User Tools

Site Tools


toh:arcadyan:ar7516

Arcadyan AR7516

Status

Chaos Calmer 15.05-rc3 has been booted on this device; caveats:

  • haven't worked out a simple way to install a bootloader yet
  • WiFi drivers aren't automatically included, but b43-based WiFi appears to work (very quick test)
  • LEDs probably need customising to the device
  • USB doesn't seem to work out of the box
  • As with all BCM63XX devices, there is no support for the integrated DSL modem.

The stock CFE on (at least) units branded as "EE BrightBox" has some (unexplored) limitations on what images it'll accept. CFE image built for another 6328 device, the Technicolor TG582n, is generic enough to work on the AR7516. See below for approaches for getting a replacement CFE flashed.

There's no dedicated OpenWRT build (yet?) but the D-Link DSL-274xB F1 revision is similar enough that its firmware boots the AR7516. As it's for a different device the wrong WiFi drivers are installed and the LEDs and GPIOs are probably wrong. USB may just need someone to take a look at the bootlog for obvious missing drivers/config options.

Intro

The AR7516 is branded in the UK as the Orange Brightbox router.

This is the AR7516 product page

These are the stock firmware's (not so) hidden config pages.

The stock Orange firmware is vulnerable to hacks by people given the WiFi password, at least, and (judging by the quality of the firmware) probably to remote hacks that aren't public yet.

Firmware update is available via holding the reset button for 8+ seconds. Also via the Admin menu.

Telnet can be enabled via popping the lid and serial connecting, or by entering 'Manufactory Mode' (see below).

Hardware

Info

Architecture: MIPS
Vendor: Broadcom
Bootloader: CFE
Board ID: AR7516AAW
System-On-Chip: Broadcom BCM6328
CPU/Speed BMIPS4350 v7.5 / 320 MHz
Flash-Chip: Macronix MX25L6406E
Flash size 8 MiB
RAM-Chip EM68B16CWQD-25H / DDR2-800
RAM 64 MiB
Wireless Broadcom BCM43227 (onboard)
Ethernet: BRCM6328 Switch (integrated on SoC)
USB Yes
Serial: Yes
JTAG: ?

Serial

J3, between the CPU and the USB port; unpopulated through-holes (some early models may have been left populated?). 3V3, 115200/8/N/1 in stock stuff and CFEs.

  • pin 2: TX
  • pin 3: RX
  • pin 4 (unlabelled): GND

'Manufactory' Mode/Telnet

In later "BrightBox" stock firmware (maybe EE branded and beyond?) it is possible to enable telnet access without opening the device. The process involves accessing a hidden settings page and resetting the box into the manufacturer's factory default mode. Please note: this is not the same page as the "factory default" page accessible from the Advanced Set-Up→Tools menu.

The steps are as follows:

  1. Go to your router's configuration in your web browser, e.g. http://192.168.1.1/
  2. Log in using the user name and password
  3. Optionally, but recommended, visit Advanced Set-Up→Tools→Configuration and backup your current config
  4. Now, change the location of the current page in your browser to u132xzp32aai.htm, so that the full address is, for example, http://192.168.1.1/u132xzp32aai.htm
  5. Click the button that says "Manufactory Default"

Once the router finishes doing its thing, you can now telnet in using the user name root and the password password. A significant drawback is that your router's normal functions may be impaired whilst in this mode. For instance, you may not be able to alter the wireless settings or use your broadband.

In "Orange BrightBox" branded versions you must either use the serial port (which provides a root shell by default) or upgrade to a vulnerable "EE BrightBox" firmware first.

Installation

Not user-friendly yet, and written by someone very new to router hacking; probably much room for improvement.

The stock version of CFE on EE BrightBox branded units offers both bootloader upgrade and main firmware upgrade, but requires at least the main firmware to pass some check that an OpenWRT image fails. The check is probably known, but a more complete CFE is reassuring and not too hard to flash using the existing root access, so that's the only route tried so far.

Using the "Manufactory" mode root login via telnet or serial console, a generic (enough) 6328 CFE can be flashed by writing to the raw mtdblock partitions. You can get it to the device in preparation for flashing by: * USB, assuming USB mass storage works in the stock firmware 'manufactory mode'? * network; while there's no netcat in the stock firmware/busybox, openssl can be substituted. * serial; use cat/dd/minicom/cutecom/gtkterm/anything else that can send a stream on the sending end, and maybe dd with a count on the receiving end to ensure you get back to the shell; openssl can be used to MD5 the received file and/or to base64-decode if you want to avoid issues escaping control characters. * SPI (skipping the root shell); flashrom or any other SPI programmer direct to the flash chip would work.

The generic CFE is slightly too big (~64k) to just overwrite the stock CFE partition and MTD partitions can't be created on the fly, so to get it to fit it needs to be either rebuilt with the fat trimmed off, or it needs to be split into three pieces and each written to an existing MTD partition. cfe6328-tg582n-custom.bin is 64688 bytes. Splitting this into appropriately sized chunks (dd would work) and writing them to mtdblock5 ("bootldr", 57344 bytes), mtdblock0 ("manuf", 4096 bytes) and mtdblock1 ("nvram", 4096 bytes) will achieve a flash.

The stock MTD partitions (rearranged into flash chip order) are:

mtdblock5: 0x000000000000-0x00000000e000 : "bootldr"
mtdblock0: 0x00000000e000-0x00000000f000 : "manuf"
mtdblock1: 0x00000000f000-0x000000010000 : "nvram"
mtdblock3: 0x000000010000-0x0000007f0000 : "priimg"
mtdblock2: 0x000000110000-0x0000007f0000 : "rootfs"
mtdblock4: 0x0000007f0000-0x000000800000 : "pricfg"

Once the generic 6328 CFE bootloader is flashed, at/after reboot the usual 63xx hold-reset-from-power-on or interrupt-the-boot-over-serial techniques will cause CFE to wait for (OpenWRT) image upload via its built-in web interface.

Bootlogs

OEM Bootlog

HELO CPUI L1CI DRAM ---- PHYS ZQDN PHYE DINT LSYN USYN MSYN LMBE PASS ---- ZBSS CODE DATA L12F ROMM ==== HELO ZBSS RAMM ==== Copyright (C) 2011 Arcadyan Technology. SPIFLASH: JEDEC ID: 0xc22017, size: 8192KB block: 64KB(64), sector: 4KB(1024) NVRAM(0) MAGIC checking passed! NVRAM(0) CRC checking passed! total 7 of NVRAM(0) entries loaded NVRAM(1) MAGIC checking passed! NVRAM(1) CRC checking passed! total 7 of NVRAM(1) entries loaded BOOTLOADER version 1.0.9 for BrightBox Build Date: Wed Nov 9 10:21:21 2011 (glen_lin@buildbed) Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz Memory Test Passed! Total Memory: 67108864 bytes (64MB) HW Version: 01 Board IP address 192.168.1.1 Board IP netmask 255.255.255.0 Gateway IP address 0.0.0.0 Server IP address 192.168.1.99 Boot image (1 or 2) 1 MAC address number 1 MAC address base xxxxxxxxxxxxxxxxx *** Press any key to stop auto run (3 seconds) *** Auto run second count down: 0 Loading primary image ... Finished loading 8257536 bytes DATE : Mon Nov 28 17:30:50 2011 VER : v0.09.82.0001 CRC : 3C15DF56 Code Address: 0x80002000, Entry Address: 0x801d8520 Decompression OK! Entry at 0x801d8520 Starting program at 0x801d8520 Linux version 2.6.30 (glen_lin@buildbed) (gcc version 4.1.2) #1 Mon Nov 28 17:16:00 CST 2011 Detected Broadcom 0x6328 CPU revision 10b0 CPU frequency is 320 MHz 64MB of RAM installed registering 32 GPIOs console [early0] enabled CPU revision is: 0002a075 (Broadcom BCM63281) board_bcm9632x: board name: AR7516AAW Determined physical RAM map: memory: 03f00000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00003f00 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00003f00 On node 0 totalpages: 16128 free_area_init_node: node 0, pgdat 8024bb30, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 94 pages used for memmap Normal zone: 11938 pages, LIFO batch:1 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16002 Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 ro rootfstype=squashfs wait instruction: enabled Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes NR_IRQS:80 PID hash table entries: 256 (order: 8, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 61368k/64512k available (1912k kernel code, 3124k reserved, 436k data, 120k init, 0k highmem) Calibrating delay loop... 318.46 BogoMIPS (lpj=159232) Mount-cache hash table entries: 512 --Kernel Config-- SMP=0 PREEMPT=0 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 net_namespace: 536 bytes /proc/net/netfilter/nf_cli_bw_mon created NET: Registered protocol family 16 registering PCI controller with io_map_base unset bio: create slab at 0 pci 0000:00:00.0: PME# supported from D0 D3hot pci 0000:00:00.0: PME# disabled pci 0000:01:00.0: reg 10 64bit mmio: [0x000000-0x003fff] pci 0000:01:00.0: supports D1 D2 pci 0000:00:00.0: PCI bridge, secondary bus 0000:01 pci 0000:00:00.0: IO window: disabled pci 0000:00:00.0: MEM window: 0x10f00000-0x10ffffff pci 0000:00:00.0: PREFETCH window: disabled PCI: Enabling device 0000:00:00.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:00.0 to 64 BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 Nov 28 2011 17:14:06 initialized NET: Registered protocol family 8 NET: Registered protocol family 20 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 Total # RxBds=848 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized squashfs: version 4.0 (2009/01/31) Phillip Lougher msgmni has been set to 119 io scheduler noop registered (default) PCI: Setting latency timer of device 0000:00:00.0 to 64 aer 0000:00:00.0:pcie02: service driver aer loaded bcm632x-uart.0: ttyS0 at MMIO 0xb0000100 (irq = 36) is a bcm632x-uart console handover: boot [early0] -> real [ttyS0] loop: module loaded PPP generic driver version 2.4.2 NET: Registered protocol family 24 PPPoL2TP kernel driver, V1.0 m25p80 spi0.0: mx25l6405d (8192 Kbytes) Creating 6 MTD partitions on "spi0.0": 0x00000000e000-0x00000000f000 : "manuf" 0x00000000f000-0x000000010000 : "nvram" 0x000000110000-0x0000007f0000 : "rootfs" 0x000000010000-0x0000007f0000 : "priimg" 0x0000007f0000-0x000000800000 : "pricfg" 0x000000000000-0x00000000e000 : "bootldr" bcm632x-hsspi bcm632x-hsspi.0: at 0xb0001000 (irq 37, FIFOs size 510) v1.0 Registered led device: dsl:sync Registered led device: dsl:data Registered led device: wps:green Registered led device: sys:a Registered led device: sys:b Registered led device: sys:c Registered led device: sys:d GACT probability on u32 classifier Actions configured TCP cubic registered NET: Registered protocol family 17 Bridge firewalling registered Initializing MCPD Module 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 120k freed gpio-buttons driver version 0.1.2 input: gpio-buttons as /devices/platform/gpio-buttons/input/input0 Button Hotplug driver version 0.4.1 arc_oshal: module license 'Propritary' taints kernel. Disabling lock debugging due to kernel taint oshal_init(1066) DRV: Created Successfully ARC_KERNEL_OSIX_init(396) DRV: Created Successfully Broadcom Logger v0.1 Nov 28 2011 17:16:27 Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 Nov 28 2011 17:16:29 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. Constructed Broadcom Packet Flow Cache v2.2 Nov 28 2011 17:16:29 Broadcom BCM6328B0 Ethernet Network Device v0.1 Nov 28 2011 17:16:31 ETH Init: Ch:0 - 180 tx BDs at 0xa3946000 ETH Init: Ch:0 - 400 rx BDs at 0xa3a21000 bcm632x-dg: register bcmsw eth0: MAC Address: xxxxxxxxxxxxxxxxx eth1: MAC Address: xxxxxxxxxxxxxxxxx eth2: MAC Address: xxxxxxxxxxxxxxxxx eth3: MAC Address: xxxxxxxxxxxxxxxxx Broadcom 802.1Q VLAN Interface, v0.1 bcmxtmrt: Broadcom BCM6328B0 ATM/PTM Network Device v0.4 Nov 28 2011 17:16:44 bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom Power Management v0.1 Nov 28 2011 17:18:42 Broadcom WLAN configuration service start PCI: Enabling device 0000:01:00.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:01:00.0 to 64 wl: passivemode=1 wl: napimode=0 wl: allocskbmode=1 wl:force using embedded data wlc_bmac_attach(2582): BpGetWirelessFlags NIY! wl0: Broadcom BCMa8dc 802.11 Wireless Controller 5.100.96.0.cpe4.10L01a.8 bcm632x-dg: register wl0 ip_tables: (C) 2000-2006 Netfilter Core Team Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (1008 buckets, 4032 max) ctnetlink v0.93: registering with nfnetlink. xt_time: kernel timezone is -0000 IMQ driver loaded successfully. Hooking IMQ after NAT on PREROUTING. Hooking IMQ before NAT on POSTROUTING. Osix_service_sys_cmd_thread_main[1302]: Osix Wait for Batch System Comand Processing... Osix Thread service system command started successfully ! ramdisk/etc/config/ ramdisk/etc/config/backup.bin ramdisk/etc/config/glbcfg.save MHDL_DB_WLAN_Init_Setting[118] MHDL_DB_LAN_Init_Setting[525] Password for 'admin' changed BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 BcmAdsl_Initialize(202): BpGetRj11InnerOuterPairGpios NIY pSdramPHY=0xA3FFFFF8, 0xD11BD1AB 0xD99AD3DB *** PhySdramSize got adjusted: 0x82CDC => 0x98878 *** AdslCoreSharedMemInit: shareMemAvailable=423776 AdslCoreHwReset: pLocSbSta=83120000 bkupThreshold=1600 AdslCoreHwReset: AdslOemDataAddr = 0xA3F77D28 EXECUTE "/bin/util_xdsl_cli mode auto" BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 EXECUTE "/bin/util_xdsl_cli bitswap enable" BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 EXECUTE "/bin/util_xdsl_cli sra enable" BcmAdsl_Initialize=0xC040AEF8, g_pFnNotifyCallback=0xC04C08D4 devCtl_xtmInitiaXTM Init: Ch:0 - 400 rx BDs at 0xa3bc5000 lize(174): devCtXTM Init: Ch:1 - 16 rx BDs at 0xa29ad780 l_getSdramSize NIY! WAN Type is ADSL Success Success Success Success Success Success Power ON stage, no need to delete interface in advance. ioctl failed. check if wl0.1 exists MHDL_DB_SYS_DNS_UPDATE_RESOLV_CONF[1046]: cmd_buf (cp /tmp/tmpResolv_536.conf /etc/resolv.conf) dhcp IP compare: old () vs new (192.168.1.101). dhcp lease time compare: old (00000000) vs new (0002A300). mhdl_dn_lan_dhcpd_cfg_file_init[169]: Check_IP_Changed : (TRUE). Lease_Time_Changed (TRUE) dhcp IP compare: old () vs new (192.168.2.1). dhcp lease time compare: old (00000000) vs new (0000A8C0). mhdl_dn_lan_dhcpd_cfg_file_init[169]: Check_IP_Changed : (TRUE). Lease_Time_Changed (TRUE) dhcp IP compare: old () vs new (192.168.3.1). Restart Level is BR0_IPCHANGED BR0 IP Changed dhcp lease time compare: old (00000000) vs new (0000A8C0). mhdl_dn_lan_dhcpd_cfg_file_init[169]: Check_IP_Changed : (TRUE). Lease_Time_Changed (TRUE) Initializing WAN ioctl failed. check if wl0.1 exists XTM driver returns Not Found Error bcmxtmrt: MAC address: xxxxxxxxxxxxxxxxx [DoCreateDeviceReq.2998]: register_netdev [DoCreateDeviceReq.3000]: register_netdev done /bin/bcm_atmctl operate conn --add 1.0.38 aal5 vcmux_pppoa 1MHDL_DB_SYS_STOP_UPNPD[1322]: cmd (killall arc_upnp) killall: arc_upnp: no process killed MHDL_DB_SYS_RESTART_UPNPD[1306]: cmd_buf: /usr/sbin/arc_upnp & Success EXECUTE "/bin/pppd -c pppoa1 -a atm0.0.0.38 -H -k -R 30 -K 60 -M 1492 -u readytoconnect@fs -p mistyview &" Success Success Success Success ioctl failed. check if wl0.1 exists PPP: pppoa1 Start to connect ... netdev path : pppoa1 -> atm0 modprobe: can't open 'modules.dep': No such file or directory The kernel doesn't support the ebtables 'nat' table. ioctl failed. check if wl0.1 exists iptables v1.4.8: Couldn't find target `QOSUP' Try `iptables -h' or 'iptables --help' for more information. iptables v1.4.8: Couldn't find target `QOSUP' Try `iptables -h' or 'iptables --help' for more information. net.netfilter.nf_conntrack_acct = 1 ioctl failed. check if wl0.1 exists RTNETLINK answers: Invalid argument CLOCK_MONOTONIC, resolution=0.999848 System clock_res=999848, clock_hz=1000 config_httpd(517) LAN IP Address (192.168.1.101) Pre-init before any Application was started. config_httpd(526) LAN IP Mask (255.255.255.0) httpd: after config_httpd() httpd: listen at 192.168.1.101:5438 [HTTPD] httpd_main(): Not the 1st httpd_main task killall: dyndns: no process killed killall: tzoupdate: no process killed start httpd Success Success Success SSDP_SetRCVSocket(217): Recv SsdpSock 14 Success Success QueryEthernetLinkStatus[115]: WAN Interface Name (NULL) Port Number: eth3, PortStatus: 0 killall: bcm_mcpd: no process killed ioctl failed. check if wl0.1 exists killall arc_httpd start arc_httpd lease_init[65]: /etc/udhcpd/udhcpd_001.leases ! 1 Jan 00:00:27 sntp[982]: kod_init_kod_db(): Cannot open KoD db file /var/db/ntp-kod 1 Jan 00:00:27 sntp[982]: Error looking up (A) ntp.readytoconnect.co.uk: Name or service not known Unable to resolve hostname(s) HTTPD: main(1478) Restart Level is BR1_IPCHANGED BR1 IP Changed main(1570): I am child for HTTPD SVR 2 main(1582): Start HTTPD SVR 0 ioctl failed. check if wl0.1 exists killall: bcm_mcpd: no process killed lease_init[65]: /etc/udhcpd/udhcpd_002.leases ! Restart Level is BR2_IPCHANGED BR2 IP Changed please assign value for wl0.1_ssid please assign value for wl0.2_ssid killall: bcm_mcpd: no process killed iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. ioctl failed. check if wl0.1 exists iptables: No chain/target/match by that name. conntrack v1.0.0 (conntrack-tools): connection tracking table has been emptied. conntrack v1.0.0 (conntrack-tools): expectation table has been emptied. ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists rmmod: can't unload 'nf_nat_pt': unknown symbol in module, or unknown parameter ioctl failed. check if wl0.1 exists killall: urlfilterd: no process killed ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists conntrack v1.0.0 (conntrack-tools): connection tracking table has been emptied. conntrack v1.0.0 (conntrack-tools): expectation table has been emptied. ioctl failed. check if wl0.1 exists please assign value for wl0_radius_key please assign value for wl0_nas_id 1 Jan 00:00:50 sntp[2769]: Error looking up (A) ntp.readytoconnect.co.uk: Name or service not known Unable to resolve hostname(s) ioctl failed. check if wl0.1 exists please assign value for wl0.1_wpa_psk please assign value for wl0.2_wpa_psk start WLAN manager WLmngr Daemon is running ioctl failed. check if wl0.1 exists ifconfig: wl0.1: error fetching interface information: Device not found ifconfig: wl0.2: error fetching interface information: Device not found wlevt_init@157: opened loopback socket 6 wlevt is ready for new msg... nvram_commit NIY! ifconfig: wl0.1: error fetching interface information: Device not found ifconfig: wl0.2: error fetching interface information: Device not found ioctl failed. check if wl0.1 exists >>>>>Start Auto Channel search !!! >>>>> Setting SSID: "BrightBox-rc3bq3" Setting SSID: "ar7516aaw-guest" Setting SSID: "ar7516aaw-guest2" PPP: pppoa1 Start to connect ... netdev path : pppoa1 -> atm0 chanspec 0x2b01 selected bcm_wlctl: Unsupported bcm_wlctl: Not Permitted bcm_wlctl: Undefined error nvram_commit NIY! LLTD daemon is ready to run EAP daemon is ready to run NAS daemon is ready to run wlmngr_startWsc(1125): wait for WPSUI message timeout! dalQos_setDefaultWlQueuesLock NIY! dalQos_setDefaultWlQueuesLock NIY! dalQos_setDefaultWlQueuesLock NIY! read/write to TR69 configuration NIY! Starting to init bandwidth contrl of wifi!! /sbin/tctrl qdisc del dev wl0 ingress 2>/dev/null /usr/sbin/ebtables -X wl0_egress 2>/dev/null iptables: No chain/target/match by that name. /sbin/tctrl qdisc del dev wl0 root 2>/dev/null /usr/sbin/ebtables -X wl0_ingress 2>/dev/null /sbin/tctrl qdisc del dev wl0.1 ingress 2>/dev/null /usr/sbin/ebtables -X wl0.1_egress 2>/dev/null /sbin/tctrl qdisc del dev wl0.1 root 2>/dev/null /usr/sbin/ebtables -X wl0.1_ingress 2>/dev/null /sbin/tctrl qdisc del dev wl0.2 ingress 2>/dev/null /usr/sbin/ebtables -X wl0.2_egress 2>/dev/null /sbin/tctrl qdisc del dev wl0.2 root 2>/dev/null /usr/sbin/ebtables -X wl0.2_ingress 2>/dev/null start mcpd 1 Jan 00:01:15 sntp[3572]: Error looking up (A) ntp.readytoconnect.co.uk: Name or service not known Unable to resolve hostname(s) start USB service Password for 'user' changed Password for 'matt' changed bcm632x-usb-ohci bcm632x-usb-ohci.0: init err (c8300000 0000) bcm632x-usb-ohci bcm632x-usb-ohci.0: startup error -79 bcm632x-usb-ohci: probe of bcm632x-usb-ohci.0 failed with error -79 action name is add product name is 1d6b/2/206 Driver 'sd' needs updating - please use bus_type methods start UMTS service action name is add product name is 1d6b/2/206 start Power-Management service Host MIPS Clock divider pwrsaving is enabled DDR Self Refresh pwrsaving is enabled System Start with Normal Phase root@BrightBox:/ #

OpenWRT Bootlog

This is a boot using the TG582n CFE and the D-Link DSL-2740B/DSL-2741B rev F1 image, but running on the AR7516.

HELO CPUI L1CI DRAM ---- PHYS ZQDN PHYE DINT LSYN USYN MSYN LMBE PASS ---- ZBSS CODE DATA L12F MAIN CFE version 2.0.3 for DGN2200v2 (32bit,SP,BE) Build Date: s\0xc3\0xa1b may 9 21:45:47 CEST 2015 (dani@tool) Copyright (C) 2000-2009 Broadcom Corporation. HS Serial flash device: name MX25L64, id 0xc217 size 8192KB Total Flash size: 8192K with 2048 sectors ** HELLO ** Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz Main Thread: TP0 Memory Test Passed Total Memory: 67108864 bytes (64MB) Boot Address: 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-4) : 963281TAN Number of MAC Addresses (1-32) : 10 Base MAC Address : 00:00:00:00:00:01 PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1\0x081\0x080 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1\0x081\0x080 Booting from only image (0xb8010000) ... Code Address: 0x80A00000, Entry Address: 0x80a00000 LZMA: Prossible old LZMA format, trying to decompress.. Decompression OK! Entry at 0x80a00000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 2 buffers found. Closing DMA Channels. Starting program at 0x80a00000 [ 0.000000] Linux version 3.18.17 (buildbot@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r46018) ) #1 Fri Jul 3 16:32:38 CEST 2015 [ 0.000000] Detected Broadcom 0x6328 CPU revision b0 [ 0.000000] CPU frequency is 320 MHz [ 0.000000] 64MB of RAM installed [ 0.000000] board_bcm963xx: Boot address 0xb8000000 [ 0.000000] board_bcm963xx: CFE version: 1.0.37-106.24 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0002a075 (Broadcom BMIPS4350) [ 0.000000] board: board name: AW4339U [ 0.000000] MIPS: machine is D-Link DSL-2740B/DSL-2741B rev F1 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x00000000-0x03ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x03ffffff] [ 0.000000] Initmem setup node 0 [mem 0x00000000-0x03ffffff] [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Memory: 59716K/65536K available (2813K kernel code, 139K rwdata, 664K rodata, 1304K init, 192K bss, 5820K reserved) [ 0.000000] NR_IRQS:256 [ 0.000000] Calibrating delay loop... 319.74 BogoMIPS (lpj=639488) [ 0.040000] pid_max: default: 32768 minimum: 301 [ 0.044000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.048000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.060000] NET: Registered protocol family 16 [ 0.300000] registering PCI controller with io_map_base unset [ 0.324000] PCI host bridge to bus 0000:00 [ 0.328000] pci_bus 0000:00: root bus resource [mem 0x10f00000-0x10ffffff] [ 0.332000] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0] [ 0.336000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.340000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 0.344000] pci 0000:00:00.0: BAR 8: assigned [mem 0x10f00000-0x10ffffff] [ 0.348000] pci 0000:01:00.0: BAR 0: assigned [mem 0x10f00000-0x10f03fff 64bit] [ 0.352000] pci 0000:00:00.0: PCI bridge to [bus 01] [ 0.356000] pci 0000:00:00.0: bridge window [mem 0x10f00000-0x10ffffff] [ 0.360000] Switched to clocksource MIPS [ 0.364000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002) [ 0.372000] PCI: Enabling device 0000:01:00.0 (0000 -> 0002) [ 0.376000] bcma: bus0: Found chip with id 43227, rev 0x00 and package 0x08 [ 0.384000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x25, class 0x0) [ 0.392000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x1E, class 0x0) [ 0.404000] bcma: bus0: Core 2 found: PCIe (manuf 0x4BF, id 0x820, rev 0x12, class 0x0) [ 0.412000] bcma: bus0: Core 3 found: SDIO Device (manuf 0x4BF, id 0x829, rev 0x07, class 0x0) [ 0.420000] bcma: bus0: Using fallback SPROM failed (err -2) [ 0.424000] bcma: bus0: No SPROM available [ 0.440000] bcma: bus0: Bus registered [ 0.444000] NET: Registered protocol family 2 [ 0.452000] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.460000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.464000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.472000] TCP: reno registered [ 0.476000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.480000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.488000] NET: Registered protocol family 1 [ 0.496000] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.508000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.512000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.524000] msgmni has been set to 116 [ 0.528000] io scheduler noop registered [ 0.532000] io scheduler deadline registered (default) [ 0.540000] bcm63xx_uart.0: ttyS0 at MMIO 0xb0000100 (irq = 36, base_baud = 1562500) is a bcm63xx_uart [ 0.552000] console [ttyS0] enabled [ 0.552000] console [ttyS0] enabled [ 0.556000] bootconsole [early0] disabled [ 0.556000] bootconsole [early0] disabled [ 0.568000] m25p80 spi1.0: found mx25l6405d, expected m25p80 [ 0.576000] m25p80 spi1.0: mx25l6405d (8192 Kbytes) [ 0.580000] bcm63xxpart: CFE boot tag found with version 6 and board type AW4339U [ 0.588000] bcm63xxpart: Partition 0 is CFE offset 0 and length 10000 [ 0.596000] bcm63xxpart: Partition 1 is kernel offset 10100 and length 136008 [ 0.604000] bcm63xxpart: Partition 2 is rootfs offset 146108 and length 689ef8 [ 0.612000] bcm63xxpart: Partition 3 is cal_data offset 7d0000 and length 10000 [ 0.616000] bcm63xxpart: Partition 4 is nvram offset 7f0000 and length 10000 [ 0.624000] bcm63xxpart: Partition 5 is linux offset 10000 and length 7c0000 [ 0.632000] 6 bcm63xxpart partitions found on MTD device spi1.0 [ 0.640000] Creating 6 MTD partitions on "spi1.0": [ 0.644000] 0x000000000000-0x000000010000 : "CFE" [ 0.652000] 0x000000010100-0x000000146108 : "kernel" [ 0.656000] 0x000000146108-0x0000007d0000 : "rootfs" [ 0.664000] mtd: device 2 (rootfs) set to be root filesystem [ 0.676000] 1 squashfs-split partitions found on MTD device rootfs [ 0.684000] 0x000000360000-0x0000007d0000 : "rootfs_data" [ 0.692000] 0x0000007d0000-0x0000007e0000 : "cal_data" [ 0.700000] 0x0000007f0000-0x000000800000 : "nvram" [ 0.704000] 0x000000010000-0x0000007d0000 : "linux" [ 0.752000] b53_common: found switch: BCM63xx, rev 0 [ 0.756000] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.768000] TCP: cubic registered [ 0.768000] NET: Registered protocol family 17 [ 0.776000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this. [ 0.788000] Bridge firewalling registered [ 0.792000] 8021q: 802.1Q VLAN Support v1.8 [ 0.812000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.836000] Freeing unused kernel memory: 1304K (8039a000 - 804e0000) [ 2.508000] init: Console is alive [ 2.512000] init: - watchdog - [ 3.280000] random: nonblocking pool is initialized [ 4.648000] init: - preinit - [ 5.368000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on Port 3, 100Mbps, full-duplex Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 9.116000] jffs2: notice: (235) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 9.148000] mount_root: switching to jffs2 overlay [ 9.240000] procd: - early - [ 9.244000] procd: - watchdog - [ 10.260000] procd: - ubus - [ 11.268000] procd: - init - Please press Enter to activate this console. [ 13.884000] NET: Registered protocol family 10 [ 13.960000] usbcore: registered new interface driver usbfs [ 13.968000] usbcore: registered new interface driver hub [ 13.972000] usbcore: registered new device driver usb [ 13.988000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 14.000000] ehci-platform: EHCI generic platform driver [ 14.016000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 14.040000] ehci-pci: EHCI PCI platform driver [ 14.056000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 14.064000] ohci-platform: OHCI generic platform driver [ 14.076000] uhci_hcd: USB Universal Host Controller Interface driver [ 14.116000] hidraw: raw HID events driver (C) Jiri Kosina [ 14.128000] Loading modules backported from Linux version master-2015-03-09-0-g141f155 [ 14.136000] Backport generated by backports.git backports-20150129-0-gdd4a670 [ 14.156000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 14.184000] nf_conntrack version 0.5.0 (953 buckets, 3812 max) [ 14.264000] xt_time: kernel timezone is -0000 [ 14.332000] cfg80211: Calling CRDA to update world regulatory domain [ 14.340000] cfg80211: World regulatory domain updated: [ 14.344000] cfg80211: DFS Master region: unset [ 14.348000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time) [ 14.360000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 14.368000] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 14.376000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A) [ 14.384000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 14.392000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s) [ 14.404000] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s) [ 14.412000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 14.420000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A) [ 14.588000] PPP generic driver version 2.4.2 [ 14.596000] NET: Registered protocol family 24 [ 14.836000] b43-phy0: Broadcom 43227 WLAN found (core revision 30) [ 14.844000] b43-phy0: Found PHY: Analog 9, Type 4 (N), Revision 16 [ 14.852000] b43-phy0: Found Radio: Manuf 0x17F, ID 0x2057, Revision 9, Version 1 [ 14.860000] Broadcom 43xx driver loaded [ Features: PNL ] [ 20.516000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on Port 3, 100Mbps, full-duplex [ 26.560000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on Port 3, 100Mbps, full-duplex [ 26.568000] device eth0.1 entered promiscuous mode [ 26.576000] device eth0 entered promiscuous mode [ 26.588000] br-lan: port 1(eth0.1) entered forwarding state [ 26.592000] br-lan: port 1(eth0.1) entered forwarding state [ 28.596000] br-lan: port 1(eth0.1) entered forwarding state

Tags

toh/arcadyan/ar7516.txt · Last modified: 2015/08/10 22:32 by zx82