wiki:Zyxel/VDSL_IAD

Zyxel Very High Speed Line, Customer Premises Equipment, Integrated Access Device (VDSL CPE IAD)

http://www.zyxel.com/uploads/images/public/vmg8924_b10a_spec_rear_pane.jpg

This article reports my investigations into a range of Zyxel and ISP-branded devices based on the  Broadcom BCM63168 chip-set. Zyxel launched their  VMG8324 and  VMG8924 VDSL CPE integrated access devices during summer 2013. These devices are also re-badged with custom firmware for ISPs.

There are two variations:

  • model suffix "-B10A"
    a regular analogue PSTN (Public Switched Telephone Network) version that supports ADSL (Asynchronous Digital Subscriber Line), ADSL2+ and VDSL (Very high speed Digital Subscriber Line aka Fibre To The Cabinet (FTTC)) using ATM (Asynchronous Transfer Mode). It has an RJ12 socket for the PSTN connection.
  • model suffix "-B30A"
    an ISDN (Integrated Services Digital Network) version.

There are two models:

  • VMG8324 provides single-band 802.11n (2.4GHz) WiFi
  • VMG8924 is dual-band, providing 802.11ac (5GHz) WiFi? using a  Broadcom BCM4360 based mini-PCIe adapter in a mini-PCIe card slot. The slot and associated components are not present in the VMG8324 although the solder pads are there.

The devices also provide 4 Gigabit Ethernet LAN switched RJ45 ports and can re-assign the high-speed WAN (Wide Area Network) link Gigabit Ethernet port to a 5th LAN port (useful when the router is connected to the PSTN). It has 2 RJ12 ports for analogue telephone devices which are supported by the two integrated  Microsemi VE890 LE89156 "Single Channel FXS VoicePort?" (Foreign Exchange Subscriber) to provide VoIP (Voice over Internet Protocol) services to analogue terminals (telephone or facsimile). It also has 2 USB (Universal Serial Bus) 2.0 host ports for attaching an external Cellular radio modem and storage devices for file-sharing on the LAN.

The device supports ADSL, ADSL2+, and VDSL2. In particular it supports the new G.vector (G.993.5) technology for reducing crosstalk on long lines - the prime reason I bought a VMG8324-B10A badged for the Ireland ISP as an "Eircom F1000".

The device bootloader is Broadcom's CFE (Common Firmware Environment). The operating system is GNU/Linux.

Broadcom BCM63168 Integrated Access Device

The BCM63168 and BCM63268 SoCs (System on Chip) consist of multiple Broadcom IP Blocks:

  • Dual-core VIPER (VoIP Enhanced RISC) processor (Broadcom MIPS 4350 32-bit) @ 400MHz
  • BCM435f 802.11 b/g/n Wireless Controller
  •  BCM53115 5-port Gigabit Ethernet switch
  • Dual Broadcom Forwarding Assist Processor (FAP) ASIC (Application Specific Integrated Circuit)
  •  BCM5862 IPSec Security Processor Unit
    ...

Source Code

I requested the GPL-licensed source-code for the device from Zyxel on 28th October 2013. On 30th October 2013 a Zyxel representative emailed me "We will provide package(V1.00(AAKL.0)C0) to you on 11/18/2013". It can be  downloaded from my HTTP server.

Update: 19th November 2013 I received an email "Sorry, since this package has some issue we need fix it, we will provide package on 11/28 Sorry for any inconvenience."
Update: 13th December 2013 I received an email with a link to an authenticated FTP site where the source-code would be available for 14 days.

Circuit Board

VMG8324-B10A PCB 500x408

Serial Port

VMG8324-B10A serial-header 223x206

Usefully, the device has a 5-pin keyed header that presents a BCM63168 UART (Universal Asynchronous Receiver Transmitter) serial port. The voltage levels are 3.3 volt CMOS (Complimentary Metal-Oxide Silicon). I connected the serial port to a PC using a CMOS to TTL (Transistor-Transistor Logic) MAX3232-based converter and a serial-to-USB MCT-U232-based converter.

VMG8324/VMG8923/F1000 serial port

I used a multi-meter to deduce the pin assignments on the device PCB. After finding ground, I monitored each pin as the device booted. One pin showed fluctuating voltage levels which told me it was the TX (transmit) pin. The remaining 2 pins both showed 3.3V so I had to guess which was the Vcc (power) and RX (receive).

The port runs at 115,200 baud 8 data-bits, strip high bit. I connected using the screen utility:

screen -L /dev/ttyUSB0 115200,cs8,istrip

Terminal Shell Access

The Zyxel user-space runs the smd daemon (Service Manager) which manages most if not all other system services. It us much like Upstart and SystemD. When connecting to the device over the serial port the consoled daemon, or if using Telnet the telnetd daemon runs. Both daemon's input is managed by the same background library which limits the commands that can be run (prctl_runCommandInShellWithTimeout) and prevents using the regular Busybox shell.

The list of available commands is given using the help command. Other unlisted commands are also available such as iptables, ps, cat, echo.

VMG8324-B10A
Login: admin
Password: 
 > help
?
help
logout
exit
quit
reboot
adsl
xdslctl
xtm
loglevel
logdest
virtualserver
ddns
dumpcfg
dumpmdm
meminfo
psp
dumpsysinfo
syslog
sntp
voice
wlan
arp
defaultgateway
dhcpserver
dhcpcondserv
igmpcmd
dns
lan
lanhosts
passwd
ppp
restoredefault
route
save
swversion
uptime
cfgupdate
swupdate
exitOnIdle
wan
udpechod
tr69c
webstyle
radvdconf
vcautohunt
vlanautohunt
sys
save_default
captiveportal
celld
zyims_watchdog
wanaslan
tr064
wakeOnLan
romctrl
phonetest


User-space

However it is possible to break out of this environment into a full shell using a simple shell command string "echo && bash". This shell will be terminated by the controlling daemon's idle timeout since input to the daemon will have stopped. That supposedly can be postponed using the exitOnIdle command (but in practice seems to be ignored!). The shell is  Busybox:

VMG8324-B10A
Login: admin
Password: 
 > exitOnIdle help
usage: exitOnIdle get
       exitOnIdle set <seconds>

 > exitOnIdle set 9999
timeout is set to 9999 seconds (for this session only, not saved to config)

 > echo && bash

~ # busybox
BusyBox v1.17.2 (2013-05-09 10:55:40 CST) multi-call binary.
Copyright (C) 1998-2009 Erik Andersen, Rob Landley, Denys Vlasenko
and others. Licensed under GPLv2.
See source distribution for full notice.

Usage: busybox [function] [arguments]...
   or: function [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use and BusyBox
        will act like whatever it was invoked as.

Currently defined functions:
        [, [[, addgroup, adduser, arp, ash, awk, basename, bash, blkid, brctl,
        cat, chat, chattr, chgrp, chmod, chown, chpasswd, chvt, clear, cmp, cp,
        cttyhack, cut, date, dd, delgroup, deluser, depmod, devmem, df, diff,
        dmesg, dnsd, dnsdomainname, du, echo, egrep, eject, env, ether-wake,
        expr, fakeidentd, false, fdisk, fgrep, find, flash_eraseall, fold,
        free, freeramdisk, fsck, fsck.minix, ftpget, ftpput, fuser, getopt,
        getty, grep, halt, head, hexdump, hostname, httpd, hwclock, ifconfig,
        ifdown, ifup, inetd, init, insmod, install, ip, ipaddr, ipcrm, ipcs,
        iplink, iproute, kill, killall, killall5, klogd, less, linuxrc, ln,
        logger, login, logread, losetup, ls, lsattr, lsmod, makedevs, mdev,
        mesg, mkdir, mkfifo, mkfs.minix, mknod, mkswap, mktemp, modprobe, more,
        mount, mountpoint, mv, nc, netstat, nice, nslookup, passwd, pidof,
        ping, ping6, pivot_root, poweroff, printf, ps, pscan, pwd, reboot,
        reset, rm, rmmod, route, runlevel, sed, sendarp, seq, setsid, sh,
        sleep, sort, stat, strings, su, sulogin, swapoff, swapon, switch_root,
        sysctl, sysinfo, syslogd, tac, tail, tar, tee, telnet, telnetd, test,
        tftp, tftpd, time, top, touch, traceroute, true, tty, udhcpc, udhcpd,
        umount, uname, unexpand, uniq, uptime, usleep, vconfig, vi, watch,
        watchdog, wc, wget, which, whoami, xargs, yes

~ # env
USER=root
LD_LIBRARY_PATH=/lib/public:/lib/private:/lib/gpl:/lib
HOME=/
TERM=vt102
PATH=/home/bin:/home/scripts:/opt/bin:/bin:/sbin:/usr/bin:/usr/local/jamvm/bin:/opt/scripts
SHELL=/bin/sh
PWD=/
TMOUT=0

~ # ls -l /
drwxr-xr-x    2 supervis root             0 May  9  2013 bin
drwxr-xr-x    5 supervis root             0 Jan  1  1970 data
drwxr-xr-x    5 supervis root             0 May  9  2013 dev
drwxr-xr-x   13 supervis root             0 May  9  2013 etc
drwxr-xr-x    2 supervis root             0 Jan  1  1970 home
drwxr-xr-x    6 supervis root             0 May  9  2013 lib
lrwxrwxrwx    1 supervis root            11 May  9  2013 linuxrc -> bin/busybox
drwxr-xr-x    2 supervis root             0 Nov 17 09:29 log
drwxr-xr-x    2 supervis root             0 Jan  1  1970 mnt
drwxr-xr-x    5 supervis root             0 May  9  2013 opt
dr-xr-xr-x  117 supervis root             0 Jan  1  1970 proc
drwxr-xr-x    2 supervis root             0 May  9  2013 sbin
drwxr-xr-x   11 supervis root             0 Jan  1  1970 sys
lrwxrwxrwx    1 supervis root             8 May  9  2013 tmp -> /var/tmp
drwxr-xr-x    4 supervis root             0 May  9  2013 usr
drwxr-xr-x   16 supervis root             0 Nov 17 10:56 var
-rw-r--r--    1 supervis root       1462651 May  9  2013 vmlinux.lz
drwxr-xr-x    4 supervis root             0 May  9  2013 webs

Kernel

~ # ls -l /proc/ | grep -v  '[[:digit:]]\{1,5\}$'
-r--r--r--    1 supervis root             0 Nov 17 10:53 bcmlog
dr-xr-xr-x    2 supervis root             0 Nov 17 10:53 brcm
-r--r--r--    1 supervis root             0 Nov 17 10:53 buddyinfo
dr-xr-xr-x    4 supervis root             0 Nov 15 17:54 bus
-r--r--r--    1 supervis root             0 Nov 17 10:53 cmdline
-r--r--r--    1 supervis root             0 Nov 17 10:53 cpuinfo
-r--r--r--    1 supervis root             0 Nov 17 10:53 crypto
-r--r--r--    1 supervis root             0 Nov 17 10:53 devices
-r--r--r--    1 supervis root             0 Nov 17 10:53 diskstats
dr-xr-xr-x    4 supervis root             0 Nov 17 10:53 driver
-r--r--r--    1 supervis root             0 Nov 17 10:53 execdomains
dr-xr-xr-x    2 supervis root             0 Nov 17 10:53 fcache
-r--r--r--    1 supervis root             0 Nov 17 10:53 filesystems
dr-xr-xr-x    3 supervis root             0 Nov 17 10:53 fs
-r--r--r--    1 supervis root             0 Nov 17 10:53 interrupts
-r--r--r--    1 supervis root             0 Nov 17 10:53 iomem
-r--r--r--    1 supervis root             0 Nov 17 10:53 ioports
dr-xr-xr-x  130 supervis root             0 Nov 17 10:53 irq
-r--r--r--    1 supervis root             0 Nov 17 10:53 kallsyms
-r--------    1 supervis root     132968448 Nov 17 10:53 kcore
-r--------    1 supervis root             0 Nov 17 10:53 kmsg
-r--------    1 supervis root             0 Nov 17 10:53 kpagecount
-r--------    1 supervis root             0 Nov 17 10:53 kpageflags
-rw-r--r--    1 supervis root             0 Nov 17 10:53 led
-r--r--r--    1 supervis root             0 Nov 17 10:53 loadavg
-r--r--r--    1 supervis root             0 Nov 17 10:53 locks
-r--r--r--    1 supervis root             0 Nov 17 10:53 meminfo
-rw-r--r--    1 supervis root             0 Nov 17 10:53 mii
-r--r--r--    1 supervis root             0 Nov 17 10:53 misc
-r--r--r--    1 supervis root             0 Nov 17 10:53 modules
lrwxrwxrwx    1 supervis root            11 Nov 17 10:53 mounts -> self/mounts
dr-xr-xr-x    2 supervis root             0 Nov 17 10:53 mstc_coredump
dr-xr-xr-x    2 supervis root             0 Nov 17 10:53 mstc_koops
-r--r--r--    1 supervis root             0 Nov 17 10:53 mtd
lrwxrwxrwx    1 supervis root             8 Nov 17 10:53 net -> self/net
dr-xr-xr-x    2 supervis root             0 Nov 17 10:53 nvram
-r--r--r--    1 supervis root             0 Nov 17 10:53 pagetypeinfo
-r--r--r--    1 supervis root             0 Nov 17 10:53 partitions
dr-xr-xr-x    2 supervis root             0 Nov 17 10:53 scsi
-rw-r--r--    1 supervis root             0 Nov 17 10:53 slabinfo
-r--r--r--    1 supervis root             0 Nov 17 10:53 stat
-rw-r--r--    1 supervis root             0 Nov 17 10:53 switch
dr-xr-xr-x    1 supervis root             0 Jan  1  1970 sys
--w-------    1 supervis root             0 Nov 17 10:53 sysrq-trigger
dr-xr-xr-x    2 supervis root             0 Nov 17 10:53 sysvipc
-rw-r--r--    1 supervis root             0 Nov 17 10:53 timer_list
dr-xr-xr-x    4 supervis root             0 Nov 17 10:53 tty
-r--r--r--    1 supervis root             0 Nov 17 10:53 uptime
-r--r--r--    1 supervis root             0 Nov 17 10:53 version
-r--------    1 supervis root             0 Nov 17 10:53 vmallocinfo
-r--r--r--    1 supervis root             0 Nov 17 10:53 vmstat
dr-xr-xr-x    2 supervis root             0 Nov 17 10:53 voice
dr-xr-xr-x    2 supervis root             0 Nov 17 10:53 wd_timer
-r--r--r--    1 supervis root             0 Nov 17 10:53 zoneinfo

~ # cat /proc/cpuinfo
system type             : 963168VX
processor               : 0
cpu model               : Broadcom4350 V8.0
BogoMIPS                : 399.36
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

unaligned exceptions            : 37022
processor               : 1
cpu model               : Broadcom4350 V8.0
BogoMIPS                : 402.43
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

unaligned exceptions            : 37022

~ # cat /proc/iomem
00000000-07ecdfff : System RAM
  00020000-00350def : Kernel code
  00350df0-0042a70f : Kernel data
10000200-10000383 : brcmnand
10002500-100025ff : ehci_hcd
10002600-100026ff : ohci_hcd
11000000-11efffff : bcm63xx pcie memory space
a0000000-a00fffff : bcm63xx pci memory space
  a0000000-a000ffff : 0000:00:00.0
  a0010000-a00107ff : 0000:00:00.0

~ # cat /proc/ioports
a1100000-a110ffff : bcm63xx pci IO space

~ # cat /proc/version
Linux version 2.6.30 (eason@msgsw3-i7) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 SMP PREEMPT Thu May 9 10:51:59 CST 2013

~ # cat /proc/cmdline
root=mtd:rootfs ro rootfstype=jffs2 console=ttyS0,115200

~ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01540000 00020000 "rootfs"
mtd1: 00400000 00020000 "data"
mtd2: 00020000 00020000 "nvram"

~ # cat /proc/partitions
major minor  #blocks  name

  31        0      21760 mtdblock0
  31        1       4096 mtdblock1
  31        2        128 mtdblock2

~ # cat /proc/mounts
rootfs / rootfs rw 0 0
mtd:rootfs / jffs2 ro,relatime 0 0
proc /proc proc rw,relatime 0 0
tmpfs /var tmpfs rw,relatime,size=420k 0 0
tmpfs /mnt tmpfs rw,relatime,size=16k 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /log tmpfs rw,relatime,size=0k 0 0
tmpfs /home tmpfs rw,relatime,size=0k 0 0
mtd:data /data jffs2 rw,relatime 0 0
usbfs /proc/bus/usb usbfs rw,relatime 0 0

~ # cat /proc/filesystems 
nodev   sysfs
nodev   rootfs
nodev   bdev
nodev   proc
nodev   sockfs
nodev   usbfs
nodev   pipefs
nodev   tmpfs
nodev   devpts
        ext3
nodev   ramfs
        vfat
nodev   jffs2
nodev   fuse
        fuseblk
nodev   fusectl

/proc/modules attached Download.

/etc/fstab:

~ # cat /etc/fstab
proc            /proc   proc    defaults        0       0
tmpfs           /var    tmpfs   size=420k       0       0
tmpfs           /mnt    tmpfs   size=16k        0       0
sysfs           /sys    sysfs   defaults        0       0
tmpfs           /log    tmpfs   size=0k 0       0
tmpfs           /home   tmpfs   size=0k 0       0
mtd:data        /data   jffs2   defaults        0       0

Executables

Listing of executable commands attached Download.

Libraries

~ # ls -l /lib/
-rwxr-xr-x    1 supervis root         20700 May  9  2013 ld-uClibc.so.0
-rwxr-xr-x    1 supervis root        364392 May  9  2013 libc.so.0
-rwxr-xr-x    1 supervis root          4524 May  9  2013 libcell.so
lrwxrwxrwx    1 supervis root            30 May  9  2013 libcms_boardctl.so -> /lib/public/libcms_boardctl.so
lrwxrwxrwx    1 supervis root            25 May  9  2013 libcms_msg.so -> /lib/public/libcms_msg.so
lrwxrwxrwx    1 supervis root            26 May  9  2013 libcms_util.so -> /lib/public/libcms_util.so
-rwxr-xr-x    1 supervis root         10420 May  9  2013 libcrypt.so.0
-rw-r--r--    1 supervis root          8304 May  9  2013 libdl.so.0
-rwxr-xr-x    1 supervis root        174632 May  9  2013 libgcc_s.so.1
-rwxr-xr-x    1 supervis root         98056 May  9  2013 libm.so.0
-rwxr-xr-x    1 supervis root        119644 May  9  2013 libmicrosipaccessor.so
-rwxr-xr-x    1 supervis root         57872 May  9  2013 libmicrosipclone.so
-rwxr-xr-x    1 supervis root        329968 May  9  2013 libmicrosipcore.so
-rwxr-xr-x    1 supervis root        444876 May  9  2013 libntfs-3g.so.83
-rwxr-xr-x    1 supervis root         11560 May  9  2013 libnvram.so
-rwxr-xr-x    1 supervis root         71628 May  9  2013 libpthread.so.0
-rwxr-xr-x    1 supervis root           917 May  9  2013 libresolv.so.0
-rwxr-xr-x    1 supervis root          3348 May  9  2013 librt-0.9.29.so
-rwxr-xr-x    1 supervis root          3348 May  9  2013 librt.so.0
-rwxr-xr-x    1 supervis root        553472 May  9  2013 libsqlite3.so.0
-rwxr-xr-x    1 supervis root       1100092 May  9  2013 libua.so
-rwxr-xr-x    1 supervis root         60394 May  9  2013 libuaport.a
lrwxrwxrwx    1 supervis root            16 May  9  2013 libusb-0.1.so.4 -> libusb.so.0.1.12
lrwxrwxrwx    1 supervis root            15 May  9  2013 libusb-1.0.so.0 -> libusb.so.1.0.0
-rwxr-xr-x    1 supervis root         29996 May  9  2013 libusb.so.0.1.12
-rwxr-xr-x    1 supervis root         47648 May  9  2013 libusb.so.1.0.0
-rwxr-xr-x    1 supervis root          3948 May  9  2013 libutil.so.0
-rwxr-xr-x    1 supervis root        646800 May  9  2013 libweblanguage.so
-rwxr-xr-x    1 supervis root         29244 May  9  2013 libwl_server_socket.so
-rwxr-xr-x    1 supervis root         97512 May  9  2013 libwlbcmcrypto.so
-rwxr-xr-x    1 supervis root         62116 May  9  2013 libwlbcmshared.so
-rwxr-xr-x    1 supervis root        442048 May  9  2013 libwlctl.so
-rwxr-xr-x    1 supervis root        342808 May  9  2013 libwlmngr.so
-rwxr-xr-x    1 supervis root         62240 May  9  2013 libwlupnp.so
-rwxr-xr-x    1 supervis root         51812 May  9  2013 libwps.so
drwxr-xr-x    3 supervis root             0 May  9  2013 modules
drwxr-xr-x    2 supervis root             0 May  9  2013 private
drwxr-xr-x    2 supervis root             0 May  9  2013 public
drwxr-xr-x    2 supervis root             0 May  9  2013 sa

~ # ls -l /lib/public/
-rwxr-xr-x    1 supervis root          7440 May  9  2013 libcms_boardctl.so
-rwxr-xr-x    1 supervis root         11320 May  9  2013 libcms_msg.so
-rwxr-xr-x    1 supervis root        162748 May  9  2013 libcms_util.so
lrwxrwxrwx    1 supervis root            18 May  9  2013 libcrypto.so -> libcrypto.so.0.9.7
-rwxr-xr-x    1 supervis root        906828 May  9  2013 libcrypto.so.0.9.7
lrwxrwxrwx    1 supervis root            17 May  9  2013 libexpat.so -> libexpat.so.0.5.0
lrwxrwxrwx    1 supervis root            17 May  9  2013 libexpat.so.0 -> libexpat.so.0.5.0
-rwxr-xr-x    1 supervis root        162608 May  9  2013 libexpat.so.0.5.0
lrwxrwxrwx    1 supervis root            15 May  9  2013 libssl.so -> libssl.so.0.9.7
-rwxr-xr-x    1 supervis root        189796 May  9  2013 libssl.so.0.9.7

~ # ls -l /lib/private/
-rwxr-xr-x    1 supervis root         12547 May  9  2013 libatmctl.so
-rwxr-xr-x    1 supervis root         95772 May  9  2013 libb_playback_ip.so
-rwxr-xr-x    1 supervis root         31684 May  9  2013 libbdlna-dms-aal.so
-rwxr-xr-x    1 supervis root        190904 May  9  2013 libbdlna-dms.so
-rwxr-xr-x    1 supervis root        153128 May  9  2013 libbdlna.so
-rwxr-xr-x    1 supervis root         38864 May  9  2013 libbmdapi.so
-rwxr-xr-x    1 supervis root         82904 May  9  2013 libbmdpkgsrc.so
-rwxr-xr-x    1 supervis root         17176 May  9  2013 libbmdshared.so
-rwxr-xr-x    1 supervis root         59372 May  9  2013 libbmdshell.so
-rwxr-xr-x    1 supervis root        362240 May  9  2013 libbmedia.so
-rwxr-xr-x    1 supervis root         81756 May  9  2013 libbos.so
-rwxr-xr-x    1 supervis root          1832 May  9  2013 libcdkdsym.so
-rwxr-xr-x    1 supervis root         17592 May  9  2013 libcdklibc.so
-rwxr-xr-x    1 supervis root         17260 May  9  2013 libcdkmain.so
-rwxr-xr-x    1 supervis root         19144 May  9  2013 libcdkpkgsrc.so
-rwxr-xr-x    1 supervis root         10640 May  9  2013 libcdkshared.so
-rwxr-xr-x    1 supervis root         36552 May  9  2013 libcdkshell.so
-rwxr-xr-x    1 supervis root          1880 May  9  2013 libcdksym.so
-rwxr-xr-x    1 supervis root        339348 May  9  2013 libcms_cli.so
-rwxr-xr-x    1 supervis root       2266080 May  9  2013 libcms_core.so
-rwxr-xr-x    1 supervis root        835008 May  9  2013 libcms_dal.so
-rwxr-xr-x    1 supervis root         63952 May  9  2013 libethswctl.so
-rwxr-xr-x    1 supervis root          8320 May  9  2013 libfapctl.so
-rwxr-xr-x    1 supervis root          3824 May  9  2013 libfcctl.so
-rwxr-xr-x    1 supervis root          4212 May  9  2013 libgmacctl.so
-rwxr-xr-x    1 supervis root          5588 May  9  2013 libiqctl.so
-rwxr-xr-x    1 supervis root        220800 May  9  2013 libmdm.so
-rwxr-xr-x    1 supervis root          5596 May  9  2013 libnanoxml.so
-rwxr-xr-x    1 supervis root          7840 May  9  2013 libphygeneric.so
-rwxr-xr-x    1 supervis root         18968 May  9  2013 libphypkgsrc.so
-rwxr-xr-x    1 supervis root          1880 May  9  2013 libphysym.so
-rwxr-xr-x    1 supervis root          6892 May  9  2013 libphyutil.so
-rwxr-xr-x    1 supervis root          5236 May  9  2013 libpwrctl.so
-rwxr-xr-x    1 supervis root          7024 May  9  2013 libsnoopctl.so
-rwxr-xr-x    1 supervis root         32904 May  9  2013 libvlanctl.so
-rwxr-xr-x    1 supervis root         35412 May  9  2013 libxdslctl.so

Further output in the form of logs of various commands:

~ # find /lib/modules/2.6.30/ -type f > /tmp/modules-list.log

modules-list.log Download

~ # cat /proc/kallsyms > /tmp/kallsyms.log

kallsyms.log Download

Networking

Interfaces

~ # ifconfig -a
bcmsw     Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Base address:0xda00 

br0       Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          inet addr:10.254.251.254  Bcast:10.254.251.255  Mask:255.255.255.0
          inet6 addr: fe80::ee43:f6ff:fe46:c080/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:10984402 errors:70674 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:1058 overruns:42634098 carrier:0
          collisions:70560 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

dsl0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          [NO FLAGS]  MTU:0  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth0      Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          

eth0.0    Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          inet6 addr: fe80::ee43:f6ff:fe46:c080/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:722909 carrier:0
          collisions:3328 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth1      Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          inet6 addr: fe80::ee43:f6ff:fe46:c080/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5183074 errors:33646 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:458 overruns:11858493 carrier:0
          collisions:29136 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          

eth1.0    Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          inet6 addr: fe80::ee43:f6ff:fe46:c080/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4577315 errors:33644 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:458 overruns:11785565 carrier:0
          collisions:30502 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth2      Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          

eth2.0    Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:721783 carrier:0
          collisions:3313 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth3      Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          

eth3.0    Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          inet6 addr: fe80::ee43:f6ff:fe46:c080/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:721801 carrier:0
          collisions:3311 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth4      Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          

eth4.0    Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          inet6 addr: fe80::ee43:f6ff:fe46:c080/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:795797 carrier:0
          collisions:4159 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth5      Link encap:Ethernet  HWaddr EC:43:F6:46:C0:80  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          

ifb0      Link encap:Ethernet  HWaddr D6:22:AE:EF:6A:B9  
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ifb1      Link encap:Ethernet  HWaddr F6:89:36:5C:D7:B0  
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ip6tnl0   Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1460  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:234090 errors:1250 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:234090 carrier:0
          collisions:1250 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ppp1.1    Link encap:Point-to-Point Protocol  
          inet addr:82.71.24.87  P-t-P:62.3.83.20  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP ALLMULTI MULTICAST  MTU:1492  Metric:1
          RX packets:35500230 errors:50074 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:9341455 carrier:0
          collisions:46339 txqueuelen:3 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ptm0      Link encap:Ethernet  HWaddr EC:43:F6:46:C0:82  
          inet6 addr: fe80::ee43:f6ff:fe46:c082/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:36998133 errors:55082 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:10553951 carrier:0
          collisions:46710 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ptm0.1    Link encap:Ethernet  HWaddr EC:43:F6:46:C0:83  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:35918471 errors:50461 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:10559481 carrier:0
          collisions:46725 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

sit0      Link encap:IPv6-in-IPv4  
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wl0       Link encap:Ethernet  HWaddr EC:43:F6:46:C0:81  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6716417 errors:35748 dropped:0 overruns:0 frame:0
          TX packets:20762 errors:0 dropped:589 overruns:32112058 carrier:0
          collisions:43685 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:15 

wl0.1     Link encap:Ethernet  HWaddr 5A:43:F6:46:C0:82  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:20762 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wl0.2     Link encap:Ethernet  HWaddr 5A:43:F6:46:C0:83  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:177618 errors:1018 dropped:0 overruns:0 frame:0
          TX packets:20762 errors:0 dropped:12 overruns:391144 carrier:0
          collisions:3184 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wl0.3     Link encap:Ethernet  HWaddr 5A:43:F6:46:C0:80  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:20762 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)


Daemons

Listening sockets (smd is the System Management Daemon):

~ # netstat -tnlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:44401           0.0.0.0:*               LISTEN      289/smd
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      4945/dnsmasq
tcp        0      0 0.0.0.0:5431            0.0.0.0:*               LISTEN      3413/upnp
tcp        0      0 0.0.0.0:5916            0.0.0.0:*               LISTEN      5211/acsd
tcp        0      0 :::80                   :::*                    LISTEN      289/smd
tcp        0      0 :::53                   :::*                    LISTEN      4945/dnsmasq
tcp        0      0 :::21                   :::*                    LISTEN      289/smd
tcp        0      0 :::30005                :::*                    LISTEN      289/smd
tcp        0      0 :::22                   :::*                    LISTEN      289/smd
tcp        0      0 :::23                   :::*                    LISTEN      289/smd
tcp        0      0 :::443                  :::*                    LISTEN      289/smd

Name Resolution

~ # cat /etc/resolv.conf
nameserver 127.0.0.1

~ # ls /var/dnsmasq/dnsmasq.conf
/var/dnsmasq/dnsmasq.conf

~ # cat /var/dnsmasq/dnsmasq.conf
user=user
resolv-file=/etc/resolv.dnsmasq.conf
addn-hosts=/var/dnsmasq/hosts

~ # cat /var/dnsmasq/hosts
127.0.0.1       localhost
10.254.251.254  MitraStar.Home


Transfering files off the device

The busybox toolbox include both a TFTP client and server. To transfer files from the device I run a TFTP server on the PC, and then use the device's TFTP client to put the files:

On the PC:

sudo apt-get install tftpd-hpa
sudo service tftpd stop

mkdir $HOME/Hacks/Zyxel/VMG8324
cd $HOME/Hacks/Zyxel/VMG8324

sudo in.tftpd -4 -L -u $USER -c -vvv -s $PWD

On the device (via serial console or telnet) I redirect output of commands to a file in /tmp/. The tftp client only reads file from the current working directory so to transfer other files change to the containing directory first:

cat /proc/kallsyms > /tmp/kallsyms.log
cd /tmp/

/var/tmp # ls
3g-hotplug.debug     celld_ready          modules-list.log
3glog                ifcfg_br0            sys-bus-usb-devices
SESS_NjI5NDk0NTEw    ifcfg_ppp1.1         usb-find-devices
bootupmessages       kallsyms.log

/var/tmp # tftp -p -l kallsyms.log 10.254.251.50


System Startup

~ # strings $(which init) | grep 'init\.d'
/etc/init.d/rcS

~ # ls -l /etc/init.d/
-rwxr-xr-x    1 supervis root           392 Mar 20  2013 rcS

/etc/init.d/rcS:

~ # cat /etc/init.d/rcS

#! /bin/sh

PATH=/sbin:/bin
export PATH

mount -t proc proc /proc
/bin/mount -a
#/sbin/inetd

mkdir /var/etc
mkdir /var/etc/ppp
mkdir /var/etc/ppp/chat

cp /etc/pwdog/* /var/etc
cp /etc/ppp/* /var/etc/ppp
cp /etc/ppp/chat/* /var/etc/ppp/chat
# automount
#mount -t tmpfs mdev /dev/mdev
#echo /sbin/mdev > /proc/sys/kernel/hotplug
#mdev -s 

# wwan data
mkdir /var/etc
cp -r /etc/wwan /var/etc

/etc/profile:

~ # cat /etc/profile

# /etc/profile: system-wide .profile file for the Bourne shells
trap "" 2

export PATH=/home/bin:/home/scripts:/opt/bin:/bin:/sbin:/usr/bin:/usr/local/jamvm/bin:/opt/scripts
export LD_LIBRARY_PATH=/lib/public:/lib/private:/lib/gpl:/lib
KERNELVER=2.6.30

# TMOUT=0 means no busybox shell timeout.
# if you want the busybox shell to timeout after some number of seconds of inactivity,
# change the 0 to the number of seconds, e.g. 300.
export TMOUT=0

echo
firsttime=`echo /var/udhcpd/udhcpd.lease*`
if [ "$firsttime" = "/var/udhcpd/udhcpd.lease*" ]; then
 echo "Loading drivers and kernel modules... "
 echo
# no-op
# create directory in /var mounted for TMPFS
 mknod /var/fuse c 10 229
 chmod a+rw /var/fuse
 mkdir -p /var/log /var/run /var/state/dhcp /var/ppp /var/udhcpd /var/zebra /var/siproxd /var/cache /var/tmp /var/samba /var/samba/share /var/samba/homes /var/samba/private /var/samba/locks
 cp  /etc/smb.conf /var/samba/ 2>/dev/null

#wtmp
ln -s /data/wtmp /var/log/wtmp
 
 echo > /var/udhcpd/udhcpd.leases
 ifconfig lo 127.0.0.1 netmask 255.0.0.0 broadcast 127.255.255.255 up
# /etc/modules_install /lib/modules/$KERNELVER/extra
 test -e /lib/modules/$KERNELVER/extra/bcm_log.ko && insmod /lib/modules/$KERNELVER/extra/bcm_log.ko
 test -e /lib/modules/$KERNELVER/extra/chipinfo.ko && insmod /lib/modules/$KERNELVER/extra/chipinfo.ko
 test -e /lib/modules/$KERNELVER/extra/bcm_ingqos.ko && insmod /lib/modules/$KERNELVER/extra/bcm_ingqos.ko
 test -e /lib/modules/$KERNELVER/extra/bcm_bpm.ko && insmod /lib/modules/$KERNELVER/extra/bcm_bpm.ko
 test -e /lib/modules/$KERNELVER/extra/pktflow.ko && insmod /lib/modules/$KERNELVER/extra/pktflow.ko fcacheMaxEntries=1024
 test -e /lib/modules/$KERNELVER/extra/pktcmf.ko && insmod /lib/modules/$KERNELVER/extra/pktcmf.ko
 test -e /lib/modules/$KERNELVER/extra/bcmfap.ko && insmod /lib/modules/$KERNELVER/extra/bcmfap.ko
 test -e /etc/cmf/cmfcfg && /etc/cmf/cmfcfg
 test -e /lib/modules/$KERNELVER/extra/profdrvdd.ko && insmod /lib/modules/$KERNELVER/extra/profdrvdd.ko
 test -e /lib/modules/$KERNELVER/extra/bcmxtmcfg.ko && insmod /lib/modules/$KERNELVER/extra/bcmxtmcfg.ko
 test -e /lib/modules/$KERNELVER/extra/ext_bonding.ko && insmod /lib/modules/$KERNELVER/extra/ext_bonding.ko
 test -e /lib/modules/$KERNELVER/extra/atmapi.ko && insmod /lib/modules/$KERNELVER/extra/atmapi.ko
 test -e /lib/modules/$KERNELVER/extra/adsldd.ko && insmod /lib/modules/$KERNELVER/extra/adsldd.ko
 test -e /lib/modules/$KERNELVER/extra/blaa_dd.ko && insmod /lib/modules/$KERNELVER/extra/blaa_dd.ko
 test -e /lib/modules/$KERNELVER/extra/bcmprocfs.ko && insmod /lib/modules/$KERNELVER/extra/bcmprocfs.ko
# test -e /lib/modules/$KERNELVER/kernel/net/ipv6/ipv6.ko && insmod /lib/modules/$KERNELVER/kernel/net/ipv6/ipv6.ko
 test -e /lib/modules/$KERNELVER/kernel/net/atm/br2684.ko && insmod /lib/modules/$KERNELVER/kernel/net/atm/br2684.ko
 test -e /lib/modules/$KERNELVER/extra/linux-kernel-bde.ko && insmod /lib/modules/$KERNELVER/extra/linux-kernel-bde.ko
 test -e /lib/modules/$KERNELVER/extra/linux-user-bde.ko && insmod /lib/modules/$KERNELVER/extra/linux-user-bde.ko
 # enet depends on moca depends on i2c
 test -e /lib/modules/$KERNELVER/extra/i2c_bcm6xxx.ko && insmod /lib/modules/$KERNELVER/extra/i2c_bcm6xxx.ko
 test -e /lib/modules/$KERNELVER/extra/bcm3450.ko && insmod /lib/modules/$KERNELVER/extra/bcm3450.ko
 test -e /lib/modules/$KERNELVER/extra/gpon_i2c.ko && insmod /lib/modules/$KERNELVER/extra/gpon_i2c.ko
 test -e /lib/modules/$KERNELVER/extra/laser_i2c.ko && insmod /lib/modules/$KERNELVER/extra/laser_i2c.ko
 test -e /lib/modules/$KERNELVER/extra/bcmmoca.ko && insmod /lib/modules/$KERNELVER/extra/bcmmoca.ko
 test -e /lib/modules/$KERNELVER/extra/bcm_enet.ko && insmod /lib/modules/$KERNELVER/extra/bcm_enet.ko
 test -e /lib/modules/$KERNELVER/extra/bcmsw.ko && insmod /lib/modules/$KERNELVER/extra/bcmsw.ko && ifconfig bcmsw up
 test -e /lib/modules/$KERNELVER/extra/bcm_usb.ko && insmod /lib/modules/$KERNELVER/extra/bcm_usb.ko
 test -e /lib/modules/$KERNELVER/extra/bcmarl.ko && insmod /lib/modules/$KERNELVER/extra/bcmarl.ko

#WLAN Module
 test -e /lib/modules/$KERNELVER/extra/wl.ko && insmod /lib/modules/$KERNELVER/extra/wl.ko
 test -e /etc/wlan/rtecdc.trx && mount -t usbfs none /proc/bus/usb && /bin/bcmdl /etc/wlan/rtecdc.trx && sleep 2 && insmod /lib/modules/$KERNELVER/extra/wl-usb.ko
 
 test -e /lib/modules/$KERNELVER/extra/dect.ko && insmod /lib/modules/$KERNELVER/extra/dect.ko 
 test -e /lib/modules/$KERNELVER/extra/dectshim.ko && insmod /lib/modules/$KERNELVER/extra/dectshim.ko 
 test -e /lib/modules/$KERNELVER/extra/dspdd.ko && insmod /lib/modules/$KERNELVER/extra/dspdd.ko
 test -e /lib/modules/$KERNELVER/extra/endpointdd.ko && insmod /lib/modules/$KERNELVER/extra/endpointdd.ko
 test -e /lib/modules/$KERNELVER/extra/p8021ag.ko && insmod /lib/modules/$KERNELVER/extra/p8021ag.ko

# other modules
 test -e /lib/modules/$KERNELVER/extra/isdn.ko && insmod /lib/modules/$KERNELVER/extra/isdn.ko
 test -e /lib/modules/$KERNELVER/kernel/drivers/isdn/capi/capi.ko && insmod /lib/modules/$KERNELVER/kernel/drivers/isdn/capi/capi.ko 

 # Media Management
 test -e /bin/mm.exe && /bin/mm.exe &
 
 test -e /lib/modules/$KERNELVER/extra/bcmgpon.ko && insmod /lib/modules/$KERNELVER/extra/bcmgpon.ko
 test -e /lib/modules/$KERNELVER/extra/bcmvlan.ko && insmod /lib/modules/$KERNELVER/extra/bcmvlan.ko
 test -e /lib/modules/$KERNELVER/extra/pwrmngtd.ko && insmod /lib/modules/$KERNELVER/extra/pwrmngtd.ko
 test -e /lib/modules/$KERNELVER/kernel/drivers/char/hw_random/rng-core.ko && insmod /lib/modules/$KERNELVER/kernel/drivers/char/hw_random/rng-core.ko
 test -e /lib/modules/$KERNELVER/extra/bcmtrng.ko && insmod /lib/modules/$KERNELVER/extra/bcmtrng.ko

 test -e /lib/modules/$KERNELVER/extra/laser_dev.ko && insmod /lib/modules/$KERNELVER/extra/laser_dev.ko

# gponolt test tool
 test -e /bin/gponolt && /bin/gponolt --daemon
 
 #test -e /bin/mm.exe && sleep 5


 # if engineering debug tools are being built, as indicated by presence of
 # dumpsysinfo.sh, then save a copy of bootup messages for dumping later
 test -e /opt/scripts/dumpsysinfo.sh && /bin/dmesg > /var/tmp/bootupmessages

# BUILD_GUI_DEBUG
 
 # As final step in system bootup, start smd, which will start configuration
 # management system (CMS)
 # __MSTC__, reduce manufacture bootup time, DelonYu
 #smd
fi
#iptk daemon
 test -e /bin/icf.exe && /bin/icf.exe &
# __MSTC__, reduce manufacture bootup time, DelonYu start
 ReduceTimeFlag=$(cat /proc/nvram/ReduceTimeFlag)
 #echo "get ReduceTimeFlag : $ReduceTimeFlag"
 if [ $ReduceTimeFlag == "00" ]; then
  smd
 else
  /bin/swmdk &
  ifconfig eth0 up
  ifconfig eth1 up
  ifconfig eth2 up
  ifconfig eth3 up
  brctl addbr br0 2>/dev/null
  brctl addif br0 eth0 2>/dev/null
  brctl addif br0 eth1 2>/dev/null
  brctl addif br0 eth2 2>/dev/null
  brctl addif br0 eth3 2>/dev/null
  ifconfig br0 192.192.192.4
  ifconfig wl0 up
  brctl addif br0 wl0 2>/dev/null
  wlctl -i wl0 phytype > /var/wl0
  wlctl -i wl0 revinfo > /var/wl0
  wlctl -i wl0 bands > /var/wl0bands
  wlctl -i wl0  ver > /var/wlver 
  wlctl -i wl0 cap > /var/wl0cap
  wlctl -i wl0 phy_watchdog 0
  wlctl -i wl0 up
  wlctl -i wl0 leddc 0 2>/dev/null
  wlctl -i wl0 down
  wlctl -i wl0 wds none
  wlctl -i wl0 mbss 0
  wlctl -i wl0 bss -C 0 down
  wlctl -i wl0 bss -C 1 down
  wlctl -i wl0 bss -C 2 down
  wlctl -i wl0 bss -C 3 down
  wlctl -i wl0 ssid -C 0 'M''F''G'
  wlctl -i wl0  ap 1
  wlctl -i wl0 infra 1
  wlctl -i wl0 closed 0
  wlctl -i wl0 country US
  wlctl -i wl0  band b
  wlctl -i wl0 regulatory 0
  wlctl -i wl0 radar 0 2>/dev/null
  wlctl -i wl0 spect 0 2>/dev/null
  wlctl -i wl0 nmode -1
  wlctl -i wl0 mimo_bw_cap 1
  wlctl -i wl0 chanspec -c 4 -b 2 -w 40 -s -1
  wlctl -i wl0 wpa_cap -C 0 > /var/wpa_cap0 
  wlctl -i wl0 wpa_cap -C 0 0 2>/dev/null
  wlctl -i wl0 wpa_cap -C 1 > /var/wpa_cap0 
  wlctl -i wl0 wpa_cap -C 1 0 2>/dev/null
  wlctl -i wl0 wpa_cap -C 2 > /var/wpa_cap0 
  wlctl -i wl0 wpa_cap -C 2 0 2>/dev/null
  wlctl -i wl0 wpa_cap -C 3 > /var/wpa_cap0 
  wlctl -i wl0 wpa_cap -C 3 0 2>/dev/null
  wlctl -i wl0 maxassoc 32
  wlctl -i wl0 bss_maxassoc 32
  wlctl -i wl0 gmode Auto
  wlctl -i wl0 gmode_protection_override -1
  wlctl -i wl0 gmode_protection_control 2
  wlctl -i wl0 nmode_protection_override -1
  wlctl -i wl0 protection_control 2
  wlctl -i wl0 rifs_advert 0
  wlctl -i wl0 obss_coex 0
  wlctl -i wl0 stbc_tx -1
  wlctl -i wl0 nreqd 0
  wlctl -i wl0 wme 0 2>/dev/null
  wlctl -i wl0 afterburner_override 0 2>/dev/null
  wlctl -i wl0 ampdu 1
  wlctl -i wl0 afterburner_override 0
  wlctl -i wl0 wme 1 2>/dev/null
  wlctl -i wl0 wme_noack 0 2>/dev/null
  wlctl -i wl0 wme_apsd 1 2>/dev/null
  wlctl -i wl0 wme_bss_disable 0
  wlctl -i wl0 plcphdr long
  wlctl -i wl0 rate 0
  wlctl -i wl0 bg_rate 0 
  wlctl -i wl0 bg_mrate 18.0 
  wlctl -i wl0 rtsthresh 2347
  wlctl -i wl0 fragthresh 2346
  wlctl -i wl0 dtim 1
  wlctl -i wl0  bi 100
  wlctl -i wl0  bcn_rotate 1
  wlctl -i wl0 frameburst 1
  wlctl -i wl0 ap_isolate 0
  wlctl -i wl0 pwr_percent 100
  wlctl -i wl0 wmf_bss_enable 0
  wlctl -i wl0.1 wmf_bss_enable 0
  wlctl -i wl0.2 wmf_bss_enable 0
  wlctl -i wl0.3 wmf_bss_enable 0
  wlctl -i wl0 chanim_mode 1
  wlctl -i wl0 rxchain_pwrsave_enable 0
  wlctl -i wl0 rxchain_pwrsave_quiet_time 1800
  wlctl -i wl0 rxchain_pwrsave_pps 10
  wlctl -i wl0 radio_pwrsave_enable 0 2>/dev/null
  wlctl -i wl0 radio_pwrsave_quiet_time 10
  wlctl -i wl0 radio_pwrsave_pps 10
  wlctl -i wl0 radio_pwrsave_level 0 2>/dev/null
  wlctl -i wl0 mac none
  wlctl -i wl0 macmode 0
  wlctl -i wl0 up
  wlctl -i wl0 rmwep -C 0 0
  wlctl -i wl0 rmwep -C 0 1
  wlctl -i wl0 rmwep -C 0 2
  wlctl -i wl0 rmwep -C 0 3
  wlctl -i wl0 rmwep -C 1 0
  wlctl -i wl0 rmwep -C 1 1
  wlctl -i wl0 rmwep -C 1 2
  wlctl -i wl0 rmwep -C 1 3
  wlctl -i wl0 rmwep -C 2 0
  wlctl -i wl0 rmwep -C 2 1
  wlctl -i wl0 rmwep -C 2 2
  wlctl -i wl0 rmwep -C 2 3
  wlctl -i wl0 rmwep -C 3 0
  wlctl -i wl0 rmwep -C 3 1
  wlctl -i wl0 rmwep -C 3 2
  wlctl -i wl0 rmwep -C 3 3
  wlctl -i wl0  wsec -C 0 0
  wlctl -i wl0 wsec_restrict -C 0 0
  wlctl -i wl0 wpa_auth -C 0 0
  wlctl -i wl0  eap 0
  wlctl -i wl0 auth -C 0 0
  wlctl -i wl0 wdswsec 0
  wlctl -i wl0 wdswsec_enable 0
  wlctl -i wl0 bss -C 0 up
  wlctl -i wl0 lazywds 0
  wlctl -i wl0 wds 
  wlctl -i wl0 wdstimeout 1
  wlctl -i wl0 phy_watchdog 1
  wlctl -i wl0 fcache 1
  fc disable
  # generate login files
  echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd
  echo "root::0:root,supervisor,support,user" > /var/group
  # bring up busybox telnetd (/usr/sbin/telnetd) instead of brcm telnetd (/bin/telnetd)
  /usr/sbin/telnetd
 fi
# __MSTC__, reduce manufacture bootup time, DelonYu end

/proc/nvram/ReduceTimeFlag:

~ # cat /proc/nvram/ReduceTimeFlag
00

Attachments