Hi, trying to hack the above box - so far have discoved:
Serial console on J806 (has pins on it - no soldering - Hooray), counting pins with power connector, etc on the *far* side of the board:
rx=4,tx(ie from board)=5, gnd=6.
Happy to post any other info that people might find useful.
Can anyone point to any useful about CFE. Command set seems v. reduced compared to reference docs on Broadcom site - or am I missing something
I'd like to build a kernel with root on a USB siick/ disk. cat proc/filesytems says I have ext3 and fatfs/
Thanks in advance for any help offered.
CFE> help
Available commands:
sm Set memory or registers.
dm Dump memory or registers.
w Write the whole image start from beginning of the flash
e Erase [n]vram or [a]ll flash except bootrom
r Run program from flash image or from host depend on [f/h] fg
p Print boot line and board parameter info
c Change booline parameters
f Write image to the flash
i Erase persistent storage data
b Change board parameters
reset Reset the board
flashimage Flashes a compressed image after the bootloader.
help Obtain help for CFE commands
For more information about a command, enter 'help command-name'
*** command status = 0
# cat /proc/cpuinfo
system type : VB784WG
processor : 0
cpu model : BCM6368 V3.1
BogoMIPS : 398.95
wait instruction : no
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : no
hardware watchpoint : no
ASEs implemented :
VCED exceptions : not available
VCEI exceptions : not available
unaligned exceptions : 13046
µÿþ
CFE version 1.0.37-102.6 for BCM96368 (32bit,SP,BE)
Build Date: Thu Feb 26 11:48:21 EST 2009 (root@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.
Parallel flash device: name AM29LV320MT, id 0x2201, size 32768KB
CPU type 0x2A031: 400MHz, Bus: 160MHz, Ref: 64MHz
CPU running TP0
Total memory: 67108864 bytes (64MB)
Boot Address 0xb8000000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Boot image (0=latest, 1=previous) : 0
Board Id (0-6) : VB784WG
Number of MAC Addresses (1-32) : 16
Base MAC Address : 00:24:7b:e0:53:c0
PSI Size (1-64) KBytes : 64
Main Thread Number [0|1] : 0
Board Serial Number : CVAA9201800006
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 110
Booting from latest image (0xb8020000) ...
Code Address: 0x80010000, Entry Address: 0x80251000
Decompression OK!
Entry at 0x80251000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x80251000
Linux version 2.6.21.5 (bcm@localhost.localdomain) (gcc version 4.2.3) #1 Wed Dec 30 20:02:38 PST 2009
Parallel flash device: name AM29LV320MT, id 0x2201, size 32768KB
VB784WG prom init
CPU revision is: 0002a031
Determined physical RAM map:
memory: 03f00000 @ 00000000 (usable)
On node 0 totalpages: 16128
DMA zone: 32 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 4064 pages, LIFO batch:0
Normal zone: 94 pages used for memmap
Normal zone: 11938 pages, LIFO batch:1
Built 1 zonelists. Total pages: 16002
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 64kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (21 instructions).
Synthesized TLB load handler fastpath (33 instructions).
Synthesized TLB store handler fastpath (33 instructions).
Synthesized TLB modify handler fastpath (32 instructions).
PID hash table entries: 256 (order: 8, 1024 bytes)
Using 200.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61320k/64512k available (1965k kernel code, 3176k reserved, 338k data, 92k init, 0k highmem)
Calibrating delay loop... 398.95 BogoMIPS (lpj=997376)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Total Flash size: 32768K with 256 sectors
File system address: 0xb8020100
registering PCI controller with io_map_base unset
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
BLOG v1.0 Initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered (default)
PPP generic driver version 2.4.2
NET: Registered protocol family 24
bcm963xx_mtd driver v1.0
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: irq 15, io mem 0x10001500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver
hub 1-0:1.0: over-current change on port 2
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 13, io mem 0x10001600
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
brcmboard: brcm_board_init entry
SES: Button Interrupt 0x1 is enabled
SES: LED GPIO 0x801e is enabled
Serial: BCM63XX driver $Revision: 1.1.1.1 $
ttyS0 at MMIO 0xb0000100 (irq = 10) is a BCM63XX
ttyS1 at MMIO 0xb0000120 (irq = 11) is a BCM63XX
bcmxtmrt: Broadcom BCM6368B1 ATM/PTM Network Device v0.1 Dec 30 2009 20:00:52
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 92k freed
init started: BusyBox v1.00 (2009.12.31-04:05+0000) multi-call binary
BusyBox v1.00 (2009.12.31-04:05+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
Loading drivers and kernel modules...
pktflow: module license 'Proprietary' taints kernel.
Broadcom Packet Flow Cache learning via BLOG enabled.
Created Proc FS /procfs/fcache
Constructed Broadcom Packet Flow Cache v0.1 Oct 9 2008 17:59:19
Broadcom Packet CMF (Experimental) Char Driver v0.1 Oct 9 2008 17:59:18 Registered<232>
Broadcom Packet CMF (Experimental) [6368-B1] v0.1 Oct 9 2008 17:59:18 Loaded
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
Broadcom BCMPROCFS v1.0 initialized
Broadcom BCM6368B1 Ethernet Network Device v0.1 Dec 30 2009 20:00:05
dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered
Broadcom Packet CMF (Experimental) SWC RESET.
Broadcom Packet CMF (Experimental) SWC INITIALIZED.
Broadcom Packet CMF (Experimental) Forwarder Net Device 0 v0.1 Oct 9 2008 17:59:18 Registered
Broadcom Packet CMF (Experimental) Forwarder Net Device 1 v0.1 Oct 9 2008 17:59:18 Registered
Broadcom Packet CMF (Experimental) ENABLED.
eth3: MAC Address: 00:24:7B:E0:53:C0
eth2: MAC Address: 00:24:7B:E0:53:C0
eth1: MAC Address: 00:24:7B:E0:53:C0
eth0: MAC Address: 00:24:7B:E0:53:C0
exsw: MAC Address: 00:24:7B:E0:53:C0
---initialize QOS mappings for switch bcmsw with 5 ports---
exsw Link UP 1000 mbps full duplex
PCI: Setting latency timer of device 0000:00:01.0 to 64
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
wl0: Broadcom BCM432c 802.11 Wireless Controller 4.174.64.19.cpe4.402.1
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
p8021ag: p8021ag_init entry
---disabling packetcmf---
Broadcom Packet CMF (Experimental) DISABLED.
success: SIOCGDIFFSERVQOS cos 255 diffserv 0x0 eth0
success: SIOCG8011PQOS cos 255 prio 0 eth0
===== Release Version QAQ01-31.00L.34 (build timestamp 091230_2003) =====
wl_cnt= 1
device eth0 is not a slave of br0
device eth1 is not a slave of br0
device eth2 is not a slave of br0
device eth3 is not a slave of br0
SIOCGIFFLAGS: No such device
interface eth4 does not exist!
interface eth4 does not exist!
SIOCSIFADDR: No such device
SIOCGIFFLAGS: No such device
interface usb0 does not exist!
interface usb0 does not exist!
SIOCSIFADDR: No such device
WLmngr Daemon is running
device wl0 is not a slave of br0
ssk:error:12.974:rutCfg_wanPppConnectionSetup:539:Failed to set up default system DNS ppp0.
getsockopt failed strangely: Protocol not available
getsockopt failed strangely: Protocol not available
getsockopt failed strangely: Protocol not available
getsockopt failed strangely: Protocol not available
getsockopt failed strangely: Protocol not available
wlctl -i wl0 phytype > /var/wl0
wlctl -i wl0 revinfo > /var/wl0
wlctl -i wl0 bands > /var/wl0bands
wlctl ver > /var/wlver
wlctl -i wl0 cap > /var/wl0cap
InValid Device Pin in CFE
WPS Device PIN = 12345670
wlctl -i wl0 phy_watchdog 0
wlctl -i wl0 wds none
wlctl -i wl0 down
wlctl -i wl0 mbss 0
wlctl -i wl0 bss -C 0 down
wlctl -i wl0 bss -C 1 down
wlctl -i wl0 bss -C 2 down
wlctl -i wl0 bss -C 3 down
wlctl -i wl0 ssid -C 0 Matts2
Setting SSID "Matts2"
wlctl -i wl0 ssid -C 1 myqwest0007
Setting SSID "myqwest0007"
wlctl -i wl0 ssid -C 2 myqwest0008
Setting SSID "myqwest0008"
wlctl -i wl0 ssid -C 3 wl0_Guest3
Setting SSID "wl0_Guest3"
wlctl -i wl0 cur_etheraddr 00:1A:2B:47:08:A4 2>/dev/null
wlctl -i wl0.1 cur_etheraddr 52:1a:2b:47:08:a5 2>/dev/null
wlctl -i wl0.2 cur_etheraddr 52:1a:2b:47:08:a6 2>/dev/null
wlctl -i wl0.3 cur_etheraddr 52:1a:2b:47:08:a7 2>/dev/null
wlctl -i wl0 ap 1
wlctl -i wl0 closed 0
wlctl -i wl0 country US
Setting country code using abbreviation: "US"
wlctl -i wl0 band b
wlctl -i wl0 regulatory 0
wlctl -i wl0 radar 0 2>/dev/null
wlctl -i wl0 spect 0 2>/dev/null
wlctl -i wl0 nmode -1
wlctl -i wl0 mimo_bw_cap 0
wlctl -i wl0 wpa_cap -C 0 > /var/wpa_cap0
wlctl -i wl0 wpa_cap -C 0 0 2>/dev/null
wlctl -i wl0 wpa_cap -C 1 > /var/wpa_cap0
wlctl -i wl0 wpa_cap -C 1 0 2>/dev/null
wlctl -i wl0 wpa_cap -C 2 > /var/wpa_cap0
wlctl -i wl0 wpa_cap -C 2 0 2>/dev/null
wlctl -i wl0 wpa_cap -C 3 > /var/wpa_cap0
wlctl -i wl0 wpa_cap -C 3 0 2>/dev/null
wlctl -i wl0 maxassoc 16
wlctl -i wl0 bss_maxassoc 16
wlctl -i wl0 gmode Auto
wlctl -i wl0 gmode_protection_override -1
wlctl -i wl0 gmode_protection_control 2
wlctl -i wl0 nmode_protection_override -1
wlctl -i wl0 protection_control 2
wlctl -i wl0 nphy_percal 3
wlctl -i wl0 nreqd 0
wlctl -i wl0 wme 0 2>/dev/null
wlctl -i wl0 afterburner_override 0 2>/dev/null
wlctl -i wl0 ampdu 1
wlctl -i wl0 amsdu 0
wlctl -i wl0 afterburner_override 0
wlctl -i wl0 wme 1 2>/dev/null
wlctl -i wl0 wme_noack 0 2>/dev/null
wlctl -i wl0 wme_apsd 1 2>/dev/null
wlctl -i wl0 wme_bss_disable 0
wlctl -i wl0 rate 0
wlctl -i wl0 bg_rate 0
wlctl -i wl0 leddc 0 2>/dev/null
wlctl -i wl0 mrate -1
wlctl -i wl0 bg_mrate -1
wlctl -i wl0 rateset default
wlctl -i wl0 rtsthresh 2347
wlctl -i wl0 fragthresh 2346
wlctl -i wl0 dtim 1
wlctl -i wl0 bi 100
wlctl -i wl0 frameburst 0
wlctl -i wl0 ap_isolate 0
wlctl -i wl0 wds none
wlctl -i wl0 pwr_percent 100
wlctl -i wl0 mac none
wlctl -i wl0 macmode 0
wlctl -i wl0 lazywds 0
wlctl -i wl0 wds
wlctl -i wl0 up
wlctl -i wl0 autochannel 1
wlctl -i wl0 autochannel 2
chanspec 0x2b06 selected
wlctl -i wl0 csscantimer 0
wlctl -i wl0 chanspec > /var/curchaspec0
*********************************************
Wi-Fi Simple Config Application - Intel Corp.
Version: Build 1.0.5, November 19 2006
*********************************************
Created @ Oct 9 2008 18:59:04
Initializing stack... OK
Now starting stack
get mac = 00 1A 2B 47 08 A4
button monitor start...!
wscLedSet@74 led word=20001
device wl0 is not a slave of br0
device wl0.1 is not a slave of br0
device wl0.2 is not a slave of br0
device wl0.3 is not a slave of br0
wlctl -i wl0 rmwep -C 0 0
wlctl -i wl0 rmwep -C 0 1
wlctl -i wl0 rmwep -C 0 2
wlctl -i wl0 rmwep -C 0 3
wlctl -i wl0 rmwep -C 1 0
wlctl -i wl0 rmwep -C 1 1
wlctl -i wl0 rmwep -C 1 2
wlctl -i wl0 rmwep -C 1 3
wlctl -i wl0 rmwep -C 2 0
wlctl -i wl0 rmwep -C 2 1
wlctl -i wl0 rmwep -C 2 2
wlctl -i wl0 rmwep -C 2 3
wlctl -i wl0 rmwep -C 3 0
wlctl -i wl0 rmwep -C 3 1
wlctl -i wl0 rmwep -C 3 2
wlctl -i wl0 rmwep -C 3 3
wlctl -i wl0 wsec -C 0 4
wlctl -i wl0 wsec_restrict -C 0 1
wlctl -i wl0 wpa_auth -C 0 132
wlctl -i wl0 eap 1
wlctl -i wl0 bss -C 0 up
wlmngr_startWsc: client-pbc mode
wlctl radio on
wlctl -i wl0 phy_watchdog 1
==>F=wlmngr.c,L=565 wlmngr setup down.
wlctl -i wl0 phytype > /var/wl0
wlctl -i wl0 revinfo > /var/wl0
wlctl -i wl0 bands > /var/wl0bands
wlctl ver > /var/wlver
wlctl -i wl0 cap > /var/wl0cap
wlctl -i wl0 phy_watchdog 0
wlctl -i wl0 wds none
wlctl -i wl0 down
wlctl -i wl0 mbss 0
wlctl -i wl0 bss -C 0 down
wlctl -i wl0 bss -C 1 down
wlctl -i wl0 bss -C 2 down
wlctl -i wl0 bss -C 3 down
wlctl -i wl0 ssid -C 0 Matts2
Setting SSID "Matts2"
wlctl -i wl0 ssid -C 1 myqwest0007
Setting SSID "myqwest0007"
wlctl -i wl0 ssid -C 2 myqwest0008
Setting SSID "myqwest0008"
wlctl -i wl0 ssid -C 3 wl0_Guest3
Setting SSID "wl0_Guest3"
wlctl -i wl0 cur_etheraddr 00:1A:2B:47:08:A4 2>/dev/null
wlctl -i wl0.1 cur_etheraddr 52:1a:2b:47:08:a5 2>/dev/null
wlctl -i wl0.2 cur_etheraddr 52:1a:2b:47:08:a6 2>/dev/null
wlctl -i wl0.3 cur_etheraddr 52:1a:2b:47:08:a7 2>/dev/null
wlctl -i wl0 ap 1
wlctl -i wl0 closed 0
wlctl -i wl0 country US
Setting country code using abbreviation: "US"
wlctl -i wl0 band b
wlctl -i wl0 regulatory 0
wlctl -i wl0 radar 0 2>/dev/null
wlctl -i wl0 spect 0 2>/dev/null
wlctl -i wl0 nmode -1
wlctl -i wl0 mimo_bw_cap 0
wlctl -i wl0 wpa_cap -C 0 > /var/wpa_cap0
wlctl -i wl0 wpa_cap -C 0 0 2>/dev/null
wlctl -i wl0 wpa_cap -C 1 > /var/wpa_cap0
wlctl -i wl0 wpa_cap -C 1 0 2>/dev/null
wlctl -i wl0 wpa_cap -C 2 > /var/wpa_cap0
wlctl -i wl0 wpa_cap -C 2 0 2>/dev/null
wlctl -i wl0 wpa_cap -C 3 > /var/wpa_cap0
wlctl -i wl0 wpa_cap -C 3 0 2>/dev/null
wlctl -i wl0 maxassoc 16
wlctl -i wl0 bss_maxassoc 16
wlctl -i wl0 gmode Auto
wlctl -i wl0 gmode_protection_override -1
wlctl -i wl0 gmode_protection_control 2
wlctl -i wl0 nmode_protection_override -1
wlctl -i wl0 protection_control 2
wlctl -i wl0 nphy_percal 3
wlctl -i wl0 nreqd 0
wlctl -i wl0 wme 0 2>/dev/null
wlctl -i wl0 afterburner_override 0 2>/dev/null
wlctl -i wl0 ampdu 1
wlctl -i wl0 amsdu 0
wlctl -i wl0 afterburner_override 0
wlctl -i wl0 wme 1 2>/dev/null
wlctl -i wl0 wme_noack 0 2>/dev/null
wlctl -i wl0 wme_apsd 1 2>/dev/null
wlctl -i wl0 wme_bss_disable 0
wlctl -i wl0 rate 0
wlctl -i wl0 bg_rate 0
wlctl -i wl0 leddc 0 2>/dev/null
wlctl -i wl0 mrate -1
wlctl -i wl0 bg_mrate -1
wlctl -i wl0 rateset default
wlctl -i wl0 rtsthresh 2347
wlctl -i wl0 fragthresh 2346
wlctl -i wl0 dtim 1
wlctl -i wl0 bi 100
wlctl -i wl0 frameburst 0
wlctl -i wl0 ap_isolate 0
wlctl -i wl0 wds none
wlctl -i wl0 pwr_percent 100
wlctl -i wl0 mac none
wlctl -i wl0 macmode 0
wlctl -i wl0 lazywds 0
wlctl -i wl0 wds
wlctl -i wl0 up
wlctl -i wl0 autochannel 1
wlctl -i wl0 autochannel 2
chanspec 0x2b01 selected
wlctl -i wl0 csscantimer 0
wlctl -i wl0 chanspec > /var/curchaspec0
*********************************************
Wi-Fi Simple Config Application - Intel Corp.
Version: Build 1.0.5, November 19 2006
*********************************************
Created @ Oct 9 2008 18:59:04
Initializing stack... OK
Now starting stack
get mac = 00 1A 2B 47 08 A4
button monitor start...!
wscLedSet@74 led word=20001
device wl0 is not a slave of br0
device wl0.1 is not a slave of br0
device wl0.2 is not a slave of br0
device wl0.3 is not a slave of br0
wsc_del_ie: no valid ie was saved, len = -1
wsc_del_ie: no valid ie was saved, len = -1
******* MODE: AP with built-in Registrar and UPnP Proxy *******
WSC: Build-in Registrar, wait for start command....