Hi,
Got this from friend, was hoping to unlock it to use with other ISP but couldnt find any unlock procedure / custom image.
So wanted to install OpenWRT but couldnt find any image. The router uses the Broadcom 6328 / 63281 (SoC)
Here are some inside pictures
The serial port is working, i used DKU-5 cable (nokia)
here is the bootlog
HELO
CPUI
L1CI
DRAM
----
PHYS
ZQDN
PHYE
DINT
LSYN
USYN
MSYN
LMBE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
CFE version 5.14.6.1 for BCM96328 (32bit,SP,BE)
Build Date: Tue Mar 8 14:24:11 CST 2011 (zoucb@SZ01007.DONGGUAN.CN)
Copyright (C) 2005-2010 SAGEM Corporation.
HS Serial flash device: name MX25L64, id 0xc217 size 8192KB
Total Flash size: 8192K with 128 sectors
Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-4) : F@ST2304
Number of MAC Addresses (1-32) : 11
Base MAC Address : 7c:03:4c:7b:45:9d
PSI Size (1-64) KBytes : 40
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Main Thread Number [0|1] : 0
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 110
Booting from only image (0xb8010000) ...
Code Address: 0x80010000, Entry Address: 0x80014230
Decompression OK!
Entry at 0x80014230
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x80014230
Linux version 2.6.30 (cookiechen@SZ01007.DONGGUAN.CN) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 Tue Aug 2 16:07:49 CST 2011
HS Serial flash device: name MX25L64, id 0xc217 size 8192KB
F@ST2304 prom init
CPU revision is: 0002a075 (Broadcom4350)
Determined physical RAM map:
memory: 03f00000 @ 00000000 (usable)
Zone PFN ranges:
DMA 0x00000000 -> 0x00001000
Normal 0x00001000 -> 0x00003f00
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00003f00
On node 0 totalpages: 16128
free_area_init_node: node 0, pgdat 80270750, node_mem_map 81000000
DMA zone: 32 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 4064 pages, LIFO batch:0
Normal zone: 94 pages used for memmap
Normal zone: 11938 pages, LIFO batch:1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16002
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
wait instruction: enabled
Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
RCU-based detection of stalled CPUs is enabled.
NR_IRQS:128
PID hash table entries: 256 (order: 8, 1024 bytes)
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61096k/64512k available (2025k kernel code, 3396k reserved, 412k data, 112k init, 0k highmem)
Calibrating delay loop... 319.48 BogoMIPS (lpj=159744)
Mount-cache hash table entries: 512
net_namespace: 812 bytes
NET: Registered protocol family 16
Total Flash size: 8192K with 2048 sectors
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:01:00.0: PME# disabled
pci 0000:02:00.0: reg 10 64bit mmio: [0x000000-0x003fff]
pci 0000:02:00.0: supports D1 D2
pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
pci 0000:01:00.0: IO window: disabled
pci 0000:01:00.0: MEM window: 0x10f00000-0x10ffffff
pci 0000:01:00.0: PREFETCH window: disabled
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:01:00.0 to 64
BLOG v2.1 Initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
squashfs: version 4.0 with LZMA457 ported by BRCM
msgmni has been set to 119
io scheduler noop registered (default)
pcieport-driver 0000:01:00.0: device [14e4:6328] has invalid IRQ; check vendor BIOS
PCI: Setting latency timer of device 0000:01:00.0 to 64
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
bcm963xx_mtd driver v1.0
File system address: 0xb8010100
brcmboard: brcm_board_init entry
kerSysScreenPciDevices: 0x14e4:0x6328:(slot 0) detected
kerSysScreenPciDevices: 0x14e4:0x4313:(slot 0) detected
SES: Button Interrupt 0x1 is enabled
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xb0000100 (irq = 36) is a BCM63XX
ttyS1 at MMIO 0xb0000120 (irq = 36) is a BCM63XX
bcmxtmrt: Broadcom BCM6328B0 ATM/PTM Network Device v0.3 Aug 2 2011 16:05:06
Broadcom Logger v0.1 Aug 2 2011 16:03:19
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
Initializing MCPD Module
Ebtables v2.0 registered
ebt_time registered
ebt_ftos registered
ebt_wmm_mark registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:0.
Freeing unused kernel memory: 112k freed
init started: BusyBox v1.00 (2011.08.02-08:10+0000) multi-call binary
mount: Mounting none on /proc/bus/usb failed: No su
BusyBox v1.00 (2011.08.02-08:10+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
Loading drivers and kernel modules...
pktflow: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Broadcom Packet Flow Cache Char Driver v2.1 Mar 18 2010 21:39:51 Registered<242>
NBUFF v1.0 Initialized
Broadcom Packet Flow Cache learning via BLOG enabled.
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Constructed Broadcom Packet Flow Cache v2.1 Mar 18 2010 21:39:50
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
Broadcom BCM6328B0 Ethernet Network Device v0.1 Aug 2 2011 16:03:28
dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered
eth0: MAC Address: 7C:03:4C:7B:45:9D
eth1: MAC Address: 7C:03:4C:7B:45:9D
eth2: MAC Address: 7C:03:4C:7B:45:9D
eth3: MAC Address: 7C:03:4C:7B:45:9D
PCI: Enabling device 0000:02:00.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:02:00.0 to 64
otp_read_pci: bad crc
wl:not strapped or invalid data
wl:srom not detected,using main memory mapped srom info(wombo board)
wl:loading /etc/wlan/bcm4313_map.bin
wl0: Broadcom BCM4313 802.11 Wireless Controller 5.60.120.11.cpe4.406.4
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
Broadcom 802.1Q VLAN Interface, v0.1
===== Release Version 5.23.1 (build timestamp 110802_1824) =====
Got primary config file from flash (len=34362), validating....
ip_tables: (C) 2000-2006 Netfilter Core Team
nf_conntrack version 0.5.0 (1008 buckets, 4032 max)
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
device eth2 entered promiscuous mode
device eth3 entered promiscuous mode
device wl0 entered promiscuous mode
br0: port 5(wl0) entering forwarding state
WLmngr Daemon is running
optarg=0 shmId=0
BcmAdsl_Initialize=0xC00B6100, g_pFnNotifyCallback=0xC00DC7D4
wlevt_init@107: opened loopback socket 4
wlevt is ready for new msg...
pSdramPHY=0xA3FFFFF8, 0x1A6CB 0x5EADBEEF
AdslCoreSharedMemInit: shareMemAvailable=491424
AdslCoreHwReset: AdslOemDataAddr = 0xA3F69564
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
Netfilter messages via NETLINK v0.30.
monitor task is initialized pid= 190
rupgrade:error:13.405:ruReadMessageFromSmd:22:got SYSTEM_BOOT msg
rupgrade:error:13.406:ruUpdateWaitHour:1074:update wait hour: 0
rupgrade:error:14.071:ruGetConfig:174:The remote server is http://fast2304.skyfirmware.com 31
rupgrade:error:14.072:ruGetConfig:198:The post server is http://fast2304.skyfirmware.com
device wl0 left promiscuous mode
br0: port 5(wl0) entering disabled state
device wl0 entered promiscuous mode
br0: port 5(wl0) entering forwarding state
wl0.1 (): not using net_device_ops yet
wl0.2 (): not using net_device_ops yet
wl0.3 (): not using net_device_ops yet
br0: port 5(wl0) entering disabled state
There is no Predefined DevicePin in CFE
WPS Device PIN = 21464065
Setting SSID: "SKYB459D"
Setting SSID: "wl0_Guest1"
Setting SSID: "wl0_Guest2"
Setting SSID: "wl0_Guest3"
wlmngr_wlIfcDown: reset wifi_up_time
wlmngr_wlIfcDown: reset wifi_up_time
wlmngr_wlIfcDown: reset wifi_up_time
wlmngr_wlIfcDown: reset wifi_up_time
wlctl: Unsupported
chanspec 0x2b06 selected
device wl0 left promiscuous mode
br0: port 5(wl0) entering disabled state
device wl0 entered promiscuous mode
br0: port 5(wl0) entering forwarding state
Reaped 762
UPnP daemon is ready to run
wlmngr_wlIfcUp: wifi_up_time=22
BCM96328 Broadband Router
Login: admin
Password: sky
the default webui userid and password works
user: admin
password: sky
now i get the prompt ">" which is not busybox
> help
?
help
logout
exit
quit
reboot
adsl
xdslctl
xtm
brctl
cat
loglevel
logdest
virtualserver
ddns
df
dumpcfg
dumpmdm
meminfo
psp
kill
dnsproxy
syslog
echo
ifconfig
ping
ps
pwd
sntp
sysinfo
tftp
wlctl
arp
defaultgateway
dhcpserver
dns
lan
lanhosts
passwd
ppp
restoredefault
route
save
swversion
cfgupdate
swupdate
exitOnIdle
wan
typing "sh" starts the busybox
BusyBox v1.00 (2011.08.02-08:10+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
# help
Built-in commands:
-------------------
. : break cd continue eval exec exit export help login newgrp
read readonly set shift times trap umask wait [ arping busybox
cat chmod cp date df dmesg echo expr false ftpget ifconfig init
insmod kill killall klogd linuxrc ln logger logread ls mkdir
mknod mount msh ping ps pwd reboot rm rmmod route sendarp sh
sleep sysinfo syslogd test tftp tftpd top true tty umount vconfig
# cat cpuinfo
system type : F@ST2304
processor : 0
cpu model : Broadcom4350 V7.5
BogoMIPS : 319.48
wait instruction : yes
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : no
hardware watchpoint : no
ASEs implemented :
shadow register sets : 1
core : 0
VCED exceptions : not available
VCEI exceptions : not available
unaligned exceptions : 27
# cat meminfo
MemTotal: 61228 kB
MemFree: 38080 kB
Buffers: 2516 kB
Cached: 8648 kB
SwapCached: 0 kB
Active: 4312 kB
Inactive: 9308 kB
Active(anon): 2456 kB
Inactive(anon): 0 kB
Active(file): 1856 kB
Inactive(file): 9308 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 2476 kB
Mapped: 2356 kB
Slab: 6224 kB
SReclaimable: 360 kB
SUnreclaim: 5864 kB
PageTables: 292 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 30612 kB
Committed_AS: 5904 kB
VmallocTotal: 1032148 kB
VmallocUsed: 2888 kB
VmallocChunk: 1024016 kB
#
# cat mtd
dev: size erasesize name
mtd0: 00380000 00380000 "Physically mapped flash"
can get easly into cfe through serial.
So, anything usefull for OpenWRT ? image ?
Regards
Tahir
tahir00ali@gmail.com