New device: Technicolor TG389ac

Hi,

I have got a device made by Technicolor - TG389ac. The model is currently being used by a provider in Eastern Europe (Telia Lithuania aka TEO). It is running OpenWRT 12.09.1 with custom web ui. Bootloader looks to be some kind of customized CFE and only allows flashing over TFTP if the firware has a valid signature. It is possible to get full root access over SSH by exploiting publicly known vulnerability of a similar device used by the same provider (https://github.com/wuseman/TG799VAC-XTREME-17.2-MINT)

Posting some info:

BusyBox v1.19.4 (2016-07-26 18:26:01 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______              __           __              __             
 |_     _|.-----.----.|  |--.-----.|__|.----.-----.|  |.-----.----.
   |   |  |  -__|  __||     |     ||  ||  __|  _  ||  ||  _  |   _|
   |___|  |_____|____||__|__|__|__||__||____|_____||__||_____|__|  
                 N E X T   G E N E R A T I O N   G A T E W A Y
 --------------------------------------------------------------------
 NG GATEWAY SIGNATURE DRINK
 --------------------------------------------------------------------
  * 1 oz Vodka          Pour all ingredients into mixing
  * 1 oz Triple Sec     tin with ice, strain into glass.
  * 1 oz Orange juice
 --------------------------------------------------------------------

Product: gant-1_r16-1
Release: Amber (16.1)
Version: 16.1.7053-1941003-20161028112421-9544494f7668bf7752134a1e2eee128ee7258458


Hash config:         9544494f7668bf7752134a1e2eee128ee7258458
Hash openwrt:        219e2cda21d096b78d06e6022e6c3d77ece72ab4
Hash kernel:         d9311367c78b7dddb72fa6982e1d83bb1a1094bc
Hash lte:            e8066e838debe9f72237b79f18ebc5b0806bdf67
Hash packages:       2a805c203c435425ab3ff7bfeb0b266d6eadc8b3
Hash mindspeed:      91b6a7a4d703268d6023c3a58da3d33fc62e7ed8
Hash custo:          bb80c914f83578dea6893a41e5023a80bc8d169c
Hash technicolor:    a54c85c2e048541d478483a1442fc0dd6961b676

Bootloader: 2.0.67

Stock boot log:

root@device:/# dmesg
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.4.11-rt19 (jenkins@edgmsjslv11) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 SMP PREEMPT Tue Jul 26 20:49:04 CEST 2016
[    0.000000] GANT-1 prom init
[    0.000000] CPU revision is: 0002a080 (Broadcom BMIPS4350)
[    0.000000] Reserving DSL memory: 010CE000-011FFFFF
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 010cc000 @ 00002000 (usable)
[    0.000000]  memory: 0eddf000 @ 01200000 (usable)
[    0.000000] Wasting 64 bytes for tracking 2 unused pages
[    0.000000] Zone PFN ranges:
[    0.000000]   DMA      0x00000002 -> 0x00001000
[    0.000000]   Normal   0x00001000 -> 0x0000ffdf
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000002 -> 0x000010ce
[    0.000000]     0: 0x00001200 -> 0x0000ffdf
[    0.000000] On node 0 totalpages: 65195
[    0.000000] free_area_init_node: node 0, pgdat 804ab2f0, node_mem_map 81200040
[    0.000000]   DMA zone: 32 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 4062 pages, LIFO batch:0
[    0.000000]   Normal zone: 480 pages used for memmap
[    0.000000]   Normal zone: 60621 pages, LIFO batch:15
[    0.000000] PERCPU: Embedded 7 pages/cpu @81403000 s5504 r8192 d14976 u32768
[    0.000000] pcpu-alloc: s5504 r8192 d14976 u32768 alloc=8*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 64683
[    0.000000] Kernel command line: root=31:0 ro noinitrd memsize=0xFFDD000 btab=0xc004180c btab_bootid=1 tbbt_addr=0x7d00000 board=GANT-1 console=ttyS0,115200 root=/dev/mtdblock1 rootfstype=squashfs irqaffinity=0 console=ttyS0,115200 root=/dev/mtdblock1 rootfstype=squashfs irqaffinity=0
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[    0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.000000] allocated 524008 bytes of page_cgroup
[    0.000000] please try 'cgroup_disable=memory' option if you don't want memory cgroups
[    0.000000] Memory: 252672k/260780k available (3780k kernel code, 8108k reserved, 938k data, 212k init, 0k highmem)
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS0] enabled
[    0.000000] Allocating memory for DSP module core and initialization code
[    0.000000] Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0
[    0.004000] Calibrating delay loop... 397.31 BogoMIPS (lpj=198656)
[    0.016000] pid_max: default: 32768 minimum: 301
[    0.017000] Mount-cache hash table entries: 512
[    0.018000] --Kernel Config--
[    0.019000]   SMP=1
[    0.020000]   PREEMPT=1
[    0.021000]   DEBUG_SPINLOCK=0
[    0.022000]   DEBUG_MUTEXES=0
[    0.023000] Initializing cgroup subsys debug
[    0.024000] Initializing cgroup subsys memory
[    0.025000] Initializing cgroup subsys blkio
[    0.026000] Broadcom Logger v0.1 Jul 26 2016 20:37:35
[    0.035000] CPU revision is: 0002a080 (Broadcom BMIPS4350)
[    0.035000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[    0.035000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.047000] Brought up 2 CPUs
[    0.055000] NET: Registered protocol family 16
[    0.058000] Enabling watchdog
[    0.170000] Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (00008b62-00008b6f=-13<300)
[    0.172000] registering PCI controller with io_map_base unset
[    0.399000] registering PCI controller with io_map_base unset
[    0.400000] gpiochip_add: registered GPIOs 0 to 51 on device: bcm963xx-gpio
[    0.416000] bio: create slab <bio-0> at 0
[    0.419000] SCSI subsystem initialized
[    0.420000] usbcore: registered new interface driver usbfs
[    0.421000] usbcore: registered new interface driver hub
[    0.422000] usbcore: registered new device driver usb
[    0.423000] PCI host bridge to bus 0000:00
[    0.424000] pci_bus 0000:00: root bus resource [mem 0xa0f00000-0xa0ffffff]
[    0.425000] pci_bus 0000:00: root bus resource [io  0xa2000000-0xa200ffff]
[    0.426000] pci 0000:00:00.0: [14e4:435f] type 00 class 0x028000
[    0.427000] pci 0000:00:00.0: reg 10: [mem 0x10004000-0x10005fff]
[    0.428000] pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310
[    0.429000] pci 0000:00:09.0: reg 10: [mem 0x10002600-0x100026ff]
[    0.430000] pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320
[    0.431000] pci 0000:00:0a.0: reg 10: [mem 0x10002500-0x100025ff]
[    0.433000] PCI host bridge to bus 0000:01
[    0.434000] pci_bus 0000:01: root bus resource [mem 0x11000000-0x11efffff]
[    0.435000] pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
[    0.436000] pci 0000:01:00.0: [14e4:6326] type 01 class 0x060400
[    0.437000] pci 0000:01:00.0: PME# supported from D0 D3hot
[    0.438000] pci 0000:02:00.0: [14e4:aa52] type 00 class 0x028000
[    0.439000] pci 0000:02:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit]
[    0.440000] pci 0000:02:00.0: reg 18: [mem 0x00000000-0x003fffff 64bit]
[    0.441000] pci 0000:02:00.0: supports D1 D2
[    0.445000] pci 0000:01:00.0: BAR 8: assigned [mem 0x11000000-0x115fffff]
[    0.446000] pci 0000:02:00.0: BAR 2: assigned [mem 0x11000000-0x113fffff 64bit]
[    0.447000] pci 0000:02:00.0: BAR 0: assigned [mem 0x11400000-0x11407fff 64bit]
[    0.448000] pci 0000:01:00.0: PCI bridge to [bus 02-02]
[    0.449000] pci 0000:01:00.0:   bridge window [mem 0x11000000-0x115fffff]
[    0.450000] PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
[    0.451000] bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated
[    0.452000] bcmleg_spi bcmleg_spi.0: master is unqueued, this is deprecated
[    0.454000] skbFreeTask created successfully
[    0.455000] gbpm_do_work scheduled
[    0.456000] BLOG v3.0 Initialized
[    0.457000] BLOG Rule v1.0 Initialized
[    0.458000] Broadcom IQoS v0.1 Jul 26 2016 20:45:24 initialized
[    0.459000] Broadcom GBPM v0.1 Jul 26 2016 20:45:24 initialized
[    0.460000] NET: Registered protocol family 8
[    0.461000] NET: Registered protocol family 20
[    0.462000] Switching to clocksource MIPS
[    0.468000] NET: Registered protocol family 2
[    0.472000] IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.480000] TCP established hash table entries: 8192 (order: 4, 65536 bytes)
[    0.487000] TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
[    0.494000] TCP: Hash tables configured (established 8192 bind 8192)
[    0.500000] TCP: reno registered
[    0.503000] UDP hash table entries: 128 (order: 0, 4096 bytes)
[    0.509000] UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
[    0.516000] NET: Registered protocol family 1
[    0.520000] PCI: CLS mismatch (64 != 16), using 16 bytes
[    0.526000] bcm_tstamp initialized, (hpt_freq=200000000 2us_div=200 2ns_mult=5 2ns_shift=0)
[    0.538000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.543000] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) © 2001-2006 Red Hat, Inc.
[    0.555000] fuse init (API version 7.18)
[    0.559000] msgmni has been set to 493
[    0.565000] io scheduler noop registered (default)
[    0.575000] Broadcom NAND controller (BrcmNand Controller)
[    0.581000] mtd->oobsize=0, mtd->eccOobSize=0
[    0.585000] NAND_CS_NAND_XOR=00000000
[    0.589000] Disabling XOR: Before: SEL=40000001, XOR=00000000
[    0.595000] Disabling XOR: After: SEL=40000000, XOR=00000000
[    0.600000] B4: NandSelect=40000000, nandConfig=15142200, chipSelect=0
[    0.607000] brcmnand_read_id: CS0: dev_id=01f1801d
[    0.612000] After: NandSelect=40000000, nandConfig=15142200
[    0.618000] Block size=00020000, erase shift=17
[    0.622000] NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11
[    0.631000] busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
[    0.638000] timing1 not adjusted: 6574845b
[    0.642000] timing2 not adjusted: 00001e96
[    0.646000] BrcmNAND mfg 1 f1 SPANSION_S30ML01GP_08 128MB on CS0
[    0.652000] 
[    0.652000] Found NAND on CS0: ACC=f7881010, cfg=15142200, flashId=01f1801d, tim1=6574845b, tim2=00001e96
[    0.664000] BrcmNAND version = 0x0400 128MB @00000000
[    0.669000] brcmnand_scan: B4 nand_select = 40000000
[    0.674000] brcmnand_scan: After nand_select = 40000000
[    0.679000] handle_acc_control: default CORR ERR threshold  6 bits
[    0.686000] ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16
[    0.692000] page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
[    0.700000] Brcm NAND controller version = 4.0 NAND flash size 128MB @18000000
[    0.707000] ECC layout=brcmnand_oob_bch8_16_2k
[    0.712000] brcmnand_scan:  mtd->oobsize=64
[    0.716000] brcmnand_scan: oobavail=11, eccsize=512, writesize=2048
[    0.722000] brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=8, eccbytes=13
[    0.734000] Gateway flash mapping
[    0.737000] brcmnand_reset_corr_threshold: default CORR ERR threshold  6 bits for CS0
[    0.747000] [NAND] : tBBT loaded
[    0.747000] 
[    0.751000] Technicolor nand flash translation layer initialized.
[    0.758000] flash mapping initialized, size=125 Mb
[    0.763000] parse_btab: num_banks (5)
[    0.767000] Creating 1 MTD partitions on "technicolor-nand-tl":
[    0.773000] 0x000002200000-0x000004b00000 : "rootfs"
[    0.780000] Creating 5 MTD partitions on "technicolor-nand-tl":
[    0.786000] 0x000000080000-0x000002000000 : "rootfs_data"
[    0.793000] 0x000002000000-0x000004b00000 : "bank_1"
[    0.800000] 0x000004b00000-0x000007600000 : "bank_2"
[    0.807000] 0x000000020000-0x000000040000 : "eripv2"
[    0.814000] 0x000000040000-0x000000080000 : "rawstorage"
[    0.821000] Creating 1 MTD partitions on "technicolor-nand-tl":
[    0.826000] 0x00000001fffd-0x000000020000 : "blversion"
[    0.837000] PPP generic driver version 2.4.2
[    0.842000] PPP BSD Compression module registered
[    0.846000] PPP Deflate Compression module registered
[    0.851000] NET: Registered protocol family 24
[    0.856000] brcmboard: brcm_board_init entry
[    0.860000] DYING GASP IRQ initialized 
[    0.864000] Serial: BCM63XX driver $Revision: 3.00 $
[    0.869000] Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported commands)
[    0.880000] ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX
[    0.886000] ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX
[    0.892000] Total # RxBds=1448
[    0.895000] bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized
[    0.895000] 
[    0.903000] bcmPktDma_init: Broadcom Packet DMA Library initialized
[    0.909000] IPSEC SPU: SUCCEEDED 
[    0.913000] GACT probability NOT on
[    0.916000] Mirror/redirect action on
[    0.920000] u32 classifier
[    0.923000]     input device check on
[    0.926000]     Actions configured
[    0.931000] TCP: cubic registered
[    0.934000] NET: Registered protocol family 10
[    0.940000] IPv6 over IPv4 tunneling driver
[    0.948000] NET: Registered protocol family 17
[    0.952000] Bridge firewalling registered
[    0.956000] Initializing MCPD Module
[    0.959000] Ebtables v2.0 registered
[    0.963000] ebt_time registered
[    0.966000] ebt_ftos registered
[    0.969000] 8021q: 802.1Q VLAN Support v1.8
[    0.989000] VFS: Mounted root (squashfs filesystem) readonly on device 31:1.
[    0.997000] Freeing unused kernel memory: 212k freed
[    5.447000] jffs2: notice: (353) jffs2_build_xattr_subsystem: complete building xattr subsystem, 7 of xdatum (1 unchecked, 6 orphan) and 111 of xref (0 dead, 19 orphan) found.
[    6.267000] jffs2: notice: (377) check_node_data: wrong data CRC in data node at 0x01d6358c: read 0xc3c4f886, calculated 0xcff099ef.
[    6.895000] tommath: module license 'unspecified' taints kernel.
[    6.901000] Disabling lock debugging due to kernel taint
[    7.245000] eRIPv2 secrets passed correctly to Linux
[    7.366000] Dsl Annex A board
[    7.368000] Set board (GANT-1)
[   10.216000] Initializing XFRM netlink socket
[   10.322000] NET: Registered protocol family 15
[   10.463000] IPv4 over IPv4 tunneling driver
[   10.554000] jffs2: notice: (354) check_node_data: wrong data CRC in data node at 0x00243f94: read 0x70638a68, calculated 0x4c938a69.
[   11.407000] L2TP core: blog_l2tp_rcv_check 
[   11.411000] L2TP core driver, V2.0
[   11.442000] L2TP netlink interface
[   11.562000] nat46: module (version 8ff2ae59ec9840a7b8b45f976c51cae80abe0226) loaded.
[   11.705000] gre: GRE over IPv4 demultiplexor driver
[   11.834000] ip_gre: GRE over IPv4 tunneling driver
[   11.870000] ip6_gre: GRE over IPv6 tunneling driver
[   11.910000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   12.318000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[   12.324000] PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
[   12.330000] ehci_hcd 0000:00:0a.0: setting latency timer to 64
[   12.336000] ehci_hcd 0000:00:0a.0: EHCI Host Controller
[   12.341000] ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
[   12.349000] ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
[   12.375000] ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
[   12.386000] ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
[   12.393000] hub 1-0:1.0: USB hub found
[   12.396000] hub 1-0:1.0: 2 ports detected
[   12.555000] nf_conntrack version 0.5.0 (3951 buckets, 15804 max)
[   13.223000] PPPoL2TP kernel driver, V2.0
[   14.362000] xt_time: kernel timezone is -0000
[   15.415000] nf_conntrack_rtsp v0.7 loading
[   15.446000] nf_nat_rtsp v0.7 loading
[   15.654000] ncr_master_key_set_internal
[   15.658000] ncr: driver 0.2-mr1 loaded.
[   15.690000] Netfilter messages via NETLINK v0.30.
[   16.379000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   16.861000] ctnetlink v0.93: registering with nfnetlink.
[   17.041000] bcmxtmrt: Broadcom BCM3169D0 ATM/PTM Network Device v0.7 Jul 26 2016 18:18:54
[   17.154000] NF_TPROXY: Transparent proxy support initialized, version 4.1.0
[   17.161000] NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd.
[   17.576000] OSCK LOADED!
[   17.935000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[   17.941000] PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
[   17.947000] ohci_hcd 0000:00:09.0: setting latency timer to 64
[   17.953000] ohci_hcd 0000:00:09.0: OHCI Host Controller
[   17.958000] ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
[   17.966000] ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
[   18.028000] hub 2-0:1.0: USB hub found
[   18.031000] hub 2-0:1.0: 2 ports detected
[   18.123000] Broadcom Ingress QoS Module  Char Driver v0.1 Jul 26 2016 18:12:05 Registered<243>
[   18.131000] 
[   18.131000] Broadcom Ingress QoS ver 0.1 initialized
[   18.167000] BPM: tot_mem_size=268435456B (256MB), buf_mem_size <20%> =53687080B (51MB), num of buffers=20712, buf size=2592
[   18.178000] Broadcom BPM Module Char Driver v0.1 Jul 26 2016 18:10:54 Registered<244>
[   18.856000] NBUFF v1.0 Initialized
[   18.888000] Initialized fcache state
[   18.892000] Broadcom Packet Flow Cache  Char Driver v2.2 Jul 26 2016 18:12:06 Registered<242>
[   18.902000] Created Proc FS /procfs/fcache
[   18.907000] Broadcom Packet Flow Cache registered with netdev chain
[   18.914000] Broadcom Packet Flow Cache learning via BLOG enabled.
[   18.922000] [FHW]  pktDbgLvl[0xc0886260]=0
[   18.927000] [FHW]  fhw_construct: 
[   18.932000] Initialized Fcache HW accelerator layer state
[   18.940000] flwStatsThread created
[   18.956000] Constructed Broadcom Packet Flow Cache v2.2 Jul 26 2016 18:12:06
[   19.250000] chipId 0x631690D0
[   19.252000] Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jul 26 2016 18:11:44 Registered <241>
[   19.262000] Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000
[   19.289000] FAP Soft Reset Done
[   19.291000] 4ke Reset Done
[   19.304000] Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000
[   19.330000] FAP Soft Reset Done
[   19.333000] 4ke Reset Done
[   19.348000] FAP Debug values at 0xaa823fa0 0xaa8a3fa0
[   19.354000] fapGso_LoopBkThread created successfully
[   19.358000] Allocated FAP0 SWQ_HOST2FAP_GSO_LOOPBACK_Q mem=ab3d8000 : 16384 bytes
[   19.366000] Allocated FAP0 SWQ_FAP2HOST_GSO_LOOPBACK_Q mem=ab3dc000 : 16384 bytes
[   19.374000] GSO LOOPBACK Cached HOST2FAP Q INFO:
[   19.374000]  Swq =b0825ef0 qStart=ab3d8000 qEnd=ab3dc000 msgSize=4 dqm=18 fapId=0
[   19.386000] GSO LOOPBACK Cached FAP2HOST Q INFO:
[   19.386000]  Swq =b0825ec0 qStart=ab3dc000 qEnd=ab3e0000 msgSize=2 dqm=19 fapId=0
[   19.399000] Allocated FAP0 SWQ_FAP2HOST_WFD_Q mem=af3ea000 : 7200 bytes
[   19.405000] Allocated FAP1 SWQ_FAP2HOST_WFD_Q mem=ab922000 : 7200 bytes
[   19.412000] Allocated FAP0 SWQ_FAP2HOST_WFD_Q mem=ab928000 : 7200 bytes
[   19.419000] Allocated FAP1 SWQ_FAP2HOST_WFD_Q mem=aec6c000 : 7200 bytes
[   19.426000] Allocated FAP0 TM SDRAM Queue Storage (aa835030) : 390144 bytes @ aa900000
[   19.434000] Allocated FAP1 TM SDRAM Queue Storage (aa8b5030) : 390144 bytes @ aa980000
[   19.448000] [NTC fapProto] fapReset  : Reset FAP Protocol layer
[   19.451000] [FAP0] DSPRAM : stack <0x80000000><1792>, global <0x80000700><4576>, free <1824>, total<8192>
[   19.451000] [FAP1] DSPRAM : stack <0x80000000><1792>, global <0x80000700><4576>, free <1824>, total<8192>
[   19.451000] [FAP0] PSM : addr<0x80002000>, used <24464>, free <112>, total <24576>
[   19.451000] [FAP1] PSM : addr<0x80002000>, used <24464>, free <112>, total <24576>
[   19.451000] [FAP0] DQM : availableMemory 14668 bytes, nextByteAddress 0xE00048B0
[   19.451000] [FAP1] DQM : availableMemory 14668 bytes, nextByteAddress 0xE00048B0
[   19.454000] [FAP0] Initializing FAP4KE GSO LOOPBACK on fapIdx=0 ...
[   19.455000] [FAP1] IC Timer started
[   19.455000] [FAP0] SWQ: HOST2FAP_GSO_LOOPBACK 
[   19.455000] [FAP1] FAP4KE WFD Init Done...
[   19.455000] [FAP0] >>>>------------------
[   19.455000] [FAP0] swq =80007ef0 msgSize =4 words , maxDepth=1024
[   19.455000] [FAP0] qStart =ab3d8000 qEnd=ab3dc000
[   19.455000] [FAP0] rdPtr =ab3d8000 wrPtr=ab3d8000 count=0
[   19.455000] [FAP0]  swq->interrupts 0 processed =0 dropped =0 
[   19.455000] [FAP0]  Associated DQM=18 dir HOST2FAP
[   19.455000] [FAP0] ------------------<<<<
[   19.455000] [FAP0] SWQ: FAP2HOST_GSO_LOOPBACK 
[   19.455000] [FAP0] >>>>------------------
[   19.455000] [FAP0] swq =80007ec0 msgSize =2 words , maxDepth=2048
[   19.455000] [FAP0] qStart =ab3dc000 qEnd=ab3e0000
[   19.455000] [FAP0] rdPtr =ab3dc000 wrPtr=ab3dc000 count=0
[   19.455000] [FAP0]  swq->interrupts 0 processed =0 dropped =0 
[   19.456000] [FAP0]  Associated DQM=19 dir FAP2HOST
[   19.456000] [FAP0] ------------------<<<<
[   19.456000] [FAP0] FAP4KE GSO LOOPBACK Init Done...
[   19.456000] [FAP0] IC Timer started
[   19.456000] [FAP0] FAP4KE WFD Init Done...
[   19.457000] [FAP1] FAP BPM Initialized.
[   19.459000] [FAP0] FAP BPM Initialized.
[   19.622000] Broadcom Packet Flow Cache HW acceleration enabled.
[   19.629000] fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes
[   19.636000] fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes
[   19.643000] bcmPktDma_bind: FAP Driver binding successfull
[   19.649000] [FAP1] FAP TM: ON
[   19.652000] [FAP0] FAP TM: ON
[   19.887000] Broadcom BCM63169D0 Ethernet Network Device v0.1 Jul 26 2016 18:18:27
[   19.894000] Broadcom GMAC Char Driver v0.1 Jul 26 2016 18:18:50 Registered<249>
[   19.902000] Broadcom GMAC Driver v0.1 Jul 26 2016 18:18:50 Initialized
[   19.909000] fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000
[   19.917000] ETH Init: Ch:0 - 200 tx BDs at 0xb0a20650
[   19.922000] fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000
[   19.931000] ETH Init: Ch:1 - 200 tx BDs at 0xb0820650
[   19.936000] fapDrv_psmAlloc: wastage 8 bytes
[   19.940000] fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184
[   19.948000] ETH Init: Ch:0 - 600 rx BDs at 0xb0821910
[   19.954000] [FAP0] enetRxChannel 0
[   19.960000] fapDrv_psmAlloc: wastage 8 bytes
[   19.964000] fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184
[   19.973000] ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910
[   19.978000] [FAP1] enetRxChannel 1
[   19.996000] dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered 
...
..
.

Full log: https://pastebin.com/rBdGc1Zt

There are two issues here:

  1. It's Broadcom - I usually dismiss the device as soon as I see that it's Broadcom because that means DSL, VoIP and WLAN support are very unlikely.
  2. NAND flash - last time I dealt with BCM63xx device, NAND wasn't supported, meaning OpenWrt could never read or boot from NAND. I'm not sure what's the state today, Wiki still says "NAND flash chips are supported since Linux kernel 4.5, but still not integrated into OpenWrt."

tl;dr: It's very likely not worth any effort.

1 Like

For info:

https://openwrt.org/meta/infobox/broadcom_dsl
https://openwrt.org/meta/infobox/broadcom_wifi