New device: ADB P.RG EA4201N-G

Hi,

I have got a device made by ADB Broadband S.p.A. - ADB P.RG EA4201N-G. The model was used by a provider in Eastern Europe (Telia Lithuania aka TEO). It seems to be running some sort of OpenWRT 10.03. Providers are deprecating this model so there should be a lot of them available on ebay. But since specs are still good (dual-core, 128MB RAM, 64MB flash) and there was initial support of OpenWRT, maybe it is possible to add this device? So users can remove bloated ISP firmware with backdoors and flash OpenWRT

Posting photos and some info:

BusyBox v1.17.3 (2013-04-19 10:20:04 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@localhost:~# uname -a
Linux localhost 2.6.30 #1 SMP PREEMPT Fri Apr 19 10:39:08 CEST 2013 mips GNU/Linux

root@localhost:~# free -m
              total         used         free       shared      buffers
  Mem:       125564        95300        30264            0           36
 Swap:         3064            0         3064
Total:       128628        95300        33328

root@localhost:~# df -h
Filesystem                Size      Used Available Use% Mounted on
mtd:rootfs_1             28.8M     23.7M      5.1M  82% /
/dev/mtdblock7          128.0K    128.0K         0 100% /tmp/cfg
/dev/mtdblock8           64.0K     32.0K     32.0K  50% /tmp/factory

cpuinfo:

system type		: 96362ADVNrtk
processor		: 0
cpu model		: Broadcom4350 V7.0
BogoMIPS		: 398.33
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 32
extra interrupt vector	: no
hardware watchpoint	: no
ASEs implemented	:
shadow register sets	: 1
core			: 0
VCED exceptions		: not available
VCEI exceptions		: not available

unaligned exceptions		: 12
processor		: 1
cpu model		: Broadcom4350 V7.0
BogoMIPS		: 402.43
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 32
extra interrupt vector	: no
hardware watchpoint	: no
ASEs implemented	:
shadow register sets	: 1
core			: 0
VCED exceptions		: not available
VCEI exceptions		: not available

unaligned exceptions		: 12

Process list:

  PID USER       VSZ STAT COMMAND
    1 root      1308 S    init
    2 root         0 SW<  [kthreadd]
    3 root         0 SW<  [migration/0]
    4 root         0 SW   [sirq-high/0]
    5 root         0 SW   [sirq-timer/0]
    6 root         0 SW   [sirq-net-tx/0]
    7 root         0 SW   [sirq-net-rx/0]
    8 root         0 SW   [sirq-block/0]
    9 root         0 SW   [sirq-tasklet/0]
   10 root         0 SW   [sirq-sched/0]
   11 root         0 SW   [sirq-hrtimer/0]
   12 root         0 SW   [sirq-rcu/0]
   13 root         0 SW<  [migration/1]
   14 root         0 SW   [sirq-high/1]
   15 root         0 SW   [sirq-timer/1]
   16 root         0 SW   [sirq-net-tx/1]
   17 root         0 SW   [sirq-net-rx/1]
   18 root         0 SW   [sirq-block/1]
   19 root         0 SW   [sirq-tasklet/1]
   20 root         0 SW   [sirq-sched/1]
   21 root         0 SW   [sirq-hrtimer/1]
   22 root         0 SW   [sirq-rcu/1]
   23 root         0 SW<  [events/0]
   24 root         0 SW<  [events/1]
   25 root         0 SW<  [khelper]
   28 root         0 SW<  [async/mgr]
   62 root         0 SW<  [kblockd/0]
   63 root         0 SW<  [kblockd/1]
   69 root         0 SW<  [khubd]
  101 root         0 SW   [pdflush]
  102 root         0 SW   [pdflush]
  103 root         0 SWN  [kswapd0]
  104 root         0 SW<  [crypto/0]
  105 root         0 SW<  [crypto/1]
  136 root         0 SW<  [mtdblockd]
  186 root         0 SW   [board-timer]
  198 root         0 SWN  [jffs2_gcd_mtd2]
  237 root      2020 S    logd
  240 root      1308 S    init
  247 root      1296 S    klogd -c3
  256 root      1524 S    /bin/sh /etc/rc.common /etc/rc.d/S11services boot
  257 root       784 S    ec
  376 root      2652 S    cm /tmp/cm/tr181 /tmp/cm_tr181 9034 Device /tmp/cm_s
  377 root         0 SW   [dsl0]
  379 root      2148 S    cm /tmp/cm/tr098 /tmp/cm_tr098 9033 InternetGatewayD
  399 root         0 SW   [bcmsw]
  400 root         0 SW   [bcmsw_timer]
  401 root         0 SW<  [linkwatch]
  929 root      1524 S    /bin/sh /etc/rc.common /etc/rc.d/S11services boot
  931 root       756 S    dns
 1033 root         0 SW<  [scsi_eh_0]
 1034 root         0 SW<  [usb-storage]
 1107 root         0 SW<  [usbhid_resumer]
 1223 root      4084 S N  smbd -D -s /tmp/samba/smb.conf
 1423 root      1132 S    dropbear -P /tmp/dropbear-remote.pid -l 100,200 -I 3
 1437 root      1292 S    sleep 60
 1438 root      1300 R    ps
 2272 nobody    2428 S    nhttpd -c /tmp/nhttpd-remote.conf
 3250 root      1296 S    telnetd Local -u 100,300,200 -b 192.168.1.254:23 -I
 3321 nobody    2484 S    nhttpd -c /tmp/nhttpd.conf
 3877 root      1312 S    /bin/sh /etc/ah/CmWatchDog.sh
 3949 root       800 S    dhcps /tmp/dhcps.conf
 5736 root       736 S    /bin/wpspbc
 5818 root      1056 S    miniupnpd -i eth4 -a 192.168.1.254 -N -I 3
 6083 root       780 S    igmpproxy -c /tmp/igmpproxy.conf -p /tmp/igmpproxy.p
 6276 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 6424 root         0 SW<  [bluetooth]
 6572 root         0 SW<  [krfcommd]
 6941 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 6942 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 6943 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 6944 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 6955 root      2300 S    /usr/sbin/hostapd -B /tmp/wlan/config/hostapd.conf
 7017 root      3784 S    cwmp
 7033 root         0 SW<  [kjournald]
 7145 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 7147 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 7165 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 7166 root     40272 R    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 7620 root      1524 S    /bin/sh /etc/rc.common /etc/rc.d/S11services boot
 7632 root      1260 S    /usr/sbin/dbus-daemon --system
 7636 root      1536 S    hcid -d
 7671 root      2872 S    voip
 7710 root      2872 S    voip
 7711 root      2872 S    voip
 7712 root      2872 S    voip
 7713 root      2872 S    voip
 7714 root      2872 S    voip
 7717 root      2872 S    voip
 7719 root         0 SW<  [aoRT]
 7720 root      2872 S    voip
 7751 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 7755 root         0 SW<  [HTSK]
 7817 root         0 SW<  [HRTBEAT]
 7818 root         0 SW<  [VRGDISP]
 7819 root         0 SW<  [HCAS]
 7820 root         0 SW<  [ISTW]
 7821 root         0 SW   [YAPS_Dsp_Event_]
 7822 root         0 SW   [YAPS_Dsp_Data_R]
 8035 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 8040 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 8050 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 8070 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 8071 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 8072 root     40272 S    jamvm -Xbootclasspath/a:/mnt/sda1/usr/share/classpat
 8317 root      1248 S    pure-ftpd (SERVER)
10848 root      1372 S    pure-ftpd (IDLE)
10860 root      1252 S    pure-ftpd (PRIV)
15339 root      1936 S    nmbd -D -s /tmp/samba/smb.conf
15340 root      1892 S    nmbd -D -s /tmp/samba/smb.conf
15346 root      3832 S N  smbd -D -s /tmp/samba/smb.conf
15405 root      3824 S N  smbd -D -s /tmp/samba/smb.conf
29019 root      1196 S    dropbear -P /tmp/dropbear-remote.pid -l 100,200 -I 3
29234 root      2088 S    -clish
29235 root      2088 S    -clish
29236 root      2088 S    -clish
29238 root      1356 R    -ash

mounts:

rootfs on / type rootfs (rw)
mtd:rootfs_1 on / type jffs2 (rw,relatime)
proc on /proc type proc (rw,relatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,relatime,size=64288768,mode=1777)
tmpfs on /dev type tmpfs (rw,relatime,size=131072)
none on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /mnt type tmpfs (rw,relatime,size=65536)
sysfs on /sys type sysfs (rw,relatime)
/dev/mtdblock7 on /tmp/cfg type yaffs (rw,relatime)
/dev/mtdblock8 on /tmp/factory type yaffs (rw,relatime)
/dev/sda1 on /mnt/sda1 type ext3 (rw,relatime,errors=continue,user_xattr,data=writeback)
none on /proc/bus/usb type usbfs (rw,relatime)

I already tried to solder Serial console, but that seems to be either disabled or disconnected

Photos of the board:

The firmware version is:

Firmware Version:
PRGEA4202N_TEO_2.1.1.0023 - main
Platform Version:
2.1.0.0019
Hardware Version:
BCM6362 

By holding Reset button at Power-On device can be put into recovery mode. Then there is 192.168.1.1 web page for flashing firmware (but I didn't try to flash anything):

Opkg contains reference to a target called bcm412l02, but that page does not exist:

# cat /etc/opkg.conf
src/gz snapshots http://downloads.openwrt.org/snapshots/trunk/bcm412l02/packages
dest root /
dest ram /tmp
dest usb1 /mnt/sda1
lists_dir ext /var/opkg-lists
option overlay_root /overlay

Is there any new for this device? I have no use for it, but how do you access shell of it?

The device I used had SSH enabled and with ISP leaked admin password I was able to login into it. Its still a good gigabit router and I'm using it after removing all ISP backdoors.

Depending on your model's firmware you could also try some public exploits to get root, like:

SAMBA injection: exploit-db . com /exploits/ 44983
FTP symlink: search for "adb-full-root-access", top link to wordpress link will be it

For anyone who wants to play with this board, here is some more info about the serial console

You will have to solder two missing resistors R428 and R429. They are located right near the heatsink:

Serial baudrate is 115200, pinout of J5 header is following:

OEM boot log:

CFE version 1.0.38-114.170 for BCM96362 (32bit,SP,BE)
Build Date: Thu Jul 10 11:05:46 CEST 2014 (f.bellintani@quelo)
Copyright (C) 2000-2011 Broadcom Corporation.
NAND flash device: name ST NAND512W3A2CN6, id 0x2076 block 16KB size 65536KB
8367 Force MII
8367 Start rtk_port_phyEnableAll_set
Chip ID: BCM6362B0, MIPS: 400MHz, DDR: 333MHz, Bus: 166MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000

Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Boot image (0=latest, 1=previous) : 0  
Board Id (0-15)                   : 96362ADVNrtk  
Number of MAC Addresses (1-32)    : 10  
Base MAC Address                  : 00:10:18:00:00:00  
PSI Size (1-64) KBytes            : 24  
Enable Backup PSI [0|1]           : 0  
System Log Size (0-256) KBytes    : 0  
Auxillary File System Size Percent: 0  
Main Thread Number [0|1]          : 0  
Voice Board Configuration (0-15)  : LE88506  
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1

 Port 4 link UP

Booting from latest image (0xb9f00000) ...
Decompression OK!
Entry at 0x802624b0
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x802624b0

[    0.000000] Linux version 2.6.30 (f.bellintani@quelo) (gcc version 4.3.3 (GCC) ) #1 SMP PREEMPT Thu Jul 10 11:54:20 CEST 2014
[    0.000000] BCM Flash API. Flash device is not found.
[    0.000000] 96362ADVNrtk prom init
[    0.000000] CPU revision is: 0002a070 (Broadcom4350)
[    0.000000] DSL SDRAM reserved: 0x100000
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 07f00000 @ 00000000 (usable)
[    0.000000] Zone PFN ranges:
[    0.000000]   DMA      0x00000000 -> 0x00001000
[    0.000000]   Normal   0x00001000 -> 0x00007f00
[    0.000000] Movable zone start PFN for each node
[    0.000000] early_node_map[1] active PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00007f00
[    0.000000] On node 0 totalpages: 32512
[    0.000000] free_area_init_node: node 0, pgdat 802f0dc0, node_mem_map 81000000
[    0.000000]   DMA zone: 32 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 4064 pages, LIFO batch:0
[    0.000000]   Normal zone: 222 pages used for memmap
[    0.000000]   Normal zone: 28194 pages, LIFO batch:7
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32258
[    0.000000] Kernel command line: root=mtd:rootfs_1 rw rootfstype=jffs2 console=ttyS0,115200 init=/sbin/init
[    0.000000] wait instruction: enabled
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[    0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.000000] NR_IRQS:128
[    0.000000] PID hash table entries: 512 (order: 9, 2048 bytes)
[    0.000000] console [ttyS0] enabled
[    0.001000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.002000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.003000] Allocating memory for DSP module core and initialization code
[    0.004000] Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0
[    0.014000] Memory: 125292k/130048k available (2407k kernel code, 4568k reserved, 558k data, 140k init, 0k highmem)
[    0.015000] Calibrating delay loop... 399.36 BogoMIPS (lpj=199680)
[    0.037000] Mount-cache hash table entries: 512
[    0.038000] --Kernel Config--
[    0.039000]   SMP=1
[    0.040000]   PREEMPT=1
[    0.041000]   DEBUG_SPINLOCK=0
[    0.042000]   DEBUG_MUTEXES=0
[    0.043000] Broadcom Logger v0.1 Jul 10 2014 11:47:49
[    0.046000] CPU revision is: 0002a070 (Broadcom4350)
[    0.046000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[    0.046000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.046000] Calibrating delay loop... 402.43 BogoMIPS (lpj=201216)
[    0.067000] Brought up 2 CPUs
[    0.072000] net_namespace: 828 bytes
[    0.074000] NET: Registered protocol family 16
[    0.076000] Total Flash size: 0K with -1 sectors
[    0.410000] registering PCI controller with io_map_base unset
[    0.411000] registering PCI controller with io_map_base unset
[    0.419000] bio: create slab <bio-0> at 0
[    0.421000] usbcore: registered new interface driver usbfs
[    0.422000] usbcore: registered new interface driver hub
[    0.423000] usbcore: registered new device driver usb
[    0.426000] pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10005fff]
[    0.427000] pci 0000:00:00.0: supports D1 D2
[    0.428000] pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
[    0.429000] pci 0000:00:00.0: PME# disabled
[    0.430000] pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff]
[    0.431000] pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff]
[    0.433000] pci 0000:01:00.0: PME# supported from D0 D3hot
[    0.434000] pci 0000:01:00.0: PME# disabled
[    0.436000] pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
[    0.437000] pci 0000:01:00.0:   IO window: disabled
[    0.438000] pci 0000:01:00.0:   MEM window: disabled
[    0.439000] pci 0000:01:00.0:   PREFETCH window: disabled
[    0.440000] PCI: Setting latency timer of device 0000:01:00.0 to 64
[    0.441000] BLOG Rule v1.0 Initialized
[    0.442000] Broadcom IQoS v0.1 Jul 10 2014 11:52:02 initialized
[    0.443000] Broadcom GBPM v0.1 Jul 10 2014 11:52:02 initialized
[    0.451000] NET: Registered protocol family 8
[    0.452000] NET: Registered protocol family 20
[    0.456000] NET: Registered protocol family 2
[    0.472000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.481000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.488000] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
[    0.495000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.502000] TCP reno registered
[    0.509000] NET: Registered protocol family 1
[    0.516000] JFFS2 version 2.2 (NAND) (ZLIB) (LZMA) (RTIME) (c) 2001-2006 Red Hat, Inc.
[    0.525000] msgmni has been set to 245
[    0.533000] io scheduler noop registered (default)
[    0.543000] PPP generic driver version 2.4.2
[    0.548000] PPP Deflate Compression module registered
[    0.553000] PPP BSD Compression module registered
[    0.558000] NET: Registered protocol family 24
[    0.563000] bcm963xx_mtd driver v2.0
[    0.567000] Failed to read image tag from flash
[    0.571000] >> nand_flash_init - entry
[    0.575000] Broadcom DSL NAND controller (BrcmNand Controller)
[    0.582000] -->brcmnand_scan: CS=0, numchips=1, csi=0
[    0.587000] mtd->oobsize=0, mtd->eccOobSize=0
[    0.592000] NAND_CS_NAND_XOR=00000000
[    0.595000] Disabling XOR on CS#0
[    0.599000] brcmnand_scan: Calling brcmnand_probe for CS=0
[    0.604000] B4: NandSelect=40000001, nandConfig=04042300, chipSelect=0
[    0.611000] brcmnand_read_id: CS0: dev_id=20762076
[    0.616000] After: NandSelect=40000001, nandConfig=04042300
[    0.622000] Block size=00004000, erase shift=14
[    0.626000] NAND Config: Reg=04042300, chipSize=64 MB, blockSize=16K, erase_shift=e
[    0.634000] busWidth=1, pageSize=512B, page_shift=9, page_mask=000001ff
[    0.641000] timing1 not adjusted: 5363444f
[    0.645000] timing2 not adjusted: 00000fc6
[    0.650000] BrcmNAND mfg 20 76 ST ST_NAND512W3A 64MB on CS0
[    0.655000] 
[    0.655000] Found NAND on CS0: ACC=f3000000, cfg=04042300, flashId=20762076, tim1=5363444f, tim2=00000fc6
[    0.667000] BrcmNAND version = 0x0202 64MB @00000000
[    0.672000] B4: NandSelect=40000001, nandConfig=04042300, chipSelect=0
[    0.678000] brcmnand_read_id: CS0: dev_id=20762076
[    0.683000] After: NandSelect=40000001, nandConfig=04042300
[    0.689000] Found NAND flash on Chip Select 0, chipSize=64MB, usable size=64MB, base=0
[    0.697000] brcmnand_scan: Done brcmnand_probe
[    0.702000] brcmnand_scan: B4 nand_select = 40000001
[    0.707000] brcmnand_scan: After nand_select = 40000001
[    0.712000] brcmnand_scan 10
[    0.715000] 200 CS=0, chip->ctrl->CS[0]=0
[    0.719000] 200 chip->ecclevel=15, acc=f3000000
[    0.724000] page_shift=9, bbt_erase_shift=14, chip_shift=26, phys_erase_shift=14
[    0.732000] brcmnand_scan 220
[    0.735000] Brcm NAND controller version = 2.2 NAND flash size 64MB @1c000000
[    0.742000] brcmnand_scan 230
[    0.745000] brcmnand_scan 40, mtd->oobsize=16, chip->ecclayout=00000000
[    0.752000] brcmnand_scan 42, mtd->oobsize=16, chip->ecclevel=15, isMLC=0, chip->cellinfo=0
[    0.761000] brcmnand_scan:  mtd->oobsize=16
[    0.765000] brcmnand_scan: oobavail=12, eccsize=512, writesize=512
[    0.771000] brcmnand_scan, eccsize=512, writesize=512, eccsteps=1, ecclevel=15, eccbytes=3
[    0.780000] 300 CS=0, chip->ctrl->CS[0]=0
[    0.784000] 500 chip=87a1ed98, CS=0, chip->ctrl->CS[0]=0
[    0.789000] -->brcmnand_default_bbt
[    0.793000] brcmnand_default_bbt: bbt_td = bbt_main_descr
[    0.799000] Bad block table Bbt0 found at page 0001ffe0, version 0xFF for chip on CS0
[    0.807000] Bad block table 1tbB found at page 0001ffc0, version 0xFF for chip on CS0
[    0.816000] rescanning .... 
[    1.682000] ----- Contents of BBT -----
[    1.686000] ----- END Contents of BBT -----
[    1.691000] brcmnandCET: Status -> Deferred
[    1.695000] brcmnand_scan 99
[    1.698000] Creating 11 MTD partitions on "brcmnand.0":
[    1.703000] 0x000000000000-0x000000004000 : "CFE"
[    1.710000] 0x000001f00000-0x000002100000 : "bootfs_1"
[    1.717000] 0x000002100000-0x000003db0000 : "rootfs_1"
[    1.726000] mtd: partition "rootfs_1" set to be root filesystem
[    1.732000] 0x000000004000-0x000000204000 : "bootfs_2"
[    1.738000] 0x000000204000-0x000001eb4000 : "rootfs_2"
[    1.747000] 0x000000004000-0x000001eb4000 : "upgrade"
[    1.756000] 0x000003dd0000-0x000003df0000 : "conf_fs_old"
[    1.763000] 0x000003db0000-0x000003df0000 : "conf_fs"
[    1.769000] 0x000003df0000-0x000003e00000 : "conf_factory"
[    1.776000] 0x000003f00000-0x000004000000 : "bbt"
[    1.782000] 0x000000000000-0x000004000000 : "flash"
[    1.794000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    1.801000] PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
[    1.807000] PCI: Setting latency timer of device 0000:00:0a.0 to 64
[    1.813000] ehci_hcd 0000:00:0a.0: EHCI Host Controller
[    1.819000] ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
[    1.827000] ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
[    1.853000] ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
[    1.864000] ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00, overcurrent ignored
[    1.872000] usb usb1: configuration #1 chosen from 1 choice
[    1.878000] hub 1-0:1.0: USB hub found
[    1.882000] hub 1-0:1.0: 2 ports detected
[    1.888000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    1.894000] PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
[    1.900000] PCI: Setting latency timer of device 0000:00:09.0 to 64
[    1.907000] ohci_hcd 0000:00:09.0: OHCI Host Controller
[    1.912000] ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
[    1.920000] ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
[    1.981000] usb usb2: configuration #1 chosen from 1 choice
[    1.988000] hub 2-0:1.0: USB hub found
[    1.991000] hub 2-0:1.0: 2 ports detected
[    1.997000] brcmboard: brcm_board_init entry
[    2.001000] kerSysScreenPciDevices: 0x14e4:0x435f:(slot 0) detected
[    2.008000] kerSysScreenPciDevices: 0x14e4:0x6300:(slot 9) detected
[    2.014000] kerSysScreenPciDevices: 0x14e4:0x6300:(slot 10) detected
[    2.021000] kerSysScreenPciDevices: 0x14e4:0x6362:(slot 0) detected
[    2.027000] SES: Button Interrupt 0x2 is enabled
[    2.032000] sesBtn_mapIntr: is_sesBtn_irq_shared=0, sesBtn_irq=2
[    2.038000] SES: LED GPIO 0xc00e is enabled
[    2.042000] PCIe: No device found - Powering down
[    2.047000] bcm963xx-flash.0: failed to claim resource 0
[    2.053000] brcm_board_init: isShared=0, rstToDflt_irq=0
[    2.058000] Serial: BCM63XX driver $Revision: 3.00 $
[    2.064000] e[0;33mMagic SysRq enabled (type ^ h for list of supported commands)e[0m
[    2.072000] ttyS0 at MMIO 0xb0000100 (irq = 11) is a BCM63XX
[    2.078000] ttyS1 at MMIO 0xb0000120 (irq = 12) is a BCM63XX
[    2.084000] Total # RxBds=848
[    2.087000] bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized
[    2.087000] 
[    2.095000] bcmPktDma_init: Broadcom Packet DMA Library initialized
[    2.101000] bcmxtmrt: Broadcom BCM6362B0 ATM/PTM Network Device v0.3 Jul 10 2014 11:50:11
[    2.112000] TCP cubic registered
[    2.116000] Initializing XFRM netlink socket
[    2.120000] NET: Registered protocol family 17
[    2.125000] NET: Registered protocol family 15
[    2.130000] Bridge firewalling registered
[    2.134000] Ebtables v2.0 registered
[    2.138000] ebt_time registered
[    2.141000] ebt_ftos registered
[    2.144000] ebt_wmm_mark registered
[    2.148000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    2.155000] All bugs added by David S. Miller <davem@redhat.com>
[    9.705000] VFS: Mounted root (jffs2 filesystem) on device 31:2.
[    9.712000] Freeing unused kernel memory: 140k freed

init started: BusyBox v1.17.3 (2014-07-10 11:04:17 CEST)
init: setting virtual memory limit 8388608 -1
Starting /etc/rc.d/S10boot.sh ...
mount usb...
Restore passwd ....
Restore group ....
Thu Jul 10 08:57:05 UTC 2014
Starting /etc/rc.d/S11services.sh ...
Please press Enter to activate this console. 
 -- e[1;44m Base System Init e[m [e[1;33m12.20e[m]
[e[1;34m*e[m] e[36mStarting Event Controllere[m
[e[1;34m*e[m] e[36mLoading Drivers and Kernel Modulese[m
[e[1;34m*e[m] e[36mStarting Configuration Loade[m
[e[1;34m*e[m] e[36mStarting Configuration Manager (B)e[m
/etc/rc.common: line 1: cm: not found
init read conf_factory
read conf_factory 527
end read conf_factory
checkFactoryData: create /tmp/factory/
tar: invalid tar magic
checkFactoryData: tar failed
checkFactoryData: DEVICE_PATH=/tmp/deviceinfo.xml
<?xml version="1.0" encoding="UTF-8"?>
<object    name="Device.X_ADB_FactoryData">
	<parameter name="WiFiKeyPassphrase">
		<value>xxxxxx</value> (value redacted)
	</parameter>
	<parameter name="WiFiWEPKey">
		<value>xxxxxx</value> (value redacted)
	</parameter>
	<parameter name="WiFiSSID">
		<value>TEO-xxxxxx</value> (value redacted)
	</parameter>
	<parameter name="SerialNumber">
		 <value>xxxxxx</value> (value redacted) 
	</parameter>
	<parameter name="BaseMACAddress">
		 <value>xxxxxx</value> (value redacted)
	</parameter>
	<parameter name="MaxMACAddress">
		<value>32</value>
	</parameter>
</object>
- e[33m CM TR-181 readye[m
- e[33m CM TR-98 readye[m
[Configuration Load ready]
[e[1;34m*e[m] e[36mProbing for usb devices...e[m
Epicentro Software Version: 
Epicentro Platform Version: 
Alignement of Model Name parameter
[   21.198000] bcmport Link UP 1000 mbps full duplex
[e[1;34m*e[m] e[36mStarting Swap Disk (RAM)e[m
Setting up swapspace version 1, size = 3141632 bytes
UUID=a8944bac-67b8-4ae6-b951-0a97867ec1f4
[Swap Disk (RAM) ready]
[   25.032000] Adding 3064k swap on /dev/zram0.  Priority:-1 extents:1 across:3064k SS
[e[1;34m*e[m] e[36mInterfaceMonitor Inite[m
[e[1;34m*e[m] e[36mStarting Firewalle[m
[   25.280000] --SMP support
[   25.283000] wl: dsl_tx_pkt_flush_len=338
[   25.287000] wl: high_wmark_tot=4775
[   25.291000] wl: passivemode=1
[   25.294000] wl: napimode=0
[   25.297000] wl0: allocskbmode=0 currallocskbsz=0
[   25.308000] Neither SPROM nor OTP has valid image
[   25.313000] wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
[   25.324000] wl:loading /etc/wlan/bcm6362_map.bin
[   25.332000] srom rev:8
[   25.346000] wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=16
[   25.378000] wl0: pqc 16 - size  tot 1368
[   25.382000]  * pkt queue base:    128
[   25.382000]  * data HI watermark: 50
[   25.382000]  * PS queue:          1140
[   25.403000] wl0: Broadcom BCM435f 802.11 Wireless Controller 6.30.102.3.cpe4.12L07.0
[   25.412000] dgasp: kerSysRegisterDyingGaspHandler: wl0 registered 
[Firewall ready]
[e[1;34m*e[m] e[36mStarting QoSe[m
[QoS ready]
[   26.062000] Initializing USB Mass Storage driver...
[   26.068000] usbcore: registered new interface driver usb-storage
[   26.075000] USB Mass Storage support registered.


 -- e[1;44m Prepare Networking e[m [e[1;33m26.08e[m]
- e[33mInit USB Interfacese[m
- e[33mInit Video Bridgese[m
- e[33mInit Bridges (0)e[m
Problem with specified source mac ''.
Problem with specified destination mac ''.

 -- e[1;44m Start Networking e[m [e[1;33m26.81e[m]
[e[1;34m*e[m] e[36mStarting DHCP servere[m
[DHCP server ready]
[e[1;34m*e[m] e[36mLAN Ethernet Interfaces - Power UP! (B)e[m
[e[1;34m*e[m] e[36mStarting Filteringe[m
[Filtering ready]
[e[1;34m*e[m] e[36mStarting WatchDoge[m
[e[1;34m*e[m] e[36mStarting NATe[m
[NAT ready]
[e[1;34m*e[m] e[36mStarting Port Mappinge[m
[Port Mapping ready]

 -- e[1;44m Start Network Services e[m [e[1;33m27.44e[m]
[e[1;34m*e[m] e[36mStarting Wifi Protected Setup service (B)e[m
[e[1;34m*e[m] e[36mStartup Software Execution Environmentse[m
[e[1;34m*e[m] e[36mStarting VOIP services (B)e[m

 -- e[1;44m System Ready e[m [e[1;33m28.38e[m]
Starting /etc/rc.d/S50telnet ...
Starting /etc/rc.d/S60ipsec.sh ...
Starting /etc/rc.d/S70vpn.sh ...
Starting /etc/rc.d/S95done ...
1404982648:685756 :   931 : VOIP BASE - File /etc/voip/numplan.conf not found!
1404982648:689183[   34.996000] BOS: Enter bosInit 
 :   936 :   STA[   35.000000] BOS: Exit bosInit 
TS   - Error con[   35.005000] endpoint_open COMPLETED
nection to cm wi[   35.010000] xChange assert pid:939
th UNIX socket
1404982648:690051 :   931 : VOIP BASE - Num media profiles 16 VS num channels 2
[   36.185000] ******* DSP: Found BCM6362 *******
[   36.190000] ******* DSP: In PCM Mode *******
[   36.194000] ******* DSP: PCM running in 16 bit mode *******
[   36.200000] gInterruptCounter     = 0xC23E8940 
[   36.205000] gInterruptErrors      = 0xC23E8944 
[   36.210000] gNextRxDesc           = 0xC23E8A6C 
[   36.215000] gNextTxDesc           = 0xC23E8A68 
[   36.220000] gDectTestMode         = 0xc22134bc 
[   36.225000] dectBuffStart         = 0xc22134c8 
[   36.230000] gDectRxOutOfSyncCounter = 0xc22134cc 
[   36.236000] gDectTxOutOfSyncCounter = 0xc22134d0 
[   36.241000] 32 ms ECAN tail-length
[   36.245000] *** gStartRxDesc[0] = 0xA0C00000 
[   36.249000] *** gBufferSizeBytes = 640 
[   36.253000] *** gStartTxDesc[0] = 0xA0C01000 
[   36.257000] halPcmInit 367 nextTxDesc = 0xA0C01000 
[   36.263000] halPcmInit 367 nextTxDesc = 0xA0C01008 
[   36.268000] halPcmInit 371 Ownership for TX desc not set. Use this buffer. 
[   40.861000] boardHalInit completed
[   40.873000] DSP: Interrupt Ids
[   40.878000] ---------------
[   40.881000] InterruptId/Location      = 44/HIGH 
[   40.886000] 
[   40.886000] DSP: Interrupt Masks
[   40.891000] ---------------
[   40.895000] IrqMask                   = 0x00000500 
[   40.900000] IrqMaskLow                = 0x2000C680 
[   40.906000] IrqMask1                  = 0x00000010 
[   40.911000] IrqMaskLow1               = 0x00000008 
[   40.916000] 
[   40.916000] DSP: Interrupt Status
[   40.922000] -----------------
[   40.925000] IrqStatus                 = 0x00000000 
[   40.931000] IrqStatusLow              = 0x00000000 
[   40.936000] IrqStatus1                = 0x00000000 
[   40.942000] IrqStatusLow1             = 0x00000000 
[   41.167000] EndpointInit completed
[   41.171000] dgasp: kerSysRegisterDyingGaspHandler: endpoint registered 
[   41.178000] DoVrgConfigureFH: Min 0 Max 0 line 0
[   41.184000] DoVrgConfigureFH: Min 0 Max 0 line 1
[   41.222000] set MinHookFlash value 0
[   41.226000] set MaxHookFlash value 0
[   41.230000] set EPPROV_MinDisconnect value 110
[   41.277000] set MinHookFlash value 0
[   41.281000] set MaxHookFlash value 0
[   41.285000] set EPPROV_MinDisconnect value 110