Hacking Flarion Desktop Modem

This modem is made by Qualcomm Flarion Technologies – it’s FDM 2045 model.
T-Mobile also provides a firmware upgrade here (2.6.11):
http://www.t-mobile.sk/c1/sluzby_tarify/sunflower/new5/pkg-cust-tmsk.exe
and the latest version (3.0.6):
http://www.telekom.sk/download/DTMupgrade306.zip (local mirror)

When extracted (run in Wine and look in the TEMP directory), it contains dtm.tgz file which contains .dui files (unknown format), an ELF executable file for ARM architecture and a shell script “install.sh”. The kern.dui file contains interesting string “vmlinux.bin”.

By placing “telnetd” command in the install.sh file and running the firmware “update”, you can connect to the device:

$ telnet 172.30.30.128
Trying 172.30.30.128...
Connected to 172.30.30.128.
Escape character is '^]'.

BusyBox v1.00-rc3 (2005.06.29-14:39+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # dmesg
6, size 393216
SDRAM start 8d04f50 end 8d64f50
SYSMEM_ABM_Impl: file emacdmarx.c, line 119, size 48
SDRAM start 8d64f50 end 8d64f80
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 768
SDRAM start 8d64f80 end 8d65280
SRAM start f0802800 end f0803000
eth0 DmaRxChannel 8d036e8
EMAC Network Driver Cnxt 2004/06/07 00:30:cd:00:02:d4
emac_probe: eth1 is not supported by CX861xx Family BSP
emac_probe: eth1 is not supported by CX861xx Family BSP
emac_probe: eth2 is not supported by CX861xx Family BSP
emac_probe: eth3 is not supported by CX861xx Family BSP
emac_probe: eth4 is not supported by CX861xx Family BSP
emac_probe: eth5 is not supported by CX861xx Family BSP
emac_probe: eth6 is not supported by CX861xx Family BSP
emac_probe: eth7 is not supported by CX861xx Family BSP
CX861xx flash device: 400000 at 4000000 mapped to 900d000
cfi_intelext_setup: map = 0x08151AAC, cfi = 0x081C1CFC
0: offset=0x0,size=0x2000,blocks=8
1: offset=0x10000,size=0x10000,blocks=63
Using word write method
Creating 7 MTD partitions on "CX861xx flash device":
0x00000000-0x00020000 : "Bootloader"
0x00020000-0x00040000 : "TTLV Provisioning"
0x00040000-0x00110000 : "dui image containing compressed Linux Kernel"
0x00110000-0x001e0000 : "dui image containing tgz file for /apps"
0x001e0000-0x002b0000 : "Upgrade scratch area"
0x002b0000-0x00380000 : "dui image containing jffs2 image for /"
0x00380000-0x00400000 : "dui image containing tgz file for DSP images"
CX861xx flash device initialization completed
slram: devname = memmtd
slram: devstart = 0x8E00000
slram: devlength = 0x9000000
slram: devname=memmtd, devstart=0x8e00000, devlength=0x200000
slram: Registered device memmtd from 145408KiB to 147456KiB
slram: Mapped from 0x0940e000 to 0x0960e000
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
usb-ohci.c: USB OHCI at membase 0xf0606000, IRQ 17
usb.c: new USB bus registered, assigned bus number 1
usb.c: kmalloc IF 081fbc44, numif 1
usb.c: new device strings: Mfr=0, Product=2, SerialNumber=1
usb.c: USB device number 1 default language ID 0x0
Product: USB OHCI Root Hub
SerialNumber: f0606000
hub.c: USB hub found
hub.c: 1 port detected
hub.c: standalone hub
hub.c: ganged power switching
hub.c: no over-current protection
hub.c: Port indicators are not supported
hub.c: power on to power good time: 4ms
hub.c: hub controller current requirement: 0mA
hub.c: port removable status: R
hub.c: local power source is good
hub.c: no over-current condition exists
hub.c: enabling power on all ports
usb.c: hub driver claimed interface 081fbc44
usb.c: call_policy add, num 1 -- no FS yet
USB: CnxtUdcInit - init USB Controler
cnxt_usbd: sysGetUSBCfg

USB: UsbLoadSWDefaults

USB: ProfileInitDescriptorPtrs
cnxt_usbd: sysUSBHwInit
sysTimerDelay 1 start
sysTimerDelay 1 end
cnxt_usbd: taking USB out of reset
sysTimerDelay 3 start
sysTimerDelay 3 end
USB: USBUDCConfigure
USB: set EP2 IN
USB: set EP2 OUT
USB: set EP4 IN
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d65280 end 8d652d0
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d652d0 end 8d652e8
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 192
SDRAM start 8d652e8 end 8d653a8
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 512
SDRAM start 8d653b0 end 8d655b0
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d655b0 end 8d65670
SRAM start f0803000 end f0803200
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d65670 end 8d656c0
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d656c0 end 8d656d8
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 96
SDRAM start 8d656d8 end 8d65738
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 256
SDRAM start 8d65740 end 8d65840
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d65840 end 8d65900
SRAM start f0804000 end f0804100
USB: USBEth_restart_tx
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d65900 end 8d65950
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d65950 end 8d65968
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 192
SDRAM start 8d65968 end 8d65a28
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 512
SDRAM start 8d65a30 end 8d65c30
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d65c30 end 8d65cf0
SRAM start f0805000 end f0805100
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d65cf0 end 8d65d40
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d65d40 end 8d65d58
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 192
SDRAM start 8d65d58 end 8d65e18
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 512
SDRAM start 8d65e20 end 8d66020
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d66020 end 8d660e0
SRAM start f0805200 end f0805400
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d660e0 end 8d66130
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d66130 end 8d66148
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 3072
SDRAM start 8d66148 end 8d66d48
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 204800
SDRAM start 8d66d50 end 8d98d50
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 1536
SDRAM start 8d98d50 end 8d99350
SRAM start f0806000 end f0806800
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d99350 end 8d993a0
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d993a0 end 8d993b8
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 1536
SDRAM start 8d993b8 end 8d999b8
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 4096
SDRAM start 8d999c0 end 8d9a9c0
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 768
SDRAM start 8d9a9c0 end 8d9acc0
SRAM start f0806800 end f0807000
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d9acc0 end 8d9ad10
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d9ad10 end 8d9ad28
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 24
SDRAM start 8d9ad28 end 8d9ad40
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 64
SDRAM start 8d9ad40 end 8d9ad80
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d9ad80 end 8d9ae40
SRAM start f0807000 end f0807100
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d9ae40 end 8d9ae90
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d9ae90 end 8d9aea8
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 96
SDRAM start 8d9aea8 end 8d9af08
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 256
SDRAM start 8d9af10 end 8d9b010
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d9b010 end 8d9b0d0
SRAM start f0807200 end f0807400
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d9b0d0 end 8d9b120
ReleaseMem SDRAM <7>8d9b0d0
USB: USBEth_restart_tx
USB: USBEth_restart_tx
USB: USBEth_restart_tx
USB: USBEth_restart_tx
USB: USBEth_restart_tx
USB: USB device has been properly initilized (&x)
USBEth Network Driver Cnxt 2004/05/10
USBEth_probe: usb0 found.
USB: USBEth_probe, hw_num 0
USB: USBEth_init_rx
Rx DMA Ring 8cb0000
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
cramfs: wrong magic
VFS: Mounted root (jffs2 filesystem).
Mounted devfs on /dev
Freeing init memory: 52K
usb0 : CNXT set mac address
00 07 35 a2 f6 64.
eth0: (CX861xx EMAC) started!
USBEth_open
usb0: (CX861xx USB) started!
ip_tables: (C) 2000-2002 Netfilter core team
PAD DNS Filter module initializing
ip_conntrack (112 buckets, 896 max)
/ # ps axu
PID  Uid     VmSize Stat Command
1 root        272 S   init
2 root            SW  [keventd]
3 root            SWN [ksoftirqd_CPU0]
4 root            SW  [kswapd]
5 root            SW  [bdflush]
6 root            SW  [kupdated]
7 root            SW  [EMAC1_Task]
8 root            SW  [mtdblockd]
9 root            SW  [khubd]
10 root            SW  [swapper]
12 root            SWN [jffs2_gcd_mtd7]
70 root        272 S   init
71 root        324 S   /bin/sh /etc/init.d/rc 2
86 root            Z   [syslogd]
92 root        276 S   syslogd -m 0 -O /dev/null
148 root        316 S   /sbin/pad_dhcp_proxy eth0 usb0 172.30.30.128
eth1 172.30.30.129 172.30.30.1 255.255.255.0 10
154 root         72 S   /sbin/oam
155 root        144 S   /sbin/watchdog
156 root        236 S   /sbin/dtm_ota_upgrade
157 root         72 S   /sbin/oam
165 root        152 S   /sbin/pad_dns_proxy pad.flarion.local 172.30.30.128
170 root        308 S   /bin/sh /bin/watch_proc.sh
176 root        188 S   webs
182 root        336 S   /bin/sh
1167 root            Z   [tar]
1183 root            Z   [telnetd]
1194 root        248 S   telnetd
1219 root        344 S   /bin/sh
1243 root        192 S   sleep 20
1244 root        256 R   ps axu
/ # uname -a
Linux flarion_pad 2.4.18-rmk8 #303 Sun Jul 8 20:14:30 EDT 2007 armv5EJl unknown
/ # cat /proc/cpuinfo
Processor       : ARM ARM926EJ-Sid(wb) rev 3 (v5EJl)
BogoMIPS        : 99.73
Features        : swp half thumb fastmult

Hardware        : Flarion Lightning Desktop Modem
Revision        : 0000
Serial          : 0000000000000000
/ # free
total         used         free       shared      buffers
Mem:        12620         7540         5080            0           16
Swap:            0            0            0
Total:        12620         7540         5080
/ # df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/mtdblock/7           2.0M      1.1M    956.0k  53% /
/ # cat /proc/mounts
/dev/mtdblock/7 / jffs2 rw 0 0
none /dev devfs rw 0 0
none /apps ramfs rw 0 0
/proc /proc proc rw 0 0

By analyzing the data flow during firmware upload (using wireshark), a C implementation of uploader called flarion_upload was created. It allows upgrading the firmware from Linux – just upload the dtm_2.6.11.tgz (extracted from the official Windows upgrade package) file to the flarion (flarion_upload dtm_2.6.11.tgz) and wait until it updates and reboots itself (more than 2 minutes). It was tested on Linux only. You can also use it to upload flarion_telnet.tgz so you can connect using telnet.

Flarion inside:

  • Conexant CX86111 CPU
  • Micron MT48LC8M16A2 SDRAM (16MB)
  • Intel 28F320C3B Flash ROM (4MB)
  • Cortina WJ972MA4 10/100 Mbps Ethernet PHY (Intel LXT972M)

flarion_3

USB Boot mode

If the two pads marked “USB boot” are shorted together during power up, the CPU does not load firmware from flash but loads boot loader from internal ROM. I have reverse engineered the protocol and created cx861xx_flash utility which can be used to read/write the flash – recover dead/bricked device! To debrick, you need full flash dump from a working device – either dump it yourself or get 3.0.6 here: flarion_3.0.6_full.tar.gz. The flash does not contain any IDs or calibration data (they’re stored in separate EEPROM) so it’s safe.
lsusb -v:

Bus 001 Device 004: ID 0572:cafc Conexant Systems (Rockwell), Inc.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass          255 Vendor Specific Class
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x0572 Conexant Systems (Rockwell), Inc.
  idProduct          0xcafc
  bcdDevice            1.00
  iManufacturer           1 -
  iProduct                2 Network Processor
  iSerial                 3 ????????
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           67
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0xc0
      Self Powered
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           7
      bInterfaceClass         0 (Defined at Interface level)
      bInterfaceSubClass      0
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval             200
Device Status:     0x0001
  Self Powered

Serial console

Serial console is available at pins marked RS232. It’s NOT TTL or 3,3V level, it’s regular RS232 so just directly connect it to PC serial port (RX<->TX). Parameters are 115200 bps, 8 bits, no parity, 1 stop bit.

Boot log:

Conexant Boot Loader v0.9
Copying root fs to SLRAM MTD area
Copying root file system from 42b0024, 4370024 to 8e00000
Uncompressing vmlinux.bin from 4040024, 40dd9d5 to 8008000 ...done.
Now booting the kernel
kernel command line arguments: root=/dev/mtdblock7 rw init=/linuxrc mem=14336K
slram=memmtd,0x8E00000,0x9000000 panic=1 console=ttyS2,115200n8

Linux version 2.4.18-rmk8 (root@msbuild-linux.qft.qualcomm.com) (gcc version 3.2.2) #304
Mon Jan 19 08:45:07 EST 2009
CPU: ARM ARM926EJ-Sid(wb) revision 3
Machine: Flarion Lightning Desktop Modem
On node 0 totalpages: 3584
zone(0): 3584 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock7 rw init=/linuxrc mem=14336K
slram=memmtd,0x8E00000,0x9000000 panic=1 console=ttyS2,115200n8
Calibrating delay loop... 99.73 BogoMIPS
Memory: 14MB = 14MB total
Memory: 12568KB available (1179K code, 285K data, 52K init)
Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode-cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
POSIX conformance testing by UNIFIX
SYSMEM_ABM_Impl: file pci_ext.c, line 159, size 320
SDRAM start 8d00000 end 8d00140
PCI: bus0: Fast back to back transfers disabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
sysEmacClockInit: EMACPHY=6
DES3X_Init hw address 601c00
SRAM start f0802000 end f0802200
SRAM start f0802200 end f0802300
DES3X_Init a 81487d4 814863c
Magnemite ASIC (Id: 1A01 Version: E02): read/write test OK.
Starting kswapd
devfs: v1.10 (20020120) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
pty: 256 Unix98 ptys configured
Serial driver version 5.06 (2004-04-16) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS0 at 0xf0604c00 (irq = 20) is a 16550A
ttyS1 at 0xf0604c00 (irq = 11) is a 16550A
ttyS2 at 0xf0604d00 (irq = 11) is a 16550A
block: 64 slots per queue, batch=16
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
SYSMEM_ABM_Impl: file cnxtEmac.c, line 1725, size 2468
SDRAM start 8d00140 end 8d00ae4
SYSMEM_ABM_Impl: file cnxtEmac.c, line 1745, size 1
SDRAM start 8d00ae4 end 8d00ae5
Adapter F0604000
Found Intel's LXT972A PHY: (phy_id 1378E2 phy address 1)
Current link status 0
emac_probe: eth0 found.
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d00ae8 end 8d00b38
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d00b38 end 8d00b50
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 6144
SDRAM start 8d00b50 end 8d02350
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 4096
SDRAM start 8d02350 end 8d03350
SYSMEM_ABM_Impl: file emacdmatx.c, line 102, size 152
SDRAM start 8d03350 end 8d033e8
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 768
SDRAM start 8d033e8 end 8d036e8
SRAM start f0802400 end f0802800
eth0 DmaTxChannel 8d00ae8
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d036e8 end 8d03738
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d03738 end 8d03750
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 6144
SDRAM start 8d03750 end 8d04f50
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 393216
SDRAM start 8d04f50 end 8d64f50
SYSMEM_ABM_Impl: file emacdmarx.c, line 119, size 48
SDRAM start 8d64f50 end 8d64f80
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 768
SDRAM start 8d64f80 end 8d65280
SRAM start f0802800 end f0803000
eth0 DmaRxChannel 8d036e8
EMAC Network Driver Cnxt 2004/06/07 00:30:cd:00:02:26
CX861xx flash device: 400000 at 4000000 mapped to 900d000
cfi_intelext_setup: map = 0x08151AAC, cfi = 0x081C1CFC
Using word write method
Creating 7 MTD partitions on "CX861xx flash device":
0x00000000-0x00020000 : "Bootloader"
0x00020000-0x00040000 : "TTLV Provisioning"
0x00040000-0x00110000 : "dui image containing compressed Linux Kernel"
0x00110000-0x001e0000 : "dui image containing tgz file for /apps"
0x001e0000-0x002b0000 : "Upgrade scratch area"
0x002b0000-0x00380000 : "dui image containing jffs2 image for /"
0x00380000-0x00400000 : "dui image containing tgz file for DSP images"
CX861xx flash device initialization completed
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
usb-ohci.c: USB OHCI at membase 0xf0606000, IRQ 17
usb.c: new USB bus registered, assigned bus number 1
Product: USB OHCI Root Hub
SerialNumber: f0606000
hub.c: USB hub found
hub.c: 1 port detected
USB: CnxtUdcInit - init USB Controler
cnxt_usbd: sysGetUSBCfg

USB: UsbLoadSWDefaults

USB: ProfileInitDescriptorPtrs
cnxt_usbd: sysUSBHwInit
sysTimerDelay 1 start
sysTimerDelay 1 end
cnxt_usbd: taking USB out of reset
sysTimerDelay 3 start
sysTimerDelay 3 end
USB: USBUDCConfigure
USB: set EP2 IN
USB: set EP2 OUT
USB: set EP4 IN
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d65280 end 8d652d0
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d652d0 end 8d652e8
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 192
SDRAM start 8d652e8 end 8d653a8
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 512
SDRAM start 8d653b0 end 8d655b0
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d655b0 end 8d65670
SRAM start f0803000 end f0803200
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d65670 end 8d656c0
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d656c0 end 8d656d8
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 96
SDRAM start 8d656d8 end 8d65738
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 256
SDRAM start 8d65740 end 8d65840
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d65840 end 8d65900
SRAM start f0804000 end f0804100
USB: USBEth_restart_tx
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d65900 end 8d65950
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d65950 end 8d65968
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 192
SDRAM start 8d65968 end 8d65a28
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 512
SDRAM start 8d65a30 end 8d65c30
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d65c30 end 8d65cf0
SRAM start f0805000 end f0805100
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d65cf0 end 8d65d40
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d65d40 end 8d65d58
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 192
SDRAM start 8d65d58 end 8d65e18
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 512
SDRAM start 8d65e20 end 8d66020
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d66020 end 8d660e0
SRAM start f0805200 end f0805400
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d660e0 end 8d66130
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d66130 end 8d66148
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 3072
SDRAM start 8d66148 end 8d66d48
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 204800
SDRAM start 8d66d50 end 8d98d50
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 1536
SDRAM start 8d98d50 end 8d99350
SRAM start f0806000 end f0806800
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d99350 end 8d993a0
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d993a0 end 8d993b8
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 1536
SDRAM start 8d993b8 end 8d999b8
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 4096
SDRAM start 8d999c0 end 8d9a9c0
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 768
SDRAM start 8d9a9c0 end 8d9acc0
SRAM start f0806800 end f0807000
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d9acc0 end 8d9ad10
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d9ad10 end 8d9ad28
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 24
SDRAM start 8d9ad28 end 8d9ad40
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 64
SDRAM start 8d9ad40 end 8d9ad80
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d9ad80 end 8d9ae40
SRAM start f0807000 end f0807100
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d9ae40 end 8d9ae90
SYSMEM_ABM_Impl: file dmabuff.c, line 129, size 24
SDRAM start 8d9ae90 end 8d9aea8
SYSMEM_ABM_Impl: file dmabuff.c, line 135, size 96
SDRAM start 8d9aea8 end 8d9af08
SYSMEM_ABM_Impl: file dmabuff.c, line 146, size 256
SDRAM start 8d9af10 end 8d9b010
SYSMEM_ABM_Impl: file LnxTools.c, line 190, size 192
SDRAM start 8d9b010 end 8d9b0d0
SRAM start f0807200 end f0807400
SYSMEM_ABM_Impl: file dmasrv.c, line 813, size 80
SDRAM start 8d9b0d0 end 8d9b120
USB: USBEth_restart_tx
USB: USBEth_restart_tx
USB: USBEth_restart_tx
USB: USBEth_restart_tx
USB: USBEth_restart_tx
USB: USB device has been properly initilized (&x)
USBEth Network Driver Cnxt 2004/05/10
USBEth_probe: usb0 found.
USB: USBEth_probe, hw_num 0
USB: USBEth_init_rx
Rx DMA Ring 8cb0000
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
cramfs: wrong magic
VFS: Mounted root (jffs2 filesystem).
Mounted devfs on /dev
Freeing init memory: 52K
Starting linuxrc...
No image in upgrade area to install
Mounting a ramfs on /apps
Populating /apps from Flash image
Populating /apps/dsp from Flash image
Mounting /proc
Running devfs
devfsd v1.3.25  started for /dev
Current mount state:
/dev/mtdblock/7 on / type jffs2 (rw)
none on /dev type devfs (rw)
none on /apps type ramfs (rw)
/proc on /proc type proc (rw)
Configuring IP Stack
Done linuxrc
Executing /sbin/init...
Start rcS...
Starting hostname.sh
Done hostname.sh
Starting modutils
Calculating module dependencies... Done rcS.
Starting rc...
Starting syslogd to /dev/null
done syslogd
Loading ft1000 module: Using /lib/modules/2.4.18-rmk8/kernel/drivers/net/wireless/ft1000/ft1000.o
Warning: loading ft1000 will taint the kernel: non-GPL license - MPL
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
done

Sleeping to give time for eth1 address to get set
Running mac_address_set...
usb0 : CNXT set mac address
 00 07 35 a2 f8 8b.
done mac_address_set
Pad operational mode:bridging
Starting bridging mode network services
sysTimerDelay 1 start
sysTimerDelay 1 end
cnxt_usbd: taking USB out of reset
sysTimerDelay 3 start
sysTimerDelay 3 end
USB: USBUDCConfigure
USB: set EP2 IN
USB: set EP2 OUT
USB: set EP4 IN
USB: USBEth_restart_tx
USB: USBEth_restart_tx
USB: USBEth_restart_tx
Setting up network interfaces and routing... eth0: (CX861xx EMAC) started!
USBEth_open
usb0: (CX861xx USB) started!
sysTimerDelay 1 start
sysTimerDelay 1 end
cnxt_usbd: taking USB out of reset
sysTimerDelay 3 start
sysTimerDelay 3 end
USB: USBUDCConfigure
USB: set EP2 IN
USB: set EP2 OUT
USB: set EP4 IN
USB: USBEth_restart_tx
USB: USBEth_restart_tx
USB: USBEth_restart_tx
Using /etc/flarion/arp_filter.o
USB: SendStringDescriptor (LANGUAGEID) 255
USB: SendStringDescriptor (PRODUCT) 255
insmod: usb_monitor.o: no module by that name found
Using /lib/modules/2.4.18-rmk8/kernel/net/ipv4/netfilter/ip_tables.o
ip_tables: (C) 2000-2002 Netfilter core team
done setting up network interfaces and routing
PAD proxy options:  eth0 usb0 172.30.30.128 eth1 172.30.30.129 172.30.30.1 255.255.255.0 10
Starting PAD DHCP proxy... PAD DHCP proxy... done
Oam is running
entering oamInit()
OAM is started

Starting PAD DNS proxy... Using /etc/flarion/pad_dns_filter.o
PAD DNS Filter module initializing
Starting PAD DNS proxy... done
Starting GoAhead webserver...
Done
Starting Console Shell

BusyBox v1.00-rc3 (2005.06.29-14:39+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # USB: SendStringDescriptor (PRODUCT) 2
USB: SendStringDescriptor (PRODUCT) 48
USB: SendStringDescriptor (MANUFACTURER) 255
USB: SendStringDescriptor (SERIAL) 255
USB: SendStringDescriptor (MAC_ADDRESS) 255

Comments are closed.