Sagemcom F@st 5350 GV – Teardown

Teardown do Sagemcom Modem F@st 5350 GV.

Cliquem na imagem acima para abrir o álbum com o teardown.

Em breve publico a descrição dos componentes. Uma análise breve:

porta serial funcional, com acesso ao bootloader (leitura de NAND, debug, carga de binários, …) e ao shell de sistema (root);
dump da partições feitas;
software baseado no OpenWRT;
mesmo SoC e line driver do PACE V5471, portanto, são parecidos em vários aspectos;
imagens de firmware assinadas, com certificado raiz gravado no bootloader;

O bacana é ver no fonte dos HTMLs da interface, informações do spider que usaram para “sugá-la” do 2764 GV!

Edit:

Bootlog:

  <td>
    <div class="text codecolorer">
      HELO<br /> CPUI<br /> L1CI<br /> HELO<br /> CPUI<br /> L1CI<br /> DRAM<br /> ----<br /> PHYS<br /> STRF<br /> 400H<br /> PHYE<br /> DDR3<br /> SIZ4<br /> SIZ3<br /> SIZ2<br /> DINT<br /> USYN<br /> LSYN<br /> MFAS<br /> LMBE<br /> RACE<br /> PASS<br /> ----<br /> ZBSS<br /> CODE<br /> DATA<br /> L12F<br /> MAIN<br /> FPS0<br /> SVOL<br /> NGEO<br /> FVLY<br /> FVLY<br /> RVOL<br /> J2EP<br /> SeKO
    </div>
  </td>
</tr>

CFE version 1.0.38-112.118 for BCM963268 (32bit,SP,BE)

Build Date: Fri Jul 12 13:19:06 CEST 2013 (g178451@rmm-p1188627fl)

CFE (soft operational)

NAND flash device: name Hynix H27U1G8F2B, id 0xadf1 block 128KB size 131072KB

Access type is MDIO_BUS

External switch id = 53125

Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz

Main Thread: TP0

Memory Test Passed

Total Memory: 134217728 bytes (128MB)

Boot Address: 0xb8000000

NextLevelBoot U-boot @ 0x87f00000

Board IP address : 192.168.1.1:ffffff00

Host IP address : 192.168.1.100

Gateway IP address :

Run from flash/host (f/h) : f

Default host run file name : vmlinux

Default host flash file name : bcm963xx_fs_kernel

Boot delay (0-9 seconds) : 1

Launch linux/uboot (l/u) : l

Board Id (0-7) : F@ST5350GV

Number of MAC Addresses (1-32) : 10

Base MAC Address : 00:10:18:00:00:00

PSI Size (1-64) KBytes : 24

Enable Backup PSI [0|1] : 0

System Log Size (0-256) KBytes : 0

Main Thread Number [0|1] : 0

*\* Press any key to stop auto run (1 seconds) **

Auto run second count down: 110

Initializing UBI to launch u-boot!

UBI volume uboot has id 1

read 834456 bytes from UBI volume 1

SHATEST=2.

Ubi U-Boot Entry at 0x87f00000

Closing network.

Disabling Switch ports.

Flushing Receive Buffers…

0 buffers found.

Closing DMA Channels.

Starting program at 0x87f00000

U-Boot 2011.12

Version: 4.10.0-full (Jul 12 2013 – 13:19:02)

gpio in: 0x40cfdf1f

board type: 00020010

board memsize : 0x08000000

CPU: Broadcom BCM63168D0

DRAM: 128 MiB

NAND: bcm63xxx nand initialization

handle_acc_control: default CORR ERR threshold 1 bits

ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16

reqEccLevel=0, eccLevel=4

128 MiB

Creating 1 MTD partitions on “nand0″:

0x0000000c0000-0x000007b00000 : “mtd=1″

UBI: attaching mtd1 to ubi0

UBI: physical eraseblock size: 131072 bytes (128 KiB)

UBI: logical eraseblock size: 126976 bytes

UBI: smallest flash I/O unit: 2048

UBI: VID header offset: 2048 (aligned 2048)

UBI: data offset: 4096

UBI: attached mtd1 to ubi0

UBI: MTD device name: “mtd=1″

UBI: MTD device size: 122 MiB

UBI: number of good PEBs: 978

UBI: number of bad PEBs: 0

UBI: max. allowed volumes: 128

UBI: wear-leveling threshold: 256

UBI: number of internal volumes: 1

UBI: number of user volumes: 7

UBI: available PEBs: 299

UBI: total number of reserved PEBs: 679

UBI: number of PEBs reserved for bad PEB handling: 9

UBI: max/mean erase counter: 6/1

Volume bootenv not found!

*** Warning – bad CRC, using default environment

Net: BCM63xxx

Hit any key to stop autoboot: 3 2 1 0

sb3: sb3_sagem_init()

sb3: action: 1007

sb3: sb3_wait_for_magic()

sb3: action: 1002

sb3: sb3_boot( operational )

sb3: top available addr 0x878b0000, ram available = 0x74b0000

sb3_load_ubivol: max_load_size=122355712

Read 20192532 bytes from volume operational to 80400000

sb3: image operational moved to 86570000-878b1d14

gsdf ident string OK

gsdf size OK

gsdf auth_hash OK

sb3: image operational has gsdf format

gsdf ident string OK

gsdf size OK

gsdf auth_hash OK

found a root CA certificate in section 0

found a secondary certificate in section 1

certificate chain OK

root certificate OK (sagemcom caCert)

not a livebox. no subject name verification

signature OK

section list OK

gsdf head_hash OK

gsdf data_hash OK

sb3: image operational signature OK

BCM63xx : unregistering Ethernet driver

Disabling Switch ports.

Flushing Receive Buffers…

0 buffers found.

Closing DMA Channels.

sb3: No pre-boot commands

sb3: setting kernel args

bootm 86570C98

## Booting kernel from Legacy Image at 86570c98 …

Image Name: scOS SG790131200068 (3.12.35)

Created: 2013-07-19 15:34:34 UTC

Image Type: MIPS Linux Kernel Image (gzip compressed)

Data Size: 2031616 Bytes = 1.9 MiB

Load Address: 80010000

Entry Point: 80337e30

Verifying Checksum … OK

Uncompressing Kernel Image … OK

Starting kernel …

Linux version 2.6.30 (orange1@rmm08070) (gcc version 4.4.2 (GCC) ) #4 SMP PREEMPT Fri Jul 19 17:34:23 CEST 2013

argc 14 arg a79c032c env a79c0840

memsize board_memsize = 128

env memsize=128

env initrd_start=0xA0000000

env initrd_size=0x0

flash_start 0

env flash_start=0x00000000

board_flash_size ffffffff

env flash_size=0xFFFFFFFF

env ethaddr=00:01:02:03:04:05

arg[1] root=mtd:rootfs

arg[2] init=/etc/preinit

arg[3] ro

arg[4] rootfstype=squashfs

arg[5] console=ttyS0,115200

arg[6] rootfs_offset=0x001f0d14

arg[7] rootfs_size=0x01151000

arg[8] mtdparts=nand:768k(bcm),125184k(partAll),5120k(data)

arg[9] ubi.mtd=ubi

arg[10] part_main=partAll

arg[11] part_boot=partAll

arg[12] image_ubivol=operational

arg[13] board_type=00020030

BCM Flash API. Flash device is not found.

F@ST5350GV prom init

CPU revision is: 0002a080 (Broadcom4350)

DSL SDRAM reserved: 0x132000

Determined physical RAM map:

memory: 07ece000 @ 00000000 (usable)

Zone PFN ranges:

DMA 0x00000000 -> 0x00001000

Normal 0x00001000 -> 0x00007ece

Movable zone start PFN for each node

early_node_map[1] active PFN ranges

0: 0x00000000 -> 0x00007ece

On node 0 totalpages: 32462

free_area_init_node: node 0, pgdat 803fc070, node_mem_map 81000000

DMA zone: 32 pages used for memmap

DMA zone: 0 pages reserved

DMA zone: 4064 pages, LIFO batch:0

Normal zone: 222 pages used for memmap

Normal zone: 28144 pages, LIFO batch:7

Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32208

Kernel command line: root=mtd:rootfs init=/etc/preinit ro rootfstype=squashfs console=ttyS0,115200 rootfs_offset=0x001f0d14 rootfs_size=0x01151000 mtdparts=nand:768k(bcm),125184k(partAll),5120k(data) ubi.mtd=ubi part_main=partAll part_boot=partAll image_ubivol=operational board_type=00020030

UBI image volume: “operational”

wait instruction: enabled

Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.

Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes

NR_IRQS:128

PID hash table entries: 512 (order: 9, 2048 bytes)

console [ttyS0] enabled

Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)

Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)

Memory: 124024k/129848k available (3263k kernel code, 5652k reserved, 769k data, 160k init, 0k highmem)

Calibrating delay loop… 398.33 BogoMIPS (lpj=199168)

Mount-cache hash table entries: 512

–Kernel Config–

SMP=1

PREEMPT=1

DEBUG_SPINLOCK=0

DEBUG_MUTEXES=0

Broadcom Logger v0.1 Jul 19 2013 07:42:11

CPU revision is: 0002a080 (Broadcom4350)

Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.

Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes

Calibrating delay loop… 402.43 BogoMIPS (lpj=201216)

Brought up 2 CPUs

net_namespace: 1140 bytes

NET: Registered protocol family 16

Total Flash size: 0K with -1 sectors

Internal 1P2 VREG will be shutdown if unused…Unused, turn it off (000087b8-000087b4=4<300)

registering PCI controller with io_map_base unset

bio: create slab at 0

SCSI subsystem initialized

pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10013fff]

pci 0000:00:00.0: reg 30 32bit mmio: [0x000000-0x0007ff]

pci 0000:00:00.0: supports D1 D2

pci 0000:00:00.0: PME# supported from D0 D3hot D3cold

pci 0000:00:00.0: PME# disabled

pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff]

pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff]

pci 0000:01:00.0: PME# supported from D0 D3hot

pci 0000:01:00.0: PME# disabled

pci 0000:01:00.0: PCI bridge, secondary bus 0000:02

pci 0000:01:00.0: IO window: disabled

pci 0000:01:00.0: MEM window: disabled

pci 0000:01:00.0: PREFETCH window: disabled

PCI: Setting latency timer of device 0000:01:00.0 to 64

BLOG v3.0 Initialized

BLOG Rule v1.0 Initialized

Broadcom IQoS v0.1 Jul 19 2013 07:45:12 initialized

Broadcom GBPM v0.1 Jul 19 2013 07:45:13 initialized

NET: Registered protocol family 8

NET: Registered protocol family 20

NET: Registered protocol family 2

Switched to high resolution mode on CPU 1

Switched to high resolution mode on CPU 0

IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

TCP established hash table entries: 4096 (order: 3, 32768 bytes)

TCP bind hash table entries: 4096 (order: 3, 32768 bytes)

TCP: Hash tables configured (established 4096 bind 4096)

TCP reno registered

NET: Registered protocol family 1

squashfs: version 4.0 (2009/01/31) Phillip Lougher

Registering unionfs 2.5.10 (for 2.6.30.10)

fuse init (API version 7.11)

msgmni has been set to 242

io scheduler noop registered

io scheduler deadline registered (default)

PCI: Setting latency timer of device 0000:01:00.0 to 64

Driver ‘sd’ needs updating – please use bus_type methods

PPP generic driver version 2.4.2

PPP Deflate Compression module registered

PPP BSD Compression module registered

NET: Registered protocol family 24

bcm963xx_mtd driver v1.0

Failed to read image tag from flash

Broadcom DSL NAND controller (BrcmNand Controller)

–>brcmnand_scan: CS=0, numchips=1, csi=0

mtd->oobsize=0, mtd->eccOobSize=0

NAND_CS_NAND_XOR=00000000

Disabling XOR on CS#0

brcmnand_scan: Calling brcmnand_probe for CS=0

B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0

brcmnand_read_id: CS0: dev_id=adf1801d

After: NandSelect=40000001, nandConfig=15142200

Block size=00020000, erase shift=17

NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11

busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff

timing1 not adjusted: 6574845b

timing2 not adjusted: 00001e96

brcmnand_adjust_acccontrol: gAccControl[CS=0]=00000000, ACC=f7441010

BrcmNAND mfg ad f1 Hynix HY27UF081G2A 128MB on CS0

Found NAND on CS0: ACC=f7441010, cfg=15142200, flashId=adf1801d, tim1=6574845b, tim2=00001e96

BrcmNAND version = 0x0400 128MB @00000000

brcmnand_scan: Done brcmnand_probe

brcmnand_scan: B4 nand_select = 40000001

brcmnand_scan: After nand_select = 40000001

100 CS=0, chip->ctrl->CS[0]=0

handle_acc_control: default CORR ERR threshold 1 bits

ECC level threshold set to 1 bits

ECC level 4, threshold at 1 bits

ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16

reqEccLevel=0, eccLevel=4

190 eccLevel=4, chip->ecclevel=4, acc=f7441010

brcmnand_scan 10

200 CS=0, chip->ctrl->CS[0]=0

200 chip->ecclevel=4, acc=f7441010

page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17

brcmnand_scan 220

Brcm NAND controller version = 4.0 NAND flash size 128MB @18000000

brcmnand_scan 230

brcmnand_scan 40, mtd->oobsize=64, chip->ecclayout=00000000

brcmnand_scan 42, mtd->oobsize=64, chip->ecclevel=4, isMLC=0, chip->cellinfo=0

ECC layout=brcmnand_oob_bch4_2k

brcmnand_scan: mtd->oobsize=64

brcmnand_scan: oobavail=35, eccsize=512, writesize=2048

brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=4, eccbytes=7

300 CS=0, chip->ctrl->CS[0]=0

500 chip=87a50990, CS=0, chip->ctrl->CS[0]=0

–>brcmnand_default_bbt

brcmnand_default_bbt: bbt_td = bbt_slc_bch4_main_descr

Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0

Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0

brcmnand_reset_corr_threshold: default CORR ERR threshold 1 bits for CS0

ECC level threshold default value is 1 bits for CS0

brcmnand_reset_corr_threshold: CORR ERR threshold changed to 3 bits for CS0

brcmnandCET: Status -> Deferred

brcmnand_scan 99

Creating 5 MTD partitions on “brcmnand.0″:

0x000000000000-0x000000020000 : “bcmfs”

0x000000020000-0x0000000c0000 : “bcmfs_update”

0x0000000c0000-0x000007b00000 : “ubi”

0x000007b00000-0x000007f00000 : “data”

0x000000000000-0x000000020000 : “nvram”

UBI: attaching mtd2 to ubi0

UBI: physical eraseblock size: 131072 bytes (128 KiB)

UBI: logical eraseblock size: 126976 bytes

UBI: smallest flash I/O unit: 2048

UBI: VID header offset: 2048 (aligned 2048)

UBI: data offset: 4096

Add UBI volume partitions: name=secondaryboot

Add UBI volume partitions: name=uboot

Add UBI volume partitions: name=permanent_param

Add UBI volume partitions: name=operational

Creating 3 MTD partitions on “operational”:

0x000000000000-0x00000001f000 : “firm_header”

0x00000001f000-0x00000020fd14 : “kernel”

mtd: partition “kernel” doesn’t end on an erase block — force read-only

0x0000001f0d14-0x000001341d14 : “rootfs”

mtd: partition “rootfs” doesn’t start on an erase block boundary — force read-only

Add UBI volume partitions: name=rescue

Add UBI volume partitions: name=filesystem1

Add UBI volume partitions: name=gui

Creating 2 MTD partitions on “gui”:

0x000000000000-0x00000001f000 : “gui_header”

mtd: partition “gui_header” is out of reach — disabled

0x000000000000-0x000000000000 : “guifs”

mtd: partition “guifs” is out of reach — disabled

UBI: attached mtd2 to ubi0

UBI: MTD device name: “ubi”

UBI: MTD device size: 122 MiB

UBI: number of good PEBs: 978

UBI: number of bad PEBs: 0

UBI: max. allowed volumes: 128

UBI: wear-leveling threshold: 256

UBI: number of internal volumes: 1

UBI: number of user volumes: 7

UBI: available PEBs: 299

UBI: total number of reserved PEBs: 679

UBI: number of PEBs reserved for bad PEB handling: 9

UBI: max/mean erase counter: 6/1

brcmboard: brcm_board_init entry

PCIe: No device found – Powering down

Serial: BCM63XX driver $Revision: 6 $

Magic SysRq enabled (type ^ h for list of supported commands)

ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX

ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX

bcmPktDma_init: Broadcom Packet DMA Library initialized

Total # RxBds=1448

bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized

bcmxtmrt: Broadcom BCM3168D0 ATM/PTM Network Device v0.4 Jul 19 2013 07:44:26

p8021ag: p8021ag_init entry

IPSEC SPU: SUCCEEDED

UBI: background thread “ubi_bgt0d” started, PID 50

GACT probability NOT on

Mirror/redirect action on

u32 classifier

input device check on

Actions configured

GRE over IPv4 tunneling driver

TCP cubic registered

Initializing XFRM netlink socket

NET: Registered protocol family 10

IPv6 over IPv4 tunneling driver

NET: Registered protocol family 17

NET: Registered protocol family 15

Bridge firewalling registered

Initializing MCPD Module

Ebtables v2.0 registered

ebt_time registered

ebt_ftos registered

ebt_wmm_mark registered

802.1Q VLAN Support v1.8 Ben Greear greearb@candelatech.com

All bugs added by David S. Miller davem@redhat.com

VFS: Mounted root (squashfs filesystem) readonly on device 31:11.

Freeing unused kernel memory: 160k freed

Warning: unable to open an initial console.

– preinit –

Press the [f] key and hit [enter] to enter failsafe mode

– regular preinit –

– init –

UBIFS: recovery needed

UBIFS: recovery completed

UBIFS: mounted UBI device 0, volume 5, name “filesystem1″

UBIFS: file system size: 11046912 bytes (10788 KiB, 10 MiB, 87 LEBs)

UBIFS: journal size: 1015809 bytes (992 KiB, 0 MiB, 6 LEBs)

UBIFS: media format: w4/r0 (latest is w4/r0)

UBIFS: default compressor: lzo

UBIFS: reserved for root: 521772 bytes (509 KiB)

_ _ ___ _ _ _

| | | | __ \ | | |/ __)

| |_| | | / | | / /__

| _ | | __| |/| | _ \

| | | | |_\ \ /\ / (_) )

_| |_/\_\_// / \_/

Embedded Sagemcom Linux Distribution

—————————————————

unionfs: new lower inode mtime (bindex=1, name=dev)

Version: SG790131200068 (3.12.35)

Built: by orange1@rmm08070 on Fri Jul 19 17:14:38 CEST 2013

(none) login: usbcore: registered new interface driver usbfs

usbcore: registered new interface driver hub

usbcore: registered new device driver usb

NTFS driver 2.1.29 [Flags: R/W MODULE].

tun: Universal TUN/TAP device driver, 1.6

[HAL-BSP]: Load …

[HAL-BSP]: Manufacturer(Sagemcom) Serial Number(XXXXXXXXXXXXXXX)

[HAL-BSP]: Sagem Hardware ProductId(SagemcomFast5350_GVT) Version(S.2.0) Revision(1.0)

[HAL-BSP]: Customer Hardware ProductId(GVT) Version(Fast5350GV) Revision(1.1)

[HAL-BSP]: Firmware Version() Type(Unknown Firmware Type)

[HAL-BSP]: Size {Ram -> [Pp(131072) Linux(124356)] Flash ->[Pp(131072)]}

[HAL-BSP]: Ok …

Driver LED and BUTTON init …..

Driver LED and BUTTON ok …..

nf_conntrack version 0.5.0 (2028 buckets, 8112 max)

nf_ct_rtsp: Successfully created nf_conntrack_rtsp task

Netfilter messages via NETLINK v0.30.

ctnetlink v0.93: registering with nfnetlink.

bcm_ingqos: module license ‘Proprietary’ taints kernel.

Disabling lock debugging due to kernel taint

Broadcom Ingress QoS Module Char Driver v0.1 Jul 19 2013 05:39:20 Registered

Broadcom Ingress QoS ver 0.1 initialized

BPM: tot_mem_size=134217728B (128MB), buf_mem_size=20132655B (19MB), num of buffers=9532, buf size=2112

Broadcom BPM Module Char Driver v0.1 Jul 19 2013 05:39:10 Registered

[NTC bpm] bpm_set_status: BPM status : enabled

NBUFF v1.0 Initialized

Initialized fcache state

Broadcom Packet Flow Cache Char Driver v2.2 Jul 19 2013 05:39:21 Registered

Created Proc FS /procfs/fcache

Broadcom Packet Flow Cache registered with netdev chain

Broadcom Packet Flow Cache learning via BLOG enabled.

Constructed Broadcom Packet Flow Cache v2.2 Jul 19 2013 05:39:21

chipId 0x631680D0

Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jul 19 2013 05:39:11 Registered

FAP Debug values at 0x00000010 0x00000010

Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000

FAP Soft Reset Done

4ke Reset Done

Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000

FAP Soft Reset Done

4ke Reset Done

FAP Debug values at 0xa549b720 0xa54db720

Allocated FAP0 GSO Buffers (0xA54A17D0) : 1048576 bytes @ 0xA5500000

Allocated FAP1 GSO Buffers (0xA54E17D0) : 1048576 bytes @ 0xA5600000

Allocated FAP0 TM SDRAM Queue Storage (a54a17d4) : 341376 bytes @ a5700000

Allocated FAP1 TM SDRAM Queue Storage (a54e17d4) : 341376 bytes @ a5780000

[NTC fapProto] fapReset : Reset FAP Protocol layer

[FAP0] DSPRAM : stack , global , free , total

[FAP1] DSPRAM : stack , global , free , total

[FAP0] PSM : addr, used , free , total

[FAP1] PSM : addr, used , free , total

[FAP0] Flows supported: 217 (dsp 56, psm 21, qsm 140)

[FAP1] Flows supported: 217 (dsp 56, psm 21, qsm 140)

[FAP0] DQM : availableMemory 15064 bytes, nextByteAddress 0xE0010528

[FAP1] DQM : availableMemory 15064 bytes, nextByteAddress 0xE0010528

[FAP0] GSO Buffer set to 0xA5500000

[FAP1] GSO Buffer set to 0xA5600000

[FAP0] FAP BPM Initialized.

[FAP1] FAP BPM Initialized.

fapDrv_construct: FAP0: pManagedMemory=b0820710. wastage 8 bytes

fapDrv_construct: FAP1: pManagedMemory=b0a20710. wastage 8 bytes

bcmPktDma_bind: FAP Driver binding successfull

[FAP0] FAP TM: ON

[FAP1] FAP TM: ON

bcmxtmcfg: bcmxtmcfg_init entry

adsl: adsl_init entry

Broadcom BCM63168D0 Ethernet Network Device v0.1 Jul 19 2013 05:41:52

fapDrv_psmAlloc: fapIdx=0, size: 4000, offset=b0820710 bytes remaining 7000

ETH Init: Ch:0 – 200 tx BDs at 0xb0820710

fapDrv_psmAlloc: fapIdx=1, size: 4000, offset=b0a20710 bytes remaining 7000

ETH Init: Ch:1 – 200 tx BDs at 0xb0a20710

fapDrv_psmAlloc: wastage 8 bytes

fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b08216b0 bytes remaining 2184

ETH Init: Ch:0 – 600 rx BDs at 0xb08216b0

fapDrv_psmAlloc: wastage 8 bytes

fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a216b0 bytes remaining 2184

ETH Init: Ch:1 – 600 rx BDs at 0xb0a216b0

ethsw.c : Ext switch TMII Port 5

dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered

eth0: MAC Address: 00:00:00:00:00:01

eth1: MAC Address: 00:00:00:00:00:01

eth2: MAC Address: 00:00:00:00:00:01

eth3: MAC Address: 00:00:00:00:00:01

eth4: MAC Address: 00:00:00:00:00:01

eth5: MAC Address: 00:00:00:00:00:01

[NTC arl] arlEnable : Enabled ARL binding to FAP

Broadcom Adress Resolution Logic Processor (ARL) Char Driver v0.1 Jul 19 2013 05:39:09 Registered

Broadcom 802.1Q VLAN Interface, v0.1

–SMP support

wl: dsl_tx_pkt_flush_len=338

wl: high_wmark_tot=6195

PCI: Setting latency timer of device 0000:00:00.0 to 64

wl: passivemode=1

wl: napimode=0

wl0: allocskbmode=1 currallocskbsz=512

otp_read_pci: bad crc

Neither SPROM nor OTP has valid image

wl:srom/otp not programmed, using main memory mapped srom info(wombo board)

wl:loading /etc/wlan/bcm6362_vars.bin

Failed to open srom image from ‘/etc/wlan/bcm6362_vars.bin’.

wl:loading /etc/wlan/bcm6362_map.bin

wl0: Broadcom BCM435f 802.11 Wireless Controller 5.100.138.2008.cpe4.12L06A.4-kdb

dgasp: kerSysRegisterDyingGaspHandler: wl0 registered

usbcore: registered new interface driver usblp

usbcore: registered new interface driver usbserial

usbserial: USB Serial Driver core

Initializing USB Mass Storage driver…

usbcore: registered new interface driver usb-storage

USB Mass Storage support registered.

USB Serial support registered for GSM modem (1-port)

usbcore: registered new interface driver option

option: v0.7.2:USB Driver for GSM modems

Endpoint: endpoint_init entry

in BpGetVoiceBoardIdin BpGetVoiceParmspszBoardId=SI32260 pszBaseBoardId=F@ST5350GV myBaseBoardId=F@ST5350Endpoint: endpoint_init COMPLETED

eth4 (switch port: 5) Link UP 200 mbps full duplex

message received before monitor task is initialized kerSysSendtoMonitorTask

eth0 (switch port: 1) Link UP 100 mbps full duplex

message received before monitor task is initialized kerSysSendtoMonitorTask

fapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22980 bytes remaining 584

XTM Init: Ch:0 – 200 rx BDs at 0xb0a22980

fapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a22fc0 bytes remaining 456

XTM Init: Ch:1 – 16 rx BDs at 0xb0a22fc0

bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system

bcmxtmcfg: gulBondDslMonitorValid = 1

BcmAdsl_Initialize=0xC0BB9C20, g_pFnNotifyCallback=0xC0BF8014

lmemhdr[2]=0x100CE000, pAdslLMem[2]=0x100CE000

pSdramPHY=0xA7FFFFF8, 0xFFFFFFFF 0xFFFFFFFF

*\* XfaceOffset: 0x5FF90 => 0x5FF90 **

*\* PhySdramSize got adjusted: 0xE3FB4 => 0x11A6E0 **

AdslCoreSharedMemInit: shareMemSize=96509(96512)

AdslCoreHwReset: pLocSbSta=84048000 bkupThreshold=3072

AdslCoreHwReset: AdslOemDataAddr = 0xA7FA34F4

*\*BcmDiagsMgrRegisterClient: 0 **

dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered

ADDRCONF(NETDEV_UP): eth1: link is not ready

ADDRCONF(NETDEV_UP): eth2: link is not ready

ADDRCONF(NETDEV_UP): eth3: link is not ready

eth0 (switch port: 1) Link DOWN.

message received before monitor task is initialized kerSysSendtoMonitorTask

eth0 (switch port: 1) Link UP 100 mbps full duplex

message received before monitor task is initialized kerSysSendtoMonitorTask

device eth0 entered promiscuous mode

BR_LAN: port 1(eth0) entering learning state

BR_LAN: port 1(eth0) entering forwarding state

device eth4 entered promiscuous mode

BR_LAN: port 2(eth4) entering learning state

BR_LAN: port 2(eth4) entering forwarding state

device wl0 entered promiscuous mode

BR_LAN: port 3(wl0) entering learning state

BR_LAN: port 3(wl0) entering forwarding state

device wl0.1 entered promiscuous mode

BR_HOTSPOT: port 1(wl0.1) entering learning state

BR_HOTSPOT: port 1(wl0.1) entering forwarding state

device wl0.1 left promiscuous mode

BR_HOTSPOT: port 1(wl0.1) entering disabled state

BOS: Enter bosInit

BOS: Exit bosInit

endpoint_open COMPLETED

**\* DSP: Found BCM963268 *****

**\* DSP: In PCM Mode *****

**\* DSP: PCM running in 16 bit mode *****

gInterruptCounter = 0xC1A98F40

gInterruptErrors = 0xC1A98F44

gNextRxDesc = 0xC1A99064

gNextTxDesc = 0xC1A99060

gDectTestMode = 0xc18bfe2c

dectBuffStart = 0xc18bfe38

gDectRxOutOfSyncCounter = 0xc18bfe3c

gDectTxOutOfSyncCounter = 0xc18bfe40

32 ms ECAN tail-length

*** gStartRxDesc[0] = 0xA0C00000

*** gBufferSizeBytes = 640

*** gStartTxDesc[0] = 0xA0C01000

halPcmInit 370 nextTxDesc = 0xA0C01000

halPcmInit 370 nextTxDesc = 0xA0C01008

halPcmInit 374 Ownership for TX desc not set. Use this buffer.

[DBG xdrv_slic] slicSi32261Init: (ts: 39s 722ms):SLIC: Starting 32261 device and line initializion…

[DBG xdrv_slic] deviceSiLabsReset: (ts: 40s 237ms):SLIC: Reset applied on GPIO pin 14

[DBG xdrv_slic] initSiLabsDevice: (ts: 40s 251ms):SLIC: Initializing SiLabs device 0

si3226x : Channel 0 : Type = PROSLIC

si3226x : Channel 1 : Type = PROSLIC

si3226x : Channel 0 : Chip Type 28

si3226x : Channel 0 : Chip Rev 3

si3226x : Channel 1 : Chip Type 28

si3226x : Channel 1 : Chip Rev 3

VBAT @ 50ms = 58.692 v

VBAT Up = 58.692 v

VBAT @ 50ms = 58.692 v

VBAT Up = 58.901 v

ehci_hcd: USB 2.0 ‘Enhanced’ Host Controller (EHCI) Driver

PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)

PCI: Setting latency timer of device 0000:00:0a.0 to 64

ehci_hcd 0000:00:0a.0: EHCI Host Controller

ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1

ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM

[DBG xdrv_slic] initSiLabsDevice: (ts: 41s 441ms):SLIC: SiLabs device BOM Type: 0

[DBG xdrv_slic] initSiLabsDevice: (ts: 41s 449ms):SLIC: SiLabs device 0 initialized OK

ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500

ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 467ms):SLIC: SiLabs Locale set to 3

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 475ms):SLIC: Initializing SiLabs FXS line 0

usb usb1: configuration #1 chosen from 1 choice

hub 1-0:1.0: USB hub found

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 509ms):FXS channel 0 Rx Gain: -11

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 509ms):FXS channel 0 Tx Gain: -4

Si3226x PCMStart

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: FXS line 0 RX timeslot = 0

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: FXS line 0 TX timeslot = 0

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: SiLabs FXS line 0 initialized OK

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: Initializing SiLabs FXS line 1

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 565ms):FXS channel 1 Rx Gain: -11

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 573ms):FXS channel 1 Tx Gain: -4

Si3226x PCMStart

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 598ms):SLIC: FXS line 1 RX timeslot = 1

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 606ms):SLIC: FXS line 1 TX timeslot = 1

[DBG xdrv_slic] initSiLabsLines: (ts: 41s 615ms):SLIC: SiLabs FXS line 1 initialized OK

[DBG xdrv_slic] slicSi32261Init: (ts: 41s 624ms):SLIC: 32261 device 0 and FXS initializion COMPLETED OK !

boardHalInit completed

hub 1-0:1.0: 2 ports detected

DSP: Interrupt Masks

—————

IrqMask = 0x00003000

IrqMask1 = 0x00000400

DSP: Interrupt Status

—————–

IrqStatus = 0x00100000

IrqStatus1 = 0x00100000

ohci_hcd: USB 1.1 ‘Open’ Host Controller (OHCI) Driver

PCI: Enabling device 0000:00:09.0 (0000 -> 0002)

PCI: Setting latency timer of device 0000:00:09.0 to 64

ohci_hcd 0000:00:09.0: OHCI Host Controller

ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2

ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600

EndpointInit completed

dgasp: kerSysRegisterDyingGaspHandler: endpoint registered

00:01:38 Endpoint Event task started with pid 1245…

00:01:38 Endpoint Packet task started with pid 1246 …

00:01:38 RTP read thread started with pid 1247

00:01:38 RTP read thread started with pid 1248

00:01:38 RTP read thread started with pid 1249

00:01:38 RTP read thread started with pid 1250

00:01:38 RTP read thread started with pid 1251

00:01:38 RTP read thread started with pid 1252

usb usb2: configuration #1 chosen from 1 choice

00:01:38 RTCP thread started with pid 1253

00:01:38 rtpInit: RTCP task created, taskId = 9226

hub 2-0:1.0: USB hub found

hub 2-0:1.0: 2 ports detected

device wl0 left promiscuous mode

BR_LAN: port 3(wl0) entering disabled state

device wl0 entered promiscuous mode

BR_LAN: port 3(wl0) entering learning state

BR_LAN: port 3(wl0) entering forwarding state

device wl0 left promiscuous mode

BR_LAN: port 3(wl0) entering disabled state

device wl0 entered promiscuous mode

BR_LAN: port 3(wl0) entering learning state

BR_LAN: port 3(wl0) entering forwarding state

Edit 04/01/2014:

Opa, um F5350GV em run level 4 (ou como o pessoal diz, “desbloqueado”). Não é nem um pouco amigável fazê-lo e atualmente só é possível na versão SG790131200068 (3.12.35). A mais nova (SG790131200312) teve algumas coisas legais removidas. Atualizo aqui no caso de novidades.

O3 Labs

Reversing stuff

Sagemcom F@st 5350 GV – Teardown