ZTE ZXDSL 831II

Overview
"AZ29C V1.0" is silkscreened on at least one 831II's board.

Pinout
.. appears to be the following... XJ1 (RxD) (TxD) (GND) (3.3)

<--- to BCM6332

Credentials
They're the same as the HTTP admin credentials. Username: admin Password: admin

Info derived from
{{SCollapse|boot log CFE version 1.0.37-10.1 for BCM96338 (32bit,SP,BE) Build Date: Tue Jun 1 15:21:05 CST 2010 (unive@Unive) Copyright (C) 2000-2006 Broadcom Corporation.

Boot Address 0xbfc00000

Initializing Arena. Initializing Devices. serial flash device: name EN25F16, id 0x1c14, size 2048KB Auto-negotiation timed-out 10 MB Half-Duplex (assumed) CPU type 0x29010: 240MHz Total memory: 8388608 bytes (8MB)

Total memory used by CFE: 0x80401000 - 0x805280C0 (1208512) Initialized Data:         0x8041DA00 - 0x8041F8E0 (7904) BSS Area:                 0x8041F8E0 - 0x804260C0 (26592) Local Heap:               0x804260C0 - 0x805260C0 (1048576) Stack Area:               0x805260C0 - 0x805280C0 (8192) Text (code) segment:      0x80401000 - 0x8041D9F8 (117240) Boot area (physical):     0x00529000 - 0x00569000 Relocation Factor:        I:00000000 - D:00000000

Board IP address                 : 192.168.1.1:ffffff00 Host IP address                  : 192.168.1.100 Gateway IP address               : Run from flash/host (f/h)        : f Default host run file name        : vmlinux Default host flash file name     : bcm963xx_fs_kernel Boot delay (0-9 seconds)         : 1 Board Id (0-8)                   : 96332L-2M-8M Number of MAC Addresses (1-32)   : 11 Base MAC Address                 : b0:75:d5:48:b9:4a PSI Size (1-64) KBytes           : 24

Auto run second count down: 0 Booting from only image (0xbfc10000) ... Code Address: 0x80001000, Entry Address: 0x801a0018 Decompression OK! Entry at 0x801a0018 Closing network. Starting program at 0x801a0018 Linux version 2.6.8.1 (dailybuild@sh01.wireline) (gcc version 3.4.2) #1 Mon Jun 21 17:21:42 CST 2010 serial flash device: name EN25F16, id 0x1c14, size 2048KB 96332L-2M-8M prom init CPU revision is: 00029010 Determined physical RAM map: memory: 007a0000 @ 00000000 (usable) On node 0 totalpages: 1952 DMA zone: 1952 pages, LIFO batch:1 Normal zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200 brcm mips: enabling icache and dcache... Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 8kB 2-way, linesize 16 bytes. PID hash table entries: 32 (order 5: 256 bytes) Using 120.000 MHz high precision timer. Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Memory: 5844k/7808k available (1446k kernel code, 1944k reserved, 209k data, 72k init, 0k highmem) KLOB Pool 1 Initialized: 1048576 bytes <0x80600000 ... 0x80700000> Calibrating delay loop... 239.20 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... unavailable. NET: Registered protocol family 16 Total Flash size: 2048K with 512 sectors File system address: 0xbfc10100 Can't analyze prologue code at 80169384 PPP generic driver version 2.4.2 NET: Registered protocol family 24 Using noop io scheduler bcm963xx_mtd driver v1.0 brcmboard: brcm_board_init entry PressAndHoldReset interrupt[4] mapping succeeded! Serial: BCM63XX driver $Revision: 1.1.1.1 $ ttyS0 at MMIO 0xfffe0300 (irq = 10) is a BCM63XX blaadd: blaa_detect entry adsl: adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6338A2 Ethernet Network Device v0.3 Jun 21 2010 17:20:36 Config Internal PHY Through MDIO BCM63xx_ENET: Auto-negotiation timed-out BCM63xx_ENET: 10 MB Half-Duplex (assumed) eth0: MAC Address: B0:75:D5:48:B9:4A NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) NET: Registered protocol family 1 NET: Registered protocol family 17 Ebtables v2.0 registered NET: Registered protocol family 8 NET: Registered protocol family 20 VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 72k freed init started: BusyBox v1.00 (2010.06.21-09:23+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5
 * Press any key to stop auto run (1 seconds) ***

BusyBox v1.00 (2010.06.21-09:23+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands.

Loading drivers and kernel modules...

BcmAdsl_Initialize=0x800DE458, g_pFnNotifyCallback=0x80198804 AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00003981 adsl2=0x00000001 pSdramPHY=0xA07FFFF8, 0xFFFFFFFF 0xFFEFFFFF AdslCoreHwReset: AdslOemDataAddr = 0xA07FB114 AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00003981 adsl2=0x00000001 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered app: atmctl start --pqs 125 ATM proc init !!! app: atmctl operate vcc --add 0.8.81 aal5 1 llcencaps --addq 0.8.81 11 1 app: atmctl operate vcc --add 0.0.35 aal5 1 llcencaps --addq 0.0.35 11 1 app: atmctl operate vcc --add 0.8.35 aal5 1 llcencaps --addq 0.8.35 11 1 app: atmctl operate vcc --add 0.0.32 aal5 1 llcencaps --addq 0.0.32 11 1 app: atmctl operate vcc --add 0.0.100 aal5 1 llcencaps --addq 0.0.100 11 1 app: atmctl operate vcc --add 0.8.36 aal5 1 llcencaps --addq 0.8.36 11 1 app: atmctl operate vcc --add 0.0.33 aal5 1 llcencaps --addq 0.0.33 11 1 ip_tables: (C) 2000-2002 Netfilter core team ip_conntrack version 2.1 (61 buckets, 0 max) - 376 bytes per conntrack ip_conntrack_pptp version 2.1 loaded ip_nat_pptp version 2.0 loaded ip_ct_h323: init success ip_nat_h323: init success ip_conntrack_ipsec: module license 'Proprietary' taints kernel. ip_conntrack_rtsp v0.01 loading ip_nat_rtsp v0.01 loading

> Bcm963xx Software Version: ZXDSL 831IIV7.5.5a_Z29_OV   <
app: brctl addbr br0 app: brctl stp br0 off app: brctl setfd br0 0 app: ifconfig eth0 up app: ifconfig br0 192.168.1.1 netmask 255.255.255.0 broadcast 192.168.1.255 up; brctl addif br0 eth0; ifconfig eth0 0.0.0.0 device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state app: sendarp -s br0 -d br0 app: sendarp -s br0 -d eth0 BcmRfc2684_init interface is not up nas_0_8_81! pvc2684ctl -a -v 0.8.81 & app: pvc2684ctl -a -v 0.8.81 & pvc2684d: Interface "nas_0_8_81" created sucessfully pvc2684d: Communicating over ATM 0.8.81, encapsulation: LLC

app: ifconfig nas_0_8_81 hw ether b0:75:d5:48:b9:4b app: ifconfig nas_0_8_81 up app: brctl addif br0 nas_0_8_81 device nas_0_8_81 entered promiscuous mode br0: port 2(nas_0_8_81) entering learning state br0: topology change detected, propagating br0: port 2(nas_0_8_81) entering forwarding state app: sendarp -s br0 -d br0 BcmRfc2684_init interface is not up nas_0_0_35! pvc2684ctl -a -v 0.0.35 & app: pvc2684ctl -a -v 0.0.35 & pvc2684d: Interface "nas_0_0_35" created sucessfully pvc2684d: Communicating over ATM 0.0.35, encapsulation: LLC

app: ifconfig nas_0_0_35 hw ether b0:75:d5:48:b9:4c app: ifconfig nas_0_0_35 up app: brctl addif br0 nas_0_0_35 device nas_0_0_35 entered promiscuous mode br0: port 3(nas_0_0_35) entering learning state br0: topology change detected, propagating br0: port 3(nas_0_0_35) entering forwarding state app: sendarp -s br0 -d br0 BcmRfc2684_init interface is not up nas_0_8_35! pvc2684ctl -a -v 0.8.35 & app: pvc2684ctl -a -v 0.8.35 & pvc2684d: Interface "nas_0_8_35" created sucessfully pvc2684d: Communicating over ATM 0.8.35, encapsulation: LLC

app: ifconfig nas_0_8_35 hw ether b0:75:d5:48:b9:4d app: ifconfig nas_0_8_35 up app: brctl addif br0 nas_0_8_35 device nas_0_8_35 entered promiscuous mode br0: port 4(nas_0_8_35) entering learning state br0: topology change detected, propagating br0: port 4(nas_0_8_35) entering forwarding state app: sendarp -s br0 -d br0 BcmRfc2684_init interface is not up nas_0_0_32! pvc2684ctl -a -v 0.0.32 & app: pvc2684ctl -a -v 0.0.32 & pvc2684d: Interface "nas_0_0_32" created sucessfully pvc2684d: Communicating over ATM 0.0.32, encapsulation: LLC

app: ifconfig nas_0_0_32 hw ether b0:75:d5:48:b9:4e app: ifconfig nas_0_0_32 up app: brctl addif br0 nas_0_0_32 device nas_0_0_32 entered promiscuous mode br0: port 5(nas_0_0_32) entering learning state br0: topology change detected, propagating br0: port 5(nas_0_0_32) entering forwarding state app: sendarp -s br0 -d br0 BcmRfc2684_init interface is not up nas_0_0_100! pvc2684ctl -a -v 0.0.100 & app: pvc2684ctl -a -v 0.0.100 & pvc2684d: Interface "nas_0_0_100" created sucessfully pvc2684d: Communicating over ATM 0.0.100, encapsulation: LLC

app: ifconfig nas_0_0_100 hw ether b0:75:d5:48:b9:4f app: ifconfig nas_0_0_100 up app: brctl addif br0 nas_0_0_100 device nas_0_0_100 entered promiscuous mode br0: port 6(nas_0_0_100) entering learning state br0: topology change detected, propagating br0: port 6(nas_0_0_100) entering forwarding state app: sendarp -s br0 -d br0 BcmRfc2684_init interface is not up nas_0_8_36! pvc2684ctl -a -v 0.8.36 & app: pvc2684ctl -a -v 0.8.36 & pvc2684d: Interface "nas_0_8_36" created sucessfully pvc2684d: Communicating over ATM 0.8.36, encapsulation: LLC

app: ifconfig nas_0_8_36 hw ether b0:75:d5:48:b9:50 app: ifconfig nas_0_8_36 up app: brctl addif br0 nas_0_8_36 device nas_0_8_36 entered promiscuous mode br0: port 7(nas_0_8_36) entering learning state br0: topology change detected, propagating br0: port 7(nas_0_8_36) entering forwarding state app: sendarp -s br0 -d br0 BcmRfc2684_init interface is not up nas_0_0_33! pvc2684ctl -a -v 0.0.33 & app: pvc2684ctl -a -v 0.0.33 & pvc2684d: Interface "nas_0_0_33" created sucessfully pvc2684d: Communicating over ATM 0.0.33, encapsulation: LLC

app: ifconfig nas_0_0_33 hw ether b0:75:d5:48:b9:51 app: ifconfig nas_0_0_33 up app: brctl addif br0 nas_0_0_33 device nas_0_0_33 entered promiscuous mode br0: port 8(nas_0_0_33) entering learning state br0: topology change detected, propagating br0: port 8(nas_0_0_33) entering forwarding state app: sendarp -s br0 -d br0

br0: port 1(eth0) entering disabled state }}
 * cfm init end! ******

cat /proc/cpuinfo
> cat /proc/cpuinfo system type            : 96332L-2M-8M processor              : 0 cpu model              : BCM6338 V1.0 BogoMIPS               : 239.20 wait instruction       : no microsecond timers      : yes tlb_entries            : 32 extra interrupt vector : yes hardware watchpoint    : no unaligned access                : 11 VCED exceptions        : not available VCEI exceptions        : not available

ps aux
> ps aux PID Uid     VmSize Stat Command 1 admin      216 S   init 2 admin          SWN [ksoftirqd/0] 3 admin          SW< [events/0] 4 admin          SW< [khelper] 5 admin          SW< [kblockd/0] 6 admin          SW  [pdflush] 7 admin          SW  [pdflush] 8 admin          SW  [kswapd0] 9 admin          SW< [aio/0] 10 admin          SW  [mtdblockd] 17 admin      292 S   -sh 41 admin      972 S   cfm 211 admin      196 S   pvc2684d 422 admin     1108 S   httpd 473 admin     1024 S   consoled 478 admin      264 S   sh -c ps aux 479 admin      252 R   ps aux

cat /proc/meminfo
> cat /proc/meminfo MemTotal:        5936 kB MemFree:           332 kB Buffers:           408 kB Cached:           2156 kB SwapCached:          0 kB Active:           1580 kB Inactive:         1476 kB HighTotal:           0 kB HighFree:            0 kB LowTotal:         5936 kB LowFree:           332 kB SwapTotal:           0 kB SwapFree:            0 kB Dirty:               0 kB Writeback:           0 kB Mapped:           1600 kB Slab:              548 kB Committed_AS:     1884 kB PageTables:        140 kB VmallocTotal:  1048560 kB VmallocUsed:       588 kB VmallocChunk:  1047968 kB

cat /proc/mtd
> cat /proc/mtd dev:   size   erasesize  name mtd0: 00144000 00004000 "Physically mapped flash"