hi all,

I have an hitachi's modem router based on a broadcom chip who is BCM6348,
I can't see any support of this in openwrt, freifunk ....
Many  ISP use this chip on their modem-router and the firmware is opensource

the T-COM Speedport W 500V (clone of the hitachi AH4021), freebox (FR), fritzbox, livebox (FR) Siemens Adsl SL2-141-I  .... have opensource firmware

They have many feature : an USB port (master or slave), 2 VOIP port, a braodcom minipci card (bcm 4318), 2 ethernet port.

Source hitachi ah4021
http://assistance.club-internet.fr/tele … v36.tar.gz
Source speedport w500 voip
http://www.t-com.de/dlp/eki/downloads/b … rel.tar.gz
Face

TOP

Bottom

back

If you havethe hardware with that chip, say it in that Topic
Excuse my poor english, i hope, i was clear.

If you Have a device based on bcm6345 Bcm6348
Please say it here

Hello,

my ISP gave me for free a BCM6348 based router, a Comtrend CT-536+

It could be very nice if OpenWRT supports it in the future, I don't have money for buying another router at this moment.

Best regards,
timofonic

Edit:

I found sourcecode for the firmware of my router (CT-536+): http://www.comtrend.com/gplcddl.htm

Here is a dead project related to this:
http://sourceforge.net/projects/brcm6345-linux/

Here is the datasheet, but is only two pages:
http://www.datasheetcatalog.com/datashe … 6348.shtml
http://www.broadcom.com/collateral/pb/6348-PB01-R.pdf

Something I don't know what is for:
http://akusho.maidlab.jp/bcm6348/broadc … m6348.bsdl

Here is a firmware that seems to support the BCM6348 chip:
http://www.f-x.fr

Some other links:
http://www.linux-mips.org/wiki/BCM6348

(Last edited by timofonic on 1 Nov 2006, 01:58)

Refer to my Wiki Article regarding the SpeedPort W500V

Hello everyone!

I'm also owning a BCM6348 based router (Siemens SL2-141-I).
I've searched through google, but couldn't find any related information to this router nor support for OpenWRT.

Someone else got this device or maybe got a similar one working with OpenWRT?

Thanks in advance.

I haven't talked with the devs on the subject in a while, but as of several months ago the outlook for the BCM63xx platform wasn't too good.  While the devices run linux-based stock firmware, three binary-based drivers are required to make the platform functional; wireless, DSL, and ethernet!  The devs expressed much disappointment with this and didn't want to invest much time into such a closed platform.  At that time they had openwrt booting on several devices but not doing much more than that.

I've seen sporadic commits since then pertaining to bcm63xx but I think most of them are extremely minor.  Unless someone steps up and hacks the binary drivers I don't expect to see progress until source for the Broadcom drivers is released in a device tarball (or someone develops free drivers.

Bad news then :-(

The main problem I've got with my device is the following (a little bit OT, sorry for that):

I'm getting SNMP data from the device from another server to plot some nice graphs with rrdtool.
Works great.
Problem: My ISP disconnects me every 24 hours and I've to dial in again.
The router itself does that automatically, but I can't fetch the SNMP data after the disconnect before resetting the security settings inside the config by pushing "save" on the web-interface.
I really hoped that someone could help me with this problem.
I believe the problem is that the pppoe device is killed after 24hours and the router starts a new process for dialing in again without binding the security setting to that "new" device I've made before.

(Last edited by xenon on 6 Mar 2007, 09:02)

You could poke around with a serial console and see if the reason is apparent.  If you were so inclined you could extract a firmware image, make the needed additions/changes, pack the image back up and flash it to your router, but that can be an extremely difficult process for someone who isn't used to working with embedded firmware images.

I'm kinda firm with unix/linux systems, but never worked with embedded systems like that router before.

Maybe you could point me in the right direction where I can find additional informations.

hello i had too a comtrend 536 and load yet the asus wl600gw_fw_1028a nb8 firm and the siems sl2141i  all works fine less siemens who had the firm copiled for anex B if anyones had one firm for this one for anex A i can test it, the hitachi load but had some bug make it dont load full and stoped on usb check
soo i need swich to another via serial port i also checked the usr 91107 firm and it works fine too whitout wifi

here is the nb8 seria output and asus output the asus is not fulll since telnet like too mixed the log bad soo is the best i can get in 1h of work hope it works gettin a open firm for our bcm 6348 routers
nb8 firm

CFE version 1.0.37-5.17 for BCM96348 (32bit,SP,BE)
Build Date: Mon, 31 Jan 2005 23:36:28 +080
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.
Device id = 22a8
totalBlks=71
totalSize=4096K
getShareBlks: i=70, sect_size=65536, end_blk=71
getShareBlks: i=0, sect_size=8192, end_blk=1
getShareBlks: i=0, sect_size=8192, end_blk=1
fInfo.flash_nvram_start_blk = 0
fInfo.flash_nvram_blk_offset = 0x580
fInfo.flash_nvram_number_blk = 1
psi startAddr = bfffa000
fInfo.flash_persistent_start_blk = 70
fInfo.flash_persistent_blk_offset = 0xa000
fInfo.flash_persistent_number
init 5325E: init mii=0
init 5325E: init success, mii=9f
getShareBlks: i=0, sect_size=8192, end_blk=1
CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz

Total memory used by CFE: 0x80401000 - 0x80522040 (1183808)
Initialized Data: 0x8041C990 - 0x8041E400 (6768)
BSS Area: 0x8041E400 - 0x80420040 (7232)
Local Heap: 0x80420040 - 0x80520040 (1048576)
Stack Area: 0x80520040 - 0x80522040 (8192)
Text (code) segment: 0x80401000 - 0x8041C990 (113040)
Boot area (physical): 0x00523000 - 0x00563000
Relocation Factor: I:00000000 - D:00000000

getShareBlks: i=0, sect_size=8192, end_blk=1
getShareBlks: i=0, sect_size=8192, end_blk=1
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id Name : 96348GW-11
Psi size in KB : 24
Number of MAC Addresses (1-32) : 11
Base MAC Address : 00:30:da:74:9d:e5
Ethernet PHY Type : External Using Reverse MII with SPI
Memory size in MB : 16

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1
web info: Waiting for connection on socket 0.
CFE>
CFE>
CFE>
CFE>
CFE>
CFE>
CFE>
CFE>
CFE> flashimage nb8.bin
Loading 192.168.1.100:nb8.bin ...
Loading failed.: C
*** command status = -21
CFE> flashimage nb8.bin
Loading 192.168.1.100:nb8.bin ...
Finished loading 3123528 bytes
Image flasing on block: 8
.Image flasing on block: 9
.Image flasing on block: 10
.Image flasing on block: 11
.Image flasing on block: 12
.Image flasing on block: 13
.Image flasing on block: 14
.Image flasing on block: 15
.Image flasing on block: 16
.Image flasing on block: 17
.Image flasing on block: 18
.Image flasing on block: 19
.Image flasing on block: 20
.Image flasing on block: 21
.Image flasing on
.Image flasing on block: 23
.Image flasing on block: 24
.Image flasing on block: 25
.Image flasing on block: 26
.Image flasing on block: 27
.Image flasing on block: 28
.Image flasing on block: 29
.Image flasing on block: 30
.Image flasing on block: 31
.Image flasing on block: 32
.Image flasing on block: 33
.Image flasing on block: 34
.Image flasing on block: 35
.Image flasing on block: 36
.Image flasing on block: 37
.Image flasing on block: 38
.Image flasing on block: 39
.Image flasing on block: 40
.Image flasing on
.Image flasing on block: 42
.Image flasing on block: 43
.Image flasing on block: 44
.Image flasing on block: 45
.Image flasing on block: 46
.Image flasing on block: 47
.Image flasing on block: 48
.Image flasing on block: 49
.Image flasing on block: 50
.Image flasing on block: 51
.Image flasing on block: 52
.Image flasing on block: 53
.Image flasing on block: 54
.Image flasing on block: 55
................

Finished flashing image.
Resetting board...

CFE version 1.0.37-5.17 for BCM96348 (32bit,SP,BE)
Build Date: Mon, 31 Jan 2005 23:36:28 +0800 (root@max-redhat)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.
Device id = 22a8
totalBlks=71
totalSize=4096K
getShareBlks: i=70, sect_size=65536, end_blk=71
getShareBlks: i=0, sect_size=8192, end_blk=1
getShareBlks: i=0, sect_size=8192, end_blk=1
fInfo.flash_nvram_start_blk = 0
fInfo.flash_nvram_blk_offset = 0x580
fInfo.flash_nvram_number_blk = 1
psi startAddr = bfffa000
fInfo.flash_persistent_start_blk = 70
fInfo.flash_persistent_blk_offset = 0xa000
fInfo.flash_persistent_number_blk = 1
init 5325E: init mii=9f
getShareBlks: i=0, sect_size=8192, end_blk=1
CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz

Total memory used by CFE: 0x80401000 - 0x80522040 (1183808)
Initialized Data: 0x8041C990 - 0x8041E400 (6768)
BSS Area: 0x8041E400 - 0x80420040 (7232)
Local Heap: 0x80420040 - 0x80520040 (1048576)
Stack Area: 0x80520040 - 0x80522040 (8192)
Text (code) segment: 0x80401000 - 0x8041C990 (113040)
Boot area (physical): 0x00523000 - 0x00563000
Relocation Factor: I:00000000 - D:00000000

getShareBlks: i=0, sect_size=8192, end_blk=1
getShareBlks: i=0, sect_size=8192, end_blk=1
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kern
Boot delay (0-9 seconds) : 1
Board Id Name : 96348GW-11
Psi size in KB : 24
Number of MAC Addresses (1-32) : 11
Base MAC Address : 00:30:da:74:9d:e5
Ethernet PHY Type : External Using Reverse MII with SPI
Memory size in MB : 16

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Code Address: 0x80010000, Entry Address: 0x801be018
Decompression OK!
Entry at 0x801be018
Closing network.
Starting program
Linux version 2.6.8.1 (yyl@bcm-linux.comtrend.com) (gcc version 3.4.2) #1 Wed Au
g 16 19:32:01 CST 2006
Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB
Total Flash size: 4096K with 71 sectors
96348GW-11 prom init
CPU revision is: 00029107
mpi: No Card is in the PCMCIA slot
Determined physical RAM map:
memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
DMA zone: 4000 pages, LIFO batch:1
Normal zone: 0 pages, LIFO batch:1
HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB 2-way, linesize 16 bytes.
PID hash table entries: 64 (order 6: 512 bytes)
Using 128.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 13860k/16000k available (1491k kernel code, 2120k reserved, 224k data, 7
2k init, 0k high
Calibrating delay loop... 255.59 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction... unavailable.
NET: Registered protocol family 16
Can't analyze prologue code at 80183604
usbcore: registered new driver hub
Initializing Cryptographic API
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v1.0
ohci_hcd: 2004 Feb 02 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI)
ohci_hcd: block sizes: ed 64 td 64
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
ohci_hcd 0000:00:09.0: OHCI Host Controller
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: irq 20, pci mem c0000b00
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 1
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
brcmboard: brcm_board_init entry
bcm963xx_serial driver v2.0
NET: Registered protocol family
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
Initializing IPsec netlink socket
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
NET: Registered protocol family 8
NET: Registered protocol family 20
802.1Q VLAN Support v1.8 Ben Greear
All bugs added by David S. Miller
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 72k freed
init started: BusyBox v1.00 (2006.08.16-11:35+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5

BusyBox v1.00 (2006.08.16-11:35+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

Loading drivers and kernel modules...

atmapi: module license 'Proprietary' taints kernel.
blaadd: blaa_detect entry
adsl: adsl_init entry
Broadcom BCMPROCFS v1.0 initialized
Broadcom BCM6348A2 Ethernet Network Device v0.3 Aug 16 2006 19:30:52
Config Ethernet Switch Through SPI Slave Select 1
dgasp: kerSysRegisterDyingGaspHandler: eth0 registered
eth0: MAC Address: 00:30:DA:74:9D:E5
Broadcom BCM6348A2 USB Network Device v0.4 Aug 16 2006 19:30:54
usb0: MAC Address: 00 30 DA 74 9D E6
usb0: Host MAC Address: 00 30 DA 74 9D E7
PCI: Setting latency timer of device 0000:00:01.0 to 64
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
wl0: Broadcom BCM4320 802.11 Wireless Controller 3.131.35.0.cpe2.3
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
BcmAdsl_Initialize=0xC0060228, g_pFnNotifyCallback=0xC0076C34
pSdramPHY=0xA0FFFFF8, 0x3A142 0xDEADBEEF
eth0 Link UP.
AdslCoreHwReset: AdslOemDataAddr = 0xA0FF8A54
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
ATM proc init !!!

==> Comtrend Router Software Version: A101-306NCM-C01_R05

device usb0 entered promiscuous mode
eth0 Link DOWN.
eth0 Link UP.
br0: port 1(usb0) entering learning state
br0: topology change detected, propagating
br0: port 1(usb0) entering forwarding state
device eth0 entered
br0: port 2(eth0) entering learning state
br0: topology change detected, propagating
br0: port 2(eth0) entering forwarding state
Setting SSID "wireless"
Setting SSID "Guest"
Setting country code using abbreviation: "AU"
wlctl: Undefined error
wl0: current channel 11
device wl0 entered promiscuous mode
br0: port 3(wl0) entering learning state
br0: topology change detected, propagating
br0: port 3(wl0) entering forwarding state
device wl0.1 entered promiscuous mode
device usb0 left promiscuous mode
br0: port 1(usb0) entering disabled state
device usb0 entered promiscuous mode
br0: port 1(usb0) entering learning state
br0: topology change detected, propagating
br0: port 1(usb0) entering forwarding state
device eth0 left promiscuous mode
br0: port 2(eth0) entering disabled state
device eth0 entered promiscuous mode
br0: port 2(eth0) entering learning state
br0: topology change detected, propagating
br0: port 2(eth0) entering forwarding state
device wl0 left promiscuous mode
br0: port 3(wl0) entering disabled state
device wl0 entered promiscuous mode
br0: port 3(wl0) entering learning state
br0: topology change detected, propagating
br0: port 3(wl0) entering forwarding state
device wl0.1 left promiscuous mode
br0: port 4(wl0.1) entering disabled state
device wl0.1 entered promiscuous mode
Scratch pad is not initialized.
Scratch pad is not initialized.
sntp: host not found
ADSL device /dev/bcmadsl0 succesfully opened, fd 7.
No scratch pad found. Initialize scratch pad...
br0: port 1(usb0) entering disabled state
ATM transport vpi/vci 0/16 succesfully opened, fd 8.
Sending coldstart
snmpEocSend(): error writing data to device, write returns -1

Login:
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

asus firm on comtrend 536+ too 

FE> flashimage asus.bin                       
Loading 192.168.1.100:asus.bin .                               
Finished loading 3238662 bytes                             
Image flasing on block: 8                         
.Image flasing on block: 9                         
.Image flasing on block: 10                           
.Image flasing on block: 11                           
.Image flasing on block: 12                           
.Image flasing on block: 13                           
.Image flasing on block: 14                           
.Image flasing on block: 15                           
.Image flasing on block: 16                           
.Image flasing on block: 17                           
.Image flasing on block: 18                           
.Image flasing on block: 19                           
.Image flasing on block: 20                           
.Image flasing on block: 21                           
.Image flasing on block: 22                           
.Image flasing on block: 23                           
.Image flasing on block: 24                           
.Image flasing on               
.Image flasing on block: 26talSize=4096K             
.Image flasing on block: 27ize=65536, end_blk=71     
.Image flasing on block: 28             
getShareBlks:
.Image flasing on block: 29k=1                       
.Image flasing on block: 30eBlks: i=0, sect_size=8192,
.Image flasing on block: 31                         

.Image flasing on block: 32= 0                       
.Image flasing on block: 33k_offset = 0x580           
.Image flasing on block: 34nfo.flash_nvram_number_blk
.Image flasing on block: 35       
psi startAddr = bff
.Image flasing on block: 36
fInfo.flash_persistent_st
.Image flasing on block: 37                     
fInfo
.Image flasing on block: 38 = 0xa000                 
.Image flasing on block: 39fo.flash_persistent_number_
.Image flasing on block: 40               
init 5325E
.Image flasing on block: 41     
init 5325E: init suc
.Image flasing on block: 42               
getShareBl
.Image flasing on block: 43_blk=1                     
.Image flasing on     
         
.Image flasing on block: 52                           
.Image flasing on block: 53           0x80420040 - 0x8
.Image flasing on block: 54                           
.Image flasing on block: 55 Area:                0x805
.Image flasing on block: 56                           
.Image flasing on block: 57Text (code) segment:       
..............8041C990 (1130

Finished flashing image.                       
Resetting board...rea (physical):   

CFE version 1.0.37-5.17 for BCM96348 (32bit,SP,BE)                       
Relocation Factor:       
Build Date: Mon, 31 Jan 2005 23:36:28 +0800 (r                           

             
Board IP addres
Device id = 22a8: 192.168.1.1:ff
totalBlks=71           
totalSize=4096K               
getShareBlks: i=70, sect_size=65536, end_blk=71.100                                           
getShareBlks: i=0, sect_size=8192, end_blk=1                         
Run from flash/ho
getShareBlks: i=0, sect_size=8192, end_blk=1       
Default host run file name      : v
fInfo.flash_nvram_start_blk = 0               
Default host fl
fInfo.flash_nvram_blk_offset = 0x580                                   
fInfo.flash_nvram_number_blk = 1seconds)        : 1             
psi startAddr = bfffa000ard Id Name             
fInfo.flash_persistent_start_blk = 70                       
Psi size in
fInfo.flash_persistent_blk_offset = 0xa000                 
Number of MAC Addresses
fInfo.flash_persistent_number                 
         
Initialized Data:          0x8041C990 - 0x8041E400 (6768) 
Auto run second count down: 0                         
BSS Area:                  0x8041E400 - 0x80420040 (7232)                                                 
Decompr
Local Heap:                0x80420040 - 0x80520040 (1048576)     
Closing network.               
Starting program at 0
Stack Area:                0x80520040 - 0x80522040 (8192)8.1 (yyl@bcm-linux.comtrend.com) (gcc version 3.4.2) #1 W
Text (code) segment:       0x80401000 - 0x8041C990 (113040)                         
g 16 19:32:01 CST 2006           
Boot area (physical):      0x00523000 - 029LV32                                 
On node 0 totalp
Host IP address                 : 192.168.1.100 4000 pages, LIFO batch:1                     
Gateway IP address              :ges, LIFO batch:1               
Run from flash/host (f/h)       : f 0 pages, LIFO batch:1             
Default host run file name      : vmlinux                 
Kernel command line: ro
Default host flash file name    : bcm963xx_fs_kernel       
brcm mips: enabling icache and dcache...   
Boot delay (0-9 seconds)        : 1
Primary instruction cache 16kB, p
Board Id Name                   : 96348GW-11                                           
Psi size in KB               
                       
Auto run second count down: 0ered promiscuous mode       
Code Address: 0x80010000, Entry Address: 0x80246018entries: 2048 (order: 1, 8192 bytes)               
Decompression OK!                 
Entry at 0x80246018ogy cha           
Closing network.60k/16000k avail
Starting program at 0x80246018reserved, 224k data, 7th0) ent
Linux version 2.6.8.1 (brama@mp3) (gcc version 3.4.2) #1 Wed Dec 20 20:11:55 CET                                                   
Settin     
2k init, 0k hig
2006     
CPU revision is: 00029107:28 +080                 
mpi: No Card is in the PCMCIA slot               
PPP generic driver
Determined physical RAM map:lk=71                       
memory: 00fa0000 @ 00000000 (usable)istered protocol family 24           
On node 0 totalpages: 4000ShareBlks: i=0, sect_size=
  DMA zone: 4000 pages, LIFO batch:1
Using noop io scheduler           
  Normal zone: 0 pages, LIFO batch:1, sect_size=8192, end_b             
  HighMem zone: 0 pages, LIFO batch:1ci_hcd: 2004 Feb 02 USB 1.1 'Open' Ho
Built 1 zonelistsI) Driver (PCI)bl
Kernel command line: root=31:0 ro noinitrd                                         

brcm mips: enabling i                   
fInf
PID hash table entries: 64 (order 6: 512 bytes) Host Controller                               
Using 128.000 MHz high precision timer.                     
PCI: Setting late
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)                               
fInfo.flash_persistent_number
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)gistered protocol family 2(1048576)                       
Memory: 13340k/16000k available (1578k kernel code, 2640k reserved, 681k data, 7 0x80520040 - 0x80522040 (8192)                                                 
6k init, 0k highmem)                   
Calibrating delay loop... 254.77 BogoMIPSed 512 bind 1024)e) segment:       0x80 
Mount-cache hash table entries: 512 (                                   
NET: Registered protocol family 16                       
NET: Regi
Can't analyze prologue code at 801992fc                 
getShareBlks: i=0, se
usbcore: registered new driver usbfsET: Registered protocol family 20   
usbcore: registered new driver hubrd IP       
802.1Q VLAN Support
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)                                               
Host I
devfs: boot_options: 0x1All bugs added by David
NTFS driver 2.1.15 [Flags: R/O DEBUG].                                     
PPP generic driver version 2.4.2       
VFS: Mounted root (squas
NET: Registered protocol family 24       : f                       
Linux video capture interface: v1.00       
Freeing unused kernel memor
Using noop io scheduler                       
bcm963xx_mtd driver v1.0 started:  BusyBox v1.00
brcmboard: brcm_board_init entryll                             
bcm963xx_serial d               
blaadd: blaa_
TCP: Hash tables configured (established 512 bind 1024)try                     
Memor     
Broadcom BCMPROCFS
NET: Registered protocol family 1                 

** 
Broadcom
NET: Registered protocol family 170.3 Aug 16 2006 19:30:52         
Ebtables v2.0 registered                       
NET: Registered protocol family 8wn: 1                           
NET: Registered protocol family 20I Slave Select 1ion on socket 0. 
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
dgasp: kerSysRegisterDyingGaspHandler: eth0 registered     
All bugs added by David S. Miller <davem@redhat.com>>   
CFE>   
CFE>   
CFE> flashimage nb8.bin     
VFS: Mounted root (squashfs filesystem) readonly.9D:E58.1.100:nb8.bin ..                         
Mounted devfs             
Asus mknod Init
getShareBlks:
Asus mknod finish (Roly)nd_blk=71               
Using /lib/modules/2.6.8.1/extra/atmapi.kosing on block: 27                         
atmapi: module license 'Proprietary' taints kernel.                                       
.Image flas
Using /lib/modules/2.6.8.1/extra/blaadd.koareBlks: i=0, sect_size=8192, end_blk=1on
blaadd: blaa_detect entry                         
Using /lib/modules/2.6.8.1/extra/bcm_enet.ko bfffa000sing on block: 35                 
Broadcom BCM6348A2 Ethernet Network Device v0.3 Aug 17 2006 16:02:3336                                               
fInfo.flash_persis
Config Ethernet Switch Through SPI Slave Select 1               
.Image flasing on block: 38     
eth0: MAC Address: 00:30:DA:74:9D:E5rsistent_number_blk = 1ng on block:
Using /lib/modules/2.6.8.1/extra/bcm_usb.ko         
init 5325E: init mii=0 block: 40
Broadcom BCM6348A2 USB Network Device v0.4 Aug 17 2006 16:02:34n                               
.Image flasing on block: 49 
usb0: MAC Address: 00 30 DA 74 9D E5                0x8041E400 - 0x80420
usb0: Host MAC Address: 0                       
wl0: Broadcom BCM4320 802.11 Wireless Controller 3.91.41.041C990 (113040)                                           
cfm init()     
Rese
BcmAdsl_Initialize=0xC0054208, g_pFnNotifyCallback=0xC0067374      0x00523000 - 0x00563000                               
AdslCoreHwReset: AdslOemDataAddr = 0xA0FF8054      : vmlinux                             
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered       
Default host flash file name    : bcm963xx_fs_

==>   Bcm963xx Software Version: 3.02L.01.A2pB018e.d16f   <==                                     
Boot delay (0-9 seconds

device usb0 entered pro                     
Code Address: 0
br0: port 2(eth0) entering learning state                                         
eth0 Link UP.         
Dec
br0: topology change detected, propagating                     
Entry at 0x801be018
br0: port 2(eth0) entering forwarding state       
Local Heap:           
Starting pr
Setting country code "ALL" (1048576)               
device wl0 entered promiscuous modeux version 2.6.8.1 (yyl@bcm-linux.c
br0: port 3(wl0) entering learning stateu20040 - 0x80522040 (8192)             
br0: topology change detected, propagating                                         
br0: port 3(wl0) entering forwarding state       
CPU revision is: 00029107       
infosvr start!!!
               
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver 
  Normal zone: 0 pages, LIFO batch:1                         
br0: port 3(wl0) entering disabled statebatch:1 :                               
Setting country code "ALL"ts (f/h)       : f       
br0: port 3(wl0) entering learning stateline: root=31:0 ro noinitrdhost run file
br0: topology change detected, propagating                                         
br0: port 3(wl0) entering forwarding statecache...host flash file name    : bcm963xx
br0: port 3(wl0) entering disabled st                                   
drivers/usb/media/ov511.c: v1.64 for Linux 2.5 : ov511 USB Camera Driver                                                           
Inode-cache
pwc: falsely claims to have parameter dev_hint                                             
pwc Philips webcam module version 9.0.1 loaded.n (1 secon                       
nd MPC-C30,
pwc the Creative WebCam 5 & Pro Ex, SOTEC Afina Eye and Visionite VCS-UC300 and
VCS-UM100.
usbcore: registered new driver Philips webcam
SCSI subsystem initialized
br0: port 3(wl0) entering learning state
br0: topology change detected, propagating
br0: port 3(wl0) entering forwarding state
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
br0: port 1(usb0) entering disabled state
br0: port 3(wl0) entering disabled state
br0: port 3(wl0) entering learning state
br0: topology change detected, propagating
br0: port 3(wl0) entering forwarding state
br0: port 3(wl0) entering disabled state
br0: port 3(wl0) entering learning state
br0: topology change detected, propagating
br0: port 3(wl0) entering forwarding state
device wl0 is already a member of a bridge; can't enslave it to bridge br0.

Login:

(Last edited by darkdead on 9 Mar 2007, 04:28)

So you got OpenWRT working on a Siemens SL2-141-I?
Where can I get the firmware?

No i can load others firms based on bcm 6348 gpl code on my comtrend soo seems they shared the code it's seems
now we need to start sharing pcb chips info soo we can see if there a generic pcb on all whit  small only diferences like voz-ip cards  <-- this one i dnot remeber how it suposed to spell or wifi 108 mbts card like usr 91108 works but had problems whit save and  load configs whit the mini pci in whit out it works and save configs.

PD:I implemt the jtag and haryman debric but the CFE seems only can read and write random code when i tryed to load a generic CFE or
full image it stop in 3 line seems the firm need to have  mac embled on it or any stuf i was misning it tryed all swiching comand like /nodma or /whachdog off

(Last edited by darkdead on 9 Mar 2007, 13:53)

darkdead, if you have the means to debrick the comtrend, you can dowload a snapshot of kamikaze svn and build it for the 6348 (you have to edit target/linux/brcm63xx-2.6/config/default to activate CONFIG_IP_NF_CONNTRACK_MARK and use V=99 to see the prompt and confirm an option during the build).
I'm pretty sure it will brick your router, but since you have a jtag cable it shouldn't be a big problem.

How do you select BCM63xx in menuconfig? Do you apply a patch?

I don't remember now, sorry. I do remember that I had to update make to the version required by openwrt ("3.81 or later").

Does someone know how to compile for bcm63xx. And if it is possible, I suppose the broadcom drivers must be used?

btw, is there sb trying to make open drivers for 63xx chip?

My ISP installs a locked down Comtrend 536+ modem and won't allow the subscribers any access to it through http.   The DSL shut down the other day because my modem was fried by a power surge, so I grabbed a spare Cayman 3346 out of my service van and plugged it up but couldn't get on.  When I called the ISP to ask for verification of the VCI/VPI/Encap and related settings they were outraged that I wanted the info!  No matter how I tried to explain to them that this is not privileged information and has nothing to do with their company secrets they wouldn't budge and I had to wait for the tech to come out with another modem.  He also was smug about keeping the login and settings private and during his visit I found out they won't even activate the other 3 ethernet ports without a charge!

Being a little outdone with their attitude and not wanting to be in the same situation the next time the modem dies and I have a system down 400 miles away that I could fix in 5 minutes using ssh I set out to get the info from the modem somehow.   I discovered you can login to http as user/user and see device info and the log, and you can login to telnet the same way.  In telnet you can also get a dumpcfg which yields the entire configuration, including the passords but they are encrypted.  I'd like to flash the modem or at least factory reset it but I don't want to lose the config including the passwords just in case.  Is there any way to decrypt the passwords in the dump output?

Also can someone tell me what the cable and settings are for the console port so I can access the shell?  Thanks in advice for any suggestions.

I don't know a way to decrypt the passwords, but it shouldn't be very hard since the same file is used to restore configuration to the router.
OTOH if you know the ppp username and password (providing your isp is using pppoa or pppoe), you can gather the rest from the configuration file and use the reset button (I think it has to be pressed for at least 10 seconds) to restore it to the factory configuration (admin/admin or 1234/1234 or 12345/12345). HOWEVER if your isp is so paranoid, it's possible that they have a custom firmware with a different password, so it's not a risk-free operation.
About the serial port parameters, mine doesn't have one (it's possible to add it) but it should be possible to trick the command interpreter to access it from telnet, i.e. I do an

>sysinfo && sh

and that gives me access to the shell

thanks for the tip on getting shell from telnet.  I'll try it tonight.  They told me Friday that my ISP Password is indeed what I selected so maybe they aren't that paranoid, but there is a possibility, which is why I was trying to get the Cayman 3346 to work before I reset the Comtrend.  Although having the dump file theoretically I can reload the config from it if needed and it should work again.  It really bugs me why the Netopia won't work with either 8/35 or 0/35, LLC and PAP which all show up in the Comtrend config.  The only difference I saw was my login is usr.domain.name instead of user@domain.name, but that also didn't fix the cayman.

They must be using custom firmware on this model because sysinfo isn't found.  Or more likely the path variable isn't valid and the user/user login can't access anything but the basic commands.  I'm amazed I can get the dumpcfg.  Still trying to find a way to decode the passwords in the dump.

sysinfo was just an example, you could try, e.g. ping or whatever command that spawns a shell (commands that are directly executed by the command intepreter won't work), followed by "&& sh", e.g.

ping 127.0.0.1 && sh

Note that the bundled busybox has just the basic commands compiled in (no ls, use the echo * trick).

Edit: " ; " instead of " && " works too, and while the latter needs the command to succeed the former doesn't, so it's probably better.

(Last edited by pippolippi on 11 Apr 2007, 08:41)

good tips!  using ping or arp or other valid commands in the telnet and ; sh I did get into the shell and can poke around a bit using the echo * trick.  Seem to get only a few commands and it kicks back to the telnet console but at least I can do some more research on it.  I have a console cable now as well, but I have to figure out the settngs.  I plugged it up and played around in hyperterminal a bit but couldn't get anything readable yet.  Funny thing was I left it connected overnight and the next morning the adsl was offline and cycling the power didn't reset it.  I finally thought to unplug the console cable and it came back to life.

Are there any hopes for my Comtrend 536+ or better wait for complete support to the AR7 platform? I see OpenWRT now can boot under CM63XX family as basic level.

(Last edited by timofonic on 23 Nov 2007, 09:03)