User Tools

Site Tools


toh:pirelli:agpf

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Previous revision
toh:pirelli:agpf [2013/02/02 11:49]
toh:pirelli:agpf [2016/05/14 18:50] (current)
francescogmb [Pirelli Alice Gate VoIP 2 Plus Wi-Fi Business]
Line 1: Line 1:
 +====== Pirelli Alice Gate VoIP 2 Plus Wi-Fi Business ======
  
 +This page is about the above mentioned device also know as **agpf**.
 +
 +Supported, but without ADSL.
 +
 +| Trunk (untested) | - | [[https://​downloads.openwrt.org/​snapshots/​trunk/​brcm63xx/​generic/​openwrt-brcm63xx-generic-AGV2%2bW-squashfs-cfe.bin]] |
 +| Chaos Calmer | 15.05.1 | https://​downloads.openwrt.org/​chaos_calmer/​15.05.1/​brcm63xx/​generic/​openwrt-15.05.1-brcm63xx-generic-AGV2+W-squashfs-cfe.bin |
 +| Chaos Calmer | 15.05 | https://​downloads.openwrt.org/​chaos_calmer/​15.05/​brcm63xx/​generic/​openwrt-15.05-brcm63xx-generic-AGV2%2bW-squashfs-cfe.bin |
 +| Barrier Breaker | 14.07 | https://​downloads.openwrt.org/​barrier_breaker/​14.07/​brcm63xx/​generic/​openwrt-AGV2%2bW-squashfs-cfe.bin |
 +| Attitude Adjustment | 12.09 | [[http://​downloads.openwrt.org/​attitude_adjustment/​12.09/​brcm63xx/​generic/​openwrt-AGV2%2bW-cfe-squashfs-cfe.bin]] |
 +| Backfire | 10.03 | [[http://​downloads.openwrt.org/​backfire/​10.03.1/​brcm63xx/​openwrt-AGV2%2bW-cfe-squashfs-cfe.bin]] |
 +
 +There are several models of Alice Gate out there, that are not supported at the moment.
 +
 +===== Hardware =====
 +==== Info ====
 +| **[[wp>​Instruction set|Architecture]]:​** ​   | [[wp>​MIPS architecture|MIPS]] |
 +| **Vendor:​** ​         | [[wp>​Broadcom]] |
 +| **[[doc:​techref:​Bootloader]]:​** ​    | [[doc:​techref:​bootloader:​CFE|CFE]] |
 +| **Board ID:**      | AGPF-S0 |
 +| **[[doc:​hardware:​soc|System-On-Chip]]:​** ​ | [[http://​www.broadcom.com/​products/​DSL/​xDSL-CPE-Solutions/​BCM6358|BCM6358KFBG ]] |
 +| **[[doc:​hardware:​cpu|CPU]]/​Speed** ​       | BMIPS4350 V1.0 / 300 Mhz [[doc:​hardware:​soc:​soc.broadcom.bcm63xx:​smp|BMIPS Dual Core]] |
 +| **Flash-Chip:​** ​     | Spansion [[http://​www.spansion.com/​datasheets/​s29gl-p_00_a11_e.pdf|S29GL128P]] |
 +| **Flash size:​** ​     | 16 MiB |
 +| **RAM:​** ​            | NANYA NT5DS16M16CS / DDR-400 ​  |
 +| **RAM size:​** ​       | 32 MiB   |
 +| **Wireless:​** ​       | BCM4318 (miniPCI) |
 +| **Ethernet:​** ​       | Broadcom ​ {{:​media:​datasheets:​bcm5325_pinout.png?​linkonly|BCM5325}} w/ vlan support [[doc:​uci:​network#​swconfig]] |
 +| **Internet:​** ​       | ADSL2+ ​ |
 +| **USB:​** ​            | 1x2.0H |
 +| **[[doc:​hardware:​port.serial|Serial]]:​** ​         | [[#​Serial|Yes]] |
 +| **[[doc:​hardware:​port.jtag|JTAG]]:​** ​           | [[#​JTAG|Yes]] ​ |
 +
 +==== Photos ====
 +
 +{{:​inbox:​alice-agpf.jpg?​400}}
 +
 +==== Serial ====
 +The serial port is J10, on the left of the switch chip, [[#Picture with highlighted Serial and Jtag|see]]
 +
 +|  6 |  GND |  RX |  5 | 
 +|  4 |  GND |  Vcc (3.3V) |  3 | 
 +|  2 |  GND |  TX |  1 | 
 +
 +Some revisions might have the connector tilted by 90 degrees and placed more or less at the center of the board.
 +Settings are 115200 8N1. 
 +
 +**NB:** a short circuit between pins ''​RX''​ and ''​TX''​ at power up puts the device in a recovery mode with IP ''​192.168.1.1''​ from where a new firmware can be uploaded. ​ OpenWrt binaries are refused, though, because of invalid CRC.
 +
 +You can use a CP210x USB to UART Bridge adapter. The advantage of the usb version is that you don't need to use battery like the old "​com"​ version.
 +
 +If you use Windows you can use HyperTerminal to connect with the router. You have to use the emulated com port, set the speed of 115200 (try other speeds if you see strange caracters).
 +
 +==== JTAG ====
 +Jtag port is J9 near the SoC and the minipci socket, [[#Picture with highlighted Serial and Jtag|see]]
 +
 +It seems to be a mips e-jtag 14 pin connector with columns swapped (used from the other side?).
 +
 +|  14 |  DINT |  VREF |  13 | 
 +|  12 |  SRST_N |  GND |  11 | 
 +|  10 |  TCK |  GND |  9 | 
 +|  8 |  TMS |  GND |  7 | 
 +|  6 |  TDO |  GND |  5 | 
 +|  4 |  TDI |  GND |  3 | 
 +|  2 |  TRST_N |  GND |  1 | 
 +
 +CPU Chip ID: 00000110001101011000000101111111 (0635817F)
 +
 +I used the JTAG port with [[http://​urjtag.org|urjtag]],​ just use the svn version. Useful info on [[http://​www.neufbox4.org/​wiki/​index.php?​title=Interface_JTAG|"​Neuf Box 4 JTAG" ]]
 +
 +You should probably try the [[http://​openocd.berlios.de/​web/​|Open On-Chip Debugger]]
 +
 +
 +
 +===== FLASH =====
 +|  CFE |  128KB |  0x00000 - 0x1FFFF | 
 +|  FIRST IMAGE |  ~8MB |  0x020000 - 0x7FFFFF | 
 +|  SECOND IMAGE |  ~8MB |  0x800000 - 0xFDFFFF | 
 +|  FACTORY SETTINGS |  128KB |  0xFE0000 - 0xFFFFFF | 
 +
 +More detailed information came from the discuss prompt:
 +<​code>​
 +Section 00 Type BOOT       Range 0x00000000-0x00020000 MaxSize 0x00020000
 +        No more information.
 +
 +Section 01 Type IMAGE      Range 0x00020000-0x007C0000 MaxSize 0x0079FF6C
 +        Size 0x0070BC38 Name '​IMAGE'​
 +        Checksum 0x37FE2BDA Counter 0x00000002 Start Offset 0x00000000
 +
 +Section 02 Type IMAGE      Range 0x00800000-0x00FA0000 MaxSize 0x0079FF6C
 +        Uninitialized.
 +
 +Section 03 Type CONF       Range 0x00FA0000-0x00FC0000 MaxSize 0x0001FF6C
 +        Size 0x0000756B Name '​rg_conf'​
 +        Checksum 0x003A4562 Counter 0x0000002D Start Offset 0x00000000
 +
 +Section 04 Type CONF       Range 0x00FC0000-0x00FE0000 MaxSize 0x0001FF6C
 +        Size 0x0000756B Name '​rg_conf'​
 +        Checksum 0x003A307D Counter 0x0000002E Start Offset 0x00000000
 +
 +Section 05 Type FACTORY ​   Range 0x00FE0000-0x00FF0000 MaxSize 0x0000FF6C
 +        Size 0x00000506 Name '​rg_factory'​
 +        Checksum 0x00011485 Counter 0x0000001A Start Offset 0x00000000
 +
 +Section 06 Type UNKNOWN ​   Range 0x00FF0000-0x01000000 MaxSize 0x00010000
 +</​code>​
 +
 +I don't understand the MaxSize value of some sections as they leave some space before the next section.
 +
 +Note, when you flash from jtag the BASE ADDRESS is 0x1E000000
 +
 +
 +
 +===== OpenWrt on the machine :-) =====
 +You will need a serial adpater!!
 +
 +Don't even try to go further without a serial adapter!!
 +
 +==== Backup of the original firmware ====
 +Connect the serial adapter and let the device complete the boot procedure. You have only to wait and don't have to short-circuit RX and TX pin.
 +At the login prompt use //admin// as username and password to get to the openrg //Discus// prompt.
 +
 +From the //Discus// prompt you can do a lot of useful things, but i've not explored it due to some lack of interest. To obtain the shell just digit //system shell//.
 +note: the first time you will not see Username, but if you write admin, router will request you the password.
 +<​code>​
 +Username: admin  ​
 +Password: *****  ​
 +
 +Discus> system shell
 +
 +
 +BusyBox v1.01 (2005.09.07-07:​38+0000) Built-in shell (lash)
 +Enter '​help'​ for a list of built-in commands.
 +
 +/ #
 +</​code>​
 +
 +Insert an USB flash key into the usb port of the router and mount the new device somewhere, for example in /mnt/backup
 +<​code>​
 +/ # cd mnt/
 +/mnt # mkdir backup
 +/mnt # mount /dev/sda
 +/mnt # mount /dev/sda1 backup/
 +[   ​90.535] VFS: Can't find ext3 filesystem on dev sda1.
 +[   ​90.590] VFS: Can't find an ext2 filesystem on dev sda1.
 +[   ​90.655] cramfs: wrong magic
 +/mnt #
 +</​code>​
 +
 +Now just copy the content of the flash in some files on the usb key.
 +<​code>​
 +/mnt # ls /dev/mtd*
 +/​dev/​mtd0 ​        /​dev/​mtd_rgconf0 ​ /​dev/​mtdblock2 ​   /dev/mtdr2
 +/​dev/​mtd1 ​        /​dev/​mtd_rgconf1 ​ /​dev/​mtdblock3 ​   /dev/mtdr3
 +/​dev/​mtd2 ​        /​dev/​mtdblock0 ​   /dev/mtdr0
 +/​dev/​mtd3 ​        /​dev/​mtdblock1 ​   /dev/mtdr1
 +/mnt # dd if=/​dev/​mtdblock0 of=/​mnt/​backup/​mtdblock
 +32768+0 records in
 +32768+0 records out
 +</​code>​
 +
 +This will create a 16M file named MTDBLOCK (due to fat limitation). If you prefer you can use an ext2 or ext3 formatted filesystem.
 +
 +From this file you can extract all you need to do a full restore of your device, both via jtag or via CFE.
 +
 +Now //unmount// your flash key, put the file in a safe place and reboot the Alice stopping the boot process at the bootloader prompt pressing some keys.
 +<​code>​
 +/mnt # sync
 +/mnt # umount backup/
 +/mnt # exit                                          ​
 +
 +Returned 0
 +Discus> system reboot<​Jan ​ 1 01:​22:​52> ​
 +Going to reboot!
 +</​code>​
 +
 +==== Restore original firmware ====
 +FIXME
 +==== Installing OpenWrt ====
 +You need to setup a tftp server on some host (I can suggest to use dnsmasq for this) to serve the firmware image to the router.
 +If you use Windows you can use tftpd32 to configure the tftpd server and the directory shared (you must connect also by lan your router and your pc).
 +
 +Now just download the image for //AGV2+W// from [[http://​downloads.openwrt.org/​snapshots/​trunk/​brcm63xx]],​ skip the jffs2 with 64k erase block as the flash use 128k block, anyway using 64k should not give much problem, just some wasted space and some errors messages. Put the choose image in the right place (see your tftp server configuration),​ and go to the CFE prompt.
 +
 +Now you have to use the //​flashimage//​ command to load the openwrt image, please don't use the //f// command. If you configure (with command //c//) the host ip address you can avoid it in the //​flashimage//​ argument.
 +To get the CFE prompt you must turn on you router and when you see a countdown and you must press '​enter'​.
 +<​code>​
 +CFE> flashimage
 +
 +     eg. flashimage [hostip:​]compressed_image_file_name
 +
 +</​code>​
 +
 +That's all, the device will automaticly reboot and openwrt will be there :-)
 +
 +Using dnsmasq:
 +<​code>​
 +sudo ifconfig eth0 192.168.1.100 # by default the router use the 192.168.1.1 ip
 +sudo dnsmasq -d --enable-tftp --tftp-root=`pwd`
 +</​code>​
 +
 +
 +For example this will result in:
 +<​code>​
 +CFE> flashimage openwrt-AGV2+W-cfe-jffs2-128k-cfe.bin
 +Loading 192.168.1.100:​openwrt-AGV2+W-cfe-jffs2-128k-cfe.bin ...
 +Finished loading 3670020 bytes
 +SGP  tagVersion : 8
 +Flashing MAIN image at address: BE020000
 +signiture_2:​ IMAGE
 +remaining to flash ....... ​ 03276804 ​
 +</​code>​
 +
 +
 +===== Specific OpenWrt configuration =====
 +==== Working as Access Point Router ====
 +
 +=== Network config (lan 4 = wan)===
 +
 +
 +I can suggest you to use Alice gate with the following network configuration using serial console:
 +
 +For more info read [[doc/​uci/​network/​switch]] config.
 +
 +You have to use the "​vi"​ editor to edit the file  ect/​config/​network . To save what you write you must press Esc, then write :w and then press enter to save (CTRL + Z to exit without save).
 +
 +<​code>​
 +config interface loopback ​                                                      
 +        option ifname ​  ​lo ​                                                     ​
 +        option proto    static ​                                                 ​
 +        option ipaddr ​  ​127.0.0.1 ​                                              
 +        option netmask ​ 255.0.0.0 ​                                              
 +                                         
 +config '​switch'​ '​eth1'​
 +        option '​enable'​ '​1'​
 +        option '​enable_vlan'​ '​1'​
 +        option '​reset'​ '​1'​
 +
 +config '​switch_vlan'​ '​vlan1' ​                                                   ​
 +   ​option '​vlan' ​      '​1' ​                                                     ​
 +   ​option '​device' ​    '​eth1' ​                                                  
 +   ​option '​ports' ​     '0 1 2 5t'
 +
 +config '​switch_vlan'​ '​vlan2'​
 +   ​option '​vlan' ​      '​2' ​                                                     ​
 +   ​option '​device' ​    '​eth1' ​                                                  
 +   ​option '​ports' ​     '3 5t'
 +
 +config interface lan                                                            ​
 +        option ifname ​  ​eth1.1
 +        option proto    static ​                                                 ​
 +        option type     ​bridge
 +        option ipaddr ​  ​192.168.5.1
 +        option netmask ​ 255.255.255.0 ​                                          
 +        option nat      1              ​
 +
 +config interface wan 
 +    option ifname ​ eth1.2 ​                                                  
 +    option proto   dhcp
 +</​code>​
 +
 +With the configuration above:  ​
 +
 +  * The LAN 4 port becomes a WAN port.
 +  * LAN port 1, 2, 3 and Wireless are switched togheter. ​
 +  * You can connect with your router at the address 192.168.5.1 using telnet protocol or your browser (note: OpenWrt Attitude Adjustment 12.09 is built with the web interface '​luci'​).
 +
 +
 +=== Leds config ===
 +
 + 
 + 
 +Inside /​etc/​config/​system add:
 +<​code>​
 +config '​led'​
 + option '​sysfs'​ '​AGPF-S0:​red:​power'​
 + option '​trigger'​ '​heartbeat'​
 +
 +config '​led'​
 + option name lan
 + option '​sysfs'​ '​AGPF-S0:​red:​wifi'​
 + option trigger netdev
 + option '​dev'​ '​eth1.0'​
 + option mode 'rx tx'
 +
 +config '​led'​
 + option name wan
 + option '​sysfs'​ '​AGPF-S0:​green:​wifi'​
 + option trigger netdev
 + option '​dev'​ '​eth1.1'​
 + option mode 'rx tx'
 +</​code>​
 +
 +
 +
 +==== Working as Client Device ====
 +
 +=== Wireless config ===
 +
 +
 +<​code>​
 +#/​etc/​config/​wireless ​
 +#NOTE: run wifi detect to create this file
 +
 +config wifi-device '​radio0'​
 + option type '​mac80211'​
 + option channel '​11'​
 + option hwmode '​11g'​
 + option path '​pci0000:​00/​0000:​00:​01.0'​
 + option txpower '​13'​
 + option country '​US'​
 +
 +config wifi-iface
 + option device '​radio0'​
 + option ssid 'YOUR NETWORK'​
 + option mode '​sta'​
 + option encryption '​psk2'​
 + option key 'ASCI PASSWD'​
 + option network '​wclient'​
 +
 +</​code>​
 +
 +=== Network config ===
 +
 +
 +Follow the network config with dhcp enabled on eth interfaces
 +<​code>​
 +#/​etc/​conf/​network
 +config interface '​loopback'​
 + option ifname '​lo'​
 + option proto '​static'​
 + option ipaddr '​127.0.0.1'​
 + option netmask '​255.0.0.0'​
 +
 +config switch '​eth1'​
 + option enable '​1'​
 + option enable_vlan '​1'​
 + option reset '​1'​
 +
 +config switch_vlan '​vlan0'​
 + option vlan '​0'​
 + option device '​eth1'​
 + option ports '0 1 2 5*'
 +
 +config switch_vlan '​vlan1'​
 + option vlan '​1'​
 + option device '​eth1'​
 + option ports '3 5t'
 +
 +config interface '​lan'​
 + option ifname '​eth1.0'​
 + option type '​bridge'​
 + option proto '​static'​
 + option ipaddr '​192.168.5.1'​
 + option netmask '​255.255.255.0'​
 + option nat '​1'​
 +
 +config interface '​wan'​
 + option ifname '​eth1.1'​
 + option proto '​dhcp'​
 + option type '​bridge'​
 +
 +config interface '​wclient'​
 + option _orig_ifname '​wlan0'​
 + option _orig_bridge '​false'​
 + option proto '​dhcp'​
 +</​code>​
 +
 +
 +=== Led config ===
 +
 +Follow the same configuration of access point router.
 +
 +==== Working as 3G/4G Router ====
 +
 +To use you usb modem you have to:
 +
 +  - install luci (if not installed)
 +  - install some packages to manage usb modem and other device ​
 +  - configure your connection using luci
 +
 +
 +=== Necessary packages ===
 +
 +you have to install tfollowing packages:
 +
 +kmod-usb-acm
 +kmod-usb-net
 +kmod-usb-net-sierrawireless
 +kmod-usb-ohci
 +kmod-usb-serial
 +kmod-usb-serial-option
 +kmod-usb-serial-qualcomm
 +kmod-usb-serial-sierrawireless
 +kmod-usb-uhci
 +kmod-usb2
 +luci-proto-3g
 +ppp  
 +ppp-mod-pppoe  
 +wpad-mini
 +usb-modeswitch  
 +usb-modeswitch-data  
 +procps  ​
 +wireless-tools
 +
 +=== Luci configuration ===
 +
 +You have to go to Network | Interface | Wan. Then swith to 3G Protocol (select UMTS/​GPRS/​EV-DO). Select the port of you modem (try all available port), your service, insert you APN, Pin, Username and Password. Finally save you configuration.
 +
 +=== Net config example ===
 +
 +This is the extracted network configuration for a ZTE MF680 modem:
 +
 +<​code>​
 +config interface '​loopback' ​      
 +        option ifname '​lo' ​       ​
 +        option proto '​static' ​    
 +        option ipaddr '​127.0.0.1' ​
 +        option netmask '​255.0.0.0'​
 +                               
 +config switch '​eth1' ​          
 +        option enable '​1' ​     ​
 +        option enable_vlan '​1' ​
 +        option reset '​1' ​      
 +                               
 +config switch_vlan '​vlan0' ​    
 +        option vlan '​0' ​           ​
 +        option device '​eth1' ​         ​
 +        option ports '0 1 2 5*' ​      
 +                                      ​
 +config switch_vlan '​vlan1' ​           ​
 +        option vlan '​1' ​              
 +        option device '​eth1' ​         ​
 +        option ports '3 5t' ​      
 +config interface '​lan' ​        
 +        option ifname '​eth1.0' ​
 +        option type '​bridge' ​  
 +        option proto '​static'  ​
 +        option ipaddr '​192.168.5.1'​
 +        option netmask '​255.255.255.0'​
 +        option nat '​1' ​               ​
 +                                      ​
 +config interface '​wan' ​               ​
 +        option _orig_ifname '​eth1.1'  ​
 +        option _orig_bridge '​false' ​  
 +        option proto '​3g' ​            
 +        option device '/​dev/​ttyUSB2' ​ #MAYBE YOU HAVE TO CHANGE THIS
 +        option service '​umts' ​        
 +        option apn 'YOUR APN'
 +        option username 'YOUR USERNAME'​
 +        option password 'YOUR PASSWORD' ​    
 +</​code>​
 +
 +=== Led config ===
 +You have to add the following code to etc/​config/​system:​
 +
 +<​code>​
 +
 +config led                                  ​
 +        option sysfs '​AGPF-S0:​green:​power'  ​
 +        option name '​on' ​                   ​
 +        option default '​1' ​                 ​
 +        option trigger '​default-on' ​        
 +                                            ​
 +config led                                  ​
 +        option name '​lan' ​                  
 +        option sysfs '​AGPF-S0:​green:​wifi' ​
 +        option trigger '​netdev' ​          
 +        option default '​0' ​               ​
 +        option dev '​wlan0' ​              
 +        option mode 'tx rx' ​             ​
 +                                         
 +config led                               
 +        option name '​wan' ​               ​
 +        option trigger '​netdev' ​         ​
 +        option sysfs '​AGPF-S0:​green:​internet'​
 +        option default '​0' ​                  
 +        option dev '​3g-wan' ​                 ​
 +        option mode '​link'  ​
 +
 +</​code>​
 +
 +=== Other suggestions ===
 +
 +Usb modem are not builded to stay turned on 24h/7d, so you could have problem like loss of connection or burned usb modems :-( . The problem is not your router, but in the original (normal) use of 3g modems. ​
 +A good solution is to buy an extention flat usb cable (A-male to B-female) and put your modem in your refrigerator (it maybe strange but 100% works).
 +
 +===== Bootlogs =====
 +==== OEM bootlog ====
 +<WRAP bootlog>
 +<​nowiki>​CFE version 1.0.37-8.7 for AGPF 0007 BCM96358 (32bit,​SP,​BE)
 +Build Date: lun giu 16 10:47:46 CEST 2008 ( gpaolo@buildserver )
 +Copyright (C) 2000-2005 Broadcom Corporation. ​                  
 +
 +Boot Address 0xbe000000
 +
 +Initializing Arena.
 +Initializing Devices.
 +
 +Flash info:
 +device_id : ............227E
 +meminfo.nsect:​..........128
 +totalSize:​..............1000000
 +num_erase_blocks:​...... 1
 +device_size:​............1000000
 +
 +Parallel flash device: name MX29L128DT, id 0x227e, size 16384KB
 +CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz
 +CPU running TP0
 +Total memory: 33554432 bytes (32MB)
 +
 +Total memory used by CFE:  0x80401000 - 0x80528CB0 (1211568)
 +Initialized Data:          0x8041E8A0 - 0x804204C0 (7200)
 +BSS Area:                  0x804204C0 - 0x80426CB0 (26608)
 +Local Heap:                0x80426CB0 - 0x80526CB0 (1048576)
 +Stack Area:                0x80526CB0 - 0x80528CB0 (8192)
 +Text (code) segment: ​      ​0x80401000 - 0x8041E894 (120980)
 +Boot area (physical): ​     0x00529000 - 0x00569000
 +Relocation Factor: ​        ​I:​00000000 - D:00000000
 +
 +Board IP address ​                 : 192.168.1.1:​ffffff00
 +Host IP address ​                  : 192.168.1.100
 +Gateway IP address ​               :
 +Run from flash/host (f/h)         : f
 +Default host run file name        : vmlinux
 +Default host flash file name      : openrg.img
 +Boot delay (0-9 seconds) ​         : 1
 +Board Id (0-3)                    : AGPF-S0
 +Number of MAC Addresses (1-32) ​   : 13
 +Base MAC Address ​                 : 02:​10:​18:​01:​00:​01
 +PSI Size (1-64) KBytes ​           : 24
 +Main Thread Number [0|1]          : 0</​nowiki>​
 +</​WRAP>​\\
 +
 +Note that while the tag on the image say this is an AGPF-S0 board, the web interface tell you this is an AGPF-S1.
 +
 +==== OpenWrt bootlog ====
 +<WRAP bootlog>
 +<​nowiki>​CFE version 1.0.37-8.7 for AGPF 0007 BCM96358 (32bit,​SP,​BE)
 +Build Date: lun giu 16 10:47:46 CEST 2008 ( gpaolo@buildserver )
 +Copyright (C) 2000-2005 Broadcom Corporation.
 +
 +Boot Address 0xbe000000
 +
 +Initializing Arena.
 +Initializing Devices.
 +
 +Flash info:
 +device_id : ............227E
 +meminfo.nsect:​..........128
 +totalSize:​..............1000000
 +num_erase_blocks:​...... 1
 +device_size:​............1000000
 +
 +Parallel flash device: name MX29L128DT, id 0x227e, size 16384KB
 +CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz
 +CPU running TP0
 +Total memory: 33554432 bytes (32MB)
 +
 +Total memory used by CFE:  0x80401000 - 0x80528CB0 (1211568)
 +Initialized Data:          0x8041E8A0 - 0x804204C0 (7200)
 +BSS Area:                  0x804204C0 - 0x80426CB0 (26608)
 +Local Heap:                0x80426CB0 - 0x80526CB0 (1048576)
 +Stack Area:                0x80526CB0 - 0x80528CB0 (8192)
 +Text (code) segment: ​      ​0x80401000 - 0x8041E894 (120980)
 +Boot area (physical): ​     0x00529000 - 0x00569000
 +Relocation Factor: ​        ​I:​00000000 - D:00000000
 +
 +Board IP address ​                 : 192.168.1.1:​ffffff00
 +Host IP address ​                  : 192.168.1.100
 +Gateway IP address ​               :
 +Run from flash/host (f/h)         : f
 +Default host run file name        : vmlinux
 +Default host flash file name      : openrg.img
 +Boot delay (0-9 seconds) ​         : 1
 +Board Id (0-3)                    : AGPF-S0
 +Number of MAC Addresses (1-32) ​   : 13
 +Base MAC Address ​                 : 02:​10:​18:​01:​00:​01
 +PSI Size (1-64) KBytes ​           : 24
 +Main Thread Number [0|1]          : 0
 +
 +*** Press any key to stop auto run (1 seconds) ***
 +Auto run second count down: 0
 +Sizeof Tag Used : 256
 +One only valid image tag found ...
 +Trying to boot from FIRST image copy (0x80010000) ...
 + ​latest imageSequence found: ... 0
 + - Flash Kernel Address: 0xBE020100
 + - Tag->​kernelLen:​ 0x000FFF00
 + - Flash Kernel Address: 0xBE020100
 + - Tag Kernel crc : 0x60CE85C1 - calculated: 0x60CE85C1
 +Decompression OK! - starting 0
 +Entry at 0x80010000
 +
 +Distribution:​
 +Version: cfe
 +
 +Build Date: –Esquashfs
 +
 +Closing network.
 +Starting program at 0x80010000
 +SGP START PARTITION: 0
 +[    0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc ve
 +rsion 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Sat Mar 23 18:09
 +:20 UTC 2013
 +[    0.000000] Detected Broadcom 0x6358 CPU revision a1
 +[    0.000000] CPU frequency is 300 MHz
 +[    0.000000] 32MB of RAM installed
 +[    0.000000] registering 40 GPIOs
 +[    0.000000] gpiochip_add:​ registered GPIOs 0 to 39 on device: bcm63xx-gpio
 +[    0.000000] board_bcm963xx:​ Boot address 0xbe000000
 +[    0.000000] board_bcm963xx:​ CFE version: AGPF-10-0007
 +[    0.000000] bootconsole [early0] enabled
 +[    0.000000] CPU revision is: 0002a010 (Broadcom BMIPS4350)
 +[    0.000000] board_bcm963xx:​ board name: AGPF-S0
 +[    0.000000] Determined physical RAM map:
 +[    0.000000] ​ memory: 02000000 @ 00000000 (usable)
 +[    0.000000] Initrd not found or empty - disabling initrd
 +[    0.000000] Zone PFN ranges:
 +[    0.000000] ​  ​Normal ​  ​0x00000000 -> 0x00002000
 +[    0.000000] Movable zone start PFN for each node
 +[    0.000000] Early memory PFN ranges
 +[    0.000000] ​    0: 0x00000000 -> 0x00002000
 +[    0.000000] Reserving 0MB of memory at 0MB for crashkernel
 +[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pag
 +es: 8128
 +[    0.000000] Kernel command line:  root=/​dev/​mtdblock2 rootfstype=squashfs,​jff
 +s2 noinitrd console=ttyS0,​115200
 +[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
 +[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
 +[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
 +[    0.000000] Primary instruction cache 32kB, VIPT, 2-way, linesize 16 bytes.
 +[    0.000000] Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16
 +bytes
 +[    0.000000] Memory: 29024k/​32768k available (2358k kernel code, 3744k reserve
 +d, 501k data, 204k init, 0k highmem)
 +[    0.000000] NR_IRQS:128
 +[    0.000000] Calibrating delay loop... 299.26 BogoMIPS (lpj=598528)
 +[    0.036000] pid_max: default: 32768 minimum: 301
 +[    0.040000] Mount-cache hash table entries: 512
 +[    0.048000] NET: Registered protocol family 16
 +[    0.064000] registering PCI controller with io_map_base unset
 +[    0.068000] registering PCI controller with io_map_base unset
 +[    0.084000] bio: create slab <​bio-0>​ at 0
 +[    0.092000] PCI host bridge to bus 0000:00
 +[    0.096000] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff]
 +[    0.100000] pci_bus 0000:00: root bus resource [io  0x8000000-0x8007fff]
 +[    0.116000] pci 0000:​00:​01.0:​ BAR 0: assigned [mem 0x30000000-0x30001fff]
 +[    0.120000] PCI host bridge to bus 0000:01
 +[    0.124000] pci_bus 0000:01: root bus resource [mem 0x38000000-0x3fffffff]
 +[    0.128000] pci_bus 0000:01: root bus resource [io  0x8008000-0x800ffff]
 +[    0.132000] pci 0000:​01:​1e.0:​ CardBus bridge to [bus 02-05]
 +[    0.136000] pci 0000:​01:​1e.0: ​  ​bridge window [io  0x0001-0x0000]
 +[    0.140000] pci 0000:​01:​1e.0: ​  ​bridge window [io  0x0001-0x0000]
 +[    0.144000] pci 0000:​01:​1e.0: ​  ​bridge window [mem 0x00000001-0x00000000]
 +[    0.148000] PCI: Enabling device 0000:​01:​1e.0 (0000 -> 0003)
 +[    0.152000] Switching to clocksource MIPS
 +[    0.164000] PCI: Enabling device 0000:​00:​01.0 (0000 -> 0002)
 +[    0.192000] ssb: Found chip with id 0x4318, rev 0x02 and package 0x02
 +[    0.244000] ssb: Sonics Silicon Backplane found on PCI device 0000:​00:​01.0
 +[    0.252000] NET: Registered protocol family 2
 +[    0.256000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
 +[    0.264000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
 +[    0.272000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
 +[    0.280000] TCP: Hash tables configured (established 1024 bind 1024)
 +[    0.288000] TCP reno registered
 +[    0.288000] UDP hash table entries: 256 (order: 0, 4096 bytes)
 +[    0.296000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
 +[    0.304000] NET: Registered protocol family 1
 +[    0.312000] audit: initializing netlink socket (disabled)
 +[    0.316000] type=2000 audit(0.316:​1):​ initialized
 +[    0.324000] squashfs: version 4.0 (2009/​01/​31) Phillip Lougher
 +[    0.328000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY
 +) (c) 2001-2006 Red Hat, Inc.
 +[    0.340000] msgmni has been set to 56
 +[    0.344000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 2
 +54)
 +[    0.352000] io scheduler noop registered
 +[    0.356000] io scheduler deadline registered (default)
 +[    0.364000] bcm63xx_uart.0:​ ttyS0 at MMIO 0xfffe0100 (irq = 10) is a bcm63xx_
 +uart
 +[    0.372000] console [ttyS0] enabled, bootconsole disabled
 +[    0.372000] console [ttyS0] enabled, bootconsole disabled
 +[    0.388000] physmap platform flash device: 02000000 at 1e000000
 +[    0.396000] physmap-flash.0:​ Found 1 x16 devices at 0x0 in 16-bit bank. Manuf
 +acturer ID 0x0000c2 Chip ID 0x00227e
 +[    0.408000] Amd/Fujitsu Extended Query Table at 0x0040
 +[    0.412000] ​  ​Amd/​Fujitsu Extended Query version 1.3.
 +[    0.416000] number of CFI chips: 1
 +[    0.420000] bcm63xxpart:​ CFE boot tag found with version 8 and board type AGP
 +F-S0
 +[    0.428000] bcm63xxpart:​ Partition 0 is CFE offset 0 and length 20000
 +[    0.436000] bcm63xxpart:​ Partition 1 is kernel offset 20100 and length fff00
 +[    0.440000] bcm63xxpart:​ Partition 2 is rootfs offset 120000 and length ec000
 +0
 +[    0.448000] bcm63xxpart:​ Partition 3 is nvram offset fe0000 and length 20000
 +[    0.456000] bcm63xxpart:​ Partition 4 is linux offset 20000 and length fc0000
 +[    0.464000] bcm63xxpart:​ Spare partition is offset 2e0004 and length cffffc
 +[    0.472000] 5 bcm63xxpart partitions found on MTD device physmap-flash.0
 +[    0.480000] Creating 5 MTD partitions on "​physmap-flash.0":​
 +[    0.484000] 0x000000000000-0x000000020000 : "​CFE"​
 +[    0.492000] 0x000000020100-0x000000120000 : "​kernel"​
 +[    0.496000] mtd: partition "​kernel"​ must either start or end on erase block b
 +oundary or be smaller than an erase block -- forcing read-only
 +[    0.516000] 0x000000120000-0x000000fe0000 : "​rootfs"​
 +[    0.524000] mtd: partition "​rootfs"​ set to be root filesystem
 +[    0.528000] mtd: partition "​rootfs_data"​ created automatically,​ ofs=2E0000, l
 +en=D00000
 +[    0.536000] 0x0000002e0000-0x000000fe0000 : "​rootfs_data"​
 +[    0.548000] 0x000000fe0000-0x000001000000 : "​nvram"​
 +[    0.556000] 0x000000020000-0x000000fe0000 : "​linux"​
 +[    0.572000] bcm63xx_enet MII bus: probed
 +[    0.576000] bcm63xx_enet bcm63xx_enet.0:​ attached PHY at address 1 [Broadcom
 +BCM63XX (2)]
 +[    0.592000] bcm63xx-wdt bcm63xx-wdt: ​ started, timer margin: 30 sec
 +[    0.612000] TCP cubic registered
 +[    0.612000] NET: Registered protocol family 17
 +[    0.620000] Bridge firewalling registered
 +[    0.624000] 8021q: 802.1Q VLAN Support v1.8
 +[    0.636000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
 +[    0.648000] Freeing unused kernel memory: 204k freed
 +awk: /​proc/​cpuinfo:​ No such file or directory
 +[    3.440000] eth1: link forced UP - 100/full - flow control off/off
 +[    3.496000] roboswitch: Probing device eth0: Failed to enable switch
 +[    3.504000] roboswitch: Probing device eth1: found a 5325! It's a 5350.
 +- preinit -
 +Press the [f] key and hit [enter] to enter failsafe mode
 +- regular preinit -
 +[    9.556000] JFFS2 notice: (370) jffs2_build_xattr_subsystem:​ complete buildin
 +g xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 12 of xref (0 dead, 6
 + ​orphan) found.
 +switching to jffs2
 +- init -
 +
 +Please press Enter to activate this console. [   ​12.564000] Compat-drivers backp
 +ort release: compat-drivers-2012-09-04-2-gddac993
 +[   ​12.572000] Backport based on wireless-testing.git master-2012-09-07
 +[   ​12.580000] compat.git: wireless-testing.git
 +[   ​12.636000] cfg80211: Calling CRDA to update world regulatory domain
 +[   ​12.640000] cfg80211: World regulatory domain updated:
 +[   ​12.648000] cfg80211: ​  ​(start_freq - end_freq @ bandwidth), (max_antenna_gai
 +n, max_eirp)
 +[   ​12.656000] cfg80211: ​  ​(2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 20
 +00 mBm)
 +[   ​12.664000] cfg80211: ​  ​(2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 20
 +00 mBm)
 +[   ​12.672000] cfg80211: ​  ​(2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 20
 +00 mBm)
 +[   ​12.680000] cfg80211: ​  ​(5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 20
 +00 mBm)
 +[   ​12.688000] cfg80211: ​  ​(5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 20
 +00 mBm)
 +[   ​13.516000] b43-phy0: Broadcom 4318 WLAN found (core revision 9)
 +[   ​13.568000] b43-phy0: Found PHY: Analog 3, Type 2 (G), Revision 7
 +[   ​13.648000] Broadcom 43xx driver loaded [ Features: PNL ]
 +[   ​13.876000] Button Hotplug driver version 0.4.1
 +[   ​14.080000] PPP generic driver version 2.4.2
 +[   ​14.504000] ip_tables: (C) 2000-2006 Netfilter Core Team
 +[   ​14.720000] NET: Registered protocol family 24
 +[   ​14.756000] nf_conntrack version 0.5.0 (456 buckets, 1824 max)
 +[   ​15.244000] input: gpio-keys-polled as /​devices/​platform/​gpio-keys-polled.0/​i
 +nput/input0
 +[   ​18.672000] eth1: link forced UP - 100/full - flow control off/off
 +[   ​20.592000] eth1: link forced UP - 100/full - flow control off/off
 +[   ​20.604000] device eth1.0 entered promiscuous mode
 +[   ​20.608000] device eth1 entered promiscuous mode
 +[   ​20.620000] br-lan: port 1(eth1.0) entered forwarding state
 +[   ​20.628000] br-lan: port 1(eth1.0) entered forwarding state
 +[   ​22.632000] br-lan: port 1(eth1.0) entered forwarding state
 +[   ​29.084000] b43-phy0: Loading firmware version 666.2 (2011-02-23 01:15:07)
 +[   ​29.232000] device wlan0 entered promiscuous mode
 +[   ​29.396000] b43-phy0: Loading firmware version 666.2 (2011-02-23 01:15:07)
 +[   ​30.484000] br-lan: port 2(wlan0) entered forwarding state
 +[   ​30.488000] br-lan: port 2(wlan0) entered forwarding state
 +[   ​32.492000] br-lan: port 2(wlan0) entered forwarding state
 +
 +
 +
 +BusyBox v1.19.4 (2013-03-14 20:30:45 UTC) built-in shell (ash)
 +Enter '​help'​ for a list of built-in commands.
 +
 +  _______ ​                    ​________ ​       __
 + ​| ​      ​|.-----.-----.-----.| ​ |  |  |.----.| ​ |_
 + ​| ​  ​- ​  ​|| ​ _  |  -__|     ​|| ​ |  |  ||   ​_|| ​  _|
 + ​|_______|| ​  ​__|_____|__|__||________||__| ​ |____|
 +          |__| W I R E L E S S   F R E E D O M
 + ​-----------------------------------------------------
 + ​ATTITUDE ADJUSTMENT (12.09, r36088)
 + ​-----------------------------------------------------
 +  * 1/4 oz Vodka      Pour all ingredients into mixing
 +  * 1/4 oz Gin        tin with ice, strain into glass.
 +  * 1/4 oz Amaretto
 +  * 1/4 oz Triple sec
 +  * 1/4 oz Peach schnapps
 +  * 1/4 oz Sour mix
 +  * 1 splash Cranberry juice
 + ​-----------------------------------------------------
 +root@OpenWrt:/#</​nowiki>​
 +</​WRAP>​\\
 +
 +
 +===== Links =====
 +  * [[http://​wiki.ninux.org/​Hackalicegate]]
 +  * [[http://​www.youtube.com/​watch?​v=GL5tMry0DlU]]
 +
 +===== Tags =====
 +[[meta:​tags|How to add tags]]
 +{{tag>​bcm63xx bcm6358}}