Sagemcom F@ST 1704


 * Product page •  Teardown

"GAW5.6U2B-5" and "REV:1.0 081222" is silkscreened on the board.

This device may be using BCM6338 (CFE identifies as
 * a BCM96338 design), or possibly BCM6333.

Per the boot log, the device is running Linux.

The default SSID appears to be WIN_XXXX where XXXX is the last
 * two octets of the WAN interface MAC (upper case hex letters).

The WAN MAC appears to be the wireless interface MAC plus one.

The power adapter included with the device is
 * a Click CPS012A120080U (12V, 0.8A).

Pinout
The serial header is above the CPU. The default login
 * credentials for the serial console are admin:admin.

to BCM4312 <-- [RxD] [TxD] [GND] [VCC] --> to RAM

Boot log
{{SCollapse|boot log CFE version 4.26.8 for BCM96338 (32bit,SP,BE) Build Date: Thu Sep 2 14:49:02 CST 2010 (cookiechen@SZ01007.DONGGUAN.CN) Copyright (C) 2005-2009 SAGEM Corporation.

Serial flash device: name NX25Q64, id 0xef16, size 8192KB CPU type 0x29010: 240MHz Total memory: 16777216 bytes (16MB) Boot Address 0xbf800000

Board IP address                 : 192.168.1.1:ffffff00 Host IP address                  : 192.168.1.100 Gateway IP address               : Run from flash/host (f/h)        : f Default host run file name        : vmlinux Default host flash file name     : bcm963xx_fs_kernel Boot delay (0-9 seconds)         : 1 Boot image (0=latest, 1=previous) : 0 Board Id (0-2)                   : F@ST1704 Number of MAC Addresses (1-32)   : 11 Base MAC Address                 : 6c:2e:85:6f:04:d6 PSI Size (1-64) KBytes           : 40

Auto run second count down: 0 Booting from latest image (0xbfc00000) ... Code Address: 0x80010000, Entry Address: 0x80216000 Decompression OK! Entry at 0x80216000 Closing network. Closing DMA Channels. Starting program at 0x80216000 Linux version 2.6.21.5 (cookiechen@SZ01007.DONGGUAN.CN) (gcc version 4.2.3) #1 Thu Apr 12 11:07:05 CST 2012 Serial flash device: name ID_W25X64, id 0xef16 size 8192KB F@ST1704 prom init CPU revision is: 00029010 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 DMA zone: 31 pages used for memmap DMA zone: 0 pages reserved DMA zone: 3969 pages, LIFO batch:0 Normal zone: 0 pages used for memmap Built 1 zonelists. Total pages: 3969 Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200 brcm mips: enabling icache and dcache... Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 8kB, 2-way, linesize 16 bytes. Synthesized TLB refill handler (21 instructions). Synthesized TLB load handler fastpath (33 instructions). Synthesized TLB store handler fastpath (33 instructions). Synthesized TLB modify handler fastpath (32 instructions). PID hash table entries: 64 (order: 6, 256 bytes) Using 120.000 MHz high precision timer. Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Memory: 13500k/16000k available (1789k kernel code, 2500k reserved, 278k data, 88k init, 0k highmem) KLOB Pool 1 Initialized: 2097152 bytes <0x80c00000 ... 0x80e00000> Calibrating delay loop... 235.52 BogoMIPS (lpj=117760) Mount-cache hash table entries: 512 wait instruction: enabled NET: Registered protocol family 16 Total Flash size: 8192K with 128 sectors BLOG v2.1 Initialized NET: Registered protocol family 8 NET: Registered protocol family 20 Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP reno registered squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro io scheduler noop registered (default) PPP generic driver version 2.4.2 NET: Registered protocol family 24 bcm963xx_mtd driver v1.0 File system address: 0xbfc00100 brcmboard: brcm_board_init entry Start wps button kernel thread! Serial: BCM63XX driver $Revision: 3.00 $ ttyS0 at MMIO 0xfffe0300 (irq = 10) is a BCM63XX bcmxtmrt: Broadcom BCM6338A2 ATM Network Device v0.1 Apr 12 2012 11:04:27 TCP cubic registered Initializing XFRM netlink socket NET: Registered protocol family 1 NET: Registered protocol family 10 NET: Registered protocol family 17 NET: Registered protocol family 15 Initializing MCPD Module Ebtables v2.0 registered 802.1Q VLAN Support v1.8 Ben Greear  All bugs added by David S. Miller  VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 88k freed init started: BusyBox v1.00 (2012.04.12-03:09+0000) multi-call binary mount: Mounting none on /proc/bus/usb failed: No such file or directory
 * Press any key to stop auto run (1 seconds) ***

BusyBox v1.00 (2012.04.12-03:09+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands.

Loading drivers and kernel modules...

pktflow: module license 'Proprietary' taints kernel. Broadcom Packet Flow Cache Char Driver v2.1 Nov 20 2009 22:59:50 Registered NBUFF v1.0 Initialized Broadcom Packet Flow Cache learning via BLOG enabled. Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Constructed Broadcom Packet Flow Cache v2.1 Nov 20 2009 22:59:47 bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry IPv6: add_dev failed for dsl0 Broadcom BCM6338A2 Ethernet Network Device v0.3 Apr 12 2012 11:03:31 Config Switch via PHY Through MDIO Pseudo PHY Interface

====> Entered BP_ENET_SWITCH_VIA_INTERNAL_PHY, PDOWN & RESET enet. BCM63xx_ENET: Auto-negotiation timed-out BCM63xx_ENET: 10 MB Half-Duplex (assumed) ethsw: found bcm5325e! eth0: MAC Address: 6C:2E:85:6F:04:D6 SDIOH mode switch from 1 to 2 available commands: sdio sdioh

---SDIO init SUCCEEDED--- blockmode capable

chipid 0x4014312 chip is bcm4312, use 512 bytes blksize bcmsdh_attach, sdioh_attach successful, bcmsdh->sdioh 0x80cbed40 wl: srom not detected, using main memory mapped srom info (wombo board) wl0: wlc_attach: MAC addr from system pool. id:0x776c0000 wl0: MAC Address: 6C:2E:85:6F:04:D7 wl0: Broadcom BCM4318 802.11 Wireless Controller 5.10.146.0.cpe4.404.1 dgasp: kerSysRegisterDyingGaspHandler: wl0 registered Trying to free already-free IRQ 25

Release Version 4.113.4_a4GL_WS_A2pB030l (build timestamp 120412_1107)
device eth0 entered promiscuous mode ADDRCONF(NETDEV_UP): eth0: link is not ready WLmngr Daemon is running optarg=0 shmId=0 wlevt_init@107: opened loopback socket 4 wlevt is ready for new msg... device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state BcmAdsl_Initialize=0xC007E808, g_pFnNotifyCallback=0xC009EC74 pSdramPHY=0xA0FFFFF8, 0x280724 0x33C9337 AdslCoreSharedMemInit: shareMemAvailable=5072 AdslCoreHwReset: AdslOemDataAddr = 0xA0FF4044 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered bcmxtmcfg: Tx Addr 0x80cc87bc, Tx Queue 0x80cc87dc device wl0 left promiscuous mode br0: port 2(wl0) entering disabled state device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state br0: port 2(wl0) entering disabled state br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state br0: port 2(wl0) entering disabled state wlctl: Unsupported There is no Predefined DevicePin in CFE WPS Device PIN = 30254749 Setting SSID "WIN_04D8" Setting SSID "wl0_Guest1" Setting SSID "wl0_Guest2" Setting SSID "wl0_Guest3" wlctl: Unsupported wlctl: Unsupported wlctl: Unsupported chanspec 0x2b01 selected br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state device wl0 left promiscuous mode br0: port 2(wl0) entering disabled state device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state br0: port 2(wl0) entering disabled state br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state Reaped 380 UPnP daemon is ready to run }}