Hello all.
I am trying to backup my existing firmware before I try anything funky on the device. It is a KW5212 modem by Kasda.
I am through serial console:
FE version 1.0.38-114.185 for BCM963268 (32bit,SP,BE)
Build Date: Thu Dec 3 19:00:47 CST 2015 (lijianlin@PonServer)
Copyright (C) 2000-2011 Broadcom Corporation.
HS Serial flash device: name S25FL064, id 0x0116 size 8192KB
Total Flash size: 8192K with 128 sectors
Flash not used for Auxillary File System
Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-34) : KW5212C13A
Number of MAC Addresses (1-32) : 11
Base MAC Address : 00:0e:f4:df:77:a3
PSI Size (1-64) KBytes : 24
Enable Backup PSI [0|1] : 1
System Log Size (0-256) KBytes : 0
Auxillary File System Size Percent: 0
Main Thread Number [0|1] : 0
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1^H1^H0
Booting from only image (0xb8010000) ...
Code Address: 0x80010000, Entry Address: 0x8030b350
Decompression OK!
Entry at 0x8030b350
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x8030b350
Linux version 2.6.30 (yanggaofei@PonServer) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 SMP PREEMPT Mon Feb 29 18:09:04 CST 2016
HS Serial flash device: name S25FL064, id 0x0116 size 8192KB
KW5212C13A prom init
CPU revision is: 0002a080 (Broadcom4350)
DSL SDRAM reserved: 0x132000
Determined physical RAM map:
memory: 03ece000 @ 00000000 (usable)
Zone PFN ranges:
DMA 0x00000000 -> 0x00001000
Normal 0x00001000 -> 0x00003ece
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00003ece
On node 0 totalpages: 16078
free_area_init_node: node 0, pgdat 803cfb40, node_mem_map 81000000
DMA zone: 32 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 4064 pages, LIFO batch:0
Normal zone: 94 pages used for memmap
Normal zone: 11888 pages, LIFO batch:1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 15952
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
wait instruction: enabled
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
NR_IRQS:128
PID hash table entries: 256 (order: 8, 1024 bytes)
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 59388k/64312k available (3084k kernel code, 4904k reserved, 773k data, 152k init, 0k highmem)
Calibrating delay loop... 398.33 BogoMIPS (lpj=199168)
Mount-cache hash table entries: 512
Here i am booted into CFE:
CFE version 1.0.38-114.185 for BCM963268 (32bit,SP,BE)
Build Date: Thu Dec 3 19:00:47 CST 2015 (lijianlin@PonServer)
Copyright (C) 2000-2011 Broadcom Corporation.
HS Serial flash device: name S25FL064, id 0x0116 size 8192KB
Total Flash size: 8192K with 128 sectors
Flash not used for Auxillary File System
Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-34) : KW5212C13A
Number of MAC Addresses (1-32) : 11
Base MAC Address : 00:0e:f4:df:77:a3
PSI Size (1-64) KBytes : 24
Enable Backup PSI [0|1] : 1
System Log Size (0-256) KBytes : 0
Auxillary File System Size Percent: 0
Main Thread Number [0|1] : 0
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1
web info: Waiting for connection on socket 0.
CFE>
I had to modify cfetool so it would work with this device. Here is the command line I am using:
cfetool.py --read=kw.bin --addr=0xB8000000 --size=0x1000000 --block=0x10000 --serial=/dev/ttyUSB0
Whenever cfetool reaches B8200000 the modem will throw an exception, please see:
CFE> dm b82000000 1000
**Exception 8: EPC=8060B120, Cause=00000008 (TLBMissRd)
RA=8060AF48, VAddr=00000000
0 ($00) = 00000000 AT ($01) = 00000000
v0 ($02) = 00000000 v1 ($03) = 00000000
a0 ($04) = 8074D668 a1 ($05) = 00000000
a2 ($06) = 00000010 a3 ($07) = 00000008
t0 ($08) = 00000000 t1 ($09) = 00000000
t2 ($10) = B0001900 t3 ($11) = 00000000
t4 ($12) = FFFFFFFF t5 ($13) = FCFFFFFF
t6 ($14) = 0000C0C0 t7 ($15) = 0F000003
s0 ($16) = 00000000 s1 ($17) = F344F0AB
s2 ($18) = 2241282A s3 ($19) = 449C0726
s4 ($20) = BD8A5098 s5 ($21) = 443E30DC
s6 ($22) = 00000000 s7 ($23) = 80000000
t8 ($24) = 0000C0C0 t9 ($25) = 0C000003
k0 ($26) = 8074D508 k1 ($27) = 8064BBB0
gp ($28) = 80642580 sp ($29) = 8074D640
fp ($30) = 8074D640 ra ($31) = 8060AF48
Resetting board in 60 seconds...
Not sure if the firmware is stored elsewhere? Anyone can help?
Thanks alot.