Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added firmware for DGA0122 VCNT-P Telia Lithuania #233

Merged
merged 1 commit into from
Nov 6, 2022
Merged

Added firmware for DGA0122 VCNT-P Telia Lithuania #233

merged 1 commit into from
Nov 6, 2022

Conversation

tosiara
Copy link
Contributor

@tosiara tosiara commented Apr 8, 2022

DGA0122 VCNT-P

This router is provided by Telia Lithuania ISP under a model name "Telia X1"
Official manual: pdf
Photo:

image

Bacis specs:

4 x Gigabit LAN
1 x Gigabit WAN
2 x Voip
1 x Dsl
1 x USB
Triple core ARM CPU 1.5 Ghz
256 MB RAM
128 MB Flash

Type 2 firmware, locked. No strategy known yet.

CWMP ACS connection is hardcoded to a list of https urls, connection requires a client cert:

	option ssl_clientcert '/proc/rip/011a.cert'
	option ssl_clientkey 'engine:keystore:/proc/keys/0x11A'
	option use_dhcp '1'
	list allowed_dhcp_acs_url 'https://acs.telia.lt:7557/cpeserver/acs'
	list allowed_dhcp_acs_url 'https://acs.telia.lt:8558/cpeserver/acs'
	list allowed_dhcp_acs_url 'https://acs.telia.com:7575/ACS-server/ACS'
	list allowed_dhcp_acs_url 'https://rgw.teliacompany.com:7575/ACS-server/ACS'
	list allowed_dhcp_acs_url 'https://acs.dk.telia.net:7575/ACS-server/ACS'
	list allowed_dhcp_acs_url 'https://acs.telia.lt:7547/cpeserver/acs'
	list allowed_dhcp_acs_url 'https://rgwtst.han.telia.se:7575/ACS-server/ACS'

Classic Telia backdoors available on ports:

HTTPS 60443
SSH 60022

Post-root config re-encryption exploit works. However, "Configuration" section is hidden from the web UI, requires manual curl connection.

Some info from root shell:

# ssh root@192.168.1.1 -i telia_x1.pem



BusyBox v1.31.0 () built-in shell (ash)

  _______              __           __              __             
 |_     _|.-----.----.|  |--.-----.|__|.----.-----.|  |.-----.----.
   |   |  |  -__|  __||     |     ||  ||  __|  _  ||  ||  _  |   _|
   |___|  |_____|____||__|__|__|__||__||____|_____||__||_____|__|  
                 N E X T   G E N E R A T I O N   G A T E W A Y
 --------------------------------------------------------------------
 NG GATEWAY SIGNATURE DRINK
 --------------------------------------------------------------------
  * 1 oz Vodka          Pour all ingredients into mixing
  * 1 oz Triple Sec     tin with ice, strain into glass.
  * 1 oz Orange juice
 --------------------------------------------------------------------


Software program:

Copyright © 2021 - Technicolor Delivery Technology SAS and/or its Group Company (Technicolor)

All Rights Reserved


This program contains proprietary information which is a trade secret of Technicolor
and also is protected by intellectual property as an unpublished work 
under applicable Copyright laws/right of authorship. 

This program is also subject to some patent and pending patent applications. 
Technicolor® is registered trademark and trade name of Technicolor group company,
and shall not be used in any manner without express written from Technicolor. 

The use of the program and documentation is strictly limited to your own internal
evaluation of the product embedding such program, unless expressly agreed otherwise
by Technicolor under a specific agreement. 

Recipient is to retain this program in confidence and is not permitted to use
or make copies thereof other than as permitted in a written agreement with Technicolor,
unless otherwise expressly allowed by applicable laws. 

Recipient is not allowed to make any copy, decompile, reverse engineer, disassemble,
or attempt to derive the source code of, modify, or
create derivative works of the program, any update, or any part thereof. 

Any violation or attempt to do so is a violation of the rights of Technicolor.
If you or any person under your control or authority breach this restriction,
you may be subject to prosecution and damages.

Product: vcnt-p_telia
Release: Damson (19.4)
Version: 19.4.0539-4521016-20210305170329-50424a9303e6453bc5b8988f7fda41daa5d7ad0e

Hash config:         50424a9303e6453bc5b8988f7fda41daa5d7ad0e
Hash openwrt:        083788ed30cad06719d6523647d95e5ab841447d
Hash kernel:         2c6deb4971ac35f3fd9e59654707346b3aeeb996
Hash custo:          72ed24e9e036bdc75077400ebf9bd8d11d0e46a0
Hash lte:            8314165bc866c5027dd16735bc38c2712eb89322
Hash technicolor:    60aa74f7b2ba5c1145dc0eb7b7f581e5e9465283
Hash routing:        0a4c07e8ddf257269ac2d548dc70823679ef3ae8
Hash packages:       d39afccf2ffc242396cfd0a46afe73c78df0865d

Bootloader: 19.48.1277-0000000-20191129105551-100cf3779d32d452d044730de116d1cf7969a5f8

root@OpenWrt:~# uname -a
Linux OpenWrt 4.1.52 #0 SMP PREEMPT Thu Jan 28 16:37:00 2021 armv7l GNU/Linux

root@OpenWrt:~# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 08000000 00020000 "brcmnand.0"
mtd1: 01e00000 00020000 "rootfs"
mtd2: 01400000 00020000 "rootfs_data"
mtd3: 03200000 00020000 "bank_1"
mtd4: 03200000 00020000 "bank_2"
mtd5: 00020000 00020000 "eripv2"
mtd6: 00040000 00020000 "rawstorage"

root@OpenWrt:~# cat /proc/cpuinfo 
processor	: 0
model name	: ARMv7 Processor rev 5 (v7l)
BogoMIPS	: 100.00
Features	: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae 
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x0
CPU part	: 0xc07
CPU revision	: 5

processor	: 1
model name	: ARMv7 Processor rev 5 (v7l)
BogoMIPS	: 100.00
Features	: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae 
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x0
CPU part	: 0xc07
CPU revision	: 5

processor	: 2
model name	: ARMv7 Processor rev 5 (v7l)
BogoMIPS	: 100.00
Features	: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae 
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x0
CPU part	: 0xc07
CPU revision	: 5

Hardware	: Generic DT based system
Revision	: 0000
Serial		: 0000000000000000

root@OpenWrt:~# free -m
              total        used        free      shared  buff/cache   available
Mem:         249836      162408       22272         296       65156       49332
Swap:             0           0           0

root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                24.8M     24.8M         0 100% /rom
tmpfs                   122.0M    292.0K    121.7M   0% /tmp
/dev/mtdblock2           20.0M      3.5M     16.5M  18% /overlay
overlayfs:/overlay       20.0M      3.5M     16.5M  18% /
tmpfs                   512.0K         0    512.0K   0% /dev

root@OpenWrt:~# mount
/dev/root on /rom type squashfs (ro,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
/dev/mtdblock2 on /overlay type jffs2 (rw,relatime,compr=zlib)
overlayfs:/overlay on / type overlay (rw,noatime,lowerdir=/,upperdir=/overlay/bank_2,workdir=/overlay/work)
tmpfs on /dev type tmpfs (rw,nosuid,relatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,mode=600,ptmxmode=000)
cgroup on /cgroups/cpumemblk type cgroup (rw,relatime,cpuset,cpu,blkio,memory,clone_children)
debugfs on /sys/kernel/debug type debugfs (rw,noatime)
mountd(pid7274) on /tmp/run/mountd type autofs (rw,relatime,fd=5,pgrp=7273,timeout=600,minproto=5,maxproto=5,indirect)

root@OpenWrt:~# netstat -atnp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      5741/nginx.conf -g 
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      5741/nginx.conf -g 
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      6543/dnsmasq
tcp        0      0 192.168.168.1:53        0.0.0.0:*               LISTEN      6543/dnsmasq
tcp        0      0 192.168.1.1:53          0.0.0.0:*               LISTEN      6543/dnsmasq
tcp        0      0 192.168.1.1:60022       0.0.0.0:*               LISTEN      4879/dropbear
tcp        0      0 x.x.x.x(removed):60022  0.0.0.0:*               LISTEN      4881/dropbear
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      5741/nginx.conf -g 
tcp        0      0 0.0.0.0:51005           0.0.0.0:*               LISTEN      5282/cwmpd
tcp        0      0 192.168.1.1:49152       0.0.0.0:*               LISTEN      2676/hostapd
tcp        0      0 127.0.0.1:55555         0.0.0.0:*               LISTEN      5741/nginx.conf -g 
tcp        0      0 0.0.0.0:55556           0.0.0.0:*               LISTEN      5741/nginx.conf -g 
tcp        0      0 :::8080                 :::*                    LISTEN      5741/nginx.conf -g 
tcp        0      0 :::80                   :::*                    LISTEN      5741/nginx.conf -g 
tcp        0      0 ::1:53                  :::*                    LISTEN      6543/dnsmasq
tcp        0      0 :::443                  :::*                    LISTEN      5741/nginx.conf -g 
tcp        0      0 :::51005                :::*                    LISTEN      5282/cwmpd
tcp        0      0 :::55556                :::*                    LISTEN      5741/nginx.conf -g 

root@OpenWrt:~# cat /proc/banktable/active
bank_2

root@OpenWrt:~# cat /proc/banktable/activeversion 
19.4.0539-4521016-20210305170329-50424a9303e6453bc5b8988f7fda41daa5d7ad0e

root@OpenWrt:~# cat /proc/banktable/inactive 
bank_1

root@OpenWrt:~# cat /proc/banktable/passiveversion 
19.4.0200-4521014-20200326194528-0b40a1ee7299a2ab46b7279b5904d465f7700e50

root@OpenWrt:~# dmesg
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 4.1.52 (repowrt-builder@45c7d76f3513) (gcc version 5.5.0 (OpenWrt GCC 5.5.0 r13793-083788ed30) ) #0 SMP PREEMPT Thu Jan 28 16:37:00 2021
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine model: Broadcom BCM963178
[    0.000000] bootconsole [earlycon0] enabled
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] On node 0 totalpages: 65024
[    0.000000] free_area_init_node: node 0, pgdat c0614080, node_mem_map cfbb8000
[    0.000000]   Normal zone: 576 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 65024 pages, LIFO batch:15
[    0.000000] PERCPU: Embedded 11 pages/cpu @cfb84000 s15180 r8192 d21684 u45056
[    0.000000] pcpu-alloc: s15180 r8192 d21684 u45056 alloc=11*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 64448
[    0.000000] Kernel command line: console=ttyAMA0 earlyprintk debug irqaffinity=0 cma=0M isolcpus=2 rootfs_offset=0x01400000 tbbt_addr=0x7d20000 btab=0x12200c btab_bootid=2 bl_version=19.48.1277-0000000-20191129105551-100cf3779d32d452d044730de116d1cf7969a5f8 board=VCNT-P platform.prozone_addr=0xffe0000 bl_oid=5de0f78e4f5d980688c37ea3 .r2secr=0xffdf000 
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 249652K/260096K available (4339K kernel code, 201K rwdata, 1576K rodata, 184K init, 321K bss, 10444K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xd0800000 - 0xff000000   ( 744 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xd0000000   ( 256 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbec00000 - 0xbfe00000   (  18 MB)
[    0.000000]       .text : 0xc0018000 - 0xc05df25c   (5917 kB)
[    0.000000]       .init : 0xc05e0000 - 0xc060e000   ( 184 kB)
[    0.000000]       .data : 0xc060e000 - 0xc0640720   ( 202 kB)
[    0.000000]        .bss : 0xc0640720 - 0xc0690c80   ( 322 kB)
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:16 nr_irqs:16 16
[    0.000000] Architected cp15 timer(s) running at 50.00MHz (phys).
[    0.000000] clocksource arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb8812736b, max_idle_ns: 440795202655 ns
[    0.000005] sched_clock: 56 bits at 50MHz, resolution 20ns, wraps every 4398046511100ns
[    0.008223] Switching to timer-based delay loop, resolution 20ns
[    0.014428] BRCM Legacy Drivers' Helper, all legacy drivers' IO memories/interrupts should be remapped here
[    0.024411]      Remapping interrupts...
[    0.028476]              hwirq      virq
[    0.032551]                60        20
[    0.036537]                61        21
[    0.040519]                43        22
[    0.044501]                44        23
[    0.048484]                45        24
[    0.052466]                46        25
[    0.056449]                66        26
[    0.060431]               110        27
[    0.064413]                69        28
[    0.068396]               152        29
[    0.072378]               153        30
[    0.076359]               154        31
[    0.080342]               155        32
[    0.084324]               156        33
[    0.088306]               157        34
[    0.092289]               158        35
[    0.096271]               159        36
[    0.100253]                76        37
[    0.104235]                78        38
[    0.108224]                77        39
[    0.112206]                79        40
[    0.116189]               104        41
[    0.120173]               105        42
[    0.124155]               106        43
[    0.128138]                96        44
[    0.132120]                97        45
[    0.136102]                98        46
[    0.140084]                99        47
[    0.144065]               100        48
[    0.148048]               101        49
[    0.152029]               148        50
[    0.156012]                71        51
[    0.159994]               128        52
[    0.163972]      Remapping IO memories...
[    0.168125]              phys              virt          size
[    0.174052]        0000000080180000  00000000d0840000  00024000
[    0.180165]        0000000080200000  00000000d0c00000  00200000
[    0.186266]        0000000080400000  00000000d0900000  00090000
[    0.192364]        00000000ff800000  00000000d0820000  00013000
[    0.198462]        00000000ff85a000  00000000d0810000  00008000
[    0.204569]        00000000ffe00000  00000000d0a00000  00100000
[    0.210667]        00000000ff860000  00000000d0808000  00002000
[    0.216765]        0000000083010a00  00000000d0802a00  00000100
[    0.222863]        000000008000c000  00000000d0838000  00003fff
[    0.228961]        0000000083010000  00000000d080c000  00001000
[    0.235059]        0000000083018000  00000000d080e000  00001000
[    0.241156]        0000000083020000  00000000d081a000  00001000
[    0.247255]        0000000083028000  00000000d081c000  00001000
[    0.253353]        0000000083030000  00000000d081e000  00001000
[    0.259451]        0000000083038000  00000000d0834000  00001000
[    0.265549]        0000000083050000  00000000d0836000  00001000
[    0.271647]        0000000083060000  00000000d083e000  00001000
[    0.277745]        0000000083068000  00000000d0866000  00001000
[    0.283842]        00000000810a0000  00000000d0868000  00001000
[    0.289941]        0000000081060000  00000000d086c000  00003000
[    0.296039]        00000000ffff0000  00000000d086a000  00001000
[    0.302137]        0000000083000000  00000000d0870000  00001000
[    0.308235]        000000008306c000  00000000d0872000  00001000
[    0.314334]        0000000080490000  00000000d0880000  00010000
[    0.320432]        0000000080650000  00000000d08c0000  00020000
[    0.326537]        0000000080700000  00000000d0f00000  00090000
[    0.332635]        0000000080800000  00000000d0878000  00006800
[    0.338740]        0000000081100000  00000000d1000000  00091000
[    0.344980] Calibrating delay loop (skipped), value calculated using timer frequency.. 100.00 BogoMIPS (lpj=50000)
[    0.355600] pid_max: default: 32768 minimum: 301
[    0.360481] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.367295] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.374833] --Kernel Config--
[    0.377946]   SMP=1
[    0.380162]   PREEMPT=1
[    0.382731]   DEBUG_SPINLOCK=0
[    0.385917]   DEBUG_MUTEXES=0
[    0.389241] Initializing cgroup subsys blkio
[    0.393681] Initializing cgroup subsys memory
[    0.398214] Initializing cgroup subsys debug
[    0.402659] CPU: Testing write buffer coherency: ok
[    0.407949] Setting up static identity map for 0x182c0 - 0x182f4
[    0.418442]      Reserved memory mapping...
[    0.422791]                 phys          virt       size
[    0.428370]    adsl   0x0fe00000  0xcfe00000  0x00200000
[    0.433858] CCI hardware cache coherency enabled
[    0.438637] pmc_init:PMC using DQM mode
[    0.447249] Brought up 3 CPUs
[    0.450363] SMP: Total of 3 processors activated (300.00 BogoMIPS).
[    0.456820] CPU: All CPU(s) started in SVC mode.
[    0.463407] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.471386] clocksource jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns
[    0.481301] futex hash table entries: 1024 (order: 4, 65536 bytes)
[    0.488281] NET: Registered protocol family 16
[    0.493237] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.505347] cpuidle: using governor ladder
[    0.514622] cpuidle: using governor menu
[    0.520159] Serial: AMBA PL011 UART driver
[    0.524476] ff812000.serial: ttyAMA0 at MMIO 0xff812000 (irq = 55, base_baud = 0) is a PL011 rev3
[    0.533601] console [ttyAMA0] enabled
[    0.541060] bootconsole [earlycon0] disabled
[    0.555817] Broadcom Logger v0.1
[    0.559852] SCSI subsystem initialized
[    0.563725] usbcore: registered new interface driver usbfs
[    0.569247] usbcore: registered new interface driver hub
[    0.574606] usbcore: registered new device driver usb
[    0.579769] bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated
[    0.587184] skb_free_task created successfully with start budget 128
[    0.593624] BLOG v3.0 Initialized
[    0.597903] BLOG Rule v1.0 Initialized
[    0.601652] Broadcom IQoS v1.0 initialized
[    0.605748] Broadcom GBPM v0.1 initialized
[    0.609887] NET: Registered protocol family 8
[    0.614243] NET: Registered protocol family 20
[    0.618845] Switched to clocksource arch_sys_counter
[    0.624376] NET: Registered protocol family 2
[    0.629286] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    0.636286] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[    0.642754] TCP: Hash tables configured (established 2048 bind 2048)
[    0.649168] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.655037] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.661490] NET: Registered protocol family 1
[    0.665889] PCI: CLS 0 bytes, default 64
[    0.670815] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.676704] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.687236] fuse init (API version 7.23)
[    0.692178] io scheduler noop registered (default)
[    0.697521] Broadcom NAND controller (BrcmNand Controller)
[    0.703131] mtd->oobsize=0, mtd->eccOobSize=0
[    0.707512] NAND_CS_NAND_XOR=00000000
[    0.711190] Disabling XOR: Before: SEL=40000001, XOR=00000000
[    0.716953] Disabling XOR: After: SEL=40000000, XOR=00000000
[    0.722621] B4: NandSelect=40000000, nandConfig=05052300, chipSelect=0
[    0.729244] brcmnand_read_id: CS0: dev_id=2cf18095
[    0.734040] After: NandSelect=40000000, nandConfig=05052300
[    0.739621] Block size=00020000, erase shift=17
[    0.744159] NAND Config: Reg=05052300, Config Ext: Reg=00000042, chipSize=128 MB, blockSize=128K, erase_shift=11
[    0.754346] busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
[    0.761148] BrcmNAND mfg 2c f1 MICRON MT29F1G08ABA 128MB on CS0
[    0.767157] 
[    0.767157] Found NAND on CS0: ACC=c3840010, cfg=05052300, cfg_ext=00000042, flashId=2cf18095, tim1=6532845b, tim2=00091e94
[    0.779779] BrcmNAND version = 0x0701 128MB @00000000
[    0.784840] brcmnand_scan: B4 nand_select = 40000000
[    0.789807] brcmnand_scan: After nand_select = 40000000
[    0.795041] handle_acc_control: default CORR ERR threshold  3 bits
[    0.801228] ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16
[    0.807417] page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
[    0.814910] Brcm NAND controller version = 7.1 NAND flash size 128MB @18000000
[    0.822140] ECC layout=brcmnand_oob_bch4_2k
[    0.826326] brcmnand_scan:  mtd->oobsize=64
[    0.830513] brcmnand_scan: oobavail=35, eccsize=512, writesize=2048
[    0.836787] brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=4, eccbytes=7
[    0.845565] Gateway flash mapping
[    0.848898] NAND FLASH TL: phy_addr 0x7d20000
[    0.853269] brcmnand_reset_corr_threshold: default CORR ERR threshold  3 bits for CS0
[    0.861660] [NAND] : tBBT loaded
[    0.861660] 
[    0.864989] Technicolor nand flash translation layer initialized.
[    0.871266] flash mapping initialized, size=125 Mb
[    0.876211] parse_btab: num_banks (5)
[    0.880008] Creating 1 MTD partitions on "technicolor-nand-tl":
[    0.885939] 0x000005b60000-0x000007960000 : "rootfs"
[    0.891265] mtd: device 1 (rootfs) set to be root filesystem
[    0.896951] Creating 5 MTD partitions on "technicolor-nand-tl":
[    0.902882] 0x000000160000-0x000001560000 : "rootfs_data"
[    0.908625] 0x000001560000-0x000004760000 : "bank_1"
[    0.913958] 0x000004760000-0x000007960000 : "bank_2"
[    0.919280] 0x000000100000-0x000000120000 : "eripv2"
[    0.924581] 0x000000120000-0x000000160000 : "rawstorage"
[    0.930983] PPP generic driver version 2.4.2
[    0.935344] PPP BSD Compression module registered
[    0.940062] PPP Deflate Compression module registered
[    0.945128] NET: Registered protocol family 24
[    0.949649] brcmboard registered
[    0.952883] brcmboard: brcm_board_init entry
[    0.957172] print_rst_status: Last RESET due to POR reset
[    0.962584] print_rst_status: RESET reason: 0x00000000
[    0.967774] DYING GASP IRQ Initialized and Enabled
[    0.972591] map_hw_timer_interrupt,130: interrupt_id 22
[    0.977831] map_hw_timer_interrupt,130: interrupt_id 23
[    0.983072] map_hw_timer_interrupt,130: interrupt_id 24
[    0.988310] map_hw_timer_interrupt,130: interrupt_id 25
[    0.993549] Allocated EXT_TIMER number 3
[    0.997481] Broadcom Timer Initialized
[    1.002254] BPM: tot_mem_size=268435456B (256MB), buf_mem_size <15%> =40265310B (38MB), num of buffers=15345, buf size=2624
[    1.013425] Broadcom BPM Module Char Driver v0.1 Registered<304>
[    1.046921] [NTC bpm] bpm_module_init: tot_mem_pool=640 mem_idx:640
[    1.061927] BCMLIBS loaded...
[    1.064998] PCIe HCD (impl1)
[    1.068086]   bcm963xx-pcie: found core [1] vcore [0] 
[    1.073377]   bcm963xx-pcie: [0] DT node available: /pcie@84000000
[    1.079589]   bcm963xx-pcie: vcore [0] initialized with [1] device
[    1.085978] pcie-vcore 84000000.pcie: PCI host bridge to bus 0000:01
[    1.092365] pci_bus 0000:01: root bus resource [mem 0x84000000-0x84ffffff]
[    1.099276] pci 0000:01:00.0: [14e4:f6ca] type 00 class 0x028000
[    1.105309] pci 0000:01:00.0: reg 0x10: [mem 0x84000000-0x84ffffff 64bit]
[    1.112136] pci 0000:01:00.0: supports D1 D2
[    1.116527] PCI: bus1: Fast back to back transfers disabled
[    1.122126] pci 0000:01:00.0: BAR 0: assigned [mem 0x84000000-0x84ffffff 64bit]
[    1.139556]   bcm963xx-pcie: [0] DT node available: /pcie@80040000
[    1.145804]   bcm963xx-pcie: found port [0] GEN2 Core Rev [3.23] with 1 Lanes
[    1.179265] getrcal for res select 5, int 675, ext 639, ratio 121 ratio1 156, rcal 9
[    1.187018]   bcm963xx-pcie: Core [0] setting resistor calibration value to 0x9
[    1.719370]   bcm963xx-pcie: core [0] Link UP - [1] lanes, [GEN2] speed
[    1.726160] bcm963xx-pcie 80040000.pcie: PCI host bridge to bus 0001:00
[    1.732788] pci_bus 0001:00: root bus resource [mem 0xc0000000-0xcfffffff]
[    1.739676] pci_bus 0001:00: root bus resource [bus 00-ff]
[    1.745207]   bcm963xx-pcie: Core [0] Enabled PCIE/UBUS Error Interrupts
[    1.745214]   bcm963xx-pcie: Core [0] UBUS Intr [UBUS_LINKUP]
[    1.757871] pci 0001:00:00.0: [14e4:6317] type 01 class 0x060400
[    1.763931] pci 0001:00:00.0: PME# supported from D0 D3hot
[    1.769517] PCI: bus0: Fast back to back transfers disabled
[    1.775181] pci 0001:01:00.0: [14e4:4360] type 00 class 0x028000
[    1.781215] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit]
[    1.788087] pci 0001:01:00.0: supports D1 D2
[    1.792457] pci 0001:00:00.0: Checking PCIe ASPM for vendor 14e4 device 4360
[    1.800880] PCI: bus1: Fast back to back transfers disabled
[    1.806467] pci_bus 0001:01: busn_res: [bus 01-ff] end is updated to 01
[    1.813113] pci 0001:00:00.0: BAR 8: assigned [mem 0xc0000000-0xc00fffff]
[    1.819915] pci 0001:01:00.0: BAR 0: assigned [mem 0xc0000000-0xc0007fff 64bit]
[    1.827242] pci 0001:00:00.0: PCI bridge to [bus 01]
[    1.832217] pci 0001:00:00.0:   bridge window [mem 0xc0000000-0xc00fffff]
[    1.839075] pcieport 0001:00:00.0: enabling device (0140 -> 0142)
[    1.845472] GACT probability NOT on
[    1.848984] Mirror/redirect action on
[    1.852673] u32 classifier
[    1.855382]     input device check on
[    1.859046]     Actions configured
[    1.862679] NET: Registered protocol family 10
[    1.867912] sit: IPv6 over IPv4 tunneling driver
[    1.873392] NET: Registered protocol family 17
[    1.877892] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    1.890524] Ebtables v2.0 registered
[    1.894170] ebt_time registered
[    1.897338] ebt_ftos registered
[    1.900490] 8021q: 802.1Q VLAN Support v1.8
[    1.904782] Registering SWP/SWPB emulation handler
[    1.916003] VFS: Mounted root (squashfs filesystem) readonly on device 31:1.
[    1.923276] Freeing unused kernel memory: 184K
[    2.864586] init: Console is alive
[    4.381564] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.416102] bcm963xx_wdt: loading out-of-tree module taints kernel.
[    4.427873] Button Hotplug driver version 0.4.1
[    4.450204] usbcore: registered new interface driver usb-storage
[    4.457689] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.467081] init: - preinit -
[    4.882354] random: jshn urandom read with 0 bits of entropy available
[    5.202503] jffs2: jffs2_scan_inode_node(): CRC failed on node at 0x013d77d4: Read 0xffffffff, calculated 0xec1a8151
[    5.216272] jffs2: notice: (87) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[    5.233267] mount_root: switching to jffs2 overlay
[    5.238185] mount_root: executing script in /lib/mount_root
[    5.245557] mount_root: /lib/mount_root/00_rtfd_all
[    5.269285] mount_root: /lib/mount_root/10_remove_due_to_upgrade
[    5.286382] mount_root: /lib/mount_root/18_ispconfig_save
[    5.296077] mount_root: /lib/mount_root/20_rtfd_remove
[    5.305310] mount_root: /lib/mount_root/30_parameter_conversion
[    5.328757] mount_root: /lib/mount_root/80_rtfd_restore
[    5.361166] mount_root: /lib/mount_root/82_ispconfig_restore
[    5.514128] urandom-seed: Seeding with /etc/urandom.seed
[    5.844628] tommath: module license 'unspecified' taints kernel.
[    5.850690] Disabling lock debugging due to kernel taint
[    5.867935] brcm_otp_init entry
[    5.881869] dgasp: kerSysRegisterDyingGaspHandler: prozone registered 
[    5.888490] Prozone base: 0ffe0000
[    5.909853] eRIPv2 secrets passed correctly to Linux
[    5.942323] Dsl Annex A board
[    5.945299] Set board (VCNT-P)
[    6.430164] procd: - early -
[    7.057959] procd: - watchdog -
[    7.061477] procd: - ubus -
[    7.118224] procd: - init -
[    8.066307] urngd: v1.0.1 started.
[    8.731612] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.763440] input: gpio-keys-polled as /devices/platform/gpio-keys-polled.0/input/input0
[    8.807141] NET: Registered protocol family 15
[    8.814269] Initializing XFRM netlink socket
[    8.820073] ipip: IPv4 over IPv4 tunneling driver
[    8.848145] L2TP core: blog_l2tp_rcv_check 
[    8.852402] l2tp_core: L2TP core driver, V2.0
[    8.862928] l2tp_netlink: L2TP netlink interface
[    8.869442] nat46: module (version 683fbd2b765506332a1af141545652bf58f03166) loaded.
[    8.879081] gre: GRE over IPv4 demultiplexor driver
[    8.886247] ip_gre: GRE over IPv4 tunneling driver
[    8.899594] ip6_gre: GRE over IPv6 tunneling driver
[    8.910769] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    8.936625] ncr_master_key_set_internal
[    8.946732] ncr: driver 0.2-mr1 loaded.
[    8.953706] Netfilter messages via NETLINK v0.30.
[    8.960315] ip_set: protocol 6
[    9.013952] cryptodev: driver 1.10 loaded.
[    9.038177] OSCK Loaded!
[    9.058859] Client Private Key Loaded!
[    9.084283] Broadcom Ingress QoS Module  Char Driver v1.0 Registered<303>
[    9.094059] 
[    9.094059] Broadcom Ingress QoS v1.0 initialized
[    9.103203] Broadcom Command List Driver v1.0
[    9.112924] Broadcom Packet Flow Cache 
[    9.118015] FCACHE_CONFIG_MAX_FLOW_ENTRIES<16384>
[    9.123127] FCACHE_CONFIG_MAX_FDB_ENTRIES<1024>
[    9.127684] FCACHE_CONFIG_MAX_HOST_DEV_ENTRIES<64>
[    9.132487] FCACHE_CONFIG_MAX_HOST_MAC_ENTRIES<32>
[    9.137288] npe_max_entries<32768>
[    9.141380] Bind blog_notify_evt_enqueue_fn[<bef2700c>]
[    9.146687] fc_evt task created successfully
[    9.151560] max_ent = 16384 intvl_msec = 10000 num_slices = 2000 num_ent = 9 period_msec = 5 
[    9.160348] NBUFF v1.0 Initialized
[    9.192797] Total # of labels = 68
[    9.197664] Initialized fcache state
[    9.203563] 	Pkt HW acceleration is disabled/unavailable.
[    9.209077] Broadcom Packet Flow Cache  Char Driver v4.0 Registered<302>
[    9.217292] fc_timer_task created successfully
[    9.222806] 	Pkt HW acceleration is disabled/unavailable.
[    9.228358] Created Proc FS /procfs/fcache
[    9.233007] Broadcom Packet Flow Cache registered with netdev chain
[    9.242813] Broadcom Packet Flow Cache learning via BLOG enabled.
[    9.250364] [FHW]  pktDbgLvl[0xbef3e0c4]=0
[    9.255478] [FHW]  fhw_construct: 
[    9.263799] Initialized Fcache HW accelerator layer state
[    9.271791] flwStatsThread created. numFlwsPerPoll 546 maxFlwIdx 16383
[    9.278260] Fcache Pathstats created
[    9.278264] Constructed Broadcom Packet Flow Cache v4.0
[    9.305738] Broadcom Archer Packet Accelerator Intializing
[    9.313478] Open archer Netdevice
[    9.317786] Archer DS DPI Initialized
[    9.321733] Archer US DPI Initialized
[    9.325507] Archer WLAN Interface Construct (Threshold 32 packets, Timeout 500 usec, Jiffies 10)
[    9.335364] SYSPORT Driver Constructed (Budget: 128, Coalescing: 826828 nsec)
[    9.342621] Archer WLAN Rx Thread Initialized
[    9.347096] Initializing IUDMA Driver
[    9.350942] RXQ[0]: IRQ 52, CPU 2
[    9.354569] Archer DMA Layer Initialized
[    9.358591] Archer Mode set to L2+L3
[    9.362301] Archer Mode set to L2+L3
[    9.365937] Initialized Archer Host Layer
[    9.370577] Flow Table (256, 64): d17e6000, 4194304 bytes
[    9.379160] Flow Info Table (44, 65536): d1be7000, 2883584 bytes
[    9.389352] Command List Table (128): virt 0xc8800000, phys 0x08800000, size 2097152 bytes
[    9.399561] Command List Control Table (8): c8f80000, 131072 bytes
[    9.405934] Sysport Classifier Initialized: Maximum 16384 flows
[    9.411893] Archer IQ status changed from 0 to 1
[    9.419316] [NTC bitpool] idx_pool_init: 551:FHW[0]:Create Index Pool_Size = 16384
[    9.429543] Retrieve num_fhw_path=64
[    9.433137] Pathstats allocated 2048 bytes
[    9.438450] Broadcom Packet Flow Cache HW acceleration enabled.
[    9.449030] Enabled Archer binding to Flow Cache
[    9.454967] Broadcom Archer Network Processor Char Driver v0.1 Registered <339>
[    9.464253] Archer TCP Pure ACK Enabled
[    9.475000] bcmxtmrt: Broadcom BCM3177A2 ATM/PTM Network Device v2.0
[    9.481741] bcmxtm module init...... 
[    9.488957] archer xtm API binded
[    9.492370] IUDMA Host Binding Successfull
[    9.523302] SYSPORT Host Binding Successfull
[    9.528641] eth0: Down <D4:35:1D:1E:96:65> <IntSw P0, Logical 00> PHY_ID <0x0007f008:0x08: On-chip 1G GPHY> Cfg: ANG.1G; Down 
[    9.528641] eth1: Down <D4:35:1D:1E:96:65> <IntSw P1, Logical 01> PHY_ID <0x0007f009:0x09: On-chip 1G GPHY> Cfg: ANG.1G; Down 
[    9.528641] eth2: Down <D4:35:1D:1E:96:65> <IntSw P2, Logical 02> PHY_ID <0x0007f00a:0x0a: On-chip 1G GPHY> Cfg: ANG.1G; Down 
[    9.528641] eth3: Down <D4:35:1D:1E:96:65> <IntSw P3, Logical 03> PHY_ID <0x0007f00b:0x0b: On-chip 1G GPHY> Cfg: ANG.1G; Down 
[    9.528641] eth4: Down <D4:35:1D:1E:96:65> <IntSw P4, Logical 04> PHY_ID <0x0007f00c:0x0c: On-chip 1G GPHY> Cfg: ANG.1G; Down 
[    9.583109] ===> Activate Deep Green Mode
[    9.587272] logical_port 0, intf_index 0, phys_port 0 -> port_index 0, 4 queues
[    9.594679] logical_port 1, intf_index 0, phys_port 1 -> port_index 1, 4 queues
[    9.602614] logical_port 2, intf_index 0, phys_port 2 -> port_index 2, 4 queues
[    9.610026] logical_port 3, intf_index 0, phys_port 3 -> port_index 3, 4 queues
[    9.617433] logical_port 4, intf_index 0, phys_port 4 -> port_index 4, 8 queues
[    9.625001] SYSPORT[0] = SWITCH_INTERNAL
[    9.629625] RXQ[0]: IRQ 44, CPU 2
[    9.633608] CSB Initialized: 0xcb2a3000 (0xcb2a3000), size 64 (128)
[    9.640157] Ports 5, TDMA Rings 24
[    9.643680] Archer DMA Layer Initialized
[    9.649322] Sysport Recycle Task: IRQ 45, CPU 2
[    9.655503] dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered 
[    9.667185] bcm_enet_init:L2322 ENET system contructed and configured enet-kthrd thread
[    9.675804] enet_kthread_handler:L293 Instantiating ENET thread
[    9.678706] Broadcom 802.1Q VLAN Interface, v0.1
[    9.688722] bcmxtmcfg: bcmxtmcfg_init entry
[    9.699952] adsl: adsl_init entry
[    9.734776] BroadMobi_GobiNet: 2018-1-9
[    9.742573] usbcore: registered new interface driver BroadMobi_GobiNet
[    9.752745] Quectel_GobiNet: Quectel_Linux_GobiNet_SR01A02V16
[    9.758929] usbcore: registered new interface driver Quectel_GobiNet
[    9.768209] usbcore: registered new interface driver usbserial
[    9.774951] usbcore: registered new interface driver GobiSerial
[    9.781072] usbserial: USB Serial support registered for GobiSerial
[    9.787399] GobiSerial: 2015-08-27/SWI_2.25:GobiSerial
[    9.795123] jnl: driver (UFSD_HEAD, Feb  1 2021 00:50:56) loaded at bf0d0000
[    9.810773] ufsd: driver (UFSD_HEAD, Feb  1 2021 00:50:57, ioctl, sd2(5), car) loaded at bf0e1000
[    9.810773] NTFSJ support included
[    9.810773] Hfs+J support included
[    9.826830] ufsd: PAGE_SIZE=4K, THREAD_SIZE=8k
[    9.833264] ufsd: Kernel .config hash: original 0xa6bd7630, current matched.
[    9.845435] Bridge firewalling registered
[    9.850687] usbcore: registered new interface driver cdc_acm
[    9.856517] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[    9.865807] usbcore: registered new interface driver cdc_ether
[    9.872920] usbcore: registered new interface driver cdc_ncm
[    9.879838] usbcore: registered new interface driver cdc_wdm
[    9.888560] usbcore: registered new interface driver huawei_cdc_ncm
[    9.895887] ip_tables: (C) 2000-2006 Netfilter Core Team
[    9.912931] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[    9.923290] nf_conntrack version 0.5.0 (3903 buckets, 15612 max)
[    9.968327] ctnetlink v0.93: registering with nfnetlink.
[    9.976076] nf_conntrack_rtsp v0.7 loading
[   10.027358] nf_nat_rtsp v0.7 loading
[   10.036401] usbcore: registered new interface driver qmi_wwan
[   10.043607] usbcore: registered new interface driver rndis_host
[   10.050676] usbcore: registered new interface driver sierra
[   10.056490] usbserial: USB Serial support registered for Sierra USB modem
[   10.064636] usbcore: registered new interface driver sierra_net
[   10.095741] xt_time: kernel timezone is -0000
[   10.109186] usbcore: registered new interface driver option
[   10.114917] usbserial: USB Serial support registered for GSM modem (1-port)
[   10.123290] usbcore: registered new interface driver qcserial
[   10.131554] usbserial: USB Serial support registered for Qualcomm USB modem
[   10.139776] kmodloader: done loading kernel modules from /etc/modules.d/*
[   12.050625] ++++ Powering up USB blocks
[   12.393969] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[   12.402285] ehci-platform: EHCI generic platform driver
[   12.402462] ehci-platform ehci-platform.0: EHCI Host Controller
[   12.402487] ehci-platform ehci-platform.0: new USB bus registered, assigned bus number 1
[   12.402590] ehci-platform ehci-platform.0: irq 42, io mem 0x8000c300
[   12.407920] ehci-platform ehci-platform.0: USB 2.0 started, EHCI 1.00
[   12.408480] hub 1-0:1.0: USB hub found
[   12.408516] hub 1-0:1.0: 1 port detected
[   12.408783] ehci-platform ehci-platform.1: EHCI Host Controller
[   12.408807] ehci-platform ehci-platform.1: new USB bus registered, assigned bus number 2
[   12.408986] ehci-platform ehci-platform.1: irq 42, io mem 0x8000c500
[   12.414885] ehci-platform ehci-platform.1: USB 2.0 started, EHCI 1.00
[   12.415418] hub 2-0:1.0: USB hub found
[   12.415457] hub 2-0:1.0: 1 port detected
[   12.423756] ehci-pci: EHCI PCI platform driver
[   12.432799] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[   12.441416] ohci-platform: OHCI generic platform driver
[   12.441584] ohci-platform ohci-platform.0: Generic Platform OHCI controller
[   12.441611] ohci-platform ohci-platform.0: new USB bus registered, assigned bus number 3
[   12.441716] ohci-platform ohci-platform.0: irq 41, io mem 0x8000c400
[   12.496461] hub 3-0:1.0: USB hub found
[   12.496505] hub 3-0:1.0: 1 port detected
[   12.496750] ohci-platform ohci-platform.1: Generic Platform OHCI controller
[   12.496781] ohci-platform ohci-platform.1: new USB bus registered, assigned bus number 4
[   12.496940] ohci-platform ohci-platform.1: irq 41, io mem 0x8000c600
[   12.553009] hub 4-0:1.0: USB hub found
[   12.553064] hub 4-0:1.0: 1 port detected
[   12.562655] ohci-pci: OHCI PCI platform driver
[   14.608546] ERROR [archer_wfd_hooks_init,1268]: Archer binding is not available
[   14.608546] 
[   14.608564] ../../bcmdrivers/opensource/net/wfd/bcm963178/wfd_dev.c wfd_dev_init: wfd_platform_init() failed
[   14.673592] Initializing WLCSM Module
[   14.673627] WLCSM Module loaded successfully 
[   14.684089] jffs2: warning: (1761) jffs2_sum_write_data: Not enough space for summary, padsize = -13
[   15.153237] Loading HND Module
[   15.210425] igs_module_init:867:	 IGS 18 create network socket successful
[   16.241375] wl_module_init: passivemode set to 0x1
[   16.241395] wl_module_init: txworkq set to 0x0
[   16.241410] wl_pktfwd_sys_init:  WL_PKTFWD[1.1.0] Success
[   16.241480] wl 0000:01:00.0: enabling device (0140 -> 0142)
[   16.241501] wl0: creating kthread wl0-kthrd
[   16.249551] si_doattach: using BAR0 value: enum_base=84000000
[   16.254436] BME Service Initialization
[   16.254465] BME: M2M Core id 0x844 rev 128
[   16.255474] wl0: phy_radio_attach: RF Band Cap: 2G:1 5G:1
[   16.275508] kerSysGetWifiLed(0) returned 0
[   16.277130] BME:register key<1010804> user RLM sel IDX set 1 mem 4 8 hi 0 0
[   16.277358] wl0 taf_do_enable: TAF is enabled
[   16.278178] wl0_awl attach successful tx: 1, rx: 2
[   16.278293] WL_FLCTL[0] bpm_total_skb 12276, exhaustion_hi 1227, exhaustion_lo 3069, prio_favor 4
[   16.278303] Archer WLAN Bind: wl%d, wl_radio_idx 0, radio_index 0, mode SKB
[   16.278309] wl_wfd_bind: wl0 wfd_idx 0 success
[   16.279377] wl0: Broadcom BCM63178 802.11 Wireless Controller 17.10.121.2004 (r786578)
[   16.279392] dgasp: kerSysRegisterDyingGaspHandler: wl0 registered 
[   16.279478] wl 0001:01:00.0: enabling device (0140 -> 0142)
[   16.279503] wl1: creating kthread wl1-kthrd
[   16.299874] BME M2M core not available
[   16.300656] wl1: phy_radio_attach: RF Band Cap: 2G:1 5G:1
[   16.308647] wl1 taf_do_enable: TAF is enabled
[   16.309496] wl1_awl attach successful tx: 1, rx: 2
[   16.309609] WL_FLCTL[1] bpm_total_skb 12276, exhaustion_hi 1227, exhaustion_lo 3069, prio_favor 4
[   16.309619] Archer WLAN Bind: wl%d, wl_radio_idx 1, radio_index 1, mode SKB
[   16.309625] wl_wfd_bind: wl1 wfd_idx 1 success
[   16.310572] wl1: Broadcom BCM4360 802.11 Wireless Controller 17.10.121.2004 (r786578)
[   16.310587] dgasp: kerSysRegisterDyingGaspHandler: wl1 registered 
[   16.333712] dhd_module_init in
[   16.333745] DHD_FKB_POOL size is:1280 and entry size:2624
[   16.338812] DHD_PKTTAG POOL size is:2592 and entry size:64
[   16.341998] dhd_pktfwd_sys_init:  dhd_PKTFWD[1.0.0] Success
[   16.342016] dhd_queue_budget = 256
[   16.342021] dhd_sta_threshold = 2048
[   16.342025] dhd_if_threshold = 65536
[   16.342079] no wifi platform data, skip
[   16.342340] No Broadcom PCI device enumerated!
[   16.342363] dhd_module_init out
[   17.249661] monitor task is initialized pid= 2020 
[   17.862570] SAR Base:d0878000
[   17.862613] bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system
[   17.862617] E-RXIntr
[   17.862762] bcmxtmcfg: Out of sequence call to XTM_ASM_HANDLER::Uninitialize().  Recovering.
[   17.862773] bcmxtmcfg: ATM Bonding configured in system. Fallback mode = Enabled 
[   17.862778] bcmxtmcfg: Bonding State is DATA_IDLE 
[   17.862782] bcmxtmcfg: SID MODE SET to 12 BIT MODE 
[   17.862792] bcmxtmcfg: ATM Bonding Mgmt Log Area = cc3a65bc 
[   17.869374] jffs2: warning: (1628) jffs2_sum_write_data: Summary too big (-32 data, -1257 pad) in eraseblock at 00b60000
[   18.859812] jffs2: warning: (1628) jffs2_sum_write_data: Summary too big (-32 data, -1156 pad) in eraseblock at 00b40000
[   22.630786] wl_event_open
[   22.630806] wl_event_open COMPLETED
[   23.122326] jffs2: warning: (1628) jffs2_sum_write_data: Summary too big (-32 data, -1210 pad) in eraseblock at 00b20000
[   23.443847] sched: RT throttling activated
[   23.635155] wl1: wlc_dfs_cacstate_init: state to PRE-ISM Channel Availability Check chanspec 108 NOT BGDFS
[   23.987662] wl0: random key value: 
[   23.989064] jffs2: warning: (1628) jffs2_sum_write_data: Summary too big (-32 data, -1174 pad) in eraseblock at 00b00000
[   24.295068] wl0: random key value: 
[   24.295391] wl0: random key value: 
[   24.732933] BcmAdsl_Initialize=0xbeff4004, g_pFnNotifyCallback=0xbeff4000
[   24.734904] AdslCoreSetSDRAMBaseAddr: pAddr=0x0fe00000 sdramPageAddr=0xCFE00000
[   24.796089] BcmAdslCoreCalibrate: (cnt1-cnt)=0x55d078b, adslCoreCyclesPerMs=1499714, BCMOS_MSEC_PER_TICK =1
[   24.796221] *** dslThread pid=2807, SSP ***
[   24.796340] AdslCoreInit: afe_reg0=0xE0 bg_bias0=0x4CD
[   24.796351] DYING GASP IRQ Disabled
[   24.796360] DYING GASP IRQ Enabled
[   24.796372] DYING GASP IRQ Disabled
[   24.796385] DYING GASP IRQ Enabled
[   24.908266] AdslCoreSetSdramImageAddr: lmem2=0x10000000, pgSize=0x200000 sdramSize=0x11417C
[   24.908287] AdslCoreSetSdramImageAddr: lmem2(0x0) vs ADSL_PHY_SDRAM_BIAS(0x0); origAddr=0xCFE00000 newAddr=0xCFE00000
[   24.908294] pSdramPHY=0xcffffff8, 0x10914820 0x0
[   24.908301] AdslCoreSetSdramImageAddr: sdramPageAddr=0xcfe00000, sdramImageAddr=0xcfe00000, sdramPhyImageAddr=0x10000000
[   24.908308] *** AdslCoreSetXfaceOffset: data[0]=0xFFFFFE6F data[1]=0x190 ***
[   24.908312] *** XfaceOffset: 0x190 => 0x190 ***
[   25.183631] *** AdslCoreSetSdramTrueSize: data[0]=0xB3BEE7FF data[1]=0x4C411800 ***
[   25.183648] *** AdslCoreSetSdramTrueSize: data[0]=0xFFE7BEB3 data[1]=0x18414C ***
[   25.183654] *** PhySdramSize got adjusted: 0x11417C => 0x18414C ***
[   25.183662] AdslCoreSharedMemInit: shareMemStart=cfffffe0 shareMemSize=2048
[   25.183668] AbovePHY: start=0xcff84150 cur=0xcff84150, size=505488 avail=505488
[   25.183674] BelowPHY: start=0xcfe00000 cur=0xcfe00000, size=0 avail=0
[   25.183679] __AdslCoreHwReset: pAdslX=0xd0f00190
[   25.183689] __AdslCoreHwReset: pAdslX->sdramBaseAddr=0x0000e0af, pAdslX->gfcTable[]=0x0000e0cf, adslCorePhyDesc.sdramImageAddr=0xcfe00000
[   25.193375] AdslCoreHwReset:  pLocSbSta=c70d0000 bkupThreshold=3072
[   25.193395] AdslCoreHwReset:  AdslOemDataAddr = 0x101016F8, time=10 ms
[   25.193438] bcmxtmcfg:ulPhysPort[0] m_ulTrafficMonitorPort[4]
[   25.193444] bcmxtmcfg: AutoSenseATM is not enabled. Link Traffic type from PHY=1 
[   25.193451] bcmxtmcfg: XTM LinkInfo. P-0, S-DOWN(2), Service =ATM(1) 
[   25.193483] bcmxtmcfg: ATM Bonding configured in system. Fallback mode = Enabled 
[   25.193487] bcmxtmcfg: Bonding State is DATA_IDLE 
[   25.193492] bcmxtmcfg: SID MODE SET to 12 BIT MODE 
[   25.193498] bcmxtmcfg: ATM Bonding Mgmt Log Area = cc3a65bc 
[   25.193530] ***BcmDiagsMgrRegisterClient: 0 ***
[   25.193538] VersionInfo: A2pv6L046o.d27j
[   25.193545] dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered 
[   25.796892] Line 0: xDSL link down
[   26.291952] ENET: proc cmd - if_phy_pwr_sync disable
[   26.368151] _compat_port_object_from_unit_port:L706 cannot map unit 0, port 6 to port object
[   26.376419] _compat_port_object_from_unit_port:L706 cannot map unit 0, port 7 to port object
[   26.387964] _compat_port_object_from_unit_port:L706 cannot map unit 1, port 0 to port object
[   26.396610] _compat_port_object_from_unit_port:L706 cannot map unit 1, port 1 to port object
[   26.404577] _compat_port_object_from_unit_port:L706 cannot map unit 1, port 2 to port object
[   26.412538] _compat_port_object_from_unit_port:L706 cannot map unit 1, port 3 to port object
[   26.418795] _compat_port_object_from_unit_port:L706 cannot map unit 1, port 4 to port object
[   26.426814] _compat_port_object_from_unit_port:L706 cannot map unit 1, port 5 to port object
[   26.439130] _compat_port_object_from_unit_port:L706 cannot map unit 1, port 6 to port object
[   26.445803] _compat_port_object_from_unit_port:L706 cannot map unit 1, port 7 to port object
[   27.172918] Drop Profile Set: eth0, logical_port 0, queue_id 0
[   27.185111] Drop Profile Set: eth0, logical_port 0, queue_id 1
[   27.195144] Drop Profile Set: eth0, logical_port 0, queue_id 2
[   27.204668] Drop Profile Set: eth0, logical_port 0, queue_id 3
[   27.215167] Drop Profile Set: eth1, logical_port 1, queue_id 0
[   27.224668] Drop Profile Set: eth1, logical_port 1, queue_id 1
[   27.234355] Drop Profile Set: eth1, logical_port 1, queue_id 2
[   27.246112] Drop Profile Set: eth1, logical_port 1, queue_id 3
[   27.256060] Drop Profile Set: eth2, logical_port 2, queue_id 0
[   27.265546] Drop Profile Set: eth2, logical_port 2, queue_id 1
[   27.277098] Drop Profile Set: eth2, logical_port 2, queue_id 2
[   27.286391] Drop Profile Set: eth2, logical_port 2, queue_id 3
[   27.296214] Drop Profile Set: eth3, logical_port 3, queue_id 0
[   27.305611] Drop Profile Set: eth3, logical_port 3, queue_id 1
[   27.318523] Drop Profile Set: eth3, logical_port 3, queue_id 2
[   27.329163] Drop Profile Set: eth3, logical_port 3, queue_id 3
[   27.339450] Drop Profile Set: eth4, logical_port 4, queue_id 0
[   27.350382] Drop Profile Set: eth4, logical_port 4, queue_id 1
[   27.362250] Drop Profile Set: eth4, logical_port 4, queue_id 2
[   27.372326] Drop Profile Set: eth4, logical_port 4, queue_id 3
[   27.383498] Drop Profile Set: eth4, logical_port 4, queue_id 4
[   27.395341] Drop Profile Set: eth4, logical_port 4, queue_id 5
[   27.405139] Drop Profile Set: eth4, logical_port 4, queue_id 6
[   27.415133] Drop Profile Set: eth4, logical_port 4, queue_id 7
[   28.758722] wl1: random key value: 
[   28.833023] wl1: random key value: 
[   28.833378] wl1: random key value: 
[   30.209053] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   30.213441] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   30.217263] IPv6: ADDRCONF(NETDEV_UP): eth2: link is not ready
[   30.221321] IPv6: ADDRCONF(NETDEV_UP): eth3: link is not ready
[   30.224951] IPv6: ADDRCONF(NETDEV_UP): eth4: link is not ready
[   32.248189] device wl0_1 entered promiscuous mode
[   32.274758] br-guest: port 1(wl0_1) entered forwarding state
[   32.274863] br-guest: port 1(wl0_1) entered forwarding state
[   32.289600] device wl1_1 entered promiscuous mode
[   32.289766] br-guest: port 2(wl1_1) entered forwarding state
[   32.289809] br-guest: port 2(wl1_1) entered forwarding state
[   32.308508] device eth0 entered promiscuous mode
[   32.350598] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   32.367977] device eth1 entered promiscuous mode
[   32.388135] device eth2 entered promiscuous mode
[   32.404753] device eth3 entered promiscuous mode
[   32.410161] IPv6: ADDRCONF(NETDEV_UP): eth4: link is not ready
[   32.416689] netdev path : vlan_iptv -> eth4
[   32.433352] device eth4 entered promiscuous mode
[   32.442533] IPv6: ADDRCONF(NETDEV_UP): vlan_iptv: link is not ready
[   32.443071] netdev path : vlane_data_dk -> eth4
[   32.466270] IPv6: ADDRCONF(NETDEV_UP): vlane_data_dk: link is not ready
[   32.804682] device wl0 entered promiscuous mode
[   32.804759] br-lan: port 5(wl0) entered forwarding state
[   32.804807] br-lan: port 5(wl0) entered forwarding state
[   32.806218] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   32.866129] device wl1 entered promiscuous mode
[   32.866204] br-lan: port 6(wl1) entered forwarding state
[   32.866235] br-lan: port 6(wl1) entered forwarding state
[   33.574542] <=== Deactivate Deep Green Mode
[   33.574754] eth4 (Int switch port: 4) (Logical Port: 4) (phyId: c) Link Up at 1000 mbps full duplex
[   33.575039] IPv6: ADDRCONF(NETDEV_CHANGE): eth4: link becomes ready
[   33.584944] IPv6: ADDRCONF(NETDEV_CHANGE): vlan_iptv: link becomes ready
[   33.590003] IPv6: ADDRCONF(NETDEV_CHANGE): vlane_data_dk: link becomes ready
[   34.279869] br-guest: port 1(wl0_1) entered forwarding state
[   34.295871] br-guest: port 2(wl1_1) entered forwarding state
[   34.807872] br-lan: port 5(wl0) entered forwarding state
[   34.871867] br-lan: port 6(wl1) entered forwarding state
[   34.934381] wl1: wlc_dfs_cacstate_init: state to PRE-ISM Channel Availability Check chanspec 128/80 NOT BGDFS
[   34.938128] wl1: wlc_dfs_cacstate_init: state to PRE-ISM Channel Availability Check chanspec 128/80 NOT BGDFS
[   54.729475] device veth3K63S2 entered promiscuous mode
[   54.748718] IPv6: ADDRCONF(NETDEV_UP): veth3K63S2: link is not ready
[   54.951656] eth0: renamed from vethVB4FCW
[   54.960121] IPv6: ADDRCONF(NETDEV_CHANGE): veth3K63S2: link becomes ready
[   54.960318] br-lan: port 7(veth3K63S2) entered forwarding state
[   54.960430] br-lan: port 7(veth3K63S2) entered forwarding state
[   56.963871] br-lan: port 7(veth3K63S2) entered forwarding state
[  639.519815] wl1: dfs : state to In-Service Monitoring(ISM) chanspec 128/80 at 600000ms

@tosiara
Copy link
Contributor Author

tosiara commented Apr 8, 2022

Temporary Dropbox link for torrent seeders: https://www.dropbox.com/s/gukgtjcfyufstn0/DGA0122-VCNT-P-19.4.0539-4521016-Signed.rbi.zip?dl=0

@tosiara
Copy link
Contributor Author

tosiara commented Apr 8, 2022 •
edited by LuKePicci
Loading

Resolves: 142 ?

@einaneina
Copy link

einaneina commented Jun 6, 2022 •
edited
Loading

@tosiara I have the same router with which I would like to play. Actually I want to change default DNS on this router, and maybe connect it to VPN service to be able to share connection through VPN for this router clients. Could you please help me root it?

You wrote that there is SSH backdoor on port 60022, but it is closed. NMAP Intense scan results:
PORT STATE SERVICE VERSION

53/tcp open domain Cloudflare public DNS
80/tcp open http nginx
139/tcp open netbios-ssn?
445/tcp open microsoft-ds?
8080/tcp open http nginx
41952/tcp open upnp
55556/tcp open http nginx

Router info:
Product Vendor
Technicolor
Product Name
Telia X1
Software Version
19.4

@tosiara
Copy link
Contributor Author

tosiara commented Jun 8, 2022

Sorry, I no longer have access to that router. And I only got a temporary root access with a help of Telia engineer.
So, I only wanted to contribute to the project by uploading the firmware, which can be unpacked and inspected for backdoors or vulnerabilities.

@LuKePicci
Copy link
Collaborator

LuKePicci commented Jul 18, 2022 •
edited
Loading

I'm ready to merge this but I have some doubts it could resolve #142 since it is related to non-telia variant. We used to have Telia devices signed by Telia specific OSIK (and also a different OSCK). This means the OSCK you shared is likely coupled to Telia OSIK and therefore the VCNT-P board owned by @protonbeam is not accepting this firmware. We can determine by running signature check on the RBI you shared using Telia OSIK which we have already in this repo.

I also need an explaination of this firmware being of Type 1. Type 1 means you can get it downgraded via software (without BOOTP/TFTP) to a Type 2 one. It is probably better to flag this as type ???

@tosiara
Copy link
Contributor Author

tosiara commented Aug 1, 2022

This means the OSCK you shared is likely coupled to Telia OSIK and there fore the VCNT-P board owned by @protonbeam is not accepting this firmware.

Maybe, we need to get confirmation from Protonbeam regarding this one. At least try Wireshark to see if it really gets into BOOTP/TFTP and really downloads the RBI

I also need an explaination of this firmware being of Type 1

In this PR I have marked the firmware as Type 2. Please clarify your question

@LuKePicci
Copy link
Collaborator

I'm going to merge this now, but the only listed firmware has been stated to be of type 1 without any other available type 2 images.

I will revert that indication to Type ??? to avoid ambiguity.

Also, we know there is a 19.4.0200-4521014 from above bank info for which we have no RBI nor raw dump.

@LuKePicci LuKePicci merged commit 1b80454 into hack-technicolor:master Nov 6, 2022
LuKePicci added a commit that referenced this pull request Feb 19, 2023
@kevdagoat @LuKePicci
@tosiara @seud0nym @lorenzocanalelc
Merge 'master' into 'stable' (#273)
c6bb730 
* Existing VCNT-P OSCK is for Telia

* Added firmware for DGA0122 VCNT-P Telia Lithuania (#233)

* Change VCNT-P listed firmware to type ???

* Added Telstra Smart Modem Gen 3 (CobraXh) (#262)

* Added Telstra Smart Modem Gen 3

* Changed reference to ARM64 boards

* Reverted RBI change + changed PKGTB to ref U-boot

* Cannot restore ubifs rootfs_data dump

* Added 20.3.c.0432-MR21.1-RA for vbnt-v and vcnt-a (#266)

* Add new Firmware for DGA0122 (#270)

---------

Co-authored-by: LuKePicci <luca.piccirillo@gmail.com>
Co-authored-by: tosiara <tosiara@users.noreply.github.com>
Co-authored-by: Luca Piccirillo <LuKePicci@users.noreply.github.com>
Co-authored-by: Stephen Stevens <41851175+seud0nym@users.noreply.github.com>
Co-authored-by: Lorenzo <44505255+lorenzocanalelc@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@tosiara @einaneina @LuKePicci