1.847000] NET: Registered protocol family 17
[ 1.852000] Bridge firewalling registered
[ 1.856000] Initializing MCPD Module
[ 1.859000] l2tp_core: L2TP core driver, V2.0
[ 1.864000] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 1.869000] 8021q: 802.1Q VLAN Support v1.8
[ 1.873000] CM handshake
[ 1.877000] regulator-dummy: disabling
[ 1.881000] UBI: default fastmap pool size: 25
[ 1.886000] UBI: default fastmap WL pool size: 25
[ 1.891000] UBI: attaching mtd6 to ubi0
[ 2.739000] random: nonblocking pool is initialized
[ 2.749000] UBI: scanning is finished
[ 2.771000] UBI: attached mtd6 (name "linuxapps2", size 74 MiB) to ubi0
[ 2.777000] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 2.784000] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 2.791000] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 2.798000] UBI: good PEBs: 595, bad PEBs: 0, corrupted PEBs: 0
[ 2.804000] UBI: user volume: 2, internal volumes: 1, max. volumes count: 128
[ 2.812000] UBI: max/mean erase counter: 12/1, WL threshold: 4096, image sequence number: 1854624321
[ 2.821000] UBI: available PEBs: 0, total reserved PEBs: 595, PEBs reserved for bad PEB handling: 40
[ 2.830000] UBI: background thread "ubi_bgt0d" started, PID 63
[ 3.018000] UBIFS: mounted UBI device 0, volume 0, name "rootfs", R/O mode
[ 3.025000] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 3.034000] UBIFS: FS size: 10031104 bytes (9 MiB, 79 LEBs), journal size 4317184 bytes (4 MiB, 34 LEBs)
[ 3.044000] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 3.049000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 79D309E8-9AE8-47DC-AD00-59246D78C396, small LPT model
[ 3.063000] VFS: Mounted root (ubifs filesystem) readonly on device 0:14.
[ 3.072000] devtmpfs: mounted
[ 3.076000] Freeing unused kernel memory: 236K (807e5000 - 80820000)
starting pid 64, tty '': '/etc/init.d/rcS'
Mounting virtual filesystems
==============================
CHIP:3384
BOARD ID:
HYPERVISOR: n
SUBSYSTEM: rg
==============================
Attaching MTD 5 to UBI device 1
[ 4.189000] UBI: default fastmap pool size: 8
[ 4.194000] UBI: default fastmap WL pool size: 25
[ 4.199000] UBI: attaching mtd5 to ubi1
[ 4.408000] UBI: scanning is finished
[ 4.429000] UBI: attached mtd5 (name "rgnv", size 18 MiB) to ubi1
[ 4.435000] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 4.442000] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 4.449000] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 4.456000] UBI: good PEBs: 144, bad PEBs: 0, corrupted PEBs: 0
[ 4.462000] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[ 4.469000] UBI: max/mean erase counter: 36/26, WL threshold: 4096, image sequence number: 2289605483
[ 4.479000] UBI: available PEBs: 0, total reserved PEBs: 144, PEBs reserved for bad PEB handling: 40
[ 4.488000] UBI: background thread "ubi_bgt1d" started, PID 122
UBI device number 1, total 144 LEBs (18284544 bytes, 17.4 MiB), available 0 LEBs (0 bytes), LEB s[ 4.502000] UBIFS: background thread "ubifs_bgt1_0" started, PID 124
ize 126976 bytes (124.0 KiB)
Mounting rgnv (mtd 5) to /data
[ 4.598000] UBIFS: recovery needed
[ 4.783000] UBIFS: recovery completed
[ 4.787000] UBIFS: mounted UBI device 1, volume 0, name "data"
[ 4.793000] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 4.803000] UBIFS: FS size: 11173888 bytes (10 MiB, 88 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[ 4.812000] UBIFS: reserved for root: 527769 bytes (515 KiB)
[ 4.818000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 5AEA4AC9-067E-4F23-B1DE-6A1B35239F48, small LPT model
Starting watchdog
Configuring private network
Disable IPv6
[ 5.126000] brcm-dqnet: net device priv0
[ 5.130000] ethsw_api: Device eth0 connected to port 0
[ 5.176000] brcm-dqnet: net device eth0
[ 5.180000] ethsw_api: Device eth1 connected to port 1
[ 5.226000] brcm-dqnet: net device eth1
[ 5.230000] ethsw_api: Device eth2 connected to port 2
[ 5.276000] brcm-dqnet: net device eth2
[ 5.280000] ethsw_api: Device eth3 connected to port 3
[ 5.326000] brcm-dqnet: net device eth3
[ 5.336000] brcm-dqnet: net device cm0
[ 5.453000] device priv0 entered promiscuous mode
[ 5.462000] IPv6: ADDRCONF(NETDEV_UP): priv0: link is not ready
[ 5.479000] IPv6: ADDRCONF(NETDEV_UP): privbr: link is not ready
[ 5.485000] IPv6: ADDRCONF(NETDEV_UP): privbr: link is not ready
/etc/init.d/rcS.net: line 155: echo: write error: Input/output error
Mounting linuxapps2 (mtd 6) to /mnt/apps
UBIFS: background thread "ubifs_bgt0_1" started, PID 232
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 1, name "apps"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 57139200 bytes (54 MiB, 450 LEBs), journal size 8253440 bytes (7 MiB, 65 LEBs)
UBIFS: reserved for root: 0 bytes (0 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID 1E2A6291-CB85-426B-94D3-B9DE8BE94715, small LPT model
Starting user apps services
==============================
CHIP:3384
BOARD ID:
HYPERVISOR: n
SUBSYSTEM: rg
==============================
RG: Upgrading eCos BFC non-vol to Linux
Non-vol upgrade not required - skipping
*
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* * * *
* * * * * * ***
* * * * * * * * *******************
* * * * * *
* *
Broadcom Corporation Reference Design
+------------------------------------------------------------------------------------------------+
| _/_/ _/ _/ _/_/_/ |
| _/ _/ _/_/ _/_/ _/ |
| _/ _/ _/ _/ _/ |
| _/ _/ _/ _/_/ |
| _/ _/ _/ _/ |
|_/ _/ _/ _/ _/ |
| _/_/ _/ _/ _/_/_/ |
| |
.
.
.
.
.
DQM Init complete for dqm tunnel stb-cm
DQM Init complete for dqm tunnel svm-cm
| Linux Kernel |
| |
| Revision : 3.14.28-rg5.8.0mp3#1 SMP Mon Aug 3 11:28:04 CST 2020 |
| |
+------------------------------------------------------------------------------------------------+
| WLAN |
| |
| Copyright (c) 1999 - 2020 Broadcom Corporation |
| |
| Revision : 10.10.122.22 (r696077 WLTEST) |
| Build Timestamp: Mon Aug 3 11:30:00 CST 2020 |
+------------------------------------------------------------------------------------------------+
Loading WL wireless driver...
wl: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
initvars_cis_pci: Not CIS format
Neither SPROM nor OTP has valid image
srom rev:0
wl:srom/otp not programmed, using external nvram file
Init SROM: unit=0 chipId=0xa8d1
Reading SROM vars files
######sagemdebug######: wl0->chipId=0xa8d1
wl0: Broadcom BCM43227 802.11 Wireless Controller 10.10.122.22 (r696077 WLTEST)
brcm-dqnet: net device wifi
PCI: Enabling device 0000:02:00.0 (0000 -> 0002)
PCI: Enabling device 0000:03:00.0 (0000 -> 0002)
initvars_cis_pci: Not CIS format
srom rev:0
wl:srom/otp not programmed, using external nvram file
Init SROM: unit=1 chipId=0x4360
Reading SROM vars files
######sagemdebug######: wl1->chipId=0x4360
wl1: Broadcom BCM4360 802.11 Wireless Controller 10.10.122.22 (r696077 WLTEST)
brcm-dqnet: net device wifi
modprobe sagemcom_wifi_led...
sagemcom_wifi_button modprobe
modprobe sagemcom_wifi_button...
modprobe sagemcom_reset_button...
sagemcom_wifi_pbc_isr!
Loading WLCSM driver...
Initializing WLCSM Module
WLCSM Module loaded successfully
ssk:11.540:mdm_loadConfig:162:Got primary config file from flash (len=63728), validating....
IPv6: ADDRCONF(NETDEV_CHANGE): priv0: link becomes ready
privbr: port 1(priv0) entered forwarding state
privbr: port 1(priv0) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): privbr: link becomes ready
rpc_erouter service (4) rx unregistered function 38, queueing to be processed later.
rpc_erouter service (4) rx unregistered function 1, queueing to be processed later.
ssk:33.364:cmsMdm_initWithAcc:323:Current mdmVersionInFile 1
can't open MoCA device: No such file or directorybonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
ssk:33.917:sagRut_creatDnsspoofConfig:2449:Enter
ip_tables: (C) 2000-2006 Netfilter Core Team
eCos (?)
BCM338498 0002A080 AVSThresholds low: ro_h = 4770, ro_s = 6081
AVSThresholds high: ro_h = 4833, ro_s = 6148
memsys4g800x16 2p5bld1
SHMOO VER 1.17
MCB
PKID 20131007 050B6000 050B0000 04B4103E 00001C00
S30000187
00000FD0
+00000004 >000000FD
t0000001D 0000003C
@000000B4 ^00000018
RDEN W0 00000022 00000005 00000000
RDLY W0 00000004
RDQS W0
0000000000111111111122222222223333333333444444444455555555556666
0123456789012345678901234567890123456789012345678901234567890123
00 ----------+++++++++++++++++++++X++++++++++++++++++++------------
01 --------++++++++++++++++++++++X++++++++++++++++++++++-----------
02 ----------++++++++++++++++++++++X+++++++++++++++++++++----------
03 -------+-++++++++++++++++++++++X++++++++++++++++++++++----------
04 ----++++++++++++++++++++++X++++++++++++++++++++++---------------
05 ------++++++++++++++++++++++X+++++++++++++++++++++--------------
06 ----+++++++++++++++++++++++X++++++++++++++++++++++--------------
07 ---------++++++++++++++++++++++X++++++++++++++++++++++----------
08 --++++++++++++++++++++++X++++++++++++++++++++++-----------------
09 --------++++++++++++++++++++X++++++++++++++++++++---------------
10 ------++++++++++++++++++++X++++++++++++++++++++-----------------
11 -----++++++++++++++++++++X++++++++++++++++++++------------------
12 ---++++++++++++++++++++++X+++++++++++++++++++++-----------------
13 --++++++++++++++++++++++X+++++++++++++++++++++------------------
14 -------+++++++++++++++++++++X++++++++++++++++++++---------------
15 ---------+++++++++++++++++++++X++++++++++++++++++++-------------
P W0
0000000000111111111122222222223333333333444444444455555555556666
0123456789012345678901234567890123456789012345678901234567890123
00 ---------+++++++++++++++++++++++X++++++++++++++++++++++---------
01 ---------++++++++++++++++++++++X++++++++++++++++++++++----------
02 --------+++++++++++++++++++++++X++++++++++++++++++++++----------
03 --------+-++++++++++++++++++++++X+++++++++++++++++++++----------
04 ---+++++++++++++++++++++++X++++++++++++++++++++++---------------
05 -------+++++++++++++++++++++++X++++++++++++++++++++++-----------
06 -----+-+++++++++++++++++++++X+++++++++++++++++++++--------------
07 ---------+++++++++++++++++++++++X++++++++++++++++++++++---------
08 --+-++++++++++++++++++++++X+++++++++++++++++++++----------------
09 -------++++++++++++++++++++++X+++++++++++++++++++++-------------
10 ----+--+++++++++++++++++++++X+++++++++++++++++++++--------------
11 ----+++++++++++++++++++++++X+++++++++++++++++++++++-------------
12 ----+++++++++++++++++++++++X+++++++++++++++++++++++-------------
13 ---++++++++++++++++++++++X+++++++++++++++++++++-----------------
14 -----+++++++++++++++++++++++X++++++++++++++++++++++-------------
15 ----------+-+++++++++++++++++++++X++++++++++++++++++++----------
N W0
0000000000111111111122222222223333333333444444444455555555556666
0123456789012345678901234567890123456789012345678901234567890123
00 -----+-+++++++++++++++++++++++X++++++++++++++++++++++-----------
01 -------+++++++++++++++++++++++X++++++++++++++++++++++-----------
02 -------+++++++++++++++++++++++X+++++++++++++++++++++++----------
03 ------+-+++++++++++++++++++++++X++++++++++++++++++++++----------
04 ----++++++++++++++++++++++X++++++++++++++++++++++---------------
05 ----+++++++++++++++++++++++X++++++++++++++++++++++--------------
06 -----+-+++++++++++++++++++++X+++++++++++++++++++++--------------
07 -------++++++++++++++++++++++++X+++++++++++++++++++++++---------
08 -+++++++++++++++++++++++X++++++++++++++++++++++-----------------
09 -------+++++++++++++++++++++X++++++++++++++++++++---------------
10 --+-+++++++++++++++++++++X+++++++++++++++++++++-----------------
11 -++-+++++++++++++++++++++X++++++++++++++++++++------------------
12 -+++++++++++++++++++++++X++++++++++++++++++++++-----------------
13 -++++++++++++++++++++++X++++++++++++++++++++++------------------
14 -+-+-++++++++++++++++++++++X+++++++++++++++++++++---------------
15 --------+++++++++++++++++++++X+++++++++++++++++++++-------------
WRDQ W0
0000000000111111111122222222223333333333444444444455555555556666
0123456789012345678901234567890123456789012345678901234567890123
00 ++++++++++++++++++++X+++++++++++++++++++-------------+++++++++++
01 +++++++++++++++++++X++++++++++++++++++---------------+++++++++++
02 +++++++++++++++++++X+++++++++++++++++++-------------++++++++++++
03 ++++++++++++++++++X++++++++++++++++++-+-------------++++++++++++
04 +++++++++++++++++X+++++++++++++++++------------------+++++++++++
05 +++++++++++++++++++X+++++++++++++++++++--------------+++++++++++
06 ++++++++++++++++++X+++++++++++++++++-----------------+++++++++++
07 +++++++++++++++++++X+++++++++++++++++++--------------+++++++++++
08 ++++++++++++++++++X+++++++++++++++++-----------------+++++++++++
09 +++++++++++++++++++X++++++++++++++++++----------------++++++++++
10 ++++++++++++++++++X+++++++++++++++++----------------++++++++++++
11 +++++++++++++++++++X++++++++++++++++++--------------++++++++++++
12 ++++++++++++++++++X+++++++++++++++++-----------------+++++++++++
13 ++++++++++++++++++X+++++++++++++++++-----------------+++++++++++
14 ++++++++++++++++++X+++++++++++++++++----------------++++++++++++
15 -+++++++++++++++++++X+++++++++++++++++++----------------++++++++
WRDM W0 00000012
WRDM W0 00000012
ADDR
0000000000111111111122222222223333333333444444444455555555556666
0123456789012345678901234567890123456789012345678901234567890123
00 ++++++++++++++++++++++++++++S+X+++++++++++++++++++++++++++++++--
0
eCos - hal_diag_init
Ecos memory map:
BLOCK OWNER MIPS SIZE MEM
Block 0: Owner: 0 - 0x00000000 0x03f00000 0x08000000
Block 0: Owner: 0 - 0 MB 63 MB 128 MB
Block 1: Owner: 3 - 0x07e00000 0x00200000 0x0e000000
Block 1: Owner: 3 - 126 MB 2 MB 224 MB
Block 2: Owner: 2 - 0x00000000 0x06000000 0x00000000
Block 2: Owner: 2 - 0 MB 96 MB 0 MB
Block 3: Owner: 3 - 0x07e00000 0x00200000 0x0fe00000
Block 3: Owner: 3 - 126 MB 2 MB 254 MB
63MB (64512KB) remaining for eCos
Init device '/dev/BrcmTelnetIoDriver'
Init device '/dev/ttydiag'
Init tty channel: 80c55b30
Init device '/dev/tty0'
Init tty channel: 80c55b50
Init device '/dev/haldiag'
HAL/diag SERIAL init
Init device '/dev/ser0'
BCM 33XX SERIAL init - dev: b4e00500.1
Set output buffer - buf: 0x80f0c208 len: 4096
Set input buffer - buf: 0x80f0d208 len: 4096
BCM 33XX SERIAL config
Init device '/dev/ser1'
BCM 33XX SERIAL init - dev: b4e00520.2
Set output buffer - buf: 0x80f0e208 len: 4096
Set input buffer - buf: 0x80f0f208 len: 4096
BCM 33XX SERIAL config
Init device '/dev/ser2'
SetProConfig(): (0xa0) DocsisConfig
InitBoard: MIPS frequency 637500000
InitBoard: Switching APM Clock to SYSPLL.
ApmClockSelect ClockSource = 0
Clock select completed successfully!
InitBoard: Setting LCPLL to 2.6GHz.
InitBoard: Updated LC PLL Lock status: OK
Allocating global lock 14, self = 80, mbox_cfg=b51f80f8
****Booting RGLinux on Zephyr.****
ATW 0 gisb: 08000000 ubus: 00000000 size 04000000 clients 0081bf09
ATW 1 gisb: 00000000 ubus: 08000000 size 08000000 clients 0081bf09
ATW 2 is disabled
ATW 3 is disabled
ATW 4 is disabled
ATW 5 is disabled
ATW 6 is disabled
ATW 7 is disabled
NAND device size 10000000 block size 00020000 partitions 14
partition 0: bootl 00000000 00010000
partition 1: image1 04c60000 00d00000
partition 2: image2 05960000 00d00000
partition 3: linux 06660000 00480000
partition 4: linuxapps 00200000 04a60000
partition 5: permnv 00010000 00020000
partition 6: rgnv 07ce0000 01200000
partition 7: dynnv 001c0000 00040000
partition 8: linuxkfs 06ae0000 01200000
partition 9: linux2 0d960000 00480000
partition 10: linuxkfs2 0dde0000 01200000
partition 11: rgnv2 0efe0000 01220000
partition 12: linuxapps2 08ee0000 04a80000
partition 13: bootnv 00030000 00020000
NAND start 00200000 Nand Top 10200000
Adjusted Sorted NAND partitions:
partition 0: linuxapps 00020000 04a40000
partition 1: image1 04a60000 00d00000
partition 2: image2 05760000 00d00000
partition 3: linux 06460000 00480000
partition 4: linuxkfs 06900000 011e0000
partition 5: rgnv 07ae0000 01200000
partition 6: linuxapps2 08d00000 04a60000
partition 7: linux2 0d760000 00480000
partition 8: linuxkfs2 0dc00000 011e0000
partition 9: rgnv2 0ede0000 01220000
BootNonvolGetSuccessCount( 2 ) = 25
BootLinuxZephyr() boot args at 0xa8001100: ubi.mtd=linuxapps2 root=ubi0:rootfs ro noinitrd rootfstype=ubifs console=ttyS0,115200 ubifs_apps apps=ubifs:linuxapps2 ubifs_data data=ubifs:rgnv product_name=BCM93384WVG wdog debug
Powering on USB
....Zephyr Handshake complete
Allocating global lock 15, self = 80, mbox_cfg=b51f80fc
BcmSagemcomNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
BcmSagemcomNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
BcmSagemcomNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
[00:00:00 01/01/1970] [tStartup] BcmBfcSystemFactory::NewBfcSystem: BcmEmtaCmDocsisSystem
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver...
[00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0xef4015
Waited 3 iterations after device ID read
NAND flash: Device size 256 MB, Block size 128 KB, Page size 2048 B
[00:00:00 01/01/1970] [tStartup] BcmNandFlashDevice::DetectNandFlash: (NAND Flash Device Factory) WARNING - Detected NAND flash with JEDEC ID =0xc2da9095
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:01 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:02 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:02 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:02 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:02 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:02 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:02 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:02 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver...
[00:00:02 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver...
ProgramStoreDeviceDriver::ProgramStoreDriverInit: INFO - Initializing...
[00:00:02 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver...
NonVolDevice Driver::NonVolDriverInit: Running on Viper and supporting split mode operations...
[00:00:02 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully.
[00:00:02 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices...
Detecting the next image number that we will store to by default...
Bootloader indicates we are running image 1
By default, we will dload to image number 2!
[00:00:02 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully.
AVS Thread Constructor....
PMC AVS Thread Constructor....
LoadPMCCode:
codesize = 11040
allocated = 32768
buffAddr = 0x83e617c4
alignMask = 0xffffc000
codeAddr = 0x83e64000
PMC AVS Thread:: Releasing B0 run-time code...
waiting on pmc to accept or reject image
PMC indicates run_stAllocating global lock 13, self = 80, mbox_cfg=b51f80f4
ate = 7 (Running)
AVS is enabled (state = 0)
Scratch register = 0x1020000
BcmEmtaNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
BcmHalIfNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
ChipId = 33840098
->Enable pinmux GPIO15 as SPI_SS4 @1.5Mhz(default) clk.
**>Probed external QAMLink Chip with SPI_SS4 return 0xffffffff
Error reading from 31xx: NO ACK
**>Probed external QAMLink Chip with I2C(0x68) return 0xdead012c
Error reading from 31xx: NO ACK
**>Probed external QAMLink Chip with I2C(0x69) return 0xdead012c
Error reading from 31xx: NO ACK
**>Probed external QAMLink Chip with I2C(0x6a) return 0xdead012c
Error reading from 31xx: NO ACK
**>Probed external QAMLink Chip with I2C(0x6b) return 0xdead012c
************************************************************************
* Detecting external QAMLink Chip with I2C(0x6c) return 0x31280200 *
************************************************************************
**External Bcm3128C0 Present @I2C(0x6c)**
**Total DS channels is now 24, Ext Channel start from ch number 16
Sagemcom Rg NonVolSettings DynamicSection ResetDefaults
Sagemcom Rg NonVolSettings PermanentSection ResetDefaults
mtaNvCalcChecksum: checksum= 1273101766
Reading Permanent settings from non-vol...
Checksum for permanent settings: 0x77ddb3f6
Settings were read and verified.
Reading Dynamic settings from non-vol...
Checksum for dynamic settings: 0x2ba64dbb
Settings were read and verified.
[00:00:03 01/01/1970] [tStartup] BcmNonVolDeviceDriverBridge::WriteSync: (NonVol Device) Writing to dynamic nonvol section
[00:00:03 01/01/1970] [tStartup] BcmNonVolDeviceDriverBridge::WriteSync: (NonVol Device) Synchronous write to dynamic nonvol section succeeded
Console input has been disabled in non-vol.
Console output has been disabled in non-vol! Goodbye...
What should I do next?
from bcm2-utils.
Related Issues (20)
- Cisco EPC3010 boot process locked HOT 8
- Device profile for TC7210 HOT 1
- Netgear CG3100; progress and things of note HOT 6
- what's the Ubee Cable modem uart console Pin sequence HOT 4
- Finding flash dump functions HOT 5
- Castlenet CBV734EW : Can't dump in bootloader mode HOT 1
- View password telnet protocol Kaon Broadcom HOT 1
- TC7200_Kernel_Image HOT 5
- Bootloader Unlocking HOT 1
- Bricked CAX80, need RG login HOT 1
- TM902S 'ARRIS NonVol Settings' group HOT 5
- Castlenet CBV384Z4-AC1600 Can't dump in bootloader mode HOT 2
- Bisected: group size 0 too small to be valid
- Failed to parse group userif and firewall KAONMEDIA CG2200 CLARO HOT 6
- CGA2121 support HOT 1
- DecryptIng and adding other groups for Arris TM902S
- Side load file with script into original bin file? HOT 1
- Can't dump flash via telnet interface, Arris TM902S HOT 24
- Sagemcom Fast 3890 support HOT 1
- Strange Telnet and SSH interface on Ubee DDW36C HOT 8
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from bcm2-utils.