CM8200 SPI Flash Dump

[Fuzion24]

Someone from this thread ( https://forums.whirlpool.net.au/thread/9jwqvxm3 ) dumped the SPI flash of a CM8200B cable modem. I compiled ProgramStore and ran it, but the SPI flash doesnt appear to follow this firmware structure. I believe the beginning of the flash is actually ARM executable code -- probably uboot. I was wondering if this rang any bells for you?

➜  ProgramStore git:(master) ✗ xxd ./CM8200B.bin | head
00000000: 0600 00ea 0900 00ea 0800 00ea 0700 00ea  ................
00000010: 0600 00ea 0500 00ea 0400 00ea 0300 00ea  ................
00000020: 14d0 9fe5 1302 00eb 1502 00eb d301 00ea  ................
00000030: feff ffea 0000 0000 5000 0000 0000 e1ff  ........P.......
00000040: a08a 0000 00ff ff00 0011 0000 0000 0700  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................

Computed HCS f0d7

stored checksum    0

Header checksum failed.
   Signature: 0600
     Control: 00ea
   Major Rev: 0900
   Minor Rev: 00ea
  Build Time: 1974/4/3 10:46:02 Z
 File Length: -1585267047258914582 bytes
Load Address: ea000003040000ea
    Filename: П�
         HCS: 0000
         CRC: 80000580000

[jclehner]

Hi, I've had a poke at this a while back, but never got back to you, sorry. Yes, you're right, this is ARM code, apparently for a Broadcom bootloader named BOLT. I'm assuming this device uses the BCM3390 chipset, which apparently includes both an ARM CPU, which is responsible for the boot process, whereas the actual cable modem firmware still runs on a MIPS chip.

The permanent and dynamic non-vol for the MIPS chip is stored as a regular file on a JFFS2 filesystem, that can be extracted from CM8200B.bin using binwalk (files cm_{dyn,perm}.bin) However, they appear to be encrypted. I don't have a firmware for the CM8200, but one from a CM1000, which uses the same chipset. On this device, the encryption used is AES-256-ECB, however the key doesn't appear to be fixed, but is taken from a memory-mapped (?) address (0xd384bfe0).

[starcraft66]

@jclehner I have a BCM3390-based modem torn apart (Technicolor TC4400-AM) from which I dumped the SPI flash. I have not yet had the time to solder pin headers to the UART connections to investigate the state of the console. I was assuming it would be locked so I wanted to tackle unlocking it via the config file first.

I arrived to the same conclusion as OP when inspecting the files from my dump. I have retrieved cm_{dyn,perm}.bin and they do not appear to be encrypted whatsoever. cm_dyn.bin does not seem to contain any configuration, it starts out with perhaps some sort of log line? It contains the default admin username and password for the modem's web interface (which I can't access, it was presumably disabled by the ISP config). When the modem is booting, I can get a basic auth prompt from the web browser when trying to access the spectrum analyzer but that basic auth is removed a few seconds into the boot, leaving the spectrum analyzer wide open. The rest of the file seems to be two blocks of garbled log messages. One copy of the logs seems to pertain to the last boot, there are messages about not finding the CMTS because the Coax wasn't plugged in. The other identical-in-size block of logs seems to be the last time it was configured by the CMTS (a long time ago), it shows the IP of the TFTP server and the file name it's downloading over TFTP.

cm_perm.bin is also unencrypted and contains my modem's BPI+ certificates, I was able to extract them with binwalk and parse them with OpenSSL.

There are a few more files that seem to be of interest on the JFFS2 filesystem I don't see mentioned in any CM research:

router-perm.config: This is just a short boring XML config file with a few MAC addresses in it mdm.config, mdm-backup.config and mdm-permanent.config: These 3 files are compressed and/or encrypted in some way. They all follow this structure:

00000000: 3c63 6f6d 7072 6573 7365 6420 616c 673d  <compressed alg=
00000010: 6c7a 7720 6c65 6e3d 3332 3337 3e00 0000  lzw len=3237>...
00000020: 0000 0000 0000 0002 3c63 7263 3d30 7832  ........<crc=0x2
00000030: 3433 3833 3462 383e 0000 0000 800f 07e7  43834b8>........
00000040: 8369 b040 7632 9c8e 6693 79b8 7a22 188b  .i.@v2..f.y.z"..
00000050: 8602 21f8 f814 3c21 9c0c a438 6998 d267  ..!...<!...8i..g
[...] (data)

Minus that plaintext header, the rest of the file is exactly len-1 long. I tried taking just the bytes after the header, slapping them into a new file and trying to use various LZW implementations in python and C in an attempt to decompress them but this did not result in successful decompression. I'm not familiar with raw LZW compression so it is possible something is wrong but there could also be some encryption I'm not aware of. I didn't want to post the entire file in case it contains some information identifying my modem (my private keys are in the spi dump!!) but I can send it to you by email or some other way if you're interested in taking a look at those files.

[starcraft66]

By searching github, I was able to find decompressed versions of other mdm.config files (https://github.com/rikka0w0/Arris-CM8200B-Reverse-Engineering/blob/f841267f8ae772912000c3af79b77b8c45735da6/spi_decoded/0x1A0000/mdm.config.txt#L4). While the decompression method remains a mystery for now, this repo contains a full XML config file from the TC4400 that reveals that this whole file isn't very interesting as it has nothing to do with the console settings. I guess my settings file is hiding somewhere else in the SPI dump. Hoping I can get some more info on the flash layout with a UART console in boot logs.

[starcraft66]

It turns out I didn't look well enough and the decompression of the XML files was documented in https://github.com/rikka0w0/Arris-CM8200B-Reverse-Engineering.git and works using a python LZW implementation.

[jclehner]

cm_dyn.bin does not seem to contain any configuration

That's weird... You should be able to run both files through bcm2cfg by the way.

I didn't want to post the entire file in case it contains some information identifying my modem (my private keys are in the spi dump!!) but I can send it to you by email or some other way if you're interested in taking a look at those files.

Sure thing, just send it via email (joseph.c.lehner@gmail.com)!

[starcraft66]

I sent you the files and full SPI dump by email.

The dump actually contains a ton of JFFS2 filesystems containing sometimes identical and sometimes different files. I thought binwalk was spazzing out at first but I loaded up the dump in a hex editor and went hunting for FF FF FF FF FF FF FF FF 85 19 to identify JFFS2 in the correct endianness and there were indeed many such filesystems in the dump. I am wondering if some of these are old/bogus overwritten parts of the chip, backups or for wear leveling purposes.

cm_dyn.bin does not seem to contain any configuration

That's weird... You should be able to run both files through bcm2cfg by the way.

I tried all of the .bin files I could recover from those filesystems and always got the same result when running them through bcm2cfg:

@CocoPommel-5:~/D/_tc4400_spi.bin-0.extracted ❯ ~/Downloads/bcm2utils-v0.9.5.1-macos/bcm2cfg verify jffs2-root-3/cm_dyn.bin
error: invalid or encrypted file
@CocoPommel-5:~/D/_tc4400_spi.bin-0.extracted ❯ ~/Downloads/bcm2utils-v0.9.5.1-macos/bcm2cfg verify jffs2-root-0/cm_perm.bin
error: invalid or encrypted file
@CocoPommel-5:~/D/_tc4400_spi.bin-0.extracted ❯ ~/Downloads/bcm2utils-v0.9.5.1-macos/bcm2cfg info jffs2-root-0/cm_perm.bin  
jffs2-root-0/cm_perm.bin
type    : gwsettings
profile : (unknown)
checksum: 00003ee785738a4c0009434d41700001
size    : (unknown)
key     : (unknown)

[jclehner]

I tried all of the .bin files I could recover from those filesystems and always got the same result when running them through bcm2cfg:

Version 0.9.5.1 didn't have support for that format yet. With the current sources it does (no prebuilt binaries yet):

$ bcm2cfg -f dyn info cm_dyn.bin 
cm_dyn.bin
type    : dyn
profile : (unknown)
checksum: 694e73fa (ok)
size    : 2744 (ok)

434d4170  CMAp  0.2     bfc              16 b
4d4c6f67  MLog  0.5     userif           93 b
f2a1f61f  ....  0.3     halif            15 b
46414354  FACT  0.1     fact             12 b
62706920  bpi.  0.3     bpi              43 b
d0c20101  ....  0.3     grp_d0c20101     41 b
d0c20300  ....  0.4     grp_d0c20300     15 b
d0c20310  ....  0.2     grp_d0c20310     20 b
42332e31  B3.1  0.1     grp_b31          39 b
434d4556  CMEV  0.1     cmlog           740 b
736e6d70  snmp  0.8     snmp           1060 b
446e5374  DnSt  0.0     grp_dnst          8 b
446e5331  DnS1  0.0     grp_dns1          8 b
55505354  UPST  0.0     grp_upst          8 b
55505331  UPS1  0.0     grp_ups1          8 b
5070616e  Ppan  0.0     grp_ppan          8 b
5253544c  RSTL  0.1     rstl            419 b
434d424c  CMBL  0.1     cmbl             10 b
42636d56  BcmV  0.2     grp_bcmv         10 b
45627069  Ebpi  0.3     ebpi             43 b
74546c76  tTlv  0.1     grp_ttlv        110 b
5350414e  SPAN  0.1     grp_span         10 b

$ bcm2cfg -f perm info cm_perm.bin 
cm_perm.bin
type    : perm
profile : (unknown)
checksum: 85738a4c (ok)
size    : 16103 (ok)

434d4170  CMAp  0.1     bfc               9 b
4d4c6f67  MLog  0.3     userif           61 b
f2a1f61f  ....  0.23    halif           243 b
46414354  FACT  0.2     fact             43 b
62706920  bpi.  0.1     bpi            2818 b
d0c20101  ....  0.1     grp_d0c20101    141 b
d0c20300  ....  0.2     grp_d0c20300     46 b
d0c20310  ....  0.1     grp_d0c20310      8 b
42332e31  B3.1  0.1     grp_b31        5399 b
434d4556  CMEV  0.1     cmlog             8 b
736e6d70  snmp  0.4     snmp           1263 b
446e5374  DnSt  2.1     grp_dnst        449 b
446e5331  DnS1  2.1     grp_dns1        449 b
55505354  UPST  0.1     grp_upst        950 b
55505331  UPS1  0.1     grp_ups1       1036 b
5070616e  Ppan  0.1     grp_ppan         10 b
5253544c  RSTL  0.1     rstl              8 b
434d424c  CMBL  0.1     cmbl              8 b
42636d56  BcmV  0.1     grp_bcmv          8 b
45627069  Ebpi  0.1     ebpi           3039 b
74546c76  tTlv  0.1     grp_ttlv         91 b
5350414e  SPAN  0.1     grp_span          8 b

[starcraft66]

Awesome! I thought of building the binaries myself but checked the commits and thought there wasn't anything of substance in the commits past the latest release but I must have looked wrong. I'll play with this tonight or maybe later this week and contribute a profile for this modem once I get the UART pins soldered on and consoles online.

[starcraft66]

@jclehner I was able to take a peek at the console output. The CM's UART shows a bunch of diagnostic boot output until I get to BcmCmVendorNonVolSettings::ConsoleState DISABLING and there is no more output. I am a but confused by this because I have:

bfc = {
  serial_console_mode = rw
  features = 0x00000000
}

set in every copy of cm_dyn.bin I could find in the spi dump. Is there a different location the firmware might be looking at?

[jclehner]

Some manufacturers have more than one settings group with options for the serial console. This is what happens here, and the message about BcmCmVendorNonVolSettings::ConsoleState is useful indeed: bfc corresponds to a group named BcmBfcAppNonVolSettings, but we're looking for one called BcmCmVendorNonVolSettings.

In your cm_dyn file, there's a group with the magic value of BcmV, which seems to be the one. As luck would have it, it just contains 2 bytes of data, which I've named "unknown1" and "unknown2" for now. Likely just boolean 0 or 1 types.

Try any combination of:

$ bcm2cfg <your options> set cm_dyn.bin vendor.unknown1 <some value>
$ bcm2cfg <your options> set cm_dyn.bin vendor.unknown2 <some value>

By the way, you could also try gaining access to the linux console, using the latest bcm2cfg on a bootloader environment store (flash0.nvram and flash0.nvram1 partitions), by stripping the noconsole and console=null options:

$ bcm2cfg -f boltenv get nvram.bin STARTUP
STARTUP = {
  value = "load -nz -raw -addr=$DT_ADDRESS -max=0x10000 flash0.devtree$DT_IDX;boot flash1.kernel$KL_IDX "ubi.mtd=flash1.rg$RG_IDX rootfstype=ubifs root=ubi0:rootfs platformboot ubifs_apps jffs2_data coherent_pool=1M noconsole console=null""
  flags = 0
}
$ bcm2cfg -f boltenv set nvram.bin STARTUP 'load -nz -raw -addr=$DT_ADDRESS -max=0x10000 flash0.devtree$DT_IDX;boot flash1.kernel$KL_IDX "ubi.mtd=flash1.rg$RG_IDX rootfstype=ubifs root=ubi0:rootfs platformboot ubifs_apps jffs2_data coherent_pool=1M noconsole console=null"'

[starcraft66]

Okay, so after a while of fighting my CH341 programmer (I could not for the life of me get it to write anything to the flash chip) and after potentially shortening the lifespan of said chip because I didn't realize the CH341 uses 5V logic and that chip 3.3V, I decided to go another route using the flipper zero and had success flashing my modified boltenv.

As expected, this modification enabled the console on the Linux UART port, but that's as far as I was able to get right now. My soldering gear is too crappy to solder pin headers to my UART pads so I'm going to get a friend with real soldering setup to do it for me next week. Right now I've just been sniffing UART ports by physically holding the TX and RX wires to the board while looking at the screen on my computer.

I was able to capture the entire boot log on the linux side which is useful because the partition layouts for the nvram chip and main nand are printed, so I know which JFFS2 filesystems to modify to get the CM console unlocked. I wasn't able to test any logins at the console due to my hands needing to physically hold the uart connection in place lol. Unfortunately, there seems to be an extra snag on the linux side I need to figure out how to thwart once I get those pins soldered. I lost the log of my first boot due to my screen scrollback being too short but near the end of the boot something printed about boltenv's checksum not matching. I accidentally caused the board to reset and on the next boot, the following was printed near the end of the boot process:

Disable RG Console
boltenv -s STARTUP 'load -nz -raw -addr=$DT_ADDRESS -max=0x10000 flash0.devtree$DT_IDX;boot flash1.kernel$KL_IDX "ubi.mtd=flash
1.rg$RG_IDX rootfstype=ubifs root=ubi0:rootfs platformboot ubifs_apps jffs2_data coherent_pool=1M noconsole console=null"'
Set STARTUP to "load -nz -raw -addr=$DT_ADDRESS -max=0x10000 flash0.devtree$DT_IDX;boot flash1.kernel$KL_IDX "ubi.mtd=flash1.rg
$RG_IDX rootfstype=ubifs root=ubi0:rootfs platformboot ubifs_apps jffs2_data coherent_pool=1M noconsole console=null"" successf
ully
BOLT env vars saved

Sure enough, on the next boot, the console was back to being dead.

It's late now and I need to get some sleep but I will report on the CM side of things tomorrow.

Here's the full boot log if anyone is interested: I got a login prompt the first time I booted with the console, but wasn't able to try any logins. The second time, the messages near the end of the log kept spamming and I pulled the plug.

ýýUncompressing Linux... done, booting the kernel.
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 3.14.28-Prod_18.1 (build@runner-2772cd7b-project-4259-concurrent-0) (gcc version 4.8.5 (Broadcom s
tbgcc-4.8-1.5) ) #1 SMP Fri Jul 31 05:01:19 UTC 2020
[    0.000000] CPU: ARMv7 Processor [420f00f3] revision 3 (ARMv7), cr=30c7387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] Machine model: BCM93390DCM
[    0.000000] moving dtb from 0x0000000007636000 to 0x00000000007d2ab4
[    0.000000] Reserved memory: reserved region for node 'reserved-nodma@00000000': base 0x0000000000000000, size 0 MiB
[    0.000000] Reserved memory: reserved region for node 'reserved-RG-memc0': base 0x0000000004000000, size 156 MiB
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] MCP: Disabling write pairing
[    0.000000] PERCPU: Embedded 8 pages/cpu @8fdd9000 s8448 r8192 d16128 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
[    0.000000] Kernel command line: ubi.mtd=flash1.rg1 rootfstype=ubifs root=ubi0:rootfs platformboot ubifs_apps jffs2_data coh
erent_pool=1M
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 91960K/262144K available (5563K kernel code, 278K rwdata, 1712K rodata, 240K init, 180K bss, 170184K res
erved, 0K cma-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x90800000 - 0xff000000   (1768 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x90000000   ( 256 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80722fac   (7276 kB)
[    0.000000]       .init : 0x80723000 - 0x8075f100   ( 241 kB)
[    0.000000]       .data : 0x80760000 - 0x807a5850   ( 279 kB)
[    0.000000]        .bss : 0x807a5858 - 0x807d2ab4   ( 181 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000]  RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000] RCU: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS:16 nr_irqs:16 16
[    0.000000] irq_brcmstb_l2: registered L2 intc (mem: 0xfc403000, parent irq: 95)
[    0.000000] irq_brcmstb_l2: registered L2 intc (mem: 0xfc4a1000, parent irq: 63)
[    0.000000] irq_brcmstb_l2: registered L2 intc (mem: 0xfc410640, parent irq: 97)
[    0.000000] irq_brcmstb_l2: registered L2 intc (mem: 0xfc431200, parent irq: 50)
[    0.000000] irq_bcm7120_l2: registered BCM7120 L2 intc (mem: 0xfc40a600, parent IRQ(s): 2)
[    0.000000] irq_bcm7120_l2: registered BCM7120 L2 intc (mem: 0xfc417200, parent IRQ(s): 3)
[    0.000000] Architected cp15 timer(s) running at 27.00MHz (virt).
[    0.000004] sched_clock: 56 bits at 27MHz, resolution 37ns, wraps every 2545165795328ns
[    0.000009] Switching to timer-based delay loop
[    0.000158] Calibrating delay loop (skipped), value calculated using timer frequency.. 54.00 BogoMIPS (lpj=270000)
[    0.000167] pid_max: default: 32768 minimum: 301
[    0.000263] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000269] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.005127] CPU: Testing write buffer coherency: ok
[    0.005295] CPU0: update cpu_power 1024
[    0.005301] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.005347] Setting up static identity map for 0x54bdc8 - 0x54be20
[    0.006972] ubus 6 segment capture space: d3e00000 size 1000
[    0.006980] ubus 2 segment capture space: d7e00000 size 1000
[    0.007564] CPU1: Booted secondary processor
[    0.007582] CPU1: update cpu_power 1024
[    0.007585] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
[    0.007680] Brought up 2 CPUs
[    0.007689] SMP: Total of 2 processors activated.
[    0.007693] CPU: All CPU(s) started in SVC mode.
[    0.008055] devtmpfs: initialized
[    0.011695] VFP support v0.3: implementor 42 architecture 4 part 00 variant 0 rev 0
[    0.011978] pinctrl core: initialized pinctrl subsystem
[    0.012344] regulator-dummy: no parameters
[    0.012609] NET: Registered protocol family 16
[    0.013096] DMA: preallocated 1024 KiB pool for atomic coherent allocations
[    0.013739] cpuidle: using governor ladder
[    0.013746] cpuidle: using governor menu
[    0.018422] syscon f0404000.syscon: regmap [mem 0xf0404000-0xf040452f] registered
[    0.018592] syscon f04a2400.syscon: regmap [mem 0xf04a2400-0xf04a27ff] registered
[    0.018741] syscon f0450000.syscon: regmap [mem 0xf0450000-0xf04500ff] registered
[    0.018899] syscon f0404100.syscon: regmap [mem 0xf0404100-0xf040413f] registered
[    0.019044] syscon f0404140.syscon: regmap [mem 0xf0404140-0xf0404167] registered
[    0.019188] syscon f0410700.syscon: regmap [mem 0xf0410700-0xf041070b] registered
[    0.019343] syscon f041070c.syscon: regmap [mem 0xf041070c-0xf0410713] registered
[    0.019495] syscon f1501004.syscon: regmap [mem 0xf1501004-0xf1501403] registered
[    0.019640] syscon f0404080.syscon: regmap [mem 0xf0404080-0xf0404083] registered
[    0.019781] syscon f04040a4.syscon: regmap [mem 0xf04040a4-0xf04040a7] registered
[    0.019917] syscon f04a0154.syscon: regmap [mem 0xf04a0154-0xf04a0157] registered
[    0.020090] syscon f04a0354.syscon: regmap [mem 0xf04a0354-0xf04a0357] registered
[    0.020250] syscon f04a0400.syscon: regmap [mem 0xf04a0400-0xf04a0403] registered
[    0.023995] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[    0.024002] hw-breakpoint: maximum watchpoint size is 8 bytes.
[    0.024101] Broadcom Brahma-B15 readahead cache at: 0xfc4a2478
[    0.024261] brcm-mbox driver v1.0
[    0.035943] bio: create slab <bio-0> at 0
[    0.036863] brcmstb-gpio f040a000.gpio: Couldn't get wake IRQ - GPIOs will not be able to wake from sleep
[    0.036877] brcmstb-gpio f040a000.gpio: Registered 5 banks (GPIO(s): 0-159)
[    0.037209] brcmstb-gpio f0417000.gpio: Couldn't get wake IRQ - GPIOs will not be able to wake from sleep
[    0.037220] brcmstb-gpio f0417000.gpio: Registered 2 banks (GPIO(s): 160-223)
[    0.038464] SCSI subsystem initialized
[    0.039107] usbcore: registered new interface driver usbfs
[    0.039187] usbcore: registered new interface driver hub
[    0.039284] usbcore: registered new device driver usb
[    0.040891] brcm-pci f1080000.pcie: adjusting to legacy (broken) pcie DT
[    0.040946] brcm-pci f1080000.pcie: cannot get msi intr; MSI disabled
[    0.041083] brcm-pci f1090000.pcie: adjusting to legacy (broken) pcie DT
[    0.041107] brcm-pci f1090000.pcie: cannot get msi intr; MSI disabled
[    0.041238] brcm-pci f10c0000.pcie: adjusting to legacy (broken) pcie DT
[    0.041260] brcm-pci f10c0000.pcie: cannot get msi intr; MSI disabled
[    0.141535] brcm-pci f1080000.pcie: link down
[    0.241552] brcm-pci f1090000.pcie: link down
[    0.341566] brcm-pci f10c0000.pcie: link down
[    0.341611] Switched to clocksource arch_sys_counter
[    0.343405] thermal thermal_zone0: failed to read out thermal zone 0
[    0.343475] NET: Registered protocol family 2
[    0.343823] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    0.343841] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[    0.343865] TCP: Hash tables configured (established 2048 bind 2048)
[    0.343892] TCP: reno registered
[    0.343899] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.343912] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.344033] NET: Registered protocol family 1
[    0.344199] RPC: Registered named UNIX socket transport module.
[    0.344204] RPC: Registered udp transport module.
[    0.344207] RPC: Registered tcp transport module.
[    0.344211] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.344431] hw perfevents: enabled with ARMv7 Cortex-A15 PMU driver, 7 counters available
[    0.345549] futex hash table entries: 512 (order: 3, 32768 bytes)
[    0.353991] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.354757] NFS: Registering the id_resolver key type
[    0.354777] Key type id_resolver registered
[    0.354783] Key type id_legacy registered
[    0.354792] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[    0.354807] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[    0.355259] fuse init (API version 7.22)
[    0.355980] msgmni has been set to 179
[    0.356597] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    0.356604] io scheduler noop registered
[    0.356609] io scheduler deadline registered
[    0.356760] io scheduler cfq registered (default)
[    0.356975] brcm-gisb-arb f0400000.gisb-arb: registered mem: fc400000, irqs: 259, 260
[    0.471960] pinctrl-single f04040a4.pinmux: allocating 1568 pins
[    0.472951] pinctrl-single f04040a4.pinmux: 1568 pins at pa fc4040a4 size 196
[    0.530127] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
[    0.533091] f040a900.serial: ttyS0 at MMIO 0xf040a900 (irq = 108, base_baud = 5062500) is a 16550A
[    1.358097] console [ttyS0] enabled
[    1.362372] f040a940.serial: ttyS1 at MMIO 0xf040a940 (irq = 109, base_baud = 5062500) is a 16550A
[    1.371969] f040a980.serial: ttyS2 at MMIO 0xf040a980 (irq = 110, base_baud = 5062500) is a 16550A
[    1.381509] d3881800.serial: ttyS3 at MMIO 0xd3881800 (irq = 111, base_baud = 5062500) is a 16550A
[    1.396755] brd: module loaded
[    1.402774] loop: module loaded
[    1.407102] brcmnand f04a2800.nand: using HIF_INTR2 cascaded IRQ
[    1.413213] brcmnand f04a2800.nand: enabling FLASH_DMA
[    1.418616] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xf1
[    1.424985] nand: Macronix MX30LF1G18AC
[    1.428826] nand: 128MiB, SLC, page size: 2048, OOB size: 64
[    1.434506] brcmnand f04a2800.nand: 128MiB total, 128KiB blocks, 2KiB pages, 16B OOB, 8-bit, BCH-4
[    1.434506]
[    1.445269] Bad block table found at page 65472, version 0x01
[    1.451297] Bad block table found at page 65408, version 0x01
[    1.457382] 7 ofpart partitions found on MTD device f04a2800.nand
[    1.463489] Creating 7 MTD partitions on "f04a2800.nand":
[    1.468895] 0x000000000000-0x000000620000 : "flash1.kernel0"
[    1.475342] 0x000000620000-0x000000c40000 : "flash1.kernel1"
[    1.481707] 0x000000c40000-0x000001fa0000 : "flash1.cm0"
[    1.487710] 0x000001fa0000-0x000003300000 : "flash1.cm1"
[    1.493727] 0x000003300000-0x000005980000 : "flash1.rg0"
[    1.499706] 0x000005980000-0x000008000000 : "flash1.rg1"
[    1.505702] 0x000000000000-0x000008000000 : "flash1"
[    1.511681] spi_brcmstb f04a3400.spi: 1-lane output, 3-byte address
[    1.518073] spi_brcmstb f04a3400.spi: master is unqueued, this is deprecated
[    1.525393] m25p80 spi32766.0: found mx25l3205d, expected m25p80
[    1.531411] m25p80 spi32766.0: mx25l3205d (4096 Kbytes)
[    1.536688] 11 ofpart partitions found on MTD device spi32766.0
[    1.542621] Creating 11 MTD partitions on "spi32766.0":
[    1.547853] 0x000000000000-0x000000100000 : "flash0.bolt"
[    1.553963] 0x000000100000-0x000000120000 : "flash0.macadr"
[    1.560209] 0x000000120000-0x000000140000 : "flash0.nvram"
[    1.566375] 0x000000140000-0x000000160000 : "flash0.nvram1"
[    1.572636] 0x000000160000-0x000000180000 : "flash0.devtree0"
[    1.579058] 0x000000180000-0x0000001a0000 : "flash0.devtree1"
[    1.585490] 0x0000001a0000-0x000000200000 : "flash0.cmnonvol0"
[    1.592036] 0x000000200000-0x000000260000 : "flash0.cmnonvol1"
[    1.598512] 0x000000260000-0x000000330000 : "flash0.rgnonvol0"
[    1.605013] 0x000000330000-0x000000400000 : "flash0.rgnonvol1"
[    1.611509] 0x000000000000-0x000000400000 : "flash0"
[    1.618994] libphy: Fixed MDIO Bus: probed
[    1.623499] PPP generic driver version 2.4.2
[    1.627968] PPP BSD Compression module registered
[    1.632686] PPP Deflate Compression module registered
[    1.637744] pegasus: v0.9.3 (2013/04/25), Pegasus/Pegasus II USB Ethernet driver
[    1.645246] usbcore: registered new interface driver pegasus
[    1.650996] usbcore: registered new interface driver asix
[    1.656475] usbcore: registered new interface driver ax88179_178a
[    1.662660] usbcore: registered new interface driver cdc_ether
[    1.668596] usbcore: registered new interface driver cdc_ncm
[    1.674744] xhci-brcm: xHCI BRCM driver
[    1.678685] xhci-brcm f1001000.xhci_v2: xHCI Host Controller
[    1.684525] xhci-brcm f1001000.xhci_v2: new USB bus registered, assigned bus number 1
[    1.692510] xhci-brcm f1001000.xhci_v2: irq 117, io mem 0xf1001000
[    1.699249] hub 1-0:1.0: USB hub found
[    1.703033] hub 1-0:1.0: config failed, hub doesn't have any ports! (err -19)
[    1.710307] xhci-brcm f1001000.xhci_v2: xHCI Host Controller
[    1.716131] xhci-brcm f1001000.xhci_v2: new USB bus registered, assigned bus number 2
[    1.724488] hub 2-0:1.0: USB hub found
[    1.728259] hub 2-0:1.0: 1 port detected
[    1.732543] ehci-brcm: EHCI BRCM driver
[    1.736461] ehci-brcm f1000300.ehci_v2: EHCI Host Controller
[    1.742290] ehci-brcm f1000300.ehci_v2: new USB bus registered, assigned bus number 3
[    1.760209] ehci-brcm f1000300.ehci_v2: irq 113, io mem 0xf1000300
[    1.781621] ehci-brcm f1000300.ehci_v2: USB 2.0 started, EHCI 1.00
[    1.788316] hub 3-0:1.0: USB hub found
[    1.792100] hub 3-0:1.0: 1 port detected
[    1.796352] ohci-brcm: OHCI BRCM driver
[    1.800257] ohci-brcm f1000400.ohci_v2: BRCM OHCI controller
[    1.806085] ohci-brcm f1000400.ohci_v2: new USB bus registered, assigned bus number 4
[    1.813966] ohci-brcm f1000400.ohci_v2: irq 115, io mem 0xf1000400
[    1.876124] hub 4-0:1.0: USB hub found
[    1.879895] hub 4-0:1.0: 1 port detected
[    1.884150] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    1.890699] ehci-pci: EHCI PCI platform driver
[    1.895417] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    1.901619] ohci-pci: OHCI PCI platform driver
[    1.906333] usbcore: registered new interface driver usb-storage
[    1.912518] usbcore: registered new interface driver usbserial
[    1.918424] usbcore: registered new interface driver option
[    1.924079] usbserial: USB Serial support registered for GSM modem (1-port)
[    1.931110] i2c /dev entries driver
[    1.934813] brcmstb-i2c f040a400.i2c: I2C driver probe entry.
[    1.940579] brcmstb-i2c f040a400.i2c: using default port select:0
[    1.947136] brcmstb-i2c f040a400.i2c:  @50000hz registered in polling mode using port select:0
[    1.955919] brcmstb_thermal: set trips 0 <--> 125000
[    1.960890] brcmstb_thermal: disable trip, type 0
[    1.965607] brcmstb_thermal: set temp 1 to 125000
[    1.970333] brcmstb_thermal: enable trip, type 1
[    1.975112] brcmstb_thermal f0431500.thermal: registered AVS TMON of-sensor driver
[    1.983220] bcm7038-wdt f040a128.watchdog: Registered Broadcom Watchdog
[    1.990002] bcm7038-wdt f10b0928.watchdog: Registered Broadcom Watchdog
[    1.996887] bcm7038-wdt f040a200.watchdog: Registered Broadcom Watchdog
[    2.003722] cpufreq_cpu0: failed to get cpu0 regulator: -19
[    2.009445] cpufreq: CPU: Clock frequency 1503 MHz
[    2.014516] sdhci: Secure Digital Host Controller Interface driver
[    2.020702] sdhci: Copyright(c) Pierre Ossman
[    2.025070] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.031843] mmc0: no vqmmc regulator found
[    2.035946] mmc0: no vmmc regulator found
[    2.082083] mmc0: SDHCI controller on f04a0000.sdhci [f04a0000.sdhci] using ADMA
[    2.121756] brcm-fpm: FPM with 2 pool(s)
[    2.127179] brcm-dqm: DQM device cpucomm with 96 Q's
[    2.132443] rpc_service_init: initializing rpc_init service
[    2.138063] rpc_register_functions registered rpc_init service with 1 functions
[    2.145389] rpc_service_init: initializing rpc_misc service
[    2.150998] rpc_service_init: initializing rpc_flash service
[    2.156699] rpc_service_init: skipping inactive rpc_nonvol service
[    2.162892] rpc_service_init: initializing rpc_erouter service
[    2.168756] rpc_service_init: skipping inactive rpc_erouter_pm service
[    2.175298] rpc_service_init: initializing rpc_wpsctl service
[    2.181076] rpc_service_init: skipping inactive rpc_bash service
[    2.187097] rpc_service_init: skipping inactive rpc_testu service
[    2.193296] dev-name = rg-cm
[    2.196180] dqm = cpucomm
[    2.198801] tx-q = 2h
[    2.201075] rx-q = 3h
[    2.203365] rpc_probe sent handshake message
[    2.207657] dev-name = svm-cm
[    2.210626] dqm = cpucomm
[    2.213255] tx-q = 14h
[    2.215616] rx-q = 15h
[    2.217983] rpc_probe sent handshake message
[    2.222597] brcm-ba driver v1.0
[    2.226564] rpc_register_functions registered rpc_misc service with 13 functions
[    2.234200] WBID driver version 1.0
[    2.237693] WBID i2c client registered with addr:0x24
[    2.244298] WBID(x.y):4095.15 WBID:0xffff
[    2.248930] MDQM_Init
[    2.251387] iperf device initialized
[    2.255090] gre: GRE over IPv4 demultiplexor driver
[    2.259975] ip_gre: GRE over IPv4 tunneling driver
[    2.267601] TCP: cubic registered
[    2.272958] NET: Registered protocol family 10
[    2.281362] ip6_gre: GRE over IPv6 tunneling driver
[    2.286732] NET: Registered protocol family 17
[    2.291230] Bridge firewalling registered
[    2.295294] 8021q: 802.1Q VLAN Support v1.8
[    2.299503] Key type dns_resolver registered
[    2.303846] Registering SWP/SWPB emulation handler
[    2.309379] regulator-dummy: disabling
[    2.313424] UBI: attaching mtd5 to ubi0
[    2.524220] UBI: scanning is finished
[    2.538674] UBI: attached mtd5 (name "flash1.rg1", size 38 MiB) to ubi0
[    2.545339] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    2.552144] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    2.558851] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    2.565738] UBI: good PEBs: 304, bad PEBs: 4, corrupted PEBs: 0
[    2.571669] UBI: user volume: 2, internal volumes: 1, max. volumes count: 128
[    2.578811] UBI: max/mean erase counter: 7/3, WL threshold: 256, image sequence number: 1784335685
[    2.587783] UBI: available PEBs: 0, total reserved PEBs: 304, PEBs reserved for bad PEB handling: 16
[    2.596941] UBI: background thread "ubi_bgt0d" started, PID 1264
[    2.680080] UBIFS: mounted UBI device 0, volume 0, name "rootfs", R/O mode
[    2.687037] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    2.696196] UBIFS: FS size: 11300864 bytes (10 MiB, 89 LEBs), journal size 1142785 bytes (1 MiB, 7 LEBs)
[    2.705693] UBIFS: reserved for root: 0 bytes (0 KiB)
[    2.710751] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 7BD6412A-A967-48CB-90CA-E2C8241A1E3D, small LPT model
[    2.722723] VFS: Mounted root (ubifs filesystem) readonly on device 0:13.
[    2.731213] devtmpfs: mounted
[    2.734332] Freeing unused kernel memory: 240K (80723000 - 8075f000)
starting pid 1274, tty '': '/etc/init.d/rcS'
Mounting virtual filesystems
[    3.010106] random: nonblocking pool is initialized
==============================
CHIP:3390
MANUFACT_BITS: C007
BOARD ID: 00000061
SUBSYSTEM: rg
VFLASH: n
EXTENSION: -dcm
KERNEL: vmlinuz-3390b0-dcm
STARTUP: BA=y RC=y AUTO=y
==============================
Mounting flash0.rgnonvol0 (mtd 15) to /data
Mounting flash0.rgnonvol1 (mtd 16) to /data_bak
check mdm: /data/mdm.config is Good
check mdm: /data/mdm-backup.config is Good
check mdm: /data/mdm-permanent.config is Good
Attaching MTD 2 to UBI device 1
[    4.120864] UBI: attaching mtd2 to ubi1
[    4.220550] UBI: scanning is finished
[    4.233066] UBI: attached mtd2 (name "flash1.cm0", size 19 MiB) to ubi1
[    4.239708] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    4.246521] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    4.253234] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    4.260116] UBI: good PEBs: 155, bad PEBs: 0, corrupted PEBs: 0
[    4.266048] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    4.273199] UBI: max/mean erase counter: 5/2, WL threshold: 256, image sequence number: 1556794024
[    4.282172] UBI: available PEBs: 0, total reserved PEBs: 155, PEBs reserved for bad PEB handling: 20
[    4.291325] UBI: background thread "ubi_bgt1d" started, PID 1745
UBI device number 1, total 155 LEBs (19681280 by[    4.300437] UBIFS: background thread "ubifs_bgt1_0" started, PID 1752
tes, 18.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
Mounting flash1.cm0 (mtd 2) to /mnt/flash
[    4.348789] UBIFS: recovery needed
[    4.377970] UBIFS: recovery completed
[    4.381885] UBIFS: mounted UBI device 1, volume 0, name "images"
[    4.387919] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    4.397113] UBIFS: FS size: 15618048 bytes (14 MiB, 123 LEBs), journal size 888833 bytes (0 MiB, 5 LEBs)
[    4.406647] UBIFS: reserved for root: 0 bytes (0 KiB)
[    4.411756] UBIFS: media format: w4/r0 (latest is w4/r0), UUID DD5F68E1-8C42-46E6-BEAF-DC4FE5F98469, small LPT model
Mounting flash0.cmnonvol0 (mtd 13) to /mnt/cmnonvol
Mounting flash0.cmnonvol1 (mtd 14) to /mnt/cmnonvol_bak
Check file /mnt/cmnonvol/cm_dyn.bin
File /mnt/cmnonvol/cm_dyn.bin matches HCS32
Check file /mnt/cmnonvol/cm_perm.bin
File /mnt/cmnonvol/cm_perm.bin matches HCS32
Unknown HZ value! (93) Assume 100.
Unknown HZ value! (93) Assume 100.
rProgramStoreHost: ethInterfaceUp error:: No such device
Unknown HZ value! (93) Assume 100.
rnonvolhost: Starting - version 1.1
rnonvolhost: ethInterfaceUp error:: No such device
Unknown HZ value! (93) Assume 100.
BA [1839]: [prep:1252] Showing merged map
BA [1839]: [show_map:539] ARM boot ROM:
BA [1839]: [show_map:541]        Memory: 0x10000@0x9430000 (64kB@148MB)
BA [1839]: [show_map:546] TP1:
BA [1839]: [show_map:548]        Memory: 0x1400000@0x8000000 (20MB@128MB)
BA [1839]: [show_map:552] CM:
BA [1839]: [show_map:554]        Memory: 0x3f00000@0x4000000 (63MB@64MB)
BA [1839]: [show_atw:505]        ATW[0]: 0x4000000 from 0x4000000 to 0x0 (64MB from 64MB to 0MB)
BA [1839]: [show_atw:520]                For clients: 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0a 0x0b 0x0c 0x0d 0x0e 0x0f 0x1
0 0x11 0x12 0x1b 0x1e
BA [1839]: [show_atw:505]        ATW[255]: 0x0 from 0x0 to 0x0 (0MB from 0MB to 0MB)
BA [1839]: [show_atw:520]                For clients:
BA [1839]: [show_map:558] LEAP:
BA [1839]: [show_map:560]        0x100000@0x7e00000 (1MB@126MB)
BA [1839]: [show_map:562] CM DSP:
BA [1839]: [show_atw:505]        ATW[1]: 0x400000 from 0x8000000 to 0x7c00000 (4MB from 128MB to 124MB)
BA [1839]: [show_atw:520]                For clients: 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0a 0x0b 0x0c 0x0d 0x0e 0x0f 0x1
2 0x1b 0x1e
BA [1839]: [show_map:565] CM BOOT:
BA [1839]: [show_atw:505]        ATW[2]: 0x10000 from 0x9400000 to 0x1fc00000 (0MB from 148MB to 508MB)
BA [1839]: [show_atw:520]                For clients: 0x12
BA [1839]: [show_map:568] CM BOOT EXTRA:
BA [1839]: [show_atw:505]        ATW[255]: 0x0 from 0x0 to 0x0 (0MB from 0MB to 0MB)
BA [1839]: [show_atw:520]                For clients:
BA [1839]: [show_map:571] CM <-> Host Xfer:
BA [1839]: [show_map:573]        2 buffers - 0x20000@0x9410000 (128KB@148MB)
BA [1839]: [prep:1299] Requesting DTB from kernel
BA [1839]: [main:1684] Boot Assist daemon running
BA [1839]: [main:1685] Board: 3390B0 - BCM93390DCM
BA [1839]: [main:1686] BA dev file: /dev/ba
BA [1839]: [main:1687] MBOX dev file: /dev/mbox
BA [1839]: [cmShow:978] CM Boot Image: cmboot.bin
BA [1839]: [cmShow:979] CM Run Image: cmrun1.bin
BA [1839]: [cmShow:980] CM Permanent non-vol: /mnt/cmnonvol/cm_perm.bin
BA [1839]: [cmShow:981] CM Dynamic non-vol: /mnt/cmnonvol/cm_dyn.bin
BA [1839]: [cmShow:982] CM Data: /tmp/cm_data.bin
BA [1839]: [main:1693] RG: auto
BA [1839]: [main:1694] STB: auto
BA [1839]: [main:1695] CM: auto
BA [1839]: [main:1696] Boot: parallel
BA [1839]: [cntrlProcess:696] BMU Power state: AC Power
BA [1839]: [cntrlProcess:697] OTP: 0x18000003 0x00000000
BA [1839]: [cntrlProcess:698] CM Power: Unknown
BA [1839]: [cntrlProcess:699] CM state: Unknown
BA [1839]: [cntrlProcess:700] RG Power: High Power
BA [1839]: [cntrlProcess:701] RG state: Kernel Running
BA [1839]: [cntrlProcess:702] STB Power: Unknown
BA [1839]: [cntrlProcess:703] STB state: Unknown
BA [1839]: [cntrlProcess:704] SVM Power: High Power
BA [1839]: [cntrlProcess:705] SVM state: Kernel Running
BA [1839]: [show_map:539] ARM boot ROM:
BA [1839]: [show_map:541]        Memory: 0x10000@0x9430000 (64kB@148MB)
BA [1839]: [show_map:546] TP1:
BA [1839]: [show_map:548]        Memory: 0x1400000@0x8000000 (20MB@128MB)
BA [1839]: [show_map:552] CM:
BA [1839]: [show_map:554]        Memory: 0x3f00000@0x4000000 (63MB@64MB)
BA [1839]: [show_atw:505]        ATW[0]: 0x4000000 from 0x4000000 to 0x0 (64MB from 64MB to 0MB)
BA [1839]: [show_atw:520]                For clients: 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0a 0x0b 0x0c 0x0d 0x0e 0x0f 0x1
0 0x11 0x12 0x1b 0x1e
BA [1839]: [show_atw:505]        ATW[255]: 0x0 from 0x0 to 0x0 (0MB from 0MB to 0MB)
BA [1839]: [show_atw:520]                For clients:
BA [1839]: [show_map:558] LEAP:
BA [1839]: [show_map:560]        0x100000@0x7e00000 (1MB@126MB)
BA [1839]: [show_map:562] CM DSP:
BA [1839]: [show_atw:505]        ATW[1]: 0x400000 from 0x8000000 to 0x7c00000 (4MB from 128MB to 124MB)
BA [1839]: [show_atw:520]                For clients: 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0a 0x0b 0x0c 0x0d 0x0e 0x0f 0x1
2 0x1b 0x1e
BA [1839]: [show_map:565] CM BOOT:
BA [1839]: [show_atw:505]        ATW[2]: 0x10000 from 0x9400000 to 0x1fc00000 (0MB from 148MB to 508MB)
BA [1839]: [show_atw:520]                For clients: 0x12
BA [1839]: [show_map:568] CM BOOT EXTRA:
BA [1839]: [show_atw:505]        ATW[255]: 0x0 from 0x0 to 0x0 (0MB from 0MB to 0MB)
BA [1839]: [show_atw:520]                For clients:
BA [1839]: [show_map:571] CM <-> Host Xfer:
BA [1839]: [show_map:573]        2 buffers - 0x20000@0x9410000 (128KB@148MB)
reading task file /var/run/wdmd/wdmd_tasks
BA [1839]: [cmBootToMem:688] Opening cmboot.bin
wdmd monitoring task cmon
wdmd[1848]: wdmd started tests_built client
Configuring private network
BA [1839]: [cmPower:853] Powering on CM
BA [1839]: [cntrlProcess:798] CM state: Waiting For Runtime
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(1)(0x80000001)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(2)(0x80000002)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(3)(0x80000003)
[    5.232216] watchdog watchdog1: watchdog stopped
wdmd[1848]: watchdog device armed with fire_timeout 60
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(4)(0x80000004)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(5)(0x80000005)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(6)(0x80000006)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(7)(0x80000007)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(8)(0x80000008)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(9)(0x80000009)
Disable IPv6
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(10)(0x8000000a)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(11)(0x8000000b)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(12)(0x8000000c)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(13)(0x8000000d)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(14)(0x8000000e)
[    5.483788] ethsw_flow_control: Enabling ACB
[    5.488412] ethsw_3390: Device ID 3390
[    5.492048] ethsw_int: Ethsw interrupt initialized
[    5.497054] ethsw_api: phy stop failed for port 0
[    5.501787] ethsw_api: phy stop failed for port 1
[    5.506504] ethsw_api: phy stop failed for port 2
[    5.511221] ethsw_api: phy stop failed for port 3
[    5.516009] ethsw_proc: /proc/driver/ethsw dir and files created
[    5.522035] ethsw_proc: Ethsw proc initialized
[    5.526488] ethsw_init_plat: Ethsw driver probed
BA [1839]: [cmImageProcess:420] CM Request: (cmr[    5.537889] ethsw_init_plat: Ethsw module initialized
un1.bin)(15)(0x8000000f)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(16)(0x80000010)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(17)(0x80000011)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(18)(0x80000012)
[    5.613121] libphy: UniMAC MII bus: probed
[    5.617249] unimac-mdio d040062c.mdio: Broadcom UniMAC MII bus at 0x90bc862c
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(19)(0x80000013)
[    5.636459] libphy: Switch MDIO bus: probed
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(20)(0x80000014)
[    5.655624] Broadcom BCM3390 d4e403c0.mdio:08: did not get GPHY clock
BA [1839]: [cmIm[    5.669577] Broadcom BCM3390 d4e403c0.mdio:09: did not get GPHY clock
ageProcess:420] CM Request: (cmrun1.bin)(21)(0x80000015)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(22)(0x8[    5.687525] Broadcom BCM3390 d4e403c0.mdio:0a: did not get G
PHY clock
0000016)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(23)(0x80000017)
[    5.702680] Broadcom BCM3390 d4e403c0.mdio:0b: did not get GPHY clock
[    5.709604] unimac-mdio d4e403c0.mdio: Broadcom Switch MDIO bus at 0x90bca3c0
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(24)(0x80000018)
rProgramStoreHost: ethInterfaceUp error:: No such device
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(25)(0x80000019)
rnonvolhost: ethInterfaceUp error:: No such device
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(26)(0x8000001a)

Load Runner Driver

BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(27)(0x8000001b)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(28)(0x8000001c)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(29)(0x8000001d)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(30)(0x8000001e)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(31)(0x8000001f)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(32)(0x80000020)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(33)(0x80000021)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(34)(0x80000022)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(35)(0x80000023)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(36)(0x80000024)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(37)(0x80000025)
BA [1839]: [cmImageProcess:420] CM Request: (cmrun1.bin)(38)(0x80000026)
BA [1839]: [cntrlProcess:798] CM state: Verifying Runtime Image
[    6.194533] rdpa: module license 'Proprietary' taints kernel.
[    6.200327] Disabling lock debugging due to kernel taint
[    6.272152] RDP Physical address=0xd5000000 Virtual address = 0x90f00000
[    6.286120] passing rdd_init_params.runner_iptv_tables_base_ptr=0x9b00000
[    6.354270] configure_runner: NATC keysize 0x100070 key element size 16 contextsize 0x400000 context element size 64
[    6.378702] rdd_init_params.runner_nat_cache_key_ptr=0x92200000
[    6.384637] g_runner_ddr0_iptv_lookup_ptr=0x92440000
[    6.389605] g_runner_ddr0_iptv_context_ptr=0x92400000
[    6.394666] g_runner_ddr0_iptv_ssm_context_ptr=0x92480000
[    6.623165] FPM_BPM phy_addr 0xd3a30000,virt_addr 0x90bf2000
rProgramStoreHost: ethInterfaceUp error:: No such device
rnonvolhost: ethInterfaceUp error:: No such device
[    6.922101] brcm-dqnet: net device priv0
[    7.002108] d4e403c0.mdio:08: Broadcom BCM3390 PHY revision: 0x00, patch: 0
[    7.112074] brcm-dqnet: net device eth0
[    7.292149] brcm-dqnet: net device eth1
[    7.342024] brcm-dqnet: net device cm0
[    7.415834] device priv0 entered promiscuous mode
[    7.422685] netif_napi_add() called with weight 256 on device
[    7.428567] IPv6: ADDRCONF(NETDEV_UP): priv0: link is not ready
[    7.439770] IPv6: ADDRCONF(NETDEV_UP): privbr: link is not ready
[    7.446270] IPv6: ADDRCONF(NETDEV_UP): privbr: link is not ready
Mounting flash1.rg1 (mtd 5) to /mnt/apps
UBIFS: background thread "ubifs_bgt0_1" started, PID 2492
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 1, name "apps"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 22220800 bytes (21 MiB, 175 LEBs), journal size 1142785 bytes (1 MiB, 7 LEBs)
UBIFS: reserved for root: 0 bytes (0 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID 366D2C00-626A-4A8E-BD9B-DA26F5990351, small LPT model
Unknown HZ value! (94) Assume 100.

******************************
Starting user apps services...
******************************
BA [1839]: [cntrlProcess:798] CM state: Waiting for DATA
BA [1839]: [cmImageProcess:420] CM Request: (/mnt/cmnonvol/cm_perm.bin)(1)(0x00000001)
rProgramStore Host (1): Waiting for eth interface 'privbr:0' to come up.
             5 seconds elapsed
rnonvolhost: Waiting for eth interface to come up. 5 seconds elapsed
BA [1839]: [cmImageProcess:420] CM Request: (/mnt/cmnonvol/cm_dyn.bin)(1)(0x80000001)
DQM Init complete for dqm tunnel rg-cm
DQM Init complete for dqm tunnel svm-cm
rpc_erouter service (4) rx unregistered function 20, queued to be processed later.

Continuing with user apps startup

==============================
CHIP:3390
MANUFACT_BITS: C007
BOARD ID: 00000061
SUBSYSTEM: rg
VFLASH: n
EXTENSION: -dcm
KERNEL: vmlinuz-3390b0-dcm
STARTUP: BA=y RC=y AUTO=y
==============================
Configuring Python
RG: Starting lattice in bridged mode
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1440 buckets, 5760 max)
ctnetlink v0.93: registering with nfnetlink.
ip_tables: (C) 2000-2006 Netfilter Core Team
device cm0 entered promiscuous mode
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
device vethpriv entered promiscuous mode
IPv6: ADDRCONF(NETDEV_UP): vethpriv: link is not ready
privbr: port 2(vethpriv) entered forwarding state
privbr: port 2(vethpriv) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): privbr: link becomes ready
Ebtables v2.0 registered
IPv6: ADDRCONF(NETDEV_UP): wanbridge: link is not ready
Warning: 0 WiFi cards are detected on the system!

                          *
                         * *
                         * *
                        *   *
                        *   *
                       *     *
                       *     *
                       *     *
                      *       *
                      *       *
                      *       *
                     *         *
                     *         *
                     *         *
                     *         *
                    *           *
          *         *           *         *
        *   *       *           *       *   *          ***
*     *      *     *             *     *      *     *       *******************
   *          *   *               *   *          *
                *                   *

Broadcom Corporation Reference Design
 +------------------------------------------------------------------------------------------------+
 |                                                                                                |
 | LATTICE                                                                                        |
 |                                                                                                |
 | Copyright (c) 1999 - 2020 Broadcom Corporation                                                 |
 |                                                                                                |
 | Revision       : Prod_18.1                                                                     |
 |                                                                                                |
 +------------------------------------------------------------------------------------------------+
 | Build Date     : Jul 31 2020                                                                   |
 | Build Time     : 05:06:45 (+0000)                                                              |
 | Build Path     : /builds/charter-broadband/tc4400/tch-brcm-customer-tc4400/brcm-open-bfc/rbb_  |
 | Build Path     : lattice/rg_apps/lattice                                                       |
 | Image Path     : /builds/charter-broadband/tc4400/tch-brcm-customer-tc4400/brcm-open-bfc/rbb_  |
 | Image Path     : lattice/images                                                                |
 | Build By       : build                                                                         |
 | Build Options  : Build_System Build_Cm Build_Mta Build_Ethernet Build_PacketAcceleration       |
 | Build Options  : Build_SpeedTest BUILD_BRIDGE                                                  |
 +------------------------------------------------------------------------------------------------+
 | Linux Kernel                                                                                   |
 |                                                                                                |
 | Revision       : 3.14.28-Prod_18.1#1 SMP Fri Jul 31 05:01:19 UTC 2020                          |
 |                                                                                                |
 +------------------------------------------------------------------------------------------------+
 | RUNNER                                                                                         |
 |                                                                                                |
 | Copyright (c) 1999 - 2020 Broadcom Corporation                                                 |
 |                                                                                                |
 | Revision       : 4.3.2                                                                         |
 +------------------------------------------------------------------------------------------------+
 | BOLT                                                                                           |
 |                                                                                                |
 | Copyright (c) 1999 - 2020 Broadcom Corporation                                                 |
 |      IPv6: ADDRCONF(NETDEV_UP): cm0: link is not ready
                                                                                          |
 | Revision       : 1.53                                                                          |
 | Build Timestamp: 2016-09-23 15:03:55                                                           |
 | Build Tag      : v1.53-RLS-6.1.1beta1_B1                                                       |
                                       IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
                8021q: adding VLAN 0 to HW filter on device eth0
 | Build By       : lemerrerv@rennsIPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
lxcomp35
      8021q: adding VLAN 0 to HW filter on device eth1
 | Revision(FSBL) : 1.53                                                                    |
 +------------------------------------------------------------------------------------------------+
rProgramStore Host (1): Waiting for eth interface 'privbr:0' to come up.
             10 seconds elapsed
rnonvolhost: Waiting for eth interface to come up. 10 seconds elapsed
privbr: port 2(vethpriv) entered disabled state
FLOWMGR: Set wandev to cm0
FLOWMGR Init: v0.7 Jul 31 2020 05:01:30
FLOWMGR Register fap: 3
FLOWMGR [pid-2777] [cpu-0]: proc cmd - fap_config wanbridge wanbridge
FLOWMGR [pid-2777] [cpu-0]: proc cmd - fap_enable 1
FAP Pkt Replacement 1
POWERMAN: Setting debug verbosity level to: 1
POWERMAN: adding rpc_register_functions registered rpc_erouter service with 256 functions
Ethernet interfaces: eth0:eth1:eth2:eth3:
POWERMAN: Setting powermanager startup delay to: 60
POWERMAN: Setting system chip type to: 3390
POWERMAN: Setting GPHY power up time to: 5
POWERMAN: Setting GPHY power down time to: 25
ActiveWanInterface cm0 BridgeWanInterface wanbridge
registered userspace service 4 functions
Command Status:1
Disable RG Console
boltenv -s STARTUP 'load -nz -raw -addr=$DT_ADDRESS -max=0x10000 flash0.devtree$DT_IDX;boot flash1.kernel$KL_IDX "ubi.mtd=flash
1.rg$RG_IDX rootfstype=ubifs root=ubi0:rootfs platformboot ubifs_apps jffs2_data coherent_pool=1M noconsole console=null"'
Set STARTUP to "load -nz -raw -addr=$DT_ADDRESS -max=0x10000 flash0.devtree$DT_IDX;boot flash1.kernel$KL_IDX "ubi.mtd=flash1.rg
$RG_IDX rootfstype=ubifs root=ubi0:rootfs platformboot ubifs_apps jffs2_data coherent_pool=1M noconsole console=null"" successf
ully
BOLT env vars saved
Runner Transparent Forwarding (RTF) Module Init: v0.2 Jul 31 2020 05:01:52
rtf [pid-2498] [cpu-1]: proc cmd - host_inf wanbridge
DQNET [pid-2498] [cpu-1]: proc cmd - brcmtag_opcode uc 1
rtf [pid-2498] [cpu-1]: proc cmd - enable 1
RG: Starting snmpd
main: iPerf Manager daemon started with PID 2945
/usr/local/bin/latticerpcd
starting pid 2957, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -aCM:Error:CmBfcCapabilitiesGet:1422:Impl call failed, result 1
process '/bin/cttyhack /bin/loginscript.sh' (pid 2957) exited. Scheduling for restart.
starting pid 2978, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 2978) exited. Scheduling for restart.
starting pid 2982, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -aCM:Error:CmBfcCapabilitiesGet:1422:Impl call failed, result 1
IPv6: ADDRCONF(NETDEV_CHANGE): priv0: link becomes ready
privbr: port 1(priv0) entered forwarding state
privbr: port 1(priv0) entered forwarding state
process '/bin/cttyhack /bin/loginscript.sh' (pid 2982) exited. Scheduling for restart.
starting pid 2986, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 2986) exited. Scheduling for restart.
starting pid 2990, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -aCM:Error:CmBfcCapabilitiesGet:1422:Impl call failed, result 1
process '/bin/cttyhack /bin/loginscript.sh' (pid 2990) exited. Scheduling for restart.
starting pid 2994, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 2994) exited. Scheduling for restart.
starting pid 2998, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -aCM:Error:CmBfcCapabilitiesGet:1422:Impl call failed, result 1
process '/bin/cttyhack /bin/loginscript.sh' (pid 2998) exited. Scheduling for restart.
starting pid 3002, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3002) exited. Scheduling for restart.
starting pid 3006, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -aCM:Error:CmBfcCapabilitiesGet:1422:Impl call failed, result 1
process '/bin/cttyhack /bin/loginscript.sh' (pid 3006) exited. Scheduling for restart.
starting pid 3010, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3010) exited. Scheduling for restart.
starting pid 3018, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -aCM:Error:CmBfcCapabilitiesGet:1422:Impl call failed, result 1
rtf [pid-3025] [cpu-1]: proc cmd - enable 1
DQNET [pid-3026] [cpu-0]: proc cmd - brcmtag_opcode uc 1
process '/bin/cttyhack /bin/loginscript.sh' (pid 3018) exited. Scheduling for restart.
starting pid 3027, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -atftpd: read error
VLM============ cp /proc/device-tree/compatible + hardware_id.txtWAN interface state: RPC_EVENT_WANIF_OPER_STATE_BOOTED
BA [1839]: [cntrlProcess:798] CM state: Running
process '/bin/cttyhack /bin/loginscript.sh' (pid 3027) exited. Scheduling for restart.
starting pid 3041, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -addr=$DT_ADDRESS load -nz -raw -addr=$DT_ADDRESS -max=0x10000 flash0.devtree$DT_IDX;boot flash1.kernel$KL_IDX "u
bi.mtd=flash1.rg$RG_IDX rootfstype=ubifs root=ubi0:rootfs platformboot ubifs_apps jffs2_data coherent_pool=1M noconsole console
=null"
Command Status:0
RG Console Already Disabled..
process '/bin/cttyhack /bin/loginscript.sh' (pid 3041) exited. Scheduling for restart.
starting pid 3050, tty '': '/bin/cttyhack /bin/loginscript.sh'
Passwords admin  stored
process '/bin/cttyhack /bin/loginscript.sh' (pid 3050) exited. Scheduling for restart.
starting pid 3054, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -aip6_tables: (C) 2000-2006 Netfilter Core Team
process '/bin/cttyhack /bin/loginscript.sh' (pid 3054) exited. Scheduling for restart.
starting pid 3094, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3094) exited. Scheduling for restart.
starting pid 3098, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3098) exited. Scheduling for restart.
starting pid 3102, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -aprivbr: port 1(priv0) entered forwarding state
process '/bin/cttyhack /bin/loginscript.sh' (pid 3102) exited. Scheduling for restart.
starting pid 3106, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3106) exited. Scheduling for restart.
starting pid 3110, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3110) exited. Scheduling for restart.
starting pid 3114, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3114) exited. Scheduling for restart.
starting pid 3118, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3118) exited. Scheduling for restart.
starting pid 3122, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3122) exited. Scheduling for restart.
starting pid 3126, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3126) exited. Scheduling for restart.
starting pid 3130, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3130) exited. Scheduling for restart.
starting pid 3134, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3134) exited. Scheduling for restart.
starting pid 3138, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3138) exited. Scheduling for restart.
starting pid 3142, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3142) exited. Scheduling for restart.
starting pid 3146, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3146) exited. Scheduling for restart.
starting pid 3150, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3150) exited. Scheduling for restart.
starting pid 3154, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3154) exited. Scheduling for restart.
starting pid 3158, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3158) exited. Scheduling for restart.
starting pid 3162, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3162) exited. Scheduling for restart.
starting pid 3166, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3166) exited. Scheduling for restart.
starting pid 3170, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3170) exited. Scheduling for restart.
starting pid 3174, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3174) exited. Scheduling for restart.
starting pid 3179, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3179) exited. Scheduling for restart.
starting pid 3183, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3183) exited. Scheduling for restart.
starting pid 3187, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3187) exited. Scheduling for restart.
starting pid 3191, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3191) exited. Scheduling for restart.
starting pid 3195, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3195) exited. Scheduling for restart.
starting pid 3199, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -addr=$DT_ADDRESS

process '/bin/cttyhack /bin/loginscript.sh' (pid 3199) exited. Scheduling for restart.
starting pid 3203, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -a

process '/bin/cttyhack /bin/loginscript.sh' (pid 3203) exited. Scheduling for restart.
starting pid 3207, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3207) exited. Scheduling for restart.
starting pid 3211, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3211) exited. Scheduling for restart.
starting pid 3247, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3247) exited. Scheduling for restart.
starting pid 3251, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3251) exited. Scheduling for restart.
starting pid 3255, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3255) exited. Scheduling for restart.
starting pid 3259, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3259) exited. Scheduling for restart.
starting pid 3263, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3263) exited. Scheduling for restart.
starting pid 3267, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3267) exited. Scheduling for restart.
starting pid 3271, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3271) exited. Scheduling for restart.
starting pid 3275, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3275) exited. Scheduling for restart.
starting pid 3279, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3279) exited. Scheduling for restart.
starting pid 3283, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3283) exited. Scheduling for restart.
starting pid 3287, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3287) exited. Scheduling for restart.
starting pid 3291, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3291) exited. Scheduling for restart.
starting pid 3295, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3295) exited. Scheduling for restart.
starting pid 3299, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3299) exited. Scheduling for restart.
starting pid 3303, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3303) exited. Scheduling for restart.
starting pid 3307, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3307) exited. Scheduling for restart.
starting pid 3311, tty '': '/bin/cttyhack /bin/loginscript.sh'
process '/bin/cttyhack /bin/loginscript.sh' (pid 3311) exited. Scheduling for restart.
starting pid 3315, tty '': '/bin/cttyhack /bin/loginscript.sh'
load -nz -raw -aýý

[jclehner]

Thanks for the info!

Sure enough, on the next boot, the console was back to being dead.

You could try setting that environment variable to readonly:

$ bcm2cfg -f boltenv set nvram.bin STARTUP.flags 0x02

or

$ bcm2cfg -f boltenv set nvram.bin STARTUP.flags +ro