NuCom R5010UN ADSL router
Hardware
SoC: bcm6328
cpu model: Broadcom4350 V7.5
Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz
flash size: 16 MB
RAM: 64 MB
WLAN: Broadcom BCM43217 2x2 802.11b/g/n transceiver
4 x ethernet
1 x USB host
Serial port
The serial port is available through header J6 which is in the lower left corner of the previous picture.
More detail and with the signal names below:
OEM bootlog
HELO
CPUI
L1CI
DRAM
----
PHYS
ZQDN
PHYE
DINT
LSYN
USYN
MSYN
LMBE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
CFE version 1.0.37-106.5 for BCM96328 (32bit,SP,BE)
Build Date: 2013年 09月 09日 星期一 12:55:22 HKT (root@s54)
Copyright (C) 2000-2009 Broadcom Corporation.
clock=40000000
flash=S25FL128 size=16MB id=0x12018 sector=64k
HS Serial flash device: name S25FL128, id 0x12018 size 16384KB
Total Flash size: 16384K with 256 sectors
Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-2) : 96328ang
Number of MAC Addresses (1-32) : 11
Base MAC Address : fa:ba:da:fa:ba:da
PSI Size (1-64) KBytes : 32
Enable Backup PSI [0|1] : 1
System Log Size (0-256) KBytes : 0
Main Thread Number [0|1] : 0
send udp message finished.
Not response, auto boot ...
Linux version 2.6.30 (root@s54) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #2 Mon Sep 9 14:09:37 HKT 2013
clock=40000000
flash=S25FL128 size=16MB id=0x12018 sector=64k
HS Serial flash device: name S25FL128, id 0x12018 size 16384KB
96328ang prom init
CPU revision is: 0002a075 (Broadcom4350)
Determined physical RAM map:
memory: 03f00000 @ 00000000 (usable)
Zone PFN ranges:
DMA 0x00000000 -> 0x00001000
Normal 0x00001000 -> 0x00003f00
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00003f00
On node 0 totalpages: 16128
free_area_init_node: node 0, pgdat 80331ac0, node_mem_map 81000000
DMA zone: 32 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 4064 pages, LIFO batch:0
Normal zone: 94 pages used for memmap
Normal zone: 11938 pages, LIFO batch:1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16002
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
wait instruction: enabled
Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
RCU-based detection of stalled CPUs is enabled.
NR_IRQS:128
PID hash table entries: 256 (order: 8, 1024 bytes)
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 60300k/64512k available (2762k kernel code, 4192k reserved, 451k data, 128k init, 0k highmem)
Calibrating delay loop... 319.48 BogoMIPS (lpj=159744)
Mount-cache hash table entries: 512
net_namespace: 760 bytes
NET: Registered protocol family 16
Total Flash size: 16384K with 256 sectors
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff]
pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff]
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:01:00.0: PME# disabled
pci 0000:02:00.0: reg 10 64bit mmio: [0x000000-0x007fff]
pci 0000:02:00.0: supports D1 D2
pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
pci 0000:01:00.0: IO window: disabled
pci 0000:01:00.0: MEM window: 0x10f00000-0x10ffffff
pci 0000:01:00.0: PREFETCH window: disabled
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:01:00.0 to 64
BLOG v3.0 Initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
squashfs: version 4.0 with LZMA457 ported by BRCM
fuse init (API version 7.11)
msgmni has been set to 117
io scheduler noop registered (default)
pcieport-driver 0000:01:00.0: device [14e4:6328] has invalid IRQ; check vendor BIOS
PCI: Setting latency timer of device 0000:01:00.0 to 64
Driver 'sd' needs updating - please use bus_type methods
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
bcm963xx_mtd driver v1.0
File system address: 0xb8010100
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 50, io mem 0x10002500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 49, io mem 0x10002600
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver usblp
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
brcmboard: brcm_board_init entry
SES: LED GPIO 0x800a is enabled
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xb0000100 (irq = 36) is a BCM63XX
ttyS1 at MMIO 0xb0000120 (irq = 36) is a BCM63XX
bcmxtmrt: Broadcom BCM6328B0 ATM/PTM Network Device v0.3 Sep 9 2013 12:40:50
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
Broadcom BCM6328B0 Ethernet Network Device v0.1 Sep 9 2013 12:39:05
ETH Init: 180 tx BDs at 0xa391d000
ETH Init: 400 rx BDs at 0xa3938000
ETH Init: 400 rx BDs at 0xa393a000
dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered
eth0: MAC Address: FA:BA:DA:FA:BA:DA
eth1: MAC Address: FA:BA:DA:FA:BA:DA
eth2: MAC Address: FA:BA:DA:FA:BA:DA
eth3: MAC Address: FA:BA:DA:FA:BA:DA
Broadcom Logger v0.1 Sep 9 2013 12:38:58
Broadcom 802.1Q VLAN Interface, v0.1
Mirror/redirect action on
u32 classifier
input device check on
Actions configured
TCP cubic registered
NET: Registered protocol family 10
ADDRCONF(NETDEV_UP): bcmsw: link is not ready
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Initializing MCPD Module
Ebtables v2.0 registered
ebt_time registered
ebt_ftos registered
ebt_wmm_mark registered
VFS: Mounted root (squashfs filesystem) readonly on device 31:0.
Freeing unused kernel memory: 128k freed
pktflow: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Initialized fcache state
Broadcom Packet Flow Cache Char Driver v2.2 Nov 16 2010 15:04:32 Registered<242>
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Broadcom Packet Flow Cache learning via BLOG enabled.
Constructed Broadcom Packet Flow Cache v2.2 Nov 16 2010 15:04:32
wl: high_wmark_tot=400
PCI: Enabling device 0000:02:00.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:02:00.0 to 64
wl: napimode=1
wl0: allocskbmode=1 currallocskbsz=256
otp_read_pci: bad crc
Neither SPROM nor OTP has valid image
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl:loading /etc/wlan/bcm43227_vars.bin
Failed to open srom image from '/etc/wlan/bcm43227_vars.bin'.
wl:loading /etc/wlan/bcm43227_map.bin
wl0: Broadcom BCMa8db 802.11 Wireless Controller 5.100.138.2001.cpe4.406.3
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
unprotect_e253protect.<6>ip_tables: (C) 2000-2006 Netfilter Core Team
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1008 buckets, 4032 max)
device eth0 entered promiscuous mode
ADDRCONF(NETDEV_UP): eth0: link is not ready
device eth1 entered promiscuous mode
ADDRCONF(NETDEV_UP): eth1: link is not ready
device eth2 entered promiscuous mode
ADDRCONF(NETDEV_UP): eth2: link is not ready
device eth3 entered promiscuous mode
ADDRCONF(NETDEV_UP): eth3: link is not ready
BcmAdsl_Initialize=0x801A6BF4, g_pFnNotifyCallback=0x80329CF4
pSdramPHY=0xA3FFFFF8, 0x1002000 0x60800000
*** XfaceOffset: 0x21F90 => 0x21F90 ***
*** PhySdramSize got adjusted: 0x8339C => 0x98D48 ***
AdslCoreSharedMemInit: shareMemAvailable=422544
AdslCoreHwReset: pLocSbSta=83160000 bkupThreshold=1600
AdslCoreHwReset: AdslOemDataAddr = 0xA3F783D4
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
XTM Init: 400 rx BDs at 0xa3108000
XTM Init: 100 rx BDs at 0xa32c9000
###reset_nf_conntrack_net_ops;540;###
###reset_nf_conntrack_net_ops;540;###
###reset_nf_conntrack_net_ops;540;###
monitor task is initialized pid= 228
br0: port 1(eth0) entering disabled state
br0: port 2(eth1) entering disabled state
br0: port 3(eth2) entering disabled state
br0: port 4(eth3) entering disabled state
unprotect_e254protect.<2>eth3 Link UP 100 mbps full duplex
br0: port 4(eth3) entering forwarding state
device wl0 entered promiscuous mode
device wl0.1 entered promiscuous mode
device wl0.2 entered promiscuous mode
device wl0.3 entered promiscuous mode
br0: port 5(wl0) entering forwarding state
clear g_wps_status
eth3 Link DOWN.
br0: port 4(eth3) entering disabled state
br0: port 4(eth3) entering disabled state
eth3 Link UP 100 mbps full duplex
br0: port 4(eth3) entering forwarding state
dhcpd uses obsolete (PF_INET,SOCK_PACKET)
Flashing procedure
Connect header J6 to the serial port of the PC through appropriate level shifter because of router's 3.3V circuitry.
Connect one of the four ethernet ports of the router to the PC using a LAN cable.
If you use Ubuntu:
sudo apt-get install gtkterm
With a USB to serial dongle:
sudo gtkterm -p /dev/ttyUSB0 -s 115200 &
Flashing ANY Firmware
You must set your TCP/IP v4 protocol to:
IP: 192.168.1.2
Netmask: 255.255.255.0
Gateway: 192.168.1.1
DNS: (optional, can be blank).
Then:
Power off the router.
Press reset button near the antenna.
Keep it pressed while powering up during ~20+ seconds.
Access to http://192.168.1.1 and upload binary file.
Wait until router reboots.
Alternatively send any key to the console at power up or reset. CFE will detect the key and stop before booting the image. You can then use a web browser to upload a new image.
Status
I tried openwrt-AR-5387un-squashfs-cfe.bin as their hardware look similar (to me). However, after flashing this is output to the serial port:
HELO
CPUI
L1CI
DRAM
----
PHYS
ZQDN
PHYE
DINT
LSYN
USYN
MSYN
LMBE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
CFE version 1.0.37-106.5 for BCM96328 (32bit,SP,BE)
Build Date: 2013幎 09æ 09æ¥ ææäž 12:55:22 HKT (root@s54)
Copyright (C) 2000-2009 Broadcom Corporation.
clock=40000000
flash=S25FL128 size=16MB id=0x12018 sector=64k
HS Serial flash device: name S25FL128, id 0x12018 size 16384KB
Total Flash size: 16384K with 256 sectors
Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-2) : 96328ang
Number of MAC Addresses (1-32) : 11
Base MAC Address : fa:ba:da:fa:ba:da
PSI Size (1-64) KBytes : 32
Enable Backup PSI [0|1] : 1
System Log Size (0-256) KBytes : 0
Main Thread Number [0|1] : 0
send udp message finished.
Not response, auto boot ...
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 110
Booting from only image (0xb8010000) ...
Code Address: 0x80010000, Entry Address: 0x80010000
LZMA: Prossible old LZMA format, trying to decompress..
Decompression OK!
Entry at 0x80010000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x80010000
[ 0.000000] Linux version 3.10.49 (bb@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r42625) ) #3 Wed Oct 1 15:07:11 CEST 2014
[ 0.000000] Detected Broadcom 0x6328 CPU revision b0
[ 0.000000] CPU frequency is 320 MHz
[ 0.000000] 64MB of RAM installed
[ 0.000000] registering 32 GPIOs
[ 0.000000] board_bcm963xx: Boot address 0xb8000000
[ 0.000000] board_bcm963xx: CFE version: unknown
[ 0.000000] bcm63xx_nvram: nvram checksum failed, contents may be invalid (expected ffc8dd2f, got a69c1bd6)
[ 0.000000] board_bcm963xx: unknown bcm963xx board: ÿ963ÿ8anÿ
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 0002a075 (Broadcom BMIPS4350)
[ 0.000000] Kernel panic - not syncing: unable to detect bcm963xx board
There is definitely a problem with the board code to start with, but I wouldn't even know how to solve that. Building a new image? Is this router supported by Openwrt?
I successfully built images for several different devices but always following the instructions, if you know what I mean . Should I try to patch the board code in nvram? How do I do that?
Any contribution is appreciated!
(Last edited by suso on 20 Mar 2015, 19:00)