OpenWrt Forum Archive

Topic: Ont gs0110gg

The content of this topic has been archived on 21 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi everyone , i am under investigation in an ont model here .
I am trying to access the shell console over ttl , but i did not had yet any success , for some reason the inputs are not been recieved by the equipment to stop the auto boot procedure in the firmware .

Let me show some pictures of this ONT GPON model , and what did i found so far .

Brand : PT Inovação (Altice)
Model : GS0110GG

Equipment have :

1x gibaport ethernet
1x Gpon fiber input
1x Rf (for home tv channels)

Hardware info :

ram : Samsung K4B1G1646G-Bch9 (128M)
CPU : Broadcom 685151FBG
ROM : 29F2G08ABAEA (256M)

Pictures :

Front :
http://s23.postimg.org/3oyn5rndn/front.jpg

Back :
http://s28.postimg.org/whdruqi25/back.jpg

Down :
http://s18.postimg.org/h0hgna5jd/down.jpg

Board top :
http://s28.postimg.org/bys2h5iwd/board_top.jpg

Board Bottom :
http://s18.postimg.org/uuk20xj7t/boardback.jpg

Interface :

http://s23.postimg.org/wpklw7eaj/interface.jpg
Serial communication : 115200

Console log :

BL LILAC STARTER VER-2.1.10.0-BL (Apr 04 2013 - 11:30:55)
SOC ID:`B¦_23515
Init DDR3.... 128MB
Press any ¦ey to stop autoboot: 1
Press any key to stop autoboot: 0

Attempt to boot from NAND...
Try to load bootloader from boot bank 0
Bootloader Loaded to DRAM
Cache enabled


U-Boot 2010.06 (May 28 2013 - 11:36:58 - BL2.1.10.0)

Board: Lilac Evaluation (CHERRY)
U-Boot Local versi¦n: BL-2.1.10.0
Chip Versionz         00002s51
CPU Clock:            49w MHz
¦D¦ ¦l¦ck:            403 MHz
RNR Clock:`           403`MHz
Peripheral BUS Clock: 62 MHz
D¦AM:  128 MiB
NAND:  256 MiB
incorrect device type in reserve_space
Creating 1 MTD partitions on "nand0":
0x000000100000-0x000000200000 : "mtd=1"
UBI: attaching mtd1 to ub¦0
Volume 0 found at volume id 0
read 12 bytes from volume 0 to 813ffd90(buf address)
UBI: mtd1 is det¦ched from ubi0
Creating 1 MTD partitions on "nand0":
0x000000200000-0x000000480000 : "mtd=2"
UBI: attaching mtd1 to ubi0
Volume 1 found at volume id 1
read 262144 bytes from volume 1 to 817c12a0(buf address)
RAM Memory regions:
RESERVED:    A=0xA6C00000 : S=0x01400000 : (tm)
RE¦ERVED:    A=0xA6800000 : S=0x00400000 : (mc)
USABLE:      A=0xA0000000 : S=0x06800000 : (sys_1)
Net:    Start ¦nitiali¦a¦i¦n
NET: MAC  configurations: EMAC4, mode = RGMII
NET: MACs configurations: emacs_group_mode = QSGMII, e4mod¦= RGMII ,e0mode = NO¦E

CRCN Phy=1
CRCN Phy=1
CRCN Phy=1NET: RDD version: 9.4.0.4
NET: Data Path successfuly initialized
Net:    ETHMAC4
Hit any key to stop autoboot:  0
UBI: mtd1 is detached from ubi0
Creating 1 MTD partitions on "nand0":
0x000000100000-0x000000200000 : "mtd=1b
UBI: ¦ttaching mtd1 to ubi0
Volume 0 found at volume id 0
read 12 bytes from volume 0 to 8117fb28(buf address)
UBI: mtd1 is detached from ubi0
Creating 1 MTD partitions on "nand0":
0x000000700000-px000000b0p0p0 : "mtd=4"
UBI: attaching mtd1 ¦o ubi0
Volume 0 found at volume id 0
read 0 bytes from volume 0 to 8117fb48(buf address)
Read [2322371] bytes
## Booting kernel from Legacy Image at 8117fb48 ...
   Image Name:   Linux Kern¦l I¦age
   Created:      2013-05-16   9:36:56 UTC
`  Image Type:   MIPS Linux Kernel I¦a¦e (gzip compressed)
  `Data Size:    2322307 Byt¦s`=`2n2 M¦B
   Load Ad¦ress:`8p010p0p
   Entry Point:` 8001t1q0
   Verifying C¦ecksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Board: Lilac Evaluation (CHERRY)
CPU Clock:            497`MHz
DDR Clock:`           403 MHz
¦N¦ ¦l¦ck:            403 MHz
Perip¦era¦ BUS Clock: 62 MHz
Config serial console: consol¦=ttyS0,115200n8
plat_m¦m_setup
Linux version 2.6.34.8-BL2.1.10.1 (root@ptinovac-******.ptin.corppt.com) (gcc version 4.4.1 (Wind River Linux Sourcery G++ 4.4-291) ) #1 We¦ Jun 27 23:23z03 WEST 2012
CPU`revis¦o¦ is: 0001974c (MIPS`7tKc)
Lila¦ SOC setup
Det¦rmine¦ ¦h¦sical RAM map:
¦emory: 01t00000 @ 06c00000 (reserved)
memory: 00400000 @ 06800000 (reserved)
m¦mory:`0v800000 @ 0000000p (usabl¦)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00006800
  HighMem  empty
Movable zone start PFN for eacx node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00008000
B¦i¦t 1 zonelists in Zone order, mobility grouping on.  Total pages: 26416
Kernel command line: ubi.mtd=0 root=ubi0_0 rw rootfstype=ubifs ip=$(ipaddr):$(serverip):$(gatewayip):d(netmask):$(hostname):$8netdev):off console=$(consoledev),$(baudrate) console=ttyS0,115200n8
PID hash ¦a¦l¦ entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
¦node-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-w¦y, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Read¦ack ErrCtl register=00000000
Memory: 100r8tk/1p6t96k available (3810k kernel code, 6212k reserved, 944k ¦a¦a, 184k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:256
console [ttyS0] enabled
C¦librating delay loop... 248.21 BogoMIPS (lpj=1241088)
Mount-cache hash table entries: 512
Init trace_clock_cyc2ns: precalc_mult = 1028, precalc_shift = 8
NET: Registered protocol family 16
check_res_of_trace_clock: sched_clock() low resolution
check_res_of_trace_clock: trace_clock_read64_ns() has high resolution
initcall check_res_of_trace_clock+0x0/0x104 ret¦rned with disabled ¦nterrupts
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver ¦s¦
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order:`3, 32768 bytes)
TCP bin¦ hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configu¦e¦ (established 4096 bi¦d`4p96)
TCP reno registered
UDP hash table ¦ntries:`2u6`(order: 0, 4096 bytes)
U¦P-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.q backchannel transport module.
MAC configurations: EMAC4, mode = RGMII
MAC configurations: emacs_group_mode } ¦SGMII, emac_mode = RGMII

CRCN PHY 1BL lila¦ ethernet driver initialization:`group_mode QSGMII  emac_mode RGMII macId EMAC4

CRCN PHY 1
CRCN PHY 1NET: RDD version: 9.4.0.4
Data Path successfuly initialized
init_vdso successfull
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Installing knfsd (copyright (C) 1996 okir@monad.swb.dei.
JFFS2 version 2.2. (NAND) ¦¦ 2001-2006 Re¦ Hat, Inc.
msgmni has been set to`1y5
io scheduler noop registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ s¦aring di¦abled
serial8250: ttyS0 at MM¦O 0xb90a0400 (irq = 116)`is a 16550A
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Mi¦ron NAND 256MiB 3,3¦ 8-bi¦)
Boo¦ from NAND FLASH
Cr¦ating x MTD partitions on "NAND 256MiB 3,3V 8-bit":
0x000000f00000-0x000008780000 : "rootfs0"
0x000008780000-0x000010000000 : "rootfs1"
0x000000000000-0x000000100000 : "starter"
0x000000100000-0x000000200000 : "cfg"
0x000000200000-0x000000480000 : "uboot0"
0x000000480000-0x000000700000 : "uboot1"
0x000000700000-0x000000b00000 : "l¦n¦x0"
0x000000b00000-0x000000f00000 : "linu¦1"
m25p80 spi0.6: non-JEDEC variant of m25p128
m25p80 spi0.6: m25¦128 (16384 Kbytes)
UBI: attaching mtd0 to ubi0
UBI: physical eraseblo¦k size:   131072 bytes (128 KiB)
UBI: log¦cal era¦eblock size:    129024 bytes
UBI: smallest flash I/O`u¦i¦:    2048
UBI: sub-page`s¦z¦:            ` 512
UBI: VID header offset:  ` ` `   512 (aligned 512)
¦BI: data offset:                2048
UBI: max. sequence number:       1487
UBI: attached mtd0 to ubi0
UBI: MTD device name:            "rootfs0"
UBI: MTD device size:            120 MiB
UBI: number of ¦o¦d PEBs:      ` 960
¦B¦: number of bad PEBs: `       4
UBI: number of corrupted PEBs:   0
UBI: m¦xn allo¦e¦ ¦olumes:       1r8
UBI: wear-leveling threshold:    4p96
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: to¦a¦ numb¦r of reserved PEBs: 960
UBI: number of PEBs reserved for`bad PEB handling: 9
U¦Iz ¦ax/mean erase counter: 139/2
UBI: image sequence number:  782448082
UBI: background thread "ubi_bgt0d" started, PI¦ 198
PPP generic driver version 2.4.2
NET: Registered protocol family 24
ehci_hcd: USB 2.0 'E¦han¦ed' Host Controller (EHCI) Driver
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) D¦i¦e¦
Initializing USB Mass Storage driver...
usbcore: registered new inte¦f¦ce driver usb-storage
USB Mass Storage s¦pport`r¦gis¦ered.
netem: version 1.2
Netfilter messages via NETLINK v0.30.
nf_connt¦a¦k version 0.5.0 (q5v6`b¦ckets, 6264 max)
CONFIG¦NF_CT_ACCT is deprecated ¦nd will be removed soonn ¦lease use
nf_conntrack.a¦ct=1 kernel parameter, ¦c¦t=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
ctnetlink v0.93: registering with nfnetlink.
nf_conntrack_rtsp v0.6.21_bl_backported loading
nf_conntrack_rtsp: ports[0]=554
nf_conntrack_rtsp init: registering helper for pf: 2 port: 554
IPv4 over IPv4 tunneling driver
nf_nat_rtsp v0.6.21_bl_backported loading
nf_nat_rtsp cofiguration: stuna¦d¦=0x0 destaction=[(null)¦ help(802f467c) expected(802f8d30) &expect¦d(802f8d30)
ip_tables: (C) 2000-2006 Netfilter`C¦r¦ ¦eam
TCP cubic registered
NET: Registered ¦rotocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Bridge firewallin¦ ¦e¦istered
Ebtables ¦2.0 registered
L2TP core dr¦v¦r, V2.0
802.1Q VLAN Support ¦1.8 Ben Greear |greearb@c¦n¦elatech.com>
All ¦ugs added by David S.`Miller |davem@redhat.com>
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "0"
UB¦FS: file system size:   120766464 bytes (117936`KiB, 115 ¦iB, 936 LEBs)
UBIFS: ¦o¦rnal size:       9033728 byt¦s (8822 KiB, 8 MiB, 71 LEBs)
UBIFS: media format:`      w4/r0 (latest is wt/¦0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  0 bytes`(p Ki¦)
VFS: Mounted root (ubifs filesystem) on device 0:11.
Freeing unused kernel memory: 184k freed
syslogd starting
klogd starting
Starting internet superserver: inetd done.
Starting portmap daemon: portmap.
Starting Dropbear SSH server: dropbear.
[236] Jan 01 00:00:18 Running in background
logrotate: Starting subsystem
logrotate: rotation for *.err ...
logrotate: rotation for *.log ...
ubiattach: error!: cannot attach mtd0
           error 17 (File exists)
UBI: attaching mtd1 to ubi1
UBI: physical eraseblock size:   131072 bytes (q28 KiB)
UBI: logical`e¦asebl¦ck size:    129024 bytes
UBI: smallest flash I/¦ ¦nit:    2048
UBIz sub-pa¦e size:              512
UBI: VID header offset:          512 (aligned`512)
¦BI: data offset:                2048
UBI: max. sequence number:       2
device: 'ubi1': device_add
PM: Adding info for No Bus:ubi1
device: 'ubi1_0': device_add
PM: Adding info for ¦o Bus:ubi1_0
UBI: attached mtd1 to ubi1
UBI: M¦D device name:        `   "rootf¦1"
UBI: MTD device siz¦:`           120 MiB
UBI: n¦m¦e¦ of good PEBs:        96q
UBI: number of bad PE¦s:         3
UBI: number o¦ ¦orrupted PEBs:   0
UBI: max. allowed volumes:       128
UBI: we¦r-lev¦ling threshold:    4096
¦B¦: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: ava¦lable PEBs:    ` `   `  0
UBI: total number of reserved PEBs: 961
U¦I: number of PEBs reserved for bad PEB handling: 9
UBI: m¦x/mean erase counter: 1/0
UBI: image sequence number:  782448082
device: 'mtd10': device_add
PM: Adding info for No Bus:mtd10
UBI: background thread "ubi_bgt1d" started, ¦I¦ 246
device: 'mtd10ro': device_add
PM: Adding info for No Bus:mtd10ro
device: 'mtdblock10': device_add
PM: Adding info for No Bus:mtdblock10
Algorithmics/MIPS FPU Emulator v1.5
UBI device number 1, total 961 LEBs (123992064 bytes, 118.2 MiB), available 0 LEBs (0 bytes), LEUBI: ¦tta¦hing mtd2 to ubi2
B s¦z¦ 129024 byUBI: physical eraseblo¦k size:   131072 bytes (128 KiB)
¦BI: logical erase¦lock size:    129024 bytes

UBI: smallest flash I/O unit:    2048
UBI: sub-page`size:              512
UBI: VI¦ ¦eader offset:          512 (aligned 512)
UBI: data offset:                2048
UBI: max. sequence number:       0
UBI error: ubi_read_volume_table: the layo¦t volume was not found
ubiattach: error!: cannot attach mtd2
           error 22 (Inv¦lid argument)
UBI: at¦ach¦ng mtd3 to ubi2
UBI: p¦y¦ical eraseblock size:   13q072 bytes (128 Ki¦)
UBI: logical eraseblock size:    129024 bytes
UBI:`s¦allest flash I/O unit:    2048
UBI: sub-page size:              512
U¦I: VID header offset:          512 (aligned 512)
UBI: data offset:                2048
UBI: max. sequence number:       5
device: 'ubi2': device_add
PM: Adding info for No Bus:ubi2
device: 'ubi2_0': device_add
PM: Adding info for No ¦us:ubi2_p
UBI: attached mtd3 to ubi2
UBI: MTD device name:            "cfg"
UBI: M¦D`dev¦c¦ size:          ` 1 MiB
¦B¦: number of good PEBs:        8
UBI: number of bad PEBs:         0
UBI: numbe¦ ¦f`corrupted PEBs:   0
UBI:`m¦x. allowed volumes:       128
UBI:`wear-leveling threshold:    4096
U¦Iz ¦umber of internal volumes: 1
UBI: number of user volumes:     1
UBI: av¦ilable PEBs:     `       1
UBI: total number of reserved PEBs: 7
UBI: number of PEBs reserved for bad ¦EB handling: 2
U¦I: ¦a¦/mean erase counter: 2/1
UBI: image sequence number:  2122916346
device: 'mtd11': device_add
PM: Adding info for No Bus:mtd11
UBI: background thread "ubi_bgt2d" started, PID 254
device: 'mtd11ro': device_add
PM: Adding info for No ¦u¦:mtd11ro
device: 'mtdblock11': device_add
PM: Adding info`for No Bus:mtdblock11
UBI device number 2, total 8 LEBs (1032192 bytes, 1008.0 KiB), available 1 LEBs UBI: attaching mtd4 to ubi3
(129024 bytesl 1UBI: physical eraseblock size:   131072 bytes (128 KiB)
26.0 KiB), L¦B`sUBI: l¦gical eraseblock siz¦:    129024 bytes
i¦e 129024 bytesUBI: sm¦l¦est`f¦ash I/O unit:  ` 2048
(126.0 KiB)
UBIz ¦ub-pa¦e size:        `     51r
U¦I: VID header offset:  `       512 (aligned 512i
¦BI: data offset:                2048
UBI: max. sequence number:       0
device: 'ubi3': device_add
PM: Adding info for No Bus:ubi3
device: 'ubi3_0': device_add
PM: Adding info for No Bus:ubi3_0
device: 'ubi3_1': device_add
PM: Adding info f¦r No Bus:ubi3_1
UBI: attached mtd4 to ubi3
UBI: MT¦ ¦evice name:       `    "uboo¦0"
UBI: MTD dev¦c¦ size:            2 MiB
UBI: number of good PEBs:        20
UBI: number of bad PEBsz         0
UBI: number of corrupted PEBs:   0
UBI:`max. allowed volumes:`      128
UBI: wear-leveling threshold:    4096
U¦I: number of internal volumes: 1
UBI: number of`user volumes:     2
UBI: ava¦l¦ble PEBs:             7
UBI: total number of reserved PEBs: 13
UBI: number of PEBs reserved for`bad PEB handling: 2
UBI: max/mean erase counter:`1/0
UBI: image sequence number:  739185145
device: 'mtd12': device_add
PM: Adding info for No Bus:mtd12
UBI: background thread "ubi_bgt3d" started, PID 262
device: 'mtd12ro': device_add
PM: Adding in¦o for No Bus:mtd12ro
device: 'mtdblock12': device_ad¦
PM: Adding info for No Bu¦:mtdblock12
device: 'mtd13': device_add
PM: Adding info for N¦ Bu¦:mtd13
device: 'mtd13ro': device_add
PMz Adding info for No Bu¦:mtd13ro
device: 'mtdblock13': device_add
PM: ¦dding info for No Bus:mt¦block13
UBI device number 3, total 20 LEBs (2580480 bytes, 2.5 MiB), availabl¦ 7 ¦E¦s (9UBI: attaching mtd5 to u¦i4
03168 bytes, 88rU¦I: ¦hysical eraseblock size:   13q072 bytes (128 KiB)
.0 KiB), LEB sizUBI: logica¦ er¦seblock size:    q290r4`bytes
e 129024`byt¦s`(¦B¦: smallest flash ¦/O unit:    2048
126.0`K¦Bi
U¦I: sub-page size:    `         512
UBI: V¦D h¦ade¦ offset:          512 (aligned 512)
UBI: data offset:                2048
UBI: max. sequence number:       0
device: 'ubi4': device_add
PM: Adding info for No Bus:ubi4
device: 'ubi4_0': device_add
PM: Adding info for No Bus:ub¦4_0
device: 'ubi4_1': device_add
PM: Ad¦i¦g info for No Bus:ubi4_1
UBI: attached mtd5 to ubi4
UBI: MTD device name:            "uboot1"
UBI: MTD dev¦ce size:            2 MiB
¦BI: number of good P¦Bs:        20
UBI:`number of b¦d PEBs:         0
¦B¦: number of corrupted PE¦sz ` p
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
U¦I: number of internal volumes: 1
UBI: number of user volumes:     2
UBI: available PEBs:  `          7
UBI: total numb¦r`of reserved PEBs: 13
UB¦: number of PEBs reserved for bad PEB handling:`2
UB¦: max/mean erase counter: 1/0
UBI: image sequence number:  739185145
device: 'mtd14': device_add
PM: Adding info for No Bus:mtd14
UBI: background thread "ubi_bgt4d" started,`P¦D 273
device: 'mtd14ro': device_add
PM: Adding info for No Bus:mtd14ro
device: 'mtdblock14': device_add
¦M: Adding info for No Bus:mt¦block14
device: 'mtd15': device_add
PM: Adding info for No B¦s:mtd15
device: 'mtd15ro': device_add
PM: Adding info for No ¦u¦:¦td15ro
device: 'mtdblock15': device_add
PM: Adding info for N¦ ¦u¦:mtdblock15
UBI device number 4, total 20 LEBs (2580480 bytes, 2.5 MiB), availa¦l¦ 7 LEBs (9UBI: attachy¦g m¦d6 to ub¦5
03168 bytes, 882UBI:`p¦ysical eraseblock size:   131072 bytes (128 KiB)
.0 KiB), LEB sizUBI: log¦c¦l eraseblock size:    129024 bytes
e 12y024 bytes (UBI: smallest flash I/O unit:    2048
12v.p ¦i¦)
UBI: sub-page size:              51r
UB¦: VID header offset:          512 (a¦igned 512)
UBI: data offset:                2048
UBI: max. sequence number:       11
device: 'ubi5': device_add
PM: Adding info for No Bus:ubi5
device: 'ubi5_0': device_add
PM: Adding info for No Bus:ubi5¦0
UBI: attached mtd6 to ubi5
UBI: MTD device nam¦:           `"linux0"
UBI: MTD device size:            4 MiB
UBI: num¦e¦ of good PEBs:      ` 32
UBI: num¦e¦ of bad PEBs:      `  0
UBI: number of corrup¦e¦ PEBs:   0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
¦BI: number of user volumes:     1
UBI: available PEBs:             8
UBI: total number of reserved P¦Bs: 24
UBI: number of PEBs r¦served for bad PEB`handl¦ng: 2
UBI: max/mean erase counter: 1/0
UBI:`image sequence number:  957204674
device: 'mtd16': device_add
PM: A¦ding info for No Bus:mtd16
UBI: background thread "ubi_bgt5d" started, ¦I¦ 283
device: 'mtd16ro': device_add
PM: Adding info for No Bus:mtd16ro
device: 'mtdblock16': device_add
PM: Adding i¦fo for No Bus:mtdbl¦ck16
UBI device number 5, total 32 LEBs (4128768 bytes, 3.9 MiB), available 8 LEBs (1UBI: attaching mtd7 to ubi6
032192 bytes, 10UBI: ph¦s¦c¦l eraseblock sizez   q3q072 bytes (128 KiB)
08.0 KiB), LEB sUBI: log¦cal e¦aseblock size:    12y024 bytes
ize 12y0r4 byt¦s¦BI: smallest fl¦sh ¦/¦ unit:    2048
h126.0 K¦B)
UBI: sub-page siz¦:`             u12
UBI: VID`h¦a¦er offset:          512 (a¦igned 512)
UBI: dat¦ offset:                2048
UBI: max. sequence number:       0
device: 'ubi6': device_add
PM: Adding info for No Bus:ubi6
device: 'ubi6_0': device_add
PM: Adding info for No Bus:ubi6_0
UBI: attached mtd7 to ubi6
UBI: MTD d¦v¦ce name:      `     "linux1"
UBI: MTD devi¦e`size:`           t MiB
UBI: num¦e¦ of good PEBs:        32
UBI: number of bad PEBs:         p
UBI: number of corrupted PE¦s:   0
UBI: max. allowed volum¦s:       128
UBI: wear-l¦veling threshold:    4096
UBI: number of internal volumes: 1
UB¦:`n¦mber of user volumes:     1
UBI: available ¦E¦s:             x
UBI: tot¦l number of reserved PEBs:`24
UBI: number of PEBs reserved for bad PEB handling: 2
UBI: max/mean erase counter: 1/0
UBI: image sequence number:  957204674
device: 'mtd17': device_add
PM: Adding info for No Bus:mtd17
UBI: background thread "ubi_bgt6d" started, PID 290
device: 'mtd17ro': device_add
PM: Adding info for No Bus:mtd17ro
device: 'mtdblock17': device_add
PM: Adding info for N¦ ¦us:mtdblock17
UBI device number 6, total 32 LEBs (4128768 bytes, 3.9 MiB), available 8 LEBs (10321y2 bytes, q008.0 KiB), LEB siz¦ 129024 bytes (126.0 K¦B)
Stratosphere initiated success
shell_drv Init Done
LOGGER driver Init Done success log_id 0x85d53a04

GateMakerPro GPL initialization done
uncorrectable error :
uncorrectable error :
uncorrectable error :
uncorrectable error :
UBI error: ubi_io_re¦d: error -77 (ECC ¦r¦o¦) while reading 1800 bytes from`P¦B 81:118216, re¦d 1800 by¦es
UBIFS error (pid 32w): ubifs_leb_read: ¦eading 1800 bytes from`L¦B 79:116168 failed, error -w7
UBIFS error (pid 327): try¦read_node: cannot read node type 1 from LEB 79:1q6168, error -77
uncorrectable error :
uncorrectable error :
uncorrectable error :
uncorrectable error :
UBI error: ubi_io_read: e¦r¦r -77 (ECC error) while reading 1800 bytes from`PEB 81:118216, read 1800 ¦ytes
UBIFS error (pid 32w)z ¦bifs_read_node: bad node type (51 but expe¦ted 1)
UBIFS error (pid 327): ubifs_read_node: bad`node at LEB 79:116168, LE¦ ¦a¦ping status 1
U¦I¦S e¦ror (pid 327): do_r¦adp¦ge: cannot read page 294 of inode 610, error -22
uncorrectable error :
uncorrectable error :
uncorrectable error :
uncorrectable error :
UBI error: ubi_io_read: err¦r -77 (ECC error) while reading 1800 bytes from PEB 81:118216, read 1800 by¦e¦
UBIFS error (pid 327): ubifs_leb_read: re¦d¦n¦ 1800 bytes from ¦E¦ 79:116168 failed, error -w7
UBIFS error (pid 327): try_read_node: cannot read`node type 1 from LEB 79:116168, error -77
uncorrectable error :
uncorrectable error :
uncorrectable error :
uncorrectable error :
UBI error: ubi_io_re¦d: error -77 (ECC e¦ror) while reading 1800 byte¦ from PEB 81:118216, read q800 bytes
UBIFS`error (pi¦ 327): ubifs_read_n¦d¦: bad node type (u1 but e¦p¦c¦ed 1)
UBIFS error (pid`327): ubifs_read_node: bad node at LEB 79:116168, LEB mapping status q
UB¦FS error (pid 327): do_readpage: cannot read pag¦ 294 of inode 610, ¦r¦or -22
Module len 1204224 truncated
insmod: can't insert 'GateMakerPro.ko': invalid module format
Machine session started.
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]¦]]]]]]]]]]]]]]        ]]¦    ]]]]]]]]          ]]]]   ]]]]
]]]]]]]]]¦]¦]]]          ]]] `  ]¦]¦]]            ]]]] ` ]]¦]
¦]¦]]]]]]]]]]]]      ` `]¦]¦    ]]]]]             ]]¦]   ]]]]
]]]]]]]]]¦]]]]]    ]]]]]]]]]    ]   ]   ]]]]]]]   ]]]]   ]]]]
]]]]]]]]]]]]]]]]  `     ]]]]    `  ]]] ]]]]   ]]  ]]]]   ]]]]
]]]]]]]]]]]]]]]]]]]]]    ]]]    ]]]]]] ]]]]   ]]  ]]]]   ]]]]
]]]]]]]]]]]]]]]]         ]]]   `] ]¦]] ¦]]]]]]]   ]]]]   ]]]]
]]]]]]]]]]]]]]]          ]]]   ]  ]]]] ]]]]    ` `]¦]]   ]]]]
]]]]]]]]]]]]]]]]        ]]]]  ]]  ¦]]]  ]]]]]]]  ]]]]]] ]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]       Target Operational & Debug Shell
`]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]       Version: 3.4.1
]]]]]]]]]]]]]]]]]]]]]]]]]]        BroadLight(C)
]]]]]]]]]]]]]]]]]]]]]]]]]

Welcome to SHELL, use (?) help to get started.
>>> Session [217] is started
command not found (/api/common/si), try using (?) "h¦lp"
command not found (/api/bridge/sem), try uslilac_net_dev: Unknown symbol fi_return_system_init_state
ing (?) "help"
command not found (/api/bridge/ce), try using (?) "help"
command not found (/api/bridge/ct), try using (?) "help"
command not found h/api/common/dpi), try using (?) "help"
command not found (/api/common/gsv), try using (?) "¦elp"
command not found (/cfg/v), try using (?) "help"
insmod: can't insert '/bl/bin/lilac_net_dev.ko': unknown symbol in module, or unknown parameter

MastergugaUSER : Read boot info record...
ptin_gpon_sfu_core: Unknown symbol fi_bl_gpon_get_link_status
insmod: can't insert '/bl/bin/ptin_gpon_sfu_core.ko': unknown symbol in module, or unknown parameter
device: 'br0': device_add
PM: Adding info for No Bus:br0
lilac_br_fp: Unknown symbol netdev_get_registered_port_id
insmod: can't insert 'lilac_br_fp.ko': unknown symbol in module, or unknown parameter
USER: failed to open /dev/ptin_io err -1
Retry...
USER: failed to open /dev/ptin_io err -1
Retry...
interface wan0 does not exist!
wan0: unknown interface: No such device
USER: failed to open /dev/ptin_io err -1
Retry...

BROADLIGHT Lilac Linux (FS version 2.1.03.0, issue 2011-11-29-100717-juno)
¦ernel 2.6.34.8-BL2.1.10.1 #1 Wed Jun 27 23:23:03`WEST 2012
USERz failed to open /dev/pti¦_io err -1
Retry...
USER: failed to open /dev/ptin_io err -1
Retry...
USER: failed to open /dev/ptin_io err -1
Retry...
USER: failed to open /dev/ptin_io err -1
Retry...
USER: failed to open /dev/ptin_io err -1
Retry...
USER: failed to open /dev/ptin_io err -1
Retry...
USER: failed to open /dev/ptin_io err -1
Retry...
USER: failed to open /dev/ptin_io err -1
Retry...
br0: no IPv6 routers present

BL LILAC STARTER VER-2.1.10.0-BL (Apr 04 2013 - 11:30:55)
SOC ID: BL_23515
Init DDR3.... 128MB
Press any key to stop autoboot: 1
Press any key to stop autoboot: 0

Attempt to boot from NAND...
Try to load bootloader from boot bank 0
Bootloader Loaded to DRAM
Cache enabled


U-Boot 2010.06 (May 28 2013 - 11:36:58 - BL2.1.10.0)

Board: Lilac Evaluation (CHERRY)
U-Boot Local vers¦o¦: BL-2.1.10.0
Ch¦p`V¦rsion:         00002351
CP¦ Clock:           `497 ¦Hz
D¦R Clock:            403 MHz
RNR Clock:            403 MH¦
Peripheral BU¦ Cl¦c¦:`62 MHz
DRAM:  128 MiB
NAND:  256 MiB

So , the device keeps rebooting the firmware over and over .
I am trying to access the shell , but i am not been enabled to stop it .
For what i could understand , this device must be connected to the ISP fiber in order to update and finish the firmware , but since is not connected then keeps rebooting .
I did not yet found the jtag pin outs configuration , and i want to ask if it possible to build a firmware based on this CPU to work with this device ?

Some of you here are very experienced with these procedures , so some advice would be very appreciated .


Update :
this is a possible configuration for the jtag port , at least GND and VCC are in these positions .

http://www.keil.com/support/man/docs/ulinkpro/ulinkpro_jtag_10pin_swm.gif

Picked from this website  :
http://www.keil.com/support/man/docs/ul … jtag10.htm

Thanks .

(Last edited by pedropt on 14 Apr 2016, 14:00)

Ask open source code to manufacturer, specially uboot source code.

This is an ISP ONT witch was developed by them , the last thing they would do is to give an open firmware .
Finally i was able to find the trick to stop the boot .Only RX and TX must  be connected , and the command to stop must be done under those to connections only .
Then boot will stop , and then you connect GND to start inserting commands .
By default , this ont is in forwarding mode , witch means there is no DHCP over ethernet port to access Webgui .
I was able to go to the shell also , but i dont have the password for this model , so last option is an firmware extraction .

I am able to have these commands over serial  :

=> help
?       - alias for 'help'
askenv  - get environment variables from stdin
base    - print or set address offset
bdinfo  - print Board Info structure
blboot  - BL boot image from flash
blfpga  - BL-Tulip read/write FPGA (blfpga all | read| write [reg] [val])
blgpio  - BL-GPIO sub-system
bli2c   - BL I2C sub-system : EEPROM address = 0xa2, TRX address = 0xa0
blmux   - BL-Pin muxing sub-system
blncfg  - BL NAND Flash display/modify active partitions
blnenvclr- BL NAND clear environment
blnfmt  - BL format NAND flash
blninit - BL init NAND Flash
blnprog - BL program NAND Flash
blotp   - BL-OTPM sub-system
blphy   - BL-Tulip read/write phys; MDC-MDIO : gpio 26,27
blscfg  - BL SPI Flash display/modify active partitions
blsprog - BL program SPI Flash
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protoco▒
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dmb     - memory display bytes
dml     - memory display dwords
echo    - echo args to console
go      - start application at address 'addr'
help    - print command description/usage
loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mmb     - memory write bytes
mml     - memory write dwords
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
sspi    - SPI utility commands
tftpboot- boot image via network using TFTP protocol
ubi     - ubi commands
version - print monitor version
=>
BL LILAC STARTER VER-2.1.10.0-BL (Apr 04 2013 - 11:30:55)
SOC ID: BL_23515
Init DDR3.... 128MB
Press any key to stop autoboot: 1
Press any key to stop autoboot: 0

Attempt to boot from NAND...
Try to load bootloader from boot bank 0
Bootloader Loaded to DRAM
Cache enabled


U-Boot 2010.06 (May 28 2013 - 11:36:58 - BL2.1.10.0)

Board: Lilac Evaluation (CHERRY)

Is there any way to grab the firmware over serial mode ?
Jtag pinout is not right .

(Last edited by pedropt on 14 Apr 2016, 19:11)

Linux and uBoot are GPL software, they can't choose, they are legally bound to publish the source code. http://gpl-violations.org/

by the other side, you can dump the firmware with memory dumps ("md" command in uboot), log to file, convert the hexadecimal to binary and extract the firmware with firmware-mod-kit.

legally i am not authorized to open an hardware from ISP , and much even trying to hack it , it goes against policy rules of the ISP .
So , i dont even go to that way or i will get in problems .
I will install uboot on my kali , i may need some help with it , anyone here experienced with this tool that may give me some help or advice in case that i need ?

Do you live in Portugal or in North Korea?

If you buy any device, you can do any anything with it, maybe you lose warranty, but it's not illegal do anything with your own router.

The illegal thing is use GPL source code without publish modifications.

You don't need install uboot to extract the firmware, just use "md" command in the router uboot, dump the firmware in hexadecimal, log the output, convert the hexadecimal to binary (using "xxd" in linux) and extract it with binwalk and firmware-mod-kit.

The ISP does not sell the equipment to clients , it makes a loan until the client ends the service with them .
Even after client give up from service , the ISP takes away the device .

i get this message from md command :
md - memory display
Usage: md
[.b, .w, .l] address [# of objects]

other info
RESERVED:    A=0xA6C00000 : S=0x01400000 : (tm)
RESERVED:    A=0xA6800000 : S=0x00400000 : (mc)
USABLE:      A=0xA0000000 : S=0x06800000 : (sys_1)

device nand0 <nand>, # parts = 8
#: name                size            offset          mask_flags
0: starter             0x00100000      0x00000000      0
1: cfg                 0x00100000      0x00100000      0
2: uboot0              0x00280000      0x00200000      0
3: uboot1              0x00280000      0x00480000      0
4: linux0              0x00400000      0x00700000      0
5: linux1              0x00400000      0x00b00000      0
6: rootfs0             0x07880000      0x00f00000      0
7: rootfs1             0x07880000      0x08780000      0

active partition: nand0,0 - (starter) 0x00100000 @ 0x00000000

defaults:
mtdids  : none
mtdparts: none
=> device nand0 <nand>, # parts = 8


how should i invoke the command ?

(Last edited by pedropt on 14 Apr 2016, 23:30)

can not get any data , somehow it must be protected ?!!!
=> md.b 0x00f00000 0x20
00f00000:

returns nothing

can this be done in tftp mode , by retrieving the current image ?

i get these variables from console :

=> printenv
bootcmd=blboot
baudrate=115200
consoledev=ttyS0
modetty0=115200n8
bootargs=ubi.mtd=0 root=ubi0_0 rw rootfstype=ubifs ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off console=$(consoledev),$(baudrate)
mtdids=nand0=nand
mtdparts=mtdparts=nand:0x100000(starter),0x100000(cfg),0x280000(uboot0),0x280000(uboot1),0x400000(linux0),0x400000(linux1),0x7880000(rootfs0),0x7880000(rootfs1)
mem_reserve_low=tm=0x1400000 mc=0x400000
EMACS_GRP_MODE=QSGMII
netmask=255.255.255.0
bootdelay=60
partition=nand0,0
mtddevnum=0
mtddevname=starter
stdin=serial
stdout=serial
stderr=serial
memsize=128M
serverip=192.168.2.53
ipaddr=192.168.2.2
ethaddr=xx:xx:xx:xx:xx
E4_MODE=RGMII
EMAC=EMAC4
ethact=ETHMAC4

Environment size: 713/262140 bytes

(Last edited by pedropt on 15 Apr 2016, 00:54)

just got it , i cleared nad environment configs and got right under shell without pass

nop , but i figured out the default username and password on shell .
root/root

However this ont creates a bridge when detects a connection on eth4 , witch is configured in init scripts , init scripts call 2 files , "masterguga.exe" witch is a script , and "blsend.exe" , why isp call them with executables i dont  figure  it out .
these 2 files are crucial to start the shell , without them it is impossible to get to it .
These ont have by default some ports opened , 20,21,22,23,80
20? , 21 ftp , 22 shell , 23 telnet , 80 was supposed to be an http server that did not give any reply over its id over shell command .
Unhappily this device uses a new broadcom cpu that is not even on the internet info about it , broadcom does not have any info on it .
it must take a while until the drivers to be compiled appear on the net .
I believe that when this device is connected on client , it recieves an update and then the password is changed to the isp defaults log/pass .
but since was not connected , then it stayed as default linux user/pass , witch is root .

(Last edited by pedropt on 18 Apr 2016, 04:48)

Hi

Can you grab a dump of the flash from this model or maybe just dd the mtdblocks  if you have shell ?

(Last edited by surrealiz3 on 6 Nov 2016, 02:04)

The discussion might have continued from here.