Hola a tod@s, el otro día encontré un router tirado en la basura, es un Sercomm modelo FD-1018, a continuación dejo sus características técnicas:
- SoC: BCM63169@400MHz
- RAM: 128MB DDR3 (Etrontech EM6GC16EWXD-15H)
- Flash: 128MB NAND (ESMT F59L1G81LA 25T)
- Ethernet: BCM53124
- Antena interna
- USB: 1 puerto USB 2.0
- Board Id.: 963268MBV
Esta es la información que he extraido por el puerto serie:
HELO
CPUI
L1CI
HELO
CPUI
L1CI
DRAM
----
PHYS
STRF
400H
PHYE
DDR3
SIZ4
SIZ3
SIZ2
DINT
USYN
LSYN
MFAS
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
RO08
SUN2
find
flag
find
flag
SUN6
002
002
001
001
RAM1
NAN3
RFS0
NAN5
CFE version 1.0.38-114.185 for BCM963268 (32bit,SP,BE)
Build Date: 2015年 09月 21日 星期一 14:10:13 CST (alex@localhost)
Copyright (C) 2000-2011 Broadcom Corporation.
NAND flash device: name , id 0xc8d1 block 128KB size 131072KB
External switch id = 53125
Chip ID: BCM63169D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000
find flag begin read flash map
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-26) : 963268MBV
Number of MAC Addresses (1-32) : 12
Base MAC Address : 94:4a:0c:c0:db:38
PSI Size (1-64) KBytes : 24
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Auxillary File System Size Percent: 0
Main Thread Number [0|1] : 0
Voice Board Configuration (0-5) : SI3217X
***************************************************
Sercomm Boot Version 1.0.3.0
***************************************************
Entering Firmware : Everything is OK.
begin check sum
safe value is 255
check sum ok
Booting from First image (0xb8520000) ...
Decompression OK!
Entry at 0x803d3720
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x803d3720
Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (00008e9b-00008e99=2<300)
Linux version 2.6.30 (sharon@ubuntu) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 SMP PREEMPT Fri Jul 1 14:40:32 CST 2016
BCM Flash API. Flash device is not found.
963268MBV prom init
CPU revision is: 0002a080 (Broadcom4350)
DSL SDRAM reserved: 0x132000
Determined physical RAM map:
memory: 07ece000 @ 00000000 (usable)
Zone PFN ranges:
DMA 0x00000000 -> 0x00001000
Normal 0x00001000 -> 0x00007ece
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00007ece
On node 0 totalpages: 32462
free_area_init_node: node 0, pgdat 804cd9c0, node_mem_map 81000000
DMA zone: 32 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 4064 pages, LIFO batch:0
Normal zone: 222 pages used for memmap
Normal zone: 28144 pages, LIFO batch:7
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32208
Kernel command line: root=mtd:rootfs rw rootfstype=jffs2 console=ttyS0,115200
wait instruction: enabled
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
NR_IRQS:128
PID hash table entries: 512 (order: 9, 2048 bytes)
console [ttyS0] enabled
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0
Memory: 123096k/129848k available (3887k kernel code, 6580k reserved, 986k data, 168k init, 0k highmem)
Calibrating delay loop... 398.33 BogoMIPS (lpj=199168)
Mount-cache hash table entries: 512
--Kernel Config--
SMP=1
PREEMPT=1
DEBUG_SPINLOCK=0
DEBUG_MUTEXES=0
Broadcom Logger v0.1 Jul 1 2016 14:25:35
CPU revision is: 0002a080 (Broadcom4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Calibrating delay loop... 402.43 BogoMIPS (lpj=201216)
Brought up 2 CPUs
CPU0 attaching sched-domain:
domain 0: span 0-1 level CPU
groups: 0 1
CPU1 attaching sched-domain:
domain 0: span 0-1 level CPU
groups: 1 0
net_namespace: 1140 bytes
NET: Registered protocol family 16
Total Flash size: 0K with -1 sectors
Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (00008f1d-00008f17=6<300)
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10005fff]
pci 0000:00:00.0: supports D1 D2
pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
pci 0000:00:00.0: PME# disabled
pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff]
pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff]
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:01:00.0: PME# disabled
pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
pci 0000:01:00.0: IO window: disabled
pci 0000:01:00.0: MEM window: disabled
pci 0000:01:00.0: PREFETCH window: disabled
PCI: Setting latency timer of device 0000:01:00.0 to 64
skbFreeTask created successfully
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS v0.1 Jul 1 2016 14:36:52 initialized
Broadcom GBPM v0.1 Jul 1 2016 14:36:53 initialized
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
NTFS driver 2.1.29 [Flags: R/W].
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.11)
msgmni has been set to 240
io scheduler noop registered (default)
PCI: Setting latency timer of device 0000:01:00.0 to 64
Driver 'sd' needs updating - please use bus_type methods
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
bcm963xx_mtd driver v2.0
Failed to read image tag from flash
Broadcom DSL NAND controller (BrcmNand Controller)
-->brcmnand_scan: CS=0, numchips=1, csi=0
mtd->oobsize=0, mtd->eccOobSize=0
NAND_CS_NAND_XOR=00000000
Disabling XOR on CS#0
brcmnand_scan: Calling brcmnand_probe for CS=0
B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0
brcmnand_read_id: CS0: dev_id=c8d18095
After: NandSelect=40000001, nandConfig=15142200
DevId c8d18095 may not be supported. Will use config info
Spare Area Size = 16B/512B
Block size=00020000, erase shift=17
NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11
busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
timing1 not adjusted: 6574845b
timing2 not adjusted: 00001e96
brcmnand_adjust_acccontrol: gAccControl[CS=0]=00000000, ACC=f7ff1010
ECC level changed to 15
OOB size changed to 16
BrcmNAND mfg 0 0 UNSUPPORTED NAND CHIP 128MB on CS0
Found NAND on CS0: ACC=f7ff1010, cfg=15142200, flashId=c8d18095, tim1=6574845b, tim2=00001e96
BrcmNAND version = 0x0400 128MB @00000000
brcmnand_scan: Done brcmnand_probe
brcmnand_scan: B4 nand_select = 40000001
brcmnand_scan: After nand_select = 40000001
100 CS=0, chip->ctrl->CS[0]=0
ECC level 15, threshold at 1 bits
reqEccLevel=0, eccLevel=15
190 eccLevel=15, chip->ecclevel=15, acc=f7ff1010
brcmnand_scan 10
200 CS=0, chip->ctrl->CS[0]=0
200 chip->ecclevel=15, acc=f7ff1010
page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
brcmnand_scan 220
Brcm NAND controller version = 4.0 NAND flash size 128MB @18000000
brcmnand_scan 230
brcmnand_scan 40, mtd->oobsize=64, chip->ecclayout=00000000
brcmnand_scan 42, mtd->oobsize=64, chip->ecclevel=15, isMLC=0, chip->cellinfo=0
ECC layout=brcmnand_oob_bch4_4k
brcmnand_scan: mtd->oobsize=64
brcmnand_scan: oobavail=50, eccsize=512, writesize=2048
brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=15, eccbytes=3
300 CS=0, chip->ctrl->CS[0]=0
500 chip=87ab5590, CS=0, chip->ctrl->CS[0]=0
-->brcmnand_default_bbt
brcmnand_default_bbt: bbt_td = bbt_main_descr
Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0
Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0
nand_read_bbt: Bad block at 0x04160000
nand_read_bbt: Bad block at 0x066e0000
brcmnand_scan 99
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver usblp
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
brcmboard: brcm_board_init entry
PCIe: No device found - Powering down
Serial: BCM63XX driver $Revision: 3.00 $
Magic SysRq enabled (type ^ h for list of supported commands)
ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX
ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX
Total # RxBds=1200
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized
bcmPktDma_init: Broadcom Packet DMA Library initialized
IPSEC SPU: SUCCEEDED
GACT probability NOT on
Mirror/redirect action on
u32 classifier
input device check on
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (2028 buckets, 8112 max)
GRE over IPv4 tunneling driver
nf_nat_pt: no ports specified
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
NET: Registered protocol family 17
NET: Registered protocol family 15
Initializing MCPD Module
Ebtables v2.0 registered
ebt_time registered
ebt_tcpmss registered
ebt_ftos registered
ebt_wmm_mark registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:00babe00
VFS: Mounted root (jffs2 filesystem) readonly on device 31:6.
Freeing unused kernel memory: 168k freed
init started: BusyBox v1.15.3 ()
starting pid 258, tty '': '/etc/rcS'
brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:0099ac00
brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:00babe00
brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:00babe00
brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:00babe00
brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:00babe00
brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:00babe00
brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:00babe00
brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:00babe00
brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:00babe00
bcm_ingqos: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Broadcom Ingress QoS Module Char Driver v0.1 Jul 1 2016 14:32:39 Registered<243>
Broadcom Ingress QoS ver 0.1 initialized
BPM: tot_mem_size=134217728B (128MB), buf_mem_size=20132655B (19MB), num of buffers=9460, buf size=2128
Broadcom BPM Module Char Driver v0.1 Jul 1 2016 14:29:59 Registered<244>
[NTC bpm] bpm_set_status: BPM status : enabled
NBUFF v1.0 Initialized
Initialized fcache state
Broadcom Packet Flow Cache Char Driver v2.2 Jul 1 2016 14:32:40 Registered<242>
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Broadcom Packet Flow Cache learning via BLOG enabled.
Constructed Broadcom Packet Flow Cache v2.2 Jul 1 2016 14:32:40
chipId 0x631690D0
Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jul 1 2016 14:32:28 Registered <241>
Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
FAP Debug values at 0xa5f56db0 0xa5f96db0
Allocated FAP0 GSO Buffers (0xA5F67E38) : 1048576 bytes @ 0xA5800000
Allocated FAP1 GSO Buffers (0xA5FA7E38) : 1048576 bytes @ 0xA5900000
Allocated FAP0 TM SDRAM Queue Storage (a5f67e3c) : 341376 bytes @ a5a00000
Allocated FAP1 TM SDRAM Queue Storage (a5fa7e3c) : 341376 bytes @ a5a80000
[NTC fapProto] fapReset : Reset FAP Protocol layer
[FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3720>, free <2936>, total<8192>
[FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3720>, free <2936>, total<8192>
[FAP0] PSM : addr<0x80002000>, used <19700>, free <4876>, total <24576>
[FAP1] PSM : addr<0x80002000>, used <19700>, free <4876>, total <24576>
[FAP0] DQM : availableMemory 10296 bytes, nextByteAddress 0xE0004938
[FAP1] DQM : availableMemory 10296 bytes, nextByteAddress 0xE0004938
[FAP0] GSO Buffer set to 0xA5800000
[FAP1] GSO Buffer set to 0xA5900000
[FAP0] FAP BPM Initialized.
[FAP1] FAP BPM Initialized.
bcmPktDma_bind: FAP Driver binding successfull
[FAP0] FAP TM: ON
[FAP1] FAP TM: ON
Broadcom BCM63169D0 Ethernet Network Device v0.1 Jul 1 2016 14:35:51
fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820030 bytes remaining 4832
ETH Init: Ch:0 - 200 tx BDs at 0xb0820030
fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20030 bytes remaining 4832
ETH Init: Ch:1 - 200 tx BDs at 0xb0a20030
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b08212f0 bytes remaining 16
ETH Init: Ch:0 - 600 rx BDs at 0xb08212f0
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a212f0 bytes remaining 16
ETH Init: Ch:1 - 600 rx BDs at 0xb0a212f0
dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered
eth0: MAC Address: 94:4A:0C:C0:DB:38
eth1: MAC Address: 94:4A:0C:C0:DB:38
eth2: MAC Address: 94:4A:0C:C0:DB:38
eth3: MAC Address: 94:4A:0C:C0:DB:38
eth4: MAC Address: 94:4A:0C:C0:DB:38
[NTC arl] arlEnable : Enabled ARL binding to FAP
Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 Jul 1 2016 14:29:58 Registered <245>
Broadcom 802.1Q VLAN Interface, v0.1
Endpoint: endpoint_init entry
Endpoint: endpoint_init COMPLETED
Success
Note: Loading 6300 MDK (default) driver for 63169 chip
Note: Forcing 53115 driver for 53125
Switch MDK: num_switches = 2
Switch MDK: unit = 0; phy_pbmp = 0x8; config_pbmp = 0x18
Switch MDK link poll thread: unit=0; phypbmp=0x8
Switch MDK link poll thread: unit=1; phypbmp=0x1e
FD1018_SERCOMM_VFES_3206
Fri Jul 1 15:13:37 UTC 2016
ap_name=syslogd, action=start
ap_name=coredump, action=start
ap_name=dnrd, action=start
ap_name=phy, action=start
ap_name=dnsmasq, action=start
ap_name=lanip, action=start
ap_name=firewall, action=start
ap_name=telnetd, action=start
ap_name=sshd, action=start
ap_name=httpd, action=start
ap_name=redirect, action=start
bind: Address already in use
ap_name=dnrd, action=start
ap_name=ftpd, action=start
ap_name=networkmap, action=start
ap_name=srt, action=restart
ap_name=rp, action=start
ap_name=udpecho, action=start
ap_name=ntp, action=start
ap_name=wlan, action=start
ap_name=ingress_qos, action=start
ap_name=ingress_classify, action=start
ap_name=qos, action=start
ap_name=qos_cls, action=start
/bin/wlctl: Not Found
/bin/wlctl: Not Found
Setting SSID: "Control"
Setting SSID: "_ONOWiFi"
Setting SSID: "_AUTO_ONOWiFi"
ifconfig: SIOCGIFFLAGS: No such device
/bin/wlctl: Not In Range
/bin/wlctl: Not In Range
Success
Success
Success
Success
Success
ap_name=qos_remark, action=start
ap_name=ipv6wd, action=start
ap_name=duplexmode, action=start
ap_name=cpm, action=start
ap_name=wanip, action=stop
ap_name=igmp_proxy, action=stop
7200 sec
killall: wps_det: no process killed
ifconfig: SIOCGIFFLAGS: No such device
ap_name=igd_upnp, action=start
ap_name=dnsr, action=start
ap_name=cron, action=start
ap_name=cups, action=start
ap_name=snmp, action=start
ap_name=3g, action=start
ap_name=emrd, action=start
ap_name=fon, action=start
starting pid 1541, tty '': '/sbin/getty ttyS0 115200'
FD1018 login:admin
Aquí lanza un mensaje de error cuando le das al intro
El usuario para entrar en modo administrador es admin/VF-ESfd1018
No he conseguido para el proceso de arranque ni acceder al servidor web del CFE.Si presiono el botón de reset mientras bootea, entra a una especie de recovery de Sercomm.Sigo investigando posibles vias de parar el boot de CFE y ejecutar comandos.No tengo experiencia en portar routers a OpenWRT, así que si teneis cualquier duda o sugerencia sobre hacia dónde debo continuar, dejadlo en los comentarios sin problema.
Saludos y gracias de antemano
EDIT 1:
He conseguido interrumpir el proceso de arranque y acceder a la consola de ÇFE, lo que he hecho ha sido poner el router en modo download, y una vez allí pulsar CTRL+C, abandonando el proceso y dando acceso a la terminal de CFE:
CFE version 1.0.38-114.185 for BCM963268 (32bit,SP,BE)
Build Date: 2015年 09月 21日 星期一 14:10:13 CST (alex@localhost)
Copyright (C) 2000-2011 Broadcom Corporation.
NAND flash device: name , id 0xc8d1 block 128KB size 131072KB
External switch id = 53125
Chip ID: BCM63169D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000
find flag begin read flash map
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-26) : 963268MBV
Number of MAC Addresses (1-32) : 12
Base MAC Address : 94:4a:0c:c0:db:38
PSI Size (1-64) KBytes : 24
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Auxillary File System Size Percent: 0
Main Thread Number [0|1] : 0
Voice Board Configuration (0-5) : SI3217X
***************************************************
Sercomm Boot Version 1.0.3.0
***************************************************
Entering Firmware : Everything is OK.
begin check sum
check error
check sum kfs1 fail
begin check sum
check error
check sum kfs2 fail
DEBUG_INF:===================================================
DEBUG_INF:Sercomm Upgrade(Module Ver 2.09.00.9) Start!
DEBUG_INF:===================================================
DEBUG_ERR:ecc bytes 12
DEBUG_INF:Console Ctrl C breaks dl process!
web info: Waiting for connection on socket 0.
CFE> help
Available commands:
sc_ramtest SC Ram test Command
s_bram set boot cferam no
rd_sc
sc_swreg SC external switch reg operation api
sc_phyreg SC phy reg operation api
sc_erase_force SC force erase function, no matter if the block is OK or not
sc_init_marker SC init clean marker in spare by given range
sc_led SC LED Debug command
sc_gpio SC GPIO Debug command
sc_flash_map Dump NAND Flash Map defined in NVRAM
sc_lp SC LoopBack Sample test Command
sc_dl New Sercomm Upgrade
sc_force_bad sc_force_bad block
sc_nand_bad Dump NAND Flash Block is bad or not
sc_nand_dump_oob Dump NAND Flash OOB area
sc_nand_dump Dump NAND Flash Content
phy Read/Write phy registers.
sm Set memory or registers.
dm Dump memory or registers.
w Write the whole image start from beginning of the flash
e Erase NAND flash
r Run program from flash image or from host depend on [f/h] flag
p Print boot line and board parameter info
c Change booline parameters
i Erase persistent storage data
a Change board AFE ID
b Change board parameters
reset Reset the board
force override chipid check for images.
help Obtain help for CFE commands
For more information about a command, enter 'help command-name'
*** command status = 0
EDIT 2:
He conseguido bootear una imagen initramfs compilada para el router Comtrend VG-8050, el cual he visto que es muy similar en hardware a este FD1018:
CFE> r 192.168.1.100:vmlinux
0x80a00000/5863087 Entry at 0x80a00000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x80a00000
OpenWrt kernel loader for BCM63XX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Copyright (C) 2014 Jonas Gorski <jogo@openwrt.org>
Copyright (C) 2020 Alvaro Fernandez Rojas <noltari@gmail.com>
Decompressing kernel... done!
blasting from 0x80010000 to 0x01358728 (0x80010000 - 0x81368730)
Starting kernel at 80010000...
[ 0.000000] Linux version 5.10.144 (rafael@delorean) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r20728-a24e07700d) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 SMP Fri Sep 23 10:16:29 2022
[ 0.000000] Detected Broadcom 0x63268 CPU revision d0
[ 0.000000] CPU frequency is 400 MHz
[ 0.000000] 128MB of RAM installed
[ 0.000000] board_bcm963xx: Boot address 0xb8000000
[ 0.000000] board_bcm963xx: CFE version: 1.0.38-114.185
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0002a080 (Broadcom BMIPS4350)
[ 0.000000] board: board name: 963169P-1861N5
[ 0.000000] MIPS: machine is Comtrend VG-8050
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] percpu: Embedded 14 pages/cpu s27472 r8192 d21680 u57344
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480
[ 0.000000] Kernel command line: rootfstype=squashfs,ubifs noinitrd console=ttyS0,115200
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 108596K/131072K available (6439K kernel code, 637K rwdata, 1316K rodata, 12464K init, 211K bss, 22476K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] Tracing variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] NR_IRQS: 256
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns
[ 0.000015] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns
[ 0.008270] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656)
[ 0.074699] pid_max: default: 32768 minimum: 301
[ 0.079808] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.087325] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.100959] rcu: Hierarchical SRCU implementation.
[ 0.106711] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[ 0.115258] smp: Bringing up secondary CPUs ...
[ 0.121796] SMP: Booting CPU1...
[ 9.343917] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[ 9.343936] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[ 9.344215] CPU1 revision is: 0002a080 (Broadcom BMIPS4350)
[ 0.190115] Synchronize counters for CPU 1:
[ 0.210782] SMP: CPU1 is running
[ 0.210808] done.
[ 0.220662] smp: Brought up 1 node, 2 CPUs
[ 0.236916] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.247074] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[ 0.254271] pinctrl core: initialized pinctrl subsystem
[ 0.261999] NET: Registered protocol family 16
[ 0.388382] clocksource: Switched to clocksource MIPS
[ 0.398121] NET: Registered protocol family 2
[ 0.403479] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.413387] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[ 0.422266] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.430200] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.437543] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.444513] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.451460] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.459737] NET: Registered protocol family 1
[ 0.464266] PCI: CLS 0 bytes, default 16
[ 0.865526] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 0.880819] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.886771] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.901976] bcm63268-pinctrl 100000c0.pin-controller: registered at mmio (ptrval)
[ 0.911262] 10000180.serial: ttyS0 at MMIO 0x10000180 (irq = 13, base_baud = 1562500) is a bcm63xx_uart
[ 0.921050] printk: console [ttyS0] enabled
[ 0.921050] printk: console [ttyS0] enabled
[ 0.929647] printk: bootconsole [early0] disabled
[ 0.929647] printk: bootconsole [early0] disabled
[ 0.950529] bcm6368_nand 10000200.nand: there is not valid maps for state default
[ 0.963206] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xd1
[ 0.969858] nand: ESMT NAND 128MiB 3,3V 8-bit
[ 0.974283] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[ 0.982141] bcm6368_nand 10000200.nand: detected 128MiB total, 128KiB blocks, 2KiB pages, 16B OOB, 8-bit, Hamming ECC
[ 0.993972] Bad block table found at page 65472, version 0x01
[ 1.000518] Bad block table found at page 65408, version 0x01
[ 1.006999] nand_read_bbt: bad block at 0x000000520000
[ 1.012279] nand_read_bbt: bad block at 0x000000540000
[ 1.017578] nand_read_bbt: bad block at 0x000000560000
......................................................................................
[ 2.270410] nand_read_bbt: bad block at 0x000002300000
[ 2.275688] nand_read_bbt: bad block at 0x000004160000
[ 2.280997] nand_read_bbt: bad block at 0x0000066e0000
[ 2.323087] 2 fixed-partitions partitions found on MTD device brcmnand.0
[ 2.330515] Creating 2 MTD partitions on "brcmnand.0":
[ 2.335767] 0x000000000000-0x000000020000 : "cferom"
[ 2.342666] 0x000000020000-0x000007ae0000 : "wfi"
[ 3.050401] bcm63xx-spi 10000800.spi: at [mem 0x10000800-0x10000f0b flags 0x200] (irq 88, FIFOs size 542)
[ 3.085478] b53-switch: probe of spi1.5 failed with error -22
[ 3.151495] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec
[ 3.161783] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 3.169020] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 3.176167] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 3.183369] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 3.190543] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 3.200593] NET: Registered protocol family 10
[ 3.212185] Segment Routing with IPv6
[ 3.216178] NET: Registered protocol family 17
[ 3.220980] 8021q: 802.1Q VLAN Support v1.8
[ 3.381285] Freeing unused kernel memory: 12464K
[ 3.385991] This architecture does not have kernel memory protection.
[ 3.392692] Run /init as init process
[ 4.282280] init: Console is alive
[ 4.286479] init: - watchdog -
[ 4.328074] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 4.347655] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 4.365745] init: - preinit -
[ 4.836694] random: jshn: uninitialized urandom read (4 bytes read)
[ 4.929165] random: jshn: uninitialized urandom read (4 bytes read)
[ 5.195715] random: jshn: uninitialized urandom read (4 bytes read)
Failed to connect to the switch. Use the "list" command to see which switches are available.
Failed to connect to the switch. Use the "list" command to see which switches are available.
Failed to connect to the switch. Use the "list" command to see which switches are available.
Failed to connect to the switch. Use the "list" command to see which switches are available.
[ 5.709780] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 6.747428] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 8.156921] procd: - early -
[ 8.160491] procd: - watchdog -
[ 8.749526] procd: - watchdog -
[ 8.755296] procd: - ubus -
[ 8.775903] random: ubusd: uninitialized urandom read (4 bytes read)
[ 8.810162] random: ubusd: uninitialized urandom read (4 bytes read)
[ 8.817565] random: ubusd: uninitialized urandom read (4 bytes read)
[ 8.829029] procd: - init -
Please press Enter to activate this console.
[ 9.793212] random: jshn: uninitialized urandom read (4 bytes read)
[ 9.857860] random: ubusd: uninitialized urandom read (4 bytes read)
[ 9.865096] random: ubus: uninitialized urandom read (4 bytes read)
[ 9.933018] kmodloader: loading kernel modules from /etc/modules.d/*
[ 10.230149] urngd: v1.0.2 started.
[ 10.705235] random: crng init done
[ 10.708803] random: 23 urandom warning(s) missed due to ratelimiting
[ 10.776455] Loading modules backported from Linux version v5.15.58-0-g7d8048d4e064
[ 10.784297] Backport generated by backports.git v5.15.58-1-0-g42a95ce7
[ 11.068541] PPP generic driver version 2.4.2
[ 11.076067] NET: Registered protocol family 24
[ 11.125694] Broadcom 43xx driver loaded [ Features: PNL ]
[ 11.151316] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 62.503058] br-lan: port 1(eth0.1) entered blocking state
[ 62.509038] br-lan: port 1(eth0.1) entered disabled state
[ 62.515241] device eth0.1 entered promiscuous mode
[ 62.520559] device eth0 entered promiscuous mode
[ 62.541157] br-lan: port 1(eth0.1) entered blocking state
[ 62.546715] br-lan: port 1(eth0.1) entered forwarding state
[ 63.548841] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
BusyBox v1.35.0 (2022-09-23 10:16:29 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r20728-a24e07700d
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
También he podido acceder a la información de la memoria y CPU:
root@OpenWrt:/# cat /proc/cpuinfo
system type : bcm63xx/963169P-1861N5 (0x63268/0xD0)
machine : Comtrend VG-8050
processor : 0
cpu model : Broadcom BMIPS4350 V8.0
BogoMIPS : 398.13
wait instruction : yes
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : yes
hardware watchpoint : no
isa : mips1 mips2 mips32r1
ASEs implemented :
Options implemented : tlb 4kex 4k_cache prefetch mcheck ejtag llsc dc_aliases
shadow register sets : 1
kscratch registers : 0
package : 0
core : 0
VCED exceptions : not available
VCEI exceptions : not available
processor : 1
cpu model : Broadcom BMIPS4350 V8.0
BogoMIPS : 398.13
wait instruction : yes
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : yes
hardware watchpoint : no
isa : mips1 mips2 mips32r1
ASEs implemented :
Options implemented : tlb 4kex 4k_cache prefetch mcheck ejtag llsc dc_aliases
shadow register sets : 1
kscratch registers : 0
package : 0
core : 0
VCED exceptions : not available
VCEI exceptions : not available
root@OpenWrt:/# cat /proc/meminfo
MemTotal: 121060 kB
MemFree: 94372 kB
MemAvailable: 70300 kB
Buffers: 0 kB
Cached: 13664 kB
SwapCached: 0 kB
Active: 7440 kB
Inactive: 7804 kB
Active(anon): 7440 kB
Inactive(anon): 7804 kB
Active(file): 0 kB
Inactive(file): 0 kB
Unevictable: 0 kB
Mlocked: 0 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 1600 kB
Mapped: 3348 kB
Shmem: 13664 kB
KReclaimable: 1008 kB
Slab: 6124 kB
SReclaimable: 1008 kB
SUnreclaim: 5116 kB
KernelStack: 480 kB
PageTables: 336 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 60528 kB
Committed_AS: 24976 kB
VmallocTotal: 1032116 kB
VmallocUsed: 2072 kB
VmallocChunk: 0 kB
Percpu: 168 kB
Creo que le hacen falta los drivers para manejar el chip del switch,el BCM53124 y bastantes cosillas, pero el booteo básico de OpenWRT funciona correctamente.A partir de aquí no sé por dónde seguir ni que pasos realizar a continuación, investigaré acerca de como incluir el soporte para el switch en dicha imagen para comprobar el correcto funcionamiento de éste e intentar crear un nuevo perfil para este router en mi repositorio local de OpenWRT.
