Sorry to say that I couldn't find that binary among busybox's choises.
/csoM
I think strace is built from source. The binary should be small enough to fit on this platform, though. It's a worthwhile investment. Any other tools you might like to see on there, @mrhaav ?
Also, even without strace, you can still poke around to determine how the switch is connected, provided debugfs is compiled and available. Is that possible with the kernel for the source @csom?
This can be applied for gpio, i2c, ...
Sorry to say that this feels a little above my knowledge. It sounds a little to much "lo-level" for me to provide any light into it 
Hi, Sorry for off-topic question, maybe U know if there is possibility to disable SFP port (fiber) or turn off this XG6846 from CLI or some another way? I need to disable SFP signal from remote location, I can login to device but I can only restart it.... Maybe there is a way update it with firmware what will cause bootloop? Can anyone help, thanks 
Hi, I found one of these devices in the electronics scrap. As I can help tinkering I've set it up using the info in this thread, and managed to boot OpenWrt on it. After some tinkering, it detects the Marvell switch on the external MDIO port.
However I haven't figured out how to connect the ethernet fixed link to the Marvell switch properly so that network can come through 
Here is my code tree on GitHub for XG6846
Current bootlog:
HELO
CPUI
L1CI
DRAM
----
PHYS
ZQDN
300H
PHYE
DINT
LSYN
USYN
MSYN
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
CFE version 1.0.38-114.101 for BCM96328 (32bit,SP,BE)
Build Date: δΈ 4ζ 23 18:54:46 CST 2014 (anton@f137)
Copyright (C) 2000-2011 Broadcom Corporation.
HS Serial flash device: name ID_W25X128, id 0xef18 size 16384KB
Total Flash size: 16384K with 4096 sectors
Flash not used for Auxillary File System
Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Boot image (0=latest, 1=previous) : 0
Board Id (0-10) : 96328avng
Number of MAC Addresses (1-32) : 11
Base MAC Address : 44:d4:37:55:3d:93
PSI Size (1-64) KBytes : 24
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Auxillary File System Size Percent: 0
Main Thread Number [0|1] : 0
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1
web info: Waiting for connection on socket 0.
CFE>
CFE>
CFE>
CFE>
CFE> r 192.168.1.2:openwrt-bmips-bcm6328-inteno_xg6846-initramfs.elf
0x81000000/5136829 Entry at 0x81000000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x81000000
OpenWrt kernel loader for BMIPS
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Copyright (C) 2014 Jonas Gorski <jogo@openwrt.org>
Copyright (C) 2020 Alvaro Fernandez Rojas <noltari@gmail.com>
Decompressing kernel... done!
blasting from 0x80010000 to 0x013cdf8b (0x80010000 - 0x813ddf90)
Starting kernel at 80010000...
[ 0.000000] Linux version 6.1.35 (linus@lino) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23483+4-86ebaef5d427) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Mon Jul 3 20:22:50 2023
[ 0.000000] CPU0 revision is: 0002a075 (Broadcom BMIPS4350)
[ 0.000000] MIPS: machine is Inteno XG6846
[ 0.000000] 64MB of RAM installed
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Reserving 0KB of memory at 4194303KB for kdump
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes.
[ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] percpu: Embedded 11 pages/cpu s13984 r8192 d22880 u45056
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16240
[ 0.000000] Kernel command line: rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 43280K/65536K available (7368K kernel code, 629K rwdata, 1512K rodata, 11796K init, 219K bss, 22256K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] rcu: RCU restricting CPUs from NR_CPUS=2 to nr_cpu_ids=1.
[ 0.000000] Tracing variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1
[ 0.000000] NR_IRQS: 256
[ 0.000000] irq_bcm6345_l1: registered BCM6345 L1 intc (IRQs: 64)
[ 0.000000] irq_bcm6345_l1: CPU0 (irq = 2)
[ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.000000] brcm,bcm6328 detected @ 320 MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 11945377789 ns
[ 0.000002] sched_clock: 32 bits at 160MHz, resolution 6ns, wraps every 13421772796ns
[ 0.000212] Calibrating delay loop... 319.48 BogoMIPS (lpj=1597440)
[ 0.050113] pid_max: default: 32768 minimum: 301
[ 0.053315] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.053383] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.062938] cblist_init_generic: Setting adjustable number of callback queues.
[ 0.062971] cblist_init_generic: Setting shift to 0 and lim to 1.
[ 0.064090] rcu: Hierarchical SRCU implementation.
[ 0.064114] rcu: Max phase no-delay instances is 1000.
[ 0.065661] smp: Bringing up secondary CPUs ...
[ 0.065687] smp: Brought up 1 node, 1 CPU
[ 0.078853] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.078922] futex hash table entries: 256 (order: 2, 16384 bytes, linear)
[ 0.079361] pinctrl core: initialized pinctrl subsystem
[ 0.083243] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.135038] clocksource: Switched to clocksource MIPS
[ 0.139695] NET: Registered PF_INET protocol family
[ 0.140370] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.142987] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.143089] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.143136] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.143214] TCP bind hash table entries: 1024 (order: 2, 16384 bytes, linear)
[ 0.143348] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.143778] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.143888] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.144818] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.145178] PCI: CLS 0 bytes, default 16
[ 0.165474] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[ 0.180548] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.180595] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.206929] bcm63xx-power-controller 10001848.power-controller: registered 10 power domains
[ 0.208491] 10000100.serial: ttyS0 at MMIO 0x10000100 (irq = 28, base_baud = 1562500) is a bcm63xx_uart
[ 0.997395] printk: console [ttyS0] enabled
[ 1.048951] spi-nor spi1.0: w25q128 (16384 Kbytes)
[ 1.101257] bcm63xxpart: Partition 0 is CFE offset 0 and length 10000
[ 1.108021] bcm63xxpart: Partition 1 is nvram offset ff0000 and length 10000
[ 1.115316] bcm63xxpart: Partition 2 is linux offset 10000 and length fe0000
[ 1.122878] 3 bcm63xxpart partitions found on MTD device spi1.0
[ 1.129089] Creating 3 MTD partitions on "spi1.0":
[ 1.133995] 0x000000000000-0x000000010000 : "CFE"
[ 1.144572] 0x000000ff0000-0x000001000000 : "nvram"
[ 1.152533] 0x000000010000-0x000000ff0000 : "linux"
[ 1.166208] parser_imagetag: rootfs: CFE image tag found at 0x0 with version 6, board type 96328avng
[ 1.175729] parser_imagetag: Partition 0 is rootfs offset 100 and length 181000
[ 1.183224] parser_imagetag: Partition 1 is kernel offset 181100 and length 11cda2
[ 1.191090] parser_imagetag: Spare partition is offset 2a0000 and length d40000
[ 1.198833] 2 bcm963xx-imagetag partitions found on MTD device linux
[ 1.205519] Creating 2 MTD partitions on "linux":
[ 1.210334] 0x000000000100-0x000000181100 : "rootfs"
[ 1.215495] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[ 1.230072] mtd: setting mtd3 (rootfs) as root device
[ 1.235701] mtdsplit: no squashfs found in "rootfs"
[ 1.240899] 0x000000181100-0x00000029dea2 : "kernel"
[ 1.246140] mtd: partition "kernel" doesn't start on an erase/write block boundary -- force read-only
[ 2.633412] bcm6368-mdio-mux 10e000b0.mdio: Broadcom BCM6368 MDIO mux bus
[ 2.641799] mv88e6085 mdio_mux-0.1:00: switch 0x3520 detected: Marvell 88E6352, revision 1
[ 2.937938] bcm6368-enetsw 1000d800.ethernet: random mac
[ 3.016486] bcm6368-enetsw 1000d800.ethernet: eth0 at 0xb000d800, IRQ 0
[ 3.025681] bcm7038-wdt 1000005c.watchdog: Registered BCM7038 Watchdog
[ 3.035153] NET: Registered PF_INET6 protocol family
[ 3.060034] Segment Routing with IPv6
[ 3.063989] In-situ OAM (IOAM) with IPv6
[ 3.068532] NET: Registered PF_PACKET protocol family
[ 3.074625] 8021q: 802.1Q VLAN Support v1.8
[ 3.108551] mv88e6085 mdio_mux-0.1:00: switch 0x3520 detected: Marvell 88E6352, revision 1
[ 3.647478] mv88e6085 mdio_mux-0.1:00: configuring for fixed/rgmii-id link mode
[ 3.658829] mv88e6085 mdio_mux-0.1:00: Link is Up - 1Gbps/Full - flow control off
[ 3.750142] mv88e6085 mdio_mux-0.1:00 lan1 (uninitialized): PHY [!ubus!mdio@10e000b0!mdio@1!switch@0!mdio:00] driver [Marvell 88E1540] (irq=17)
[ 3.858113] mv88e6085 mdio_mux-0.1:00 lan2 (uninitialized): PHY [!ubus!mdio@10e000b0!mdio@1!switch@0!mdio:01] driver [Marvell 88E1540] (irq=18)
[ 3.970201] mv88e6085 mdio_mux-0.1:00 lan3 (uninitialized): PHY [!ubus!mdio@10e000b0!mdio@1!switch@0!mdio:02] driver [Marvell 88E1540] (irq=19)
[ 4.080201] mv88e6085 mdio_mux-0.1:00 lan4 (uninitialized): PHY [!ubus!mdio@10e000b0!mdio@1!switch@0!mdio:03] driver [Marvell 88E1540] (irq=20)
[ 4.190104] mv88e6085 mdio_mux-0.1:00 ext1 (uninitialized): PHY [!ubus!mdio@10e000b0!mdio@1!switch@0!mdio:04] driver [Marvell 88E1540] (irq=21)
[ 4.212782] device eth0 entered promiscuous mode
[ 4.217875] DSA: tree 0 setup
[ 4.315343] Freeing unused kernel image (initmem) memory: 11796K
[ 4.321517] This architecture does not have kernel memory protection.
[ 4.328391] Run /init as init process
[ 5.393844] init: Console is alive
[ 5.398682] init: - watchdog -
[ 5.447884] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 5.488708] usbcore: registered new interface driver usbfs
[ 5.494484] usbcore: registered new interface driver hub
[ 5.500288] usbcore: registered new device driver usb
[ 5.573484] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 5.592193] init: - preinit -
[ 8.725094] random: crng init done
[ 9.282315] mv88e6085 mdio_mux-0.1:00 lan1: configuring for phy/gmii link mode
[ 9.293177] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 9.336890] mv88e6085 mdio_mux-0.1:00 lan1: Link is Up - 1Gbps/Full - flow control off
[ 9.345261] IPv6: ADDRCONF(NETDEV_CHANGE): lan1: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 11.764467] mv88e6085 mdio_mux-0.1:00 lan1: Link is Down
[ 11.794682] procd: - early -
[ 11.798853] procd: - watchdog -
[ 12.486040] procd: - watchdog -
[ 12.492310] procd: - ubus -
[ 12.556399] procd: - init -
Please press Enter to activate this console.
[ 14.049098] kmodloader: loading kernel modules from /etc/modules.d/*
[ 14.109923] i2c_dev: i2c /dev entries driver
[ 14.133823] i2c-gpio i2c-sfp: Slow GPIO pins might wreak havoc into I2C/SMBus bus timing
[ 14.143007] i2c-gpio i2c-sfp: using lines 481 (SDA) and 499 (SCL)
[ 14.149979] i2c-gpio i2c-catv: Slow GPIO pins might wreak havoc into I2C/SMBus bus timing
[ 14.159129] i2c-gpio i2c-catv: using lines 503 (SDA) and 487 (SCL)
[ 14.315243] sfp sfp0: Host maximum power 1.0W
[ 14.319732] sfp sfp0: No tx_disable pin: SFP modules will always be emitting.
[ 14.575389] PPP generic driver version 2.4.2
[ 14.588771] NET: Registered PF_PPPOX protocol family
[ 14.647209] sfp sfp0: module OEM FTCS-1312-20D rev 11.0 sn S1501193731 dc 150304
[ 14.657006] mv88e6085 mdio_mux-0.1:00 wan: switched to inband/1000base-x link mode
[ 14.670829] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 14.990015] urngd: v1.0.2 started.
[ 65.209597] mv88e6085 mdio_mux-0.1:00 lan1: configuring for phy/gmii link mode
[ 65.293294] br-lan: port 1(lan1) entered blocking state
[ 65.298831] br-lan: port 1(lan1) entered disabled state
[ 65.488458] device lan1 entered promiscuous mode
[ 65.710745] mv88e6085 mdio_mux-0.1:00 lan2: configuring for phy/gmii link mode
[ 65.788836] mv88e6085 mdio_mux-0.1:00: Timeout while waiting for switch
[ 65.838046] br-lan: port 2(lan2) entered blocking state
[ 65.843446] br-lan: port 2(lan2) entered disabled state
[ 65.916416] device lan2 entered promiscuous mode
[ 66.019011] mv88e6085 mdio_mux-0.1:00 lan3: configuring for phy/gmii link mode
[ 66.090345] br-lan: port 3(lan3) entered blocking state
[ 66.095857] br-lan: port 3(lan3) entered disabled state
[ 66.151055] device lan3 entered promiscuous mode
[ 66.223390] mv88e6085 mdio_mux-0.1:00 lan4: configuring for phy/gmii link mode
[ 66.302438] br-lan: port 4(lan4) entered blocking state
[ 66.307967] br-lan: port 4(lan4) entered disabled state
[ 66.383896] device lan4 entered promiscuous mode
[ 66.606657] mv88e6085 mdio_mux-0.1:00 wan: configuring for inband/1000base-x link mode
[ 66.729385] br-wan: port 1(wan) entered blocking state
[ 66.734673] br-wan: port 1(wan) entered disabled state
[ 66.869928] device wan entered promiscuous mode
[ 66.976024] mv88e6085 mdio_mux-0.1:00: p5: hw VLAN 1 already used by port 0 in br-lan
[ 67.337913] mv88e6085 mdio_mux-0.1:00 ext1: configuring for phy/gmii link mode
[ 67.411843] mv88e6085 mdio_mux-0.1:00: Timeout while waiting for switch
[ 67.506289] br-wan: port 2(ext1) entered blocking state
[ 67.511666] br-wan: port 2(ext1) entered disabled state
[ 67.651628] device ext1 entered promiscuous mode
[ 67.657419] mv88e6085 mdio_mux-0.1:00: p4: hw VLAN 1 already used by port 0 in br-lan
[ 68.448287] mv88e6085 mdio_mux-0.1:00 lan1: Link is Up - 1Gbps/Full - flow control off
[ 68.456706] br-lan: port 1(lan1) entered blocking state
[ 68.462071] br-lan: port 1(lan1) entered forwarding state
[ 68.535690] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
BusyBox v1.36.1 (2023-07-02 20:10:17 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r23489+5-531fea72ad7d
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
I figured out networking and fixed some hardware bugs in the NOR flash support and MV88E6352 DSA code and pushed upstream. My code tree is updated and boots fine from RAM.
What remains to be figured out is the firmware format on flash, because it is not standard Broadcom, but a derivative.
3 Likes
Congratulations on getting openwrt booting on this device
Edit: I read your commit message, and I wonder whether any of the tools provided in the 'SDK' for this device give info on how the firmware image is built. (e.g. xavi_image_merge or tools in the hostTools folder).
The makefile portion for image building:
# (mksquashfs call moved to buildFS, for fakeroot to work)
ifeq ($(strip $(BRCM_KERNEL_ROOTFS)),jffs2)
cd $(PROFILE_DIR); \
dd if=/dev/zero of=file128k.tmp bs=1k count=128; \
cat $(CFE_ROM_FILE) file128k.tmp | head --bytes=$(FLASH_NAND_BLOCK_16KB) > cferom.tmp; \
cat cferom.tmp rootfs16kb.img > $(FLASH_NAND_CFEROM_FS_IMAGE_NAME_16); \
$(HOSTTOOLS_DIR)/addvtoken --chip $(BRCM_CHIP) --flashtype NAND16 $(FLASH_NAND_CFEROM_FS_IMAGE_NAME_16) $(FLASH_NAND_CFEROM_FS_IMAGE_NAME_16).w; \
$(HOSTTOOLS_DIR)/addvtoken --chip $(BRCM_CHIP) --flashtype NAND16 rootfs16kb.img $(FLASH_NAND_FS_IMAGE_NAME_16).w; \
$(HOSTTOOLS_DIR)/createimg --boardid=$(BRCM_BOARD_ID) --voiceboardid $(BRCM_VOICE_BOARD_ID) --numbermac=$(BRCM_NUM_MAC_ADDRESSES) --macaddr=$(BRCM_BASE_MAC_ADDRESS) --tp=$(BRCM_MAIN_TP_NUM) --psisize=$(BRCM_PSI_SIZE) --auxfsprcnt=$(BRCM_AUXFS_PERCENT) --gponsn=$(BRCM_GPON_SERIAL_NUMBER) --gponpw=$(BRCM_GPON_PASSWORD) --wholeflashfile=$(FLASH_NAND_CFEROM_FS_IMAGE_NAME_16).w; \
cat $(CFE_ROM_FILE) file128k.tmp | head --bytes=$(FLASH_NAND_BLOCK_128KB) > cferom.tmp; \
cat cferom.tmp rootfs128kb.img > $(FLASH_NAND_CFEROM_FS_IMAGE_NAME_128); \
$(HOSTTOOLS_DIR)/addvtoken --chip $(BRCM_CHIP) --flashtype NAND128 $(FLASH_NAND_CFEROM_FS_IMAGE_NAME_128) $(FLASH_NAND_CFEROM_FS_IMAGE_NAME_128).w; \
$(HOSTTOOLS_DIR)/addvtoken --chip $(BRCM_CHIP) --flashtype NAND128 rootfs128kb.img $(FLASH_NAND_FS_IMAGE_NAME_128).w; \
$(HOSTTOOLS_DIR)/createimg --boardid=$(BRCM_BOARD_ID) --voiceboardid $(BRCM_VOICE_BOARD_ID) --numbermac=$(BRCM_NUM_MAC_ADDRESSES) --macaddr=$(BRCM_BASE_MAC_ADDRESS) --tp=$(BRCM_MAIN_TP_NUM) --psisize=$(BRCM_PSI_SIZE) --auxfsprcnt=$(BRCM_AUXFS_PERCENT) --gponsn=$(BRCM_GPON_SERIAL_NUMBER) --gponpw=$(BRCM_GPON_PASSWORD) --wholeflashfile=$(FLASH_NAND_CFEROM_FS_IMAGE_NAME_128).w; \
rm $(FLASH_NAND_CFEROM_FS_IMAGE_NAME_16) $(FLASH_NAND_CFEROM_FS_IMAGE_NAME_128); \
rm file128k.tmp cferom.tmp;
@mkdir -p $(IMAGES_DIR)
ifeq ($(strip $(XAVI_NAND_BLOCK_LARGE)), y)
@cp $(PROFILE_DIR)/$(FLASH_NAND_CFEROM_FS_IMAGE_NAME_128).w $(IMAGES_DIR)/$(FLASH_NAND_CFEROM_FS_IMAGE_NAME_128)_$(BRCM_RELEASETAG)-$(shell date '+%y%m%d_%H%M').w
else
@cp $(PROFILE_DIR)/$(FLASH_NAND_CFEROM_FS_IMAGE_NAME_16).w $(IMAGES_DIR)/$(FLASH_NAND_CFEROM_FS_IMAGE_NAME_16)_$(BRCM_RELEASETAG)-$(shell date '+%y%m%d_%H%M').w
endif
@echo
@echo -e "Done! Image $(PROFILE) has been built in $(PROFILE_DIR)."
@$(MAKE) -s xavi_release_image
else
ifeq ($(strip $(BRCM_KERNEL_ROOTFS)),nfs)
@cd $(PROFILE_DIR); cp $(KERNEL_DIR)/vmlinux . ;
@echo
@echo -e "======== Follow the below steps to start your NFS root file system on host ========"
@echo -e "* Copy $(PROFILE_DIR)/vmlinux to your TFTP server boot directory"
@echo -e " cp $(PROFILE_DIR)/vmlinux /tftpboot"
@if [ -n "$(BRCM_NFS_ROOT_DIR)" ]; then \
echo -e "* Copy your $(PROFILE_DIR)/fs directory to $(NFS_ROOT_DIR)"; \
echo -e " cp -Rf $(PROFILE_DIR)/fs $(NFS_ROOT_DIR)"; \
fi
@if [ `grep "$(NFS_ROOT_DIR)" /etc/exports | wc -l` -lt "1" ]; then \
echo -e "* Login as root"; \
echo -e "* Add \"$(NFS_ROOT_DIR) *(rw,no_root_squash)\" to /etc/exports"; \
echo -e " echo \"$(NFS_ROOT_DIR) *(rw,no_root_squash)\" >> /etc/exports"; \
echo -e "* Restart your nfs server"; \
echo -e " service nfs restart"; \
fi
@echo -e "* Reboot your board and break into CFE bootloader, choose h on \"Run from flash/host\" and vmlinux on \"Default host run file name\""
@echo
else
cd $(PROFILE_DIR); \
cp $(KERNEL_DIR)/vmlinux . ; \
$(STRIP) --remove-section=.note --remove-section=.comment vmlinux; \
$(OBJCOPY) -O binary vmlinux vmlinux.bin; \
$(HOSTTOOLS_DIR)/cmplzma -k -2 vmlinux vmlinux.bin vmlinux.lz;\
$(HOSTTOOLS_DIR)/bcmImageBuilder --output $(FS_KERNEL_IMAGE_NAME) --chip $(or $(TAG_OVERRIDE),$(BRCM_CHIP)) --board $(BRCM_BOARD_ID) --blocksize $(BRCM_FLASHBLK_SIZE) --image-version $(IMAGE_VERSION) --cfefile $(CFE_FILE) --rootfsfile rootfs.img --kernelfile vmlinux.lz; \
$(HOSTTOOLS_DIR)/bcmImageBuilder --output $(CFE_FS_KERNEL_IMAGE_NAME) --chip $(or $(TAG_OVERRIDE),$(BRCM_CHIP)) --board $(BRCM_BOARD_ID) --blocksize $(BRCM_FLASHBLK_SIZE) --image-version $(IMAGE_VERSION) --cfefile $(CFE_FILE) --rootfsfile rootfs.img --kernelfile vmlinux.lz --include-cfe; \
$(HOSTTOOLS_DIR)/createimg --boardid=$(BRCM_BOARD_ID) --voiceboardid $(BRCM_VOICE_BOARD_ID) --numbermac=$(BRCM_NUM_MAC_ADDRESSES) --macaddr=$(BRCM_BASE_MAC_ADDRESS) --tp=$(BRCM_MAIN_TP_NUM) --psisize=$(BRCM_PSI_SIZE) --logsize=$(BRCM_LOG_SECTION_SIZE) --auxfsprcnt=$(BRCM_AUXFS_PERCENT) --gponsn=$(BRCM_GPON_SERIAL_NUMBER) --gponpw=$(BRCM_GPON_PASSWORD) --inputfile=$(CFE_FS_KERNEL_IMAGE_NAME) --outputfile=$(FLASH_IMAGE_NAME); \
$(HOSTTOOLS_DIR)/addvtoken --chip $(or $(TAG_OVERRIDE),$(BRCM_CHIP)) --flashtype NOR $(FLASH_IMAGE_NAME) $(FLASH_IMAGE_NAME).w
@mkdir -p $(IMAGES_DIR)
@cp $(PROFILE_DIR)/$(FS_KERNEL_IMAGE_NAME) $(IMAGES_DIR)/$(FS_KERNEL_IMAGE_NAME)_$(BRCM_RELEASETAG)-$(shell date '+%y%m%d_%H%M')
@echo
@echo -e "Done! Image $(PROFILE) has been built in $(IMAGES_DIR)."
@$(MAKE) -s xavi_release_image
endif
endif
I guess bugs depend on hardware variant. Just checked my photos and I see my device has a Spansion S25FL128S, but they're basically synonymous. ( This model also supports DIO and QIO ) This makes me wonder - what HW version did you pick out of the scrap? Does the sticker on the underside reveal anything? My board has no USB, and is labelled as an R1.
My device says:
XG6846-R1
...
HW: 1.3
Factory: H
Date: April 22th 2020
But I guess they just stick whatever 128MBit NOR chip they find on the street in Shenzhen 
I will look closer at the custom SDK flash commands in some weeks (travelling).
I am especially suspicious about this:
$(HOSTTOOLS_DIR)/addvtoken --chip $(or $(TAG_OVERRIDE),$(BRCM_CHIP)) --flashtype NOR $(FLASH_IMAGE_NAME) $(FLASH_IMAGE_NAME).w
"add vendor token"...
I think I will maybe send the current patches upstream so we can add firmware re-flash later.
1 Like
OK. Mine is:
XG6484-R1
HW: 1.0
Factory: H
Date: Sept 13, 2016
PCB: V1.0 2012-11-05/1..83 (two characters hidden by reset button)
Well, it seems that all of those environment variables are set sooner or later in the scripts and makefiles.
This $(BRCM_CHIP) appears to be e.g. bcm96328avng
and
FLASH_IMAGE_NAME is defined in make.common as
FLASH_IMAGE_NAME = $(VENDOR_NAME)$(PROFILE)_flash_image_$(BRCM_BOARD_ID)
Hi
I have three XG6846s:
Model name: XG6846 (with USB)
HW: 1.0
Factory: H
Date: September 1th, 2014
Model name: XG6846
HW: 1.0
Factory: H
Date: April 4th, 2015
Model name: XG6846-R1
HW: 1.1
Factory: H
Date: August 9th, 2017
All have HS Serial flash device: name S25FL128, id 0x0118 size 16384KB
Boot log from XG6846 (with USB):
HELO
CPUI
L1CI
DRAM
----
PHYS
ZQDN
300H
PHYE
DINT
LSYN
USYN
MSYN
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
CFE version 1.0.38-114.101 for BCM96328 (32bit,SP,BE)
Build Date: δΈ 12ζ 4 18:39:23 CST 2013 (anton@anton-fedora)
Copyright (C) 2000-2011 Broadcom Corporation.
HS Serial flash device: name S25FL128, id 0x0118 size 16384KB
Total Flash size: 16384K with 256 sectors
Flash not used for Auxillary File System
Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-10) : 96328avng
Number of MAC Addresses (1-32) : 11
Base MAC Address : 00:22:07:c7:98:cd
PSI Size (1-64) KBytes : 24
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Auxillary File System Size Percent: 0
Main Thread Number [0|1] : 0
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1
web info: Waiting for connection on socket 0.
CFE>
CFE>
CFE>
CFE> r 192.168.1.100:openwrt-bmips-bcm6328-inteno_xg6846-initramfs.elf
0x81000000/5144392 Entry at 0x81000000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x81000000
OpenWrt kernel loader for BMIPS
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Copyright (C) 2014 Jonas Gorski <jogo@openwrt.org>
Copyright (C) 2020 Alvaro Fernandez Rojas <noltari@gmail.com>
Decompressing kernel... done!
blasting from 0x80010000 to 0x013cd2db (0x80010000 - 0x813dd2e0)
Starting kernel at 80010000...
[ 0.000000] Linux version 6.1.40 (henrik@archie) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23614-8dd137a2f3) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Tue Jul 25 18:08:33 2023
[ 0.000000] CPU0 revision is: 0002a075 (Broadcom BMIPS4350)
[ 0.000000] MIPS: machine is Inteno XG6846
[ 0.000000] 64MB of RAM installed
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Reserving 0KB of memory at 4194303KB for kdump
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes.
[ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] percpu: Embedded 11 pages/cpu s13984 r8192 d22880 u45056
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16240
[ 0.000000] Kernel command line: rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 43276K/65536K available (7370K kernel code, 627K rwdata, 1512K rodata, 11796K init, 219K bss, 22260K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] rcu: RCU restricting CPUs from NR_CPUS=2 to nr_cpu_ids=1.
[ 0.000000] Tracing variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1
[ 0.000000] NR_IRQS: 256
[ 0.000000] irq_bcm6345_l1: registered BCM6345 L1 intc (IRQs: 64)
[ 0.000000] irq_bcm6345_l1: CPU0 (irq = 2)
[ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.000000] brcm,bcm6328 detected @ 320 MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 11945377789 ns
[ 0.000003] sched_clock: 32 bits at 160MHz, resolution 6ns, wraps every 13421772796ns
[ 0.000215] Calibrating delay loop... 319.48 BogoMIPS (lpj=1597440)
[ 0.050112] pid_max: default: 32768 minimum: 301
[ 0.053353] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.053420] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.062950] cblist_init_generic: Setting adjustable number of callback queues.
[ 0.062982] cblist_init_generic: Setting shift to 0 and lim to 1.
[ 0.064072] rcu: Hierarchical SRCU implementation.
[ 0.064095] rcu: Max phase no-delay instances is 1000.
[ 0.065644] smp: Bringing up secondary CPUs ...
[ 0.065668] smp: Brought up 1 node, 1 CPU
[ 0.079830] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.079899] futex hash table entries: 256 (order: 2, 16384 bytes, linear)
[ 0.080476] pinctrl core: initialized pinctrl subsystem
[ 0.084410] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.137166] clocksource: Switched to clocksource MIPS
[ 0.141910] NET: Registered PF_INET protocol family
[ 0.142579] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.145094] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.145193] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.145243] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.145321] TCP bind hash table entries: 1024 (order: 2, 16384 bytes, linear)
[ 0.145454] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.145876] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.145983] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.146851] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.147293] PCI: CLS 0 bytes, default 16
[ 0.167573] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[ 0.182647] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.182694] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.209046] bcm63xx-power-controller 10001848.power-controller: registered 10 power domains
[ 0.210757] 10000100.serial: ttyS0 at MMIO 0x10000100 (irq = 28, base_baud = 1562500) is a bcm63xx_uart
[ 0.997956] printk: console [ttyS0] enabled
[ 1.050941] spi-nor spi1.0: found s25fl128s1, expected w25q128
[ 1.058292] spi-nor spi1.0: s25fl128s1 (16384 Kbytes)
[ 1.108957] 3 fixed-partitions partitions found on MTD device spi1.0
[ 1.116209] Creating 3 MTD partitions on "spi1.0":
[ 1.121280] 0x000000000000-0x000000010000 : "cfe"
[ 1.133299] 0x000000010000-0x000000ff0000 : "firmware"
[ 1.144227] mtdsplit_bcm63xx: CFE image tag found at 0x0 with version 6, board type 96328avng
[ 1.153394] mtdsplit_bcm63xx: rootfs magic not found
[ 1.158625] 2 bcm63xx-fw partitions found on MTD device firmware
[ 1.164779] Creating 2 MTD partitions on "firmware":
[ 1.169965] 0x000000000100-0x0000001aa100 : "rootfs"
[ 1.175034] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[ 1.189915] mtd: setting mtd2 (rootfs) as root device
[ 1.196070] mtdsplit: no squashfs found in "rootfs"
[ 1.201345] 0x0000001aa100-0x0000002c6e5a : "kernel"
[ 1.206431] mtd: partition "kernel" doesn't start on an erase/write block boundary -- force read-only
[ 1.221237] 0x000000ff0000-0x000001000000 : "nvram"
[ 2.611267] bcm6368-mdio-mux 10e000b0.mdio: Broadcom BCM6368 MDIO mux bus
[ 2.619603] b53-switch 10e00000.switch: found switch: BCM63xx, rev 0
[ 2.626925] mv88e6085 mdio_mux-0.1:00: switch 0x3520 detected: Marvell 88E6352, revision 1
[ 2.921996] bcm6368-enetsw 1000d800.ethernet: mtd mac 00:22:07:c7:98:cd
[ 3.008630] bcm6368-enetsw 1000d800.ethernet: eth0 at 0xb000d800, IRQ 0
[ 3.018053] bcm7038-wdt 1000005c.watchdog: Registered BCM7038 Watchdog
[ 3.027615] NET: Registered PF_INET6 protocol family
[ 3.053638] Segment Routing with IPv6
[ 3.057737] In-situ OAM (IOAM) with IPv6
[ 3.062138] NET: Registered PF_PACKET protocol family
[ 3.068235] 8021q: 802.1Q VLAN Support v1.8
[ 3.101747] b53-switch 10e00000.switch: found switch: BCM63xx, rev 0
[ 3.268838] b53-switch 10e00000.switch: Using legacy PHYLIB callbacks. Please migrate to PHYLINK!
[ 3.325026] device eth0 entered promiscuous mode
[ 3.330075] DSA: tree 0 setup
[ 3.333693] mv88e6085 mdio_mux-0.1:00: switch 0x3520 detected: Marvell 88E6352, revision 1
[ 3.888636] mv88e6085 mdio_mux-0.1:00: configuring for fixed/rgmii-id link mode
[ 3.899624] mv88e6085 mdio_mux-0.1:00: Link is Up - 1Gbps/Full - flow control off
[ 3.992264] mv88e6085 mdio_mux-0.1:00 lan1 (uninitialized): PHY [!ubus!mdio@10e000b0!mdio@1!switch@0!mdio:00] driver [Marvell 88E1540] (irq=17)
[ 4.008990] mv88e6085 mdio_mux-0.1:00: nonfatal error -34 setting MTU to 1500 on port 0
[ 4.112335] mv88e6085 mdio_mux-0.1:00 lan2 (uninitialized): PHY [!ubus!mdio@10e000b0!mdio@1!switch@0!mdio:01] driver [Marvell 88E1540] (irq=18)
[ 4.129152] mv88e6085 mdio_mux-0.1:00: nonfatal error -34 setting MTU to 1500 on port 1
[ 4.230238] mv88e6085 mdio_mux-0.1:00 lan3 (uninitialized): PHY [!ubus!mdio@10e000b0!mdio@1!switch@0!mdio:02] driver [Marvell 88E1540] (irq=19)
[ 4.249482] mv88e6085 mdio_mux-0.1:00: nonfatal error -34 setting MTU to 1500 on port 2
[ 4.352214] mv88e6085 mdio_mux-0.1:00 lan4 (uninitialized): PHY [!ubus!mdio@10e000b0!mdio@1!switch@0!mdio:03] driver [Marvell 88E1540] (irq=20)
[ 4.368959] mv88e6085 mdio_mux-0.1:00: nonfatal error -34 setting MTU to 1500 on port 3
[ 4.472271] mv88e6085 mdio_mux-0.1:00 ext1 (uninitialized): PHY [!ubus!mdio@10e000b0!mdio@1!switch@0!mdio:04] driver [Marvell 88E1540] (irq=21)
[ 4.489031] mv88e6085 mdio_mux-0.1:00: nonfatal error -34 setting MTU to 1500 on port 4
[ 4.500148] mv88e6085 mdio_mux-0.1:00: nonfatal error -34 setting MTU to 1500 on port 5
[ 4.511570] b53-switch 10e00000.switch extsw: error -34 setting MTU to 1508 to include DSA overhead
[ 4.520980] device extsw entered promiscuous mode
[ 4.526023] DSA: tree 1 setup
[ 4.623323] Freeing unused kernel image (initmem) memory: 11796K
[ 4.629570] This architecture does not have kernel memory protection.
[ 4.636179] Run /init as init process
[ 5.701766] init: Console is alive
[ 5.706293] init: - watchdog -
[ 5.755735] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 5.799242] usbcore: registered new interface driver usbfs
[ 5.805016] usbcore: registered new interface driver hub
[ 5.810802] usbcore: registered new device driver usb
[ 5.881786] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 5.900736] init: - preinit -
[ 8.947245] random: crng init done
[ 9.504880] b53-switch 10e00000.switch extsw: configuring for fixed/rgmii link mode
[ 9.513285] mv88e6085 mdio_mux-0.1:00 lan1: configuring for phy/gmii link mode
[ 9.521488] b53-switch 10e00000.switch extsw: Link is Up - 1Gbps/Full - flow control off
[ 9.530790] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 9.537754] IPv6: ADDRCONF(NETDEV_CHANGE): extsw: link becomes ready
[ 9.597349] mv88e6085 mdio_mux-0.1:00 lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[ 9.605802] IPv6: ADDRCONF(NETDEV_CHANGE): lan1: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 11.996580] mv88e6085 mdio_mux-0.1:00 lan1: Link is Down
[ 12.027050] procd: - early -
[ 12.030859] procd: - watchdog -
[ 12.732389] procd: - watchdog -
[ 12.738926] procd: - ubus -
[ 12.804719] procd: - init -
Please press Enter to activate this console.
[ 14.300190] kmodloader: loading kernel modules from /etc/modules.d/*
[ 14.352284] i2c_dev: i2c /dev entries driver
[ 14.384833] i2c-gpio i2c-sfp: Slow GPIO pins might wreak havoc into I2C/SMBus bus timing
[ 14.394055] i2c-gpio i2c-sfp: using lines 481 (SDA) and 499 (SCL)
[ 14.401078] i2c-gpio i2c-catv: Slow GPIO pins might wreak havoc into I2C/SMBus bus timing
[ 14.410234] i2c-gpio i2c-catv: using lines 503 (SDA) and 487 (SCL)
[ 14.565916] sfp sfp0: Host maximum power 1.0W
[ 14.570611] sfp sfp0: No tx_disable pin: SFP modules will always be emitting.
[ 14.815119] PPP generic driver version 2.4.2
[ 14.839515] NET: Registered PF_PPPOX protocol family
[ 14.899408] sfp sfp0: module FINISAR CORP. FTRJ1319P1BTL-J2 rev A sn PBK4H2N dc 070513
[ 14.909208] mv88e6085 mdio_mux-0.1:00 wan: switched to inband/1000base-x link mode
[ 14.924180] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 18.491576] urngd: v1.0.2 started.
[ 63.207526] b53-switch 10e00000.switch extsw: Link is Down
[ 63.361628] b53-switch 10e00000.switch extsw: configuring for fixed/rgmii link mode
[ 63.370153] b53-switch 10e00000.switch extsw: Link is Up - 1Gbps/Full - flow control off
[ 63.380007] IPv6: ADDRCONF(NETDEV_CHANGE): extsw: link becomes ready
[ 63.430742] mv88e6085 mdio_mux-0.1:00 lan1: configuring for phy/gmii link mode
[ 63.510996] br-lan: port 1(lan1) entered blocking state
[ 63.516372] br-lan: port 1(lan1) entered disabled state
[ 63.738606] device lan1 entered promiscuous mode
[ 63.954217] mv88e6085 mdio_mux-0.1:00 lan2: configuring for phy/gmii link mode
[ 64.039513] br-lan: port 2(lan2) entered blocking state
[ 64.044888] br-lan: port 2(lan2) entered disabled state
[ 64.095452] device lan2 entered promiscuous mode
[ 64.166580] mv88e6085 mdio_mux-0.1:00 lan3: configuring for phy/gmii link mode
[ 64.253073] br-lan: port 3(lan3) entered blocking state
[ 64.258585] br-lan: port 3(lan3) entered disabled state
[ 64.317565] device lan3 entered promiscuous mode
[ 64.395691] mv88e6085 mdio_mux-0.1:00 lan4: configuring for phy/gmii link mode
[ 64.478476] br-lan: port 4(lan4) entered blocking state
[ 64.483845] br-lan: port 4(lan4) entered disabled state
[ 64.547558] device lan4 entered promiscuous mode
[ 64.774485] mv88e6085 mdio_mux-0.1:00 wan: configuring for inband/1000base-x link mode
[ 64.920208] br-wan: port 1(wan) entered blocking state
[ 64.925485] br-wan: port 1(wan) entered disabled state
[ 65.068909] device wan entered promiscuous mode
[ 65.118418] mv88e6085 mdio_mux-0.1:00: p5: hw VLAN 1 already used by port 0 in br-lan
[ 65.473884] mv88e6085 mdio_mux-0.1:00 ext1: configuring for phy/gmii link mode
[ 65.610417] br-wan: port 2(ext1) entered blocking state
[ 65.615791] br-wan: port 2(ext1) entered disabled state
[ 65.758508] device ext1 entered promiscuous mode
[ 65.764135] mv88e6085 mdio_mux-0.1:00: p4: hw VLAN 1 already used by port 0 in br-lan
[ 66.438621] mv88e6085 mdio_mux-0.1:00 lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[ 66.447030] br-lan: port 1(lan1) entered blocking state
[ 66.452511] br-lan: port 1(lan1) entered forwarding state
[ 66.539939] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
BusyBox v1.36.1 (2023-07-25 18:08:33 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r23614-8dd137a2f3
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
1 Like
So my HW 1.3 is some special with the new NOR flash and all, well fair enough, I just list it as jedec NOR in the device tree so the version will autodetect.
I am working with firmware re-flash (slowly). These observations are in the current commit msg:
Installation to target flash is not yet possible because
the firmware format deviates from the Broadcom standard:
it is based on the standard format generated by the
"imagetag" tool, but some stuff is off and images don't flash
or boot so this needs further work. The Broadcom image creation
tool bcmImageBuilder has been patched to take a new command line
option such as this:
--image-version 4125XG6846_ITT12023725
then this ends up as a string at offset 142-191 in the BCM tag
normally used for "rsa-signature" and "information1". There
may be other differences as well. We will need to work on this.
I hope to figure out what Inteno has been hacking up at some point, including just using their modified bcmImageBuilder for test.
I sent off the initial patches to the MIPS OpenWrt maintainers:
http://lists.openwrt.org/pipermail/openwrt-devel/2023-August/041387.html
1 Like
Hi, old Inteno dev here. Unfortunately the software for this device was done by an other team then what I was in. I dont really have any answers to the open issues but if anyone needs devices I can probably arrange that.
1 Like
@merbanan Perhaps you have some leads on other Inteno devices?
I suppose having an extra device to work with would be fine, considering the risk of frying my working Internet connection 
@linusw saw your patches - they're now in patchwork awaiting approval.
What difficulties have you encountered if you try to flash directly from initramfs? The risk that it won't boot at all?
Didn't realize that we could have CONFIG_NET_DSA_MV88E6XXX_PTP=y
PTP is always welcome addition
@systemcrash I can re-flash the device after booting from initramfs, actually there are two copies of the flash image (kernel+rootfs) in the device, one right after the boot loader CFE at 0x10000 (as indicated by the device tree) and another one at something like 0x7f0000 in the firmware partition i.e. half way into the flash at 0x80000.
I first reflashed the first firmware image (at 0x10000) with something produced by standard OpenWrt which means the standard settings from target/linux/bmips/image/Makefile.
This is done by simply bringing up the interfaces after booting from initramfs, scp over the sysupgrade.bin file and execute sysupgrade. The flashing works fine and the image is written fine into flash.
The result failed to decompress.
After some trial-and-error I found that using the legacy format makes the bootloader claim it can decompress it properly, but then it hangs. This is why I used Device/bcm63xx-cfe-legacy in the image build, it takes me the furthest.
So the problem is with decompression.
I looked at the vendor code and it uses a customized CFE file named "cfe6328_xavi.bin".
I have heard that "XAVI" means "eXtensible Access Virtual Interface" which is some kind of Inteno ambition that I don't understand, maybe @merbanan can tell us what this is The point is that the CFE boot loader on the device is hacked around by Inteno and maybe this is why decompression won't work.
I did some hacks to add the custom version string from Intenos host tools including patching imagetag.c, but it didn't make any difference. I think it's just metadata that the boot loader actually ignores, so it doesn't affect the boot, but I could be wrong.
My next thing to test would be to take something like a BCM6328 U-Boot and sign it with the vendor host tools and see if I can get it to execute. I can't use the Linux kernel because it gets too big and therefore need the "relocate" loader from target/linux/generic/image/relocate, which in turn needs the standard imagetag tool to bundle it, and yeah that didn't decompress so...
Yeah, you and me. I figured out maybe a hundred ways it would not work.
The sources have this:
cd $(PROFILE_DIR); \
cp $(KERNEL_DIR)/vmlinux . ; \
$(STRIP) --remove-section=.note --remove-section=.comment vmlinux; \
$(OBJCOPY) -O binary vmlinux vmlinux.bin; \
$(HOSTTOOLS_DIR)/cmplzma -k -2 vmlinux vmlinux.bin vmlinux.lz;\
$(HOSTTOOLS_DIR)/bcmImageBuilder --output $(FS_KERNEL_IMAGE_NAME) --chip $(or $(TAG_OVERRIDE),$(BRCM_CHIP)) --board $(BRCM_BOARD_ID) --blocksize $(BRCM_FLASHBLK_SIZE) --image-version $(IMAGE_VERSION) --cfefile $(CFE_FILE) --rootfsfile rootfs.img --kernelfile vmlinux.lz; \
$(HOSTTOOLS_DIR)/bcmImageBuilder --output $(CFE_FS_KERNEL_IMAGE_NAME) --chip $(or $(TAG_OVERRIDE),$(BRCM_CHIP)) --board $(BRCM_BOARD_ID) --blocksize $(BRCM_FLASHBLK_SIZE) --image-version $(IMAGE_VERSION) --cfefile $(CFE_FILE) --rootfsfile rootfs.img --kernelfile vmlinux.lz --include-cfe; \
$(HOSTTOOLS_DIR)/createimg --boardid=$(BRCM_BOARD_ID) --voiceboardid $(BRCM_VOICE_BOARD_ID) --numbermac=$(BRCM_NUM_MAC_ADDRESSES) --macaddr=$(BRCM_BASE_MAC_ADDRESS) --tp=$(BRCM_MAIN_TP_NUM) --psisize=$(BRCM_PSI_SIZE) --logsize=$(BRCM_LOG_SECTION_SIZE) --auxfsprcnt=$(BRCM_AUXFS_PERCENT) --gponsn=$(BRCM_GPON_SERIAL_NUMBER) --gponpw=$(BRCM_GPON_PASSWORD) --inputfile=$(CFE_FS_KERNEL_IMAGE_NAME) --outputfile=$(FLASH_IMAGE_NAME); \
$(HOSTTOOLS_DIR)/addvtoken --chip $(or $(TAG_OVERRIDE),$(BRCM_CHIP)) --flashtype NOR $(FLASH_IMAGE_NAME) $(FLASH_IMAGE_NAME).w
@mkdir -p $(IMAGES_DIR)
@cp $(PROFILE_DIR)/$(FS_KERNEL_IMAGE_NAME) $(IMAGES_DIR)/$(FS_KERNEL_IMAGE_NAME)_$(BRCM_RELEASETAG)-$(shell date '+%y%m%d_%H%M')
@echo
@echo -e "Done! Image $(PROFILE) has been built in $(IMAGES_DIR)."
@$(MAKE) -s xavi_release_image
where:
#
# Chip selection
#
BRCM_6328=y
BRCM_CHIP=6328
BRCM_BOARD_ID="96328avng"
BRCM_VOICE_BOARD_ID=""
BRCM_GPON_SERIAL_NUMBER=""
BRCM_GPON_PASSWORD=""
BRCM_FLASHBLK_SIZE=64
BRCM_AUXFS_PERCENT=
BRCM_NUM_MAC_ADDRESSES=11
BRCM_BASE_MAC_ADDRESS="02:10:18:01:00:01"
BRCM_PSI_SIZE=24
BRCM_BACKUP_PSI=
BRCM_MAIN_TP_NUM=0
and BRCM_LOG_SECTION_SIZE=
cmplzma seems an interface to lzma. Alt source here:
* For CFE RAM compress:
* Command: cmplzma [-t] -c -2 cfe cfe.bin flashimg.S
* where cfe is elf, cfe.bin is
* binary file to be compressed and flashimg.S is Asm data array for
* the compressed binary to be linked in as data.
*
* For vmlinux:
* Command: cmplzma [-t] -k -2 vmlinux vmlinux.bin vmlinux.lz
* where vmlinux is the elf file, vmliux.bin the binary file
* and vmlinux.lz is the compressed output
bcmImageBuilder sources seem to be floating around also:
// Function Name: build image
// Description : builds a complete norflash or emmc image
// Parameters : little endian - endianess.
// chipid - chipid
// board - boardid
// blksize - flash block size for combined cfe(NOR) or cferom(EMMC)
// imageversiona - image version
// outputfile - final output image name
// cfefile - Name of cfe(NOR) or cferom(EMMC) binary
// rootfsfile - root fs image name
// kernelfile - compressed kernel(NOR) or bootfs image(EMMC) name
// dtb_mdata_file- dtb(NOR) or metadata blob(EMMC) name
// includecfe - flag to to include cfe(NOR) or cferom(EMMC)
// emmcimage - flag to indicate an emmcimage build
createimg source also.
* File Name : createimg.c
*
* Description: This program creates a complete flash image for a BCM963xx
* board from an input file that is created by the
* bcmImageBuilder utility.
*
* Build : $ gcc -o createimg createimg.c boardparms.c
*
* Example : createimg -b 96362GW -c SI3217X -n 4 -m 02:10:18:18:12:01 -t 0 -p 24
* -i bcm96362GW_cfe_fs_kernel -o bcm96362GW_cfe_fs_kernel.img
* OR
* -f whole_flash_image.w
* only sets NVRAM_DATA
* where:
* -b = board id
* -c = voice board id
* -n = number of mac address
* -m = base mac address
* -t = main thread number
* -p = PSI Size
* -i = input file name
* -o = output file name
Pulling apart addvtoken and it seems it appends a 4 byte crc at the end, in lieu of a 20 byte 'validation token'. And despite what the command lines require, I only see that it adds a 4 byte CRC at the end of the image. Try just that?
Here is a recent ish source for addvtoken. The addvtoken binary in the source drop for XG6846 only has NOR, NAND16, NAND128, so it's older - though the makefile mandates NOR anyhow.
// File Name : addvtoken.c
//
// Description: Add validation token - 20 bytes, to the firmware image file to
// be uploaded by CFE 'w' command. For now, just 4 byte crc in
// network byte order
The bcmImageBuilder steps probably build an image which will be accepted by the running system. So if we can duplicate those, that would be nice. We may need to get analogue functionality into firmware-utils. Some functionality may already be present.
@linusw It looks like the utils know about Broadcom firmware images.