Mobile Computer Repairs

I have not seen any teardowns or any information of whats inside of the Virgin Media Super Hub 3 so I thought I would do it my self with one I bought from ebay for £10. As Dave at the EEVBLOG would say "don't turn it on, take it apart!".

The Super Hub 3 DOCSIS 3.0 modem/router/Ethernet switch is an Arris TG2492 and will named as such throughout.

Some basic information:

• 2.4 GHz radio and 5 GHz radio for wireless 802.11a/b/g/n/ac connectivity
• Four Ethernet ports
• Up to two lines of telephone service
• DOCSIS 3.0 and Euro-DOCSIS 3.0 compliant

The main goal of the teardown is to extract the firmware, if you want to cut to the chase you can download it hear

https://drive.google.com/open?id=1HNpia3pVRFy6OjKp...

or

http://www.mediafire.com/file/iupc8113d6ty2xs/tg24....

First of all here are some pretty pictures of the Arris TG2492.

To disassemble you first have to shim the front panel off with a thin piece of plastic or just use a flat head screw driver if you don't care about damaging it.

Remove the Torx screw which is now visible from behind the front pannel.

Flip the TG2492 around to the rear and remove the sticker which surrounds the all the ports. You will need a very sharp thin knife to do so.

Once the sticker is removed then proceed to remove the 2 Trox screws which are now visbale.

Now place the TG2492 flat so that the plastic mesh side closest to the screws is pointing upwards. Place a flat head screw driver between the case and the plastic mesh in the bottom left corner and gently pry the mesh upwards. Once the mesh is raised enough to get you fingers underneath proceed to pull the rest up by hand.

Now we have a rear view of the PCB. To remove the PCB , remove the 2 Torx circled in red at the top of the picture then push back the 2 white clips also circled in red at the bottom of the picture.

TC58NVG0S3HTA10 Pinout

Phison PS8211-0 Pinout (maybe the same pinout for PS7000-0, PS8035, PS8130, PS8131, PS8210)

Thanks to Dan the man for correcting the emmc pinout. Dan has great blog about the Arris router firmware which can be found here https://blog.danman.eu/about-adding-a-static-route-to-my-docsis-modem/

The Phison firmware and config for the PS8211-0 and PS7000-0 can be found on partition 5 at /etc/mmc of router firmware.

I: Input , O:Output, S:Power supply

UART Intel Puma 6 DUMP 1 of 3

According to Dan the UART output no longer shows very much at all, this dump is from 2016. This page has been visted many times by an IP address owned by Arris which would explain a few things.

AC_BOOT
POST: 0xb03
wdt: reset type = 0, reset reason = 0
POST: 0xc02
cefdk_rom_base_addr: 0x002e0000
POST: 0xc1f
wdt: acboot win2 end, counter=1068829
POST: 0xf02
Warning: No device found in chip select 0
Spi Flash Init Failed and disable SPI Fl
Intel(R) Consumer Electronics Firmware Development Kit (Intel(R) CEFDK)
Copyright (C) 1999-2012 Intel Corporation. All rights reserved.
Build Time (10/13/14 08:28:14).
POST: 0xf07
Set flash layout to Arris 128MB Phison layout
POST: 0xf19
Waiting for 5 sec for DOCSIS PLL1 ready...
DOCSIS PLL1 ready
POST: 0xfa0
SMM: Ok
POST: 0xf24
ACPI Init: finished with table region from 00011ab0 to 00018000
acpi: Created tables at 00011ab0-00018000
POST: 0xf29
CEFDK Version        : ARRIS build 1682:2.01.17 (SMP enabled)
Built from SDK       : IntelCE-4.5.14421.347211
8051 Firmware        : A0-1.2.0 build R 0x20A
8051 FW I/O Module   :
Silicon Stepping     : D0
Silicon SKU          : 0x14F
Board Set As         : Harbor Park - MG
CPU Threads          : 2
CPU Multiplier       : 12
CPU Bus Speed        : 100 MHz
Memory Size          : 512 MB
Memory Type & Speed  : x16 DDR3-1333 (10-10-10)
Trusted Boot         : Untrusted
Boot Mode            : eMMC-NAND (STRAPS)
Registered net controller: e1000
Init External Switch for board Type: 1
ARRIS : INIT EXTERNAL BCM SWITCH
1000M FD Link is ready!
Configure IP via static IP.
Mac address is    : 00:00:CA:01:02:03
Host IP address is: 192.168.100.1
Subnet Mask is    : 255.255.255.0
Gateway address is: 192.168.100.1

================================================
WARNING:
  Please make sure the board type and DOCSIS DDR offset/size are set correctly,
  otherwise DOCSIS subsystem won't boot!
  If not sure, please use "settings" shell command to show the setup menu,
  then check "Advanced Features".
================================================

Press 'Enter' within 0 seconds to disable automatic boot.
Hit a key to start the shell...
Running auto script...
shell> ord4 0xC80D0000 0x03000000
shell> ord4 0xdf9fa004 0xB
shell> load -m 0x200000 -i a -t emmc
get Active Image info success:3a40000, 400000, 1, 1, 3
eMMC kernel command:  root=/dev/mmcblk0p12
Load data from emmc
Load done.
shell> bootkernel -b 0x200000 "console=ttyS0,115200 ip=static memmap=256M$256M"
Working Cmd: console=ttyS0,115200 ip=static memmap=256M$256M root=/dev/mmcblk0p1                                           2
CMD(0x48000)='console=ttyS0,115200 ip=static memmap=256M$256M root=/dev/mmcblk0p                                           12 '
WARNING: Ancient bootloader, some functionality may be limited!
Initializing cgroup subsys cpuset
Initializing cgroup subsys cpu
Linux version 2.6.39 (ccbuild@canes.arrisi.com) (gcc version 4.5.1 (IntelCE tool                                           chain-V5 Tue Apr 17 19:34:48 PDT 2012) ) #2 SMP PREEMPT Fri Dec 11 16:06:06 EST                                            2015
BIOS-provided physical RAM map:
 BIOS-e820: 0000000000000000 - 0000000000011ab0 (reserved)
 BIOS-e820: 0000000000011ab0 - 0000000000018000 (ACPI data)
 BIOS-e820: 0000000000018000 - 0000000000020000 (reserved)
 BIOS-e820: 0000000000020000 - 0000000000040000 (usable)
 BIOS-e820: 0000000000040000 - 0000000000100000 (reserved)
 BIOS-e820: 0000000000100000 - 0000000007400000 (usable)
 BIOS-e820: 0000000007400000 - 0000000008000000 (reserved)
 BIOS-e820: 0000000008000000 - 0000000010000000 (usable)
 BIOS-e820: 0000000010000000 - 0000000030000000 (reserved)
 BIOS-e820: 00000000fec00000 - 00000000fec00400 type 6
 BIOS-e820: 00000000fee00000 - 00000000fee00400 type 7
extended physical RAM map:
 reserve setup_data: 0000000000000000 - 0000000000011ab0 (reserved)
 reserve setup_data: 0000000000011ab0 - 0000000000018000 (ACPI data)
 reserve setup_data: 0000000000018000 - 0000000000020000 (reserved)
 reserve setup_data: 0000000000020000 - 0000000000040000 (usable)
 reserve setup_data: 0000000000040000 - 0000000000100000 (reserved)
 reserve setup_data: 0000000000100000 - 0000000007400000 (usable)
 reserve setup_data: 0000000007400000 - 0000000008000000 (reserved)
 reserve setup_data: 0000000008000000 - 0000000010000000 (usable)
 reserve setup_data: 0000000010000000 - 0000000030000000 (reserved)
 reserve setup_data: 00000000fec00000 - 00000000fec00400 type 6
 reserve setup_data: 00000000fee00000 - 00000000fee00400 type 7
NX (Execute Disable) protection: active
user-defined physical RAM map:
 user: 0000000000000000 - 0000000000011ab0 (reserved)
 user: 0000000000011ab0 - 0000000000018000 (ACPI data)
 user: 0000000000018000 - 0000000000020000 (reserved)
 user: 0000000000020000 - 0000000000040000 (usable)
 user: 0000000000040000 - 0000000000100000 (reserved)
 user: 0000000000100000 - 0000000007400000 (usable)
 user: 0000000007400000 - 0000000008000000 (reserved)
 user: 0000000008000000 - 0000000010000000 (usable)
 user: 0000000010000000 - 0000000030000000 (reserved)
 user: 00000000fec00000 - 00000000fec00400 type 6
 user: 00000000fee00000 - 00000000fee00400 type 7
DMI not present or invalid.
last_pfn = 0x10000 max_arch_pfn = 0x1000000
init_memory_mapping: 0000000000000000-0000000010000000
ACPI: RSDP 0009fc00 00024 (v02 INTEL )
ACPI: RSDT 00017fb0 00030 (v01 INTEL           00000000      00000000)
ACPI: FACP 00013b20 000F4 (v03 INTEL           00000000      00000000)
ACPI: DSDT 00013c20 010D4 (v01 Intel    CE2600 00000001 INTL 20091112)
ACPI: FACS 00017f70 00040
ACPI: APIC 00011af0 00068 (v01 INTEL           00000000      00000000)
ACPI: HPET 00011ab0 00038 (v01 INTEL           00000000      00000000)
0MB HIGHMEM available.
256MB LOWMEM available.
  mapped low ram: 0 - 10000000
  low ram: 0 - 10000000
Zone PFN ranges:
  DMA      0x00000020 -> 0x00001000
  Normal   0x00001000 -> 0x00010000
  HighMem  empty
Movable zone start PFN for each node
early_node_map[3] active PFN ranges
    0: 0x00000020 -> 0x00000040
    0: 0x00000100 -> 0x00007400
    0: 0x00008000 -> 0x00010000
Using APIC driver default
ACPI: PM-Timer IO Port: 0x1008
ACPI: LAPIC (acpi_id[0x00] lapic_id[0x00] enabled)
ACPI: LAPIC (acpi_id[0x01] lapic_id[0x01] enabled)
ACPI: IOAPIC (id[0x00] address[0xfec00000] gsi_base[0])
IOAPIC[0]: apic_id 0, version 32, address 0xfec00000, GSI 0-23
ACPI: IOAPIC (id[0x01] address[0xbffff000] gsi_base[24])
IOAPIC[1]: apic_id 1, version 32, address 0xbffff000, GSI 24-47
ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
Using ACPI (MADT) for SMP configuration information
ACPI: HPET id: 0x8086a201 base: 0xfed00000
SMP: Allowing 2 CPUs, 0 hotplug CPUs
Allocating PCI resources starting at 30000000 (gap: 30000000:cec00000)
setup_percpu: NR_CPUS:8 nr_cpumask_bits:8 nr_cpu_ids:2 nr_node_ids:1
PERCPU: Embedded 12 pages/cpu @cfa00000 s25792 r0 d23360 u1048576
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 61728
Kernel command line: console=ttyS0,115200 ip=static memmap=256M$256M root=/dev/m                                           mcblk0p12
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Initializing CPU#0
allocated 1048064 bytes of page_cgroup
please try 'cgroup_disable=memory' option if you don't want memory cgroups
Initializing HighMem for node 0 (00000000:00000000)
Memory: 237120k/262144k available (5732k kernel code, 11840k reserved, 1901k dat                                           a, 400k init, 0k highmem)
virtual kernel memory layout:
    fixmap  : 0xfff18000 - 0xfffff000   ( 924 kB)
    pkmap   : 0xffc00000 - 0xffe00000   (2048 kB)
    vmalloc : 0xd0800000 - 0xffbfe000   ( 755 MB)
    lowmem  : 0xc0000000 - 0xd0000000   ( 256 MB)
      .init : 0xc1775000 - 0xc17d9000   ( 400 kB)
      .data : 0xc159929d - 0xc1774a80   (1901 kB)
      .text : 0xc1000000 - 0xc159929d   (5732 kB)
Checking if this processor honours the WP bit even in supervisor mode...Ok.
SLUB: Genslabs=15, HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Preemptable hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:512
Extended CMOS year: 2000
Console: colour dummy device 80x25
console [ttyS0] enabled
Fast TSC calibration using PIT
Detected 1200.047 MHz processor.
Calibrating delay loop (skipped), value calculated using timer frequency.. 2400.                                           09 BogoMIPS (lpj=4800188)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys ns
ns_cgroup deprecated: consider using the 'clone_children' flag without the ns_cg                                           roup.
Initializing cgroup subsys cpuacct
Initializing cgroup subsys memory
Initializing cgroup subsys devices
Initializing cgroup subsys freezer
Initializing cgroup subsys blkio
Initializing cgroup subsys perf_event
CPU: Physical Processor ID: 0
CPU: Processor Core ID: 0
mce: CPU supports 5 MCE banks
CPU0: Thermal monitoring enabled (TM1)
using mwait in idle threads.
ACPI: Core revision 20110316
Enabling APIC mode:  Flat.  Using 2 I/O APICs
..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
CPU0: Intel(R) Atom(TM) CPU  652   @ 1.20GHz stepping 08
Performance Events: PEBS fmt0+, generic architected perfmon, Intel PMU driver.
... version:                3
... bit width:              40
... generic registers:      2
... value mask:             000000ffffffffff
... max period:             000000007fffffff
... fixed-purpose events:   3
... event mask:             0000000700000003
Booting Node   0, Processors  #1 Ok.
Initializing CPU#1
Brought up 2 CPUs
Total of 2 processors activated (4800.03 BogoMIPS).
NET: Registered protocol family 16
ACPI: bus type pci registered
PCI: Using configuration type 1 for base access
pcimode=0x0
bio: create slab <bio-0> at 0
ACPI: Interpreter enabled
ACPI: (supports S0 S3 S5)
ACPI: Using IOAPIC for interrupt routing
ACPI: No dock devices found.
PCI: Ignoring host bridge windows from ACPI; if necessary, use "pci=use_crs" and                                            report a bug
ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-fe])
pci 0000:00:01.0: PCI bridge to [bus 01-01] (subtractive decode)
pci 0000:00:1c.0: PCI bridge to [bus 02-02]
pci 0000:00:1c.1: PCI bridge to [bus 03-03]
ACPI: PCI Interrupt Link [LSAT] (IRQs *47)
ACPI: PCI Interrupt Link [LUSB] (IRQs *46)
ACPI: PCI Interrupt Link [LGBE] (IRQs *45)
ACPI: PCI Interrupt Link [LUAR] (IRQs *38)
ACPI: PCI Interrupt Link [LDOS] (IRQs *24)
ACPI: PCI Interrupt Link [LGPA] (IRQs *25)
ACPI: PCI Interrupt Link [LEPU] (IRQs *25)
ACPI: PCI Interrupt Link [LHVE] (IRQs *25)
ACPI: PCI Interrupt Link [LAVC] (IRQs *44)
ACPI: PCI Interrupt Link [LHDR] (IRQs *44)
ACPI: PCI Interrupt Link [LGPB] (IRQs *26)
ACPI: PCI Interrupt Link [LCRS] (IRQs *27)
ACPI: PCI Interrupt Link [LTSP] (IRQs *28)
ACPI: PCI Interrupt Link [LTSD] (IRQs *29)
ACPI: PCI Interrupt Link [LWTG] (IRQs *42)
ACPI: PCI Interrupt Link [LLW0] (IRQs *30)
ACPI: PCI Interrupt Link [LLW1] (IRQs *31)
ACPI: PCI Interrupt Link [LL2W] (IRQs *32)
ACPI: PCI Interrupt Link [LDSD] (IRQs *33)
ACPI: PCI Interrupt Link [LMOC] (IRQs *34)
ACPI: PCI Interrupt Link [LMTX] (IRQs *35)
ACPI: PCI Interrupt Link [LSEC] (IRQs *36)
ACPI: PCI Interrupt Link [LMMC] (IRQs *37)
ACPI: PCI Interrupt Link [LIDL] (IRQs *39)
ACPI: PCI Interrupt Link [LPWM] (IRQs *39)
ACPI: PCI Interrupt Link [LI2C] (IRQs *40)
ACPI: PCI Interrupt Link [LPNT] (IRQs *41)
ACPI: PCI Interrupt Link [LAEP] (IRQs *44)
ACPI: PCI Interrupt Link [LWAN] (IRQs *33)
ACPI: PCI Interrupt Link [LMPD] (IRQs *43)
ACPI: PCI Interrupt Link [LNKA] (IRQs *4 5 6 7 9 10 11 12 14 15)
ACPI: PCI Interrupt Link [LNKB] (IRQs *4 5 6 7 9 10 11 12 14 15)
ACPI: PCI Interrupt Link [LNKC] (IRQs *4 5 6 7 9 10 11 12 14 15)
ACPI: PCI Interrupt Link [LNKD] (IRQs *4 5 6 7 9 10 11 12 14 15)
vgaarb: loaded
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI: Using ACPI for IRQ routing
ACPI: PCI Interrupt Link [LMTX] enabled at IRQ 35
ce-hw-mutex 0000:01:0e.0: PCI INT A -> Link[LMTX] -> GSI 35 (level, high) -> IRQ                                            35
mem_iobase = 0xdffe1800, mem_iosize = 0x800
pmaster 0xcf429600 mem_base 0xdffe1800, io_size 0x800,irq_num 35, reg_base 0xd08                                           10800
Intel(R) HW MUTEX driver built on Dec 11 2015 @ 16:04:44
ACPI: PCI Interrupt Link [LDOS] enabled at IRQ 24
mailbox driver 0000:01:1f.0: PCI INT A -> Link[LDOS] -> GSI 24 (edge, high) -> I                                           RQ 24
Intel(R) NPCPU <-> APPCPU Event Mailbox Device Driver built on Dec 11 2015 @ 16:                                           03:37
enable IRQ #24 for device named ce_mailbox
Switching to clocksource hpet
pnp: PnP ACPI init
ACPI: bus type pnp registered
pnp: PnP ACPI: found 2 devices
ACPI: ACPI bus type pnp unregistered
pci 0000:00:01.0: PCI bridge to [bus 01-01]
pci 0000:00:01.0:   bridge window [io  disabled]
pci 0000:00:01.0:   bridge window [mem 0xc0000000-0xdfffffff]
pci 0000:00:01.0:   bridge window [mem pref disabled]
pci 0000:00:1c.0: PCI bridge to [bus 02-02]
pci 0000:00:1c.0:   bridge window [io  0x9000-0x9fff]
pci 0000:00:1c.0:   bridge window [mem 0xbfc00000-0xbfefffff]
pci 0000:00:1c.0:   bridge window [mem 0xbfa00000-0xbfafffff 64bit pref]
pci 0000:00:1c.1: PCI bridge to [bus 03-03]
pci 0000:00:1c.1:   bridge window [io  0xa000-0xafff]
pci 0000:00:1c.1:   bridge window [mem 0xbfb00000-0xbfbfffff]
pci 0000:00:1c.1:   bridge window [mem 0xbf900000-0xbf9fffff 64bit pref]
pci 0000:00:1c.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
pci 0000:00:1c.1: PCI INT B -> GSI 17 (level, low) -> IRQ 17
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
platform rtc_cmos: registered platform RTC device (no PNP device found)
microcode: CPU0 sig=0x30658, pf=0x40, revision=0x4
microcode: CPU1 sig=0x30658, pf=0x40, revision=0x4
microcode: Microcode Update Driver: v2.00 <tigran@aivazian.fsnet.co.uk>, Peter O                                           ruba
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
JFFS2 version 2.2. (NAND) (SUMMARY)  

UART Intel Puma 6 DUMP 2 of 3

fuse init (API version 7.16)
SGI XFS with security attributes, realtime, large block/inode numbers, no debug                                            enabled
SGI XFS Quota Management subsystem
msgmni has been set to 463
alg: No test for stdrng (krng)
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
pci_hotplug: PCI Hot Plug PCI Core version: 0.5
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250: ttyS0 at I/O 0x3f8 (irq = 38) is a GEN3_serial
serial8250: ttyS1 at I/O 0x2f8 (irq = 38) is a GEN3_serial
ACPI: PCI Interrupt Link [LUAR] enabled at IRQ 38
serial 0000:01:0b.0: PCI INT A -> Link[LUAR] -> GSI 38 (level, high) -> IRQ 38
serial 0000:01:0b.0: PCI INT A disabled
ACPI: PCI Interrupt Link [LAEP] enabled at IRQ 44
intelce_aep 0000:01:07.0: PCI INT A -> Link[LAEP] -> GSI 44 (level, high) -> IRQ                                            44
Trying to free nonexistent resource <00000000df8c0000-00000000df8cffff>
intelce_aep 0000:01:07.0: PCI INT A disabled
intelce_aep: probe of 0000:01:07.0 failed with error -1
toshiba: not a supported Toshiba laptop
Linux agpgart interface v0.103
[drm] Initialized drm 1.1.0 20060810
brd: module loaded
loop: module loaded
ACPI: PCI Interrupt Link [LPNT] enabled at IRQ 41
p_unit_access_drv 0000:00:1e.0: PCI INT A -> Link[LPNT] -> GSI 41 (edge, high) -                                           > IRQ 41
SCSI Media Changer driver v0.25
ACPI: PCI Interrupt Link [LSAT] enabled at IRQ 47
ahci 0000:00:0e.0: PCI INT A -> Link[LSAT] -> GSI 47 (level, high) -> IRQ 47
ahci 0000:00:0e.0: forcing PORTS_IMPL to 0x3
ahci: SSS flag set, parallel bus scan disabled
ahci 0000:00:0e.0: AHCI 0001.0300 32 slots 2 ports 3 Gbps 0x3 impl SATA mode
ahci 0000:00:0e.0: flags: 64bit ncq sntf ilck stag pm led clo pmp pio slum part                                            ems apst
scsi0 : ahci
scsi1 : ahci
ata1: SATA max UDMA/133 abar m2048@0xbfffe000 port 0xbfffe100 irq 64
ata2: SATA max UDMA/133 abar m2048@0xbfffe000 port 0xbfffe180 irq 64
physmap platform flash device: 08000000 at c0000000
physmap-flash physmap-flash.0: map_probe failed
Intel(R) SPI FLASH CONTROLLER Driver built on Dec 11 2015 @ 16:04:19
ce5xx-spi-flash 0000:01:17.0: csr iobase 0xdffe0100, iosize 0x100 , mapped to 0x                                           d081c100
ce5xx-spi-flash 0000:01:17.0: mem iobase 0xd8000000, iosize 0x4000000 , mapped t                                           o 0xd0900000
ce5xx-spi-flash 0000:01:17.0: can't setup spi1.0, status -19
ce5xx-spi-flash 0000:01:17.0: can't create new device for nmyx25
e1000: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI
e1000: Copyright (c) 1999-2006 Intel Corporation.
ACPI: PCI Interrupt Link [LGBE] enabled at IRQ 45
e1000 0000:01:0c.0: PCI INT A -> Link[LGBE] -> GSI 45 (level, high) -> IRQ 45
GMUX setting: GMAC0 is connected to internal switch (RGMII0)
GBE working in Internal Fake Phy Mode
e1000 0000:01:0c.0: eth0: (PCI:33MHz:32-bit) 00:00:ca:01:02:03
e1000 0000:01:0c.0: eth0: Intel(R) PRO/1000 Network Connection
e1000e: Intel(R) PRO/1000 Network Driver - 1.3.10-k2
e1000e: Copyright(c) 1999 - 2011 Intel Corporation.
udma -  Intel (R) UDMA Driver - 1.0.0

udma -  Copyright (c) 2012 Intel Corperation.

ACPI: PCI Interrupt Link [LLW0] enabled at IRQ 30
udma 0000:01:00.0: PCI INT A -> Link[LLW0] -> GSI 30 (level, high) -> IRQ 30
Intel(R) UDMA Port 0 Device Driver Init Done
ACPI: PCI Interrupt Link [LLW1] enabled at IRQ 31
udma 0000:01:01.0: PCI INT A -> Link[LLW1] -> GSI 31 (level, high) -> IRQ 31
Intel(R) UDMA Port 1 Device Driver Init Done
eth_udma0: Features changed: 0x00004800 -> 0x00004000
eth_udma1: Features changed: 0x00004800 -> 0x00004000
UDMA Network Device Driver init
ixgbe: Intel(R) 10 Gigabit PCI Express Network Driver - version 3.2.9-k2
ixgbe: Copyright (c) 1999-2011 Intel Corporation.
ixgb: Intel(R) PRO/10GbE Network Driver - version 1.0.135-k2-NAPI
ixgb: Copyright (c) 1999-2008 Intel Corporation.
e100: Intel(R) PRO/100 Network Driver, 3.5.24-k2-NAPI
e100: Copyright(c) 1999-2006 Intel Corporation
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver cdc_eem
usbcore: registered new interface driver cdc_subset
cdc_ncm: 23-Apr-2011
usbcore: registered new interface driver cdc_ncm
ACPI: PCI Interrupt Link [LL2W] enabled at IRQ 32
uio_ce2600 0000:01:1d.0: PCI INT A -> Link[LL2W] -> GSI 32 (level, high) -> IRQ                                            32
ata1: SATA link down (SStatus 0 SControl 300)
ACPI: PCI Interrupt Link [LMOC] enabled at IRQ 34
uio_ce2600 0000:01:1e.0: PCI INT A -> Link[LMOC] -> GSI 34 (level, high) -> IRQ                                            34
usbmon: debugfs is not available
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ACPI: PCI Interrupt Link [LUSB] enabled at IRQ 46
ehci_hcd 0000:01:0d.0: PCI INT A -> Link[LUSB] -> GSI 46 (level, high) -> IRQ 46
ehci_hcd 0000:01:0d.0: EHCI Host Controller
ehci_hcd 0000:01:0d.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:01:0d.0: irq 46, io mem 0xdf810100
ehci_hcd 0000:01:0d.0: USB 0.0 started, EHCI 1.10
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.39 ehci_hcd
usb usb1: SerialNumber: 0000:01:0d.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ehci_hcd 0000:01:0d.1: PCI INT A -> Link[LUSB] -> GSI 46 (level, high) -> IRQ 46
ehci_hcd 0000:01:0d.1: EHCI Host Controller
ehci_hcd 0000:01:0d.1: new USB bus registered, assigned bus number 2
ehci_hcd 0000:01:0d.1: irq 46, io mem 0xdf820100
ehci_hcd 0000:01:0d.1: USB 0.0 started, EHCI 1.10
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: EHCI Host Controller
usb usb2: Manufacturer: Linux 2.6.39 ehci_hcd
usb usb2: SerialNumber: 0000:01:0d.1
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
ehci_hcd 0000:01:0d.2: PCI INT A -> Link[LUSB] -> GSI 46 (level, high) -> IRQ 46
ehci_hcd 0000:01:0d.2: EHCI Host Controller
ehci_hcd 0000:01:0d.2: new USB bus registered, assigned bus number 3
Refined TSC clocksource calibration: 1199.999 MHz.
ehci_hcd 0000:01:0d.2: irq 46, io mem 0xdf880100
Switching to clocksource tsc
ehci_hcd 0000:01:0d.2: USB 0.0 started, EHCI 1.10
usb usb3: New USB device found, idVendor=1d6b, idProduct=0002
usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1
ata2: SATA link down (SStatus 0 SControl 300)
usb usb3: Product: EHCI Host Controller
usb usb3: Manufacturer: Linux 2.6.39 ehci_hcd
usb usb3: SerialNumber: 0000:01:0d.2
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapter                                           s
usbcore: registered new interface driver usblp
usbcore: registered new interface driver cdc_wdm
usbcore: registered new interface driver usbtmc
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
USB Serial support registered for FTDI USB Serial Device
usbcore: registered new interface driver ftdi_sio
ftdi_sio: v1.6.0:USB FTDI Serial Converters Driver
i8042: PNP: No PS/2 controller found. Probing ports directly.
i8042: No controller found
mousedev: PS/2 mouse device common for all mice
rtc_cmos rtc_cmos: RTC can wake from S4
rtc_cmos rtc_cmos: rtc core: registered rtc_cmos as rtc0
rtc0: alarms up to one month, y3k, 114 bytes nvram, hpet irqs
cpuidle: using governor ladder
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
sdhci-pci 0000:01:1b.0: SDHCI controller found [8086:070b] (rev 4)
ACPI: PCI Interrupt Link [LMMC] enabled at IRQ 37
sdhci-pci 0000:01:1b.0: PCI INT A -> Link[LMMC] -> GSI 37 (level, high) -> IRQ 3                                           7
waiting for eMMC legacy mode exit notification from NPCPU ... ...
npcpu_appcpu_mbx_send_ack- Writing ack Mask = 0x4 for event = 0x4
mmc0: SDHCI controller on PCI [0000:01:1b.0] using ADMA
waiting for eMMC advanced mode exit notification from NPCPU ... ...
mmc0: new high speed MMC card at address 0001
mmcblk0: mmc0:0001 MMC128 112 MiB
mmcblk0: detected capacity change from 0 to 117833728
 mmcblk0: p1 p2 p3 p4 < p5 p6 p7 p8 p9 p10 p11 p12 p13 >
npcpu_appcpu_mbx_send_notification event id 4, 0x4
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
oprofile: using NMI interrupt.
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
Mobile IPv6
IPv6 over IPv4 tunneling driver
sit0: Features changed: 0x00007800 -> 0x00007000
ip6tnl0: Features changed: 0x00006800 -> 0x00006000
NET: Registered protocol family 17
NET: Registered protocol family 15
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
sctp: Hash tables configured (established 8192 bind 8192)
lib80211: common routines for IEEE802.11 drivers
Registering the dns_resolver key type
Using IPI No-Shortcut mode
rtc_cmos rtc_cmos: setting system clock to 2000-01-01 00:00:10 UTC (946684810)
ADDRCONF(NETDEV_UP): eth0: link is not ready
e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
8021q: adding VLAN 0 to HW filter on device eth0
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
IP-Config: Guessing netmask 255.255.0.0
IP-Config: Complete:
     device=eth0, addr=133.0.0.0, mask=255.255.0.0, gw=255.255.255.255,
     host=133.0.0.0, domain=, nis-domain=(none),
     bootserver=255.255.255.255, rootserver=255.255.255.255, rootpath=
VFS: Mounted root (squashfs filesystem) readonly on device 179:12.
Freeing unused kernel memory: 400k freed
starting pid 808, tty '': '/etc/init.d/rcS'
##### Starting Scripts #####
*** /etc/rc3.d/avcap_rx_ce not found, skipping
*** /etc/rc3.d/smd not found, skipping
*** /etc/rc3.d/avcap_core not found, skipping
*** /etc/rc3.d/display not found, skipping
*** /etc/rc3.d/avcap_ce4X00 not found, skipping
*** /etc/rc3.d/avcap_si not found, skipping
*** /etc/rc3.d/graphics_2d not found, skipping
### Start system_setup
*** /etc/rc3.d/directfb not found, skipping
*** /etc/rc3.d/graphics not found, skipping
*** /etc/rc3.d/gentimer not found, skipping
*** /etc/rc3.d/en2510_start not found, skipping
*** /etc/rc3.d/psb6973_start not found, skipping
*** /etc/rc3.d/edl not found, skipping
*** /etc/rc3.d/expbus not found, skipping
*** /etc/rc3.d/smd_core not found, skipping
*** /etc/rc3.d/hl_start not found, skipping
*** /etc/rc3.d/hdmi not found, skipping
*** /etc/rc3.d/libvirt not found, skipping
*** /etc/rc3.d/init_pic_uart not found, skipping
*** /etc/rc3.d/qemu_kvm not found, skipping
*** /etc/rc3.d/mspod not found, skipping
*** /etc/rc3.d/sec_fw_2000 not found, skipping
*** /etc/rc3.d/sec_fw_3030 not found, skipping
*** /etc/rc3.d/sec_fw_mediavault not found, skipping
*** /etc/rc3.d/sec_fw_hdcp2 not found, skipping
*** /etc/rc3.d/sec_fw_playready2 not found, skipping
*** /etc/rc3.d/sec_fw_3040 not found, skipping
*** /etc/rc3.d/wifi not found, skipping
*** /etc/rc3.d/smd_avcap_shim not found, skipping
system_setup SUCCESS
### Start /etc/rc3.d/udev
### Start /etc/rc3.d/pal
PAL driver init...
Device: CE2600
Stepping: D0
pal SUCCESS
### Start /etc/rc3.d/platform_config
platform_config init complete! (build Dec 11 2015)
/* LOAD "/etc/platform_config/ce2600/memory_layout.hcfg" to (new) database locat                                           ion "platform.memory.layout"*/
udev SUCCESS
### Start /etc/rc3.d/dhcpv6
### Start /etc/rc3.d/cosai
### Start /etc/rc3.d/dibbler
### Start /etc/rc3.d/kernel
dhcpv6 SUCCESS
dibbler SUCCESS
kernel SUCCESS
cosai SUCCESS
MEU is disabled.
PMRs are disabled.
sh: 1: unknown operand
/* EXECUTE config database location "platform.startup"*/
platform_config SUCCESS
### Start /etc/rc3.d/devmem
### Start /etc/rc3.d/bootparams
devmem list is sorted and considated as:
/proc/bootparams created
bootparams SUCCESS      base: 0x07400000 size: 0x00b80000 access: 0x00000001

        base: 0x07f80000 size: 0x00030000 access: 0x00000000
        base: 0x07fb0000 size: 0x00002000 access: 0x00000001
devmem load sucessfully. major num is 249.
devmem SUCCESS
### Start /etc/rc3.d/osal
 ESS OSAL release - Built on Dec 11 2015 at 16:10:17.
osal SUCCESS
### Start /etc/rc3.d/thermal
### Start /etc/rc3.d/system_utils
### Start /etc/rc3.d/sven
### Start /etc/rc3.d/flashtool
### Start /etc/rc3.d/gpio
flashtool SUCCESS
board is hpmg making sure hard disk is partitoned
### Start /etc/rc3.d/nvram
ln: /lib/libidl_gpio.so: File exists
thermal init complete! (build Dec 11 2015)
major number =248
Partioning the hard drive
SVEN init:Dec 11 2015 16:10:38
sven_open_header(): 328: SVEN Header Initialized d08a2000@07fb0000:00001000, cir                                           cbuf d4a00000@07500000:00100000 dis:ffffffff
intelce_gpio 0000:01:0b.1: CE2600 GPIO controller detected.
system_utils SUCCESSsven_init_dfx_support(): 302: SVEN DFX Enabled @df8f0000:000                                           10000 wpos:0

ACPI: PCI Interrupt Link [LIDL] enabled at IRQ 39
intelce_gpio 0000:01:0b.1: PCI INT B -> Link[LIDL] -> GSI 39 (level, high) -> IR                                           Q 39
thermal SUCCESS
sven SUCCESS
### Start /etc/rc3.d/init_watchdog
### Start /etc/rc3.d/init_iosf
### Start /etc/rc3.d/init_pwm
intelce watchdog: Intel CE2600 WatchDog Timer Driver v0.1
ACPI: PCI Interrupt Link [LWTG] enabled at IRQ 42
intelce watchdog 0000:01:0f.0: PCI INT A -> Link[LWTG] -> GSI 42 (level, high) -                                           > IRQ 42
init_iosf SUCCESS
intelce watchdog: initialized (0xd4936400). heartbeat=30 sec (nowayout=0)
### Start /etc/rc3.d/init_punit_fw_upgrade
pwm 0000:01:0b.6: PCI INT B -> Link[LIDL] -> GSI 39 (level, high) -> IRQ 39
init_watchdog SUCCESS
Atom Watchdog daemon started <kick interval = 10 seconds>
pwm 0000:01:0b.6: 2 channels
[punit_fw_upgrade] firmware "/lib/firmware/punit/ce2600_8051_firmware.bin" doesn                                           't exist
init_punit_fw_upgrade SUCCESS
gpio SUCCESS
/dev/mmcblk0p11: recovering journal
### Start /etc/rc3.d/idl
init_pwm SUCCESS
i2c /dev entries driver
CE2600 Smartcard Controller found currently!
scard_pci_driver 0000:01:0b.3: PCI INT B -> Link[LIDL] -> GSI 39 (level, high) -                                           > IRQ 39
/dev/mmcblk0p11: clean, 33/256 files, 1151/2048 blocks
The partition mmcblk0p11 was scan with fsck and the return valkjournald starting                                           .  Commit interval 5 seconds
ue is 0
idl SUCCESS

UART Intel Puma 6 DUMP 3 of 3

EXT3-fs (mmcblk0p11): using internal journal
EXT3-fs (mmcblk0p11): mounted filesystem with journal data mode
### Start /etc/rc3.d/clock_control
Change reboot to atom only reboot
nvram SUCCESS
### Start /etc/rc3.d/rpc_ifconfig_init
### Start /etc/rc3.d/telnetd
telnetd SUCCESS
clock_control SUCCESS
### Start /etc/rc3.d/intel_ce_pm
rpc_ifconfig:main
Waiting for RPC-IF mailbox event from NP-CPU...
ICEPM GPIOs:: WIFI 10 : SATA -1 : PCIE 100 : SC -1 : Ext Tuner -1 : GbE -1
intel_ce_pm SUCCESS
### Start /etc/rc3.d/sec
dma_tracker_init: initialized
ACPI: PCI Interrupt Link [LSEC] enabled at IRQ 36
pci 0000:01:09.0: PCI INT A -> Link[LSEC] -> GSI 36 (level, high) -> IRQ 36
sec_hal_set_irq: os_pci_get_interrupt returned SEC IRQ=36
sec_hal_set_irq: os_acquire_interrupt installed the SEC
 interrupt handler, sec_hal_intr_func, to IRQ number=36
pmr_count=0 and enable_tdp = 0
***g_cw_enabled=0
Setting snoop configuration... SUCCESS
SEC ROM Version 0x05030106
Initializing TDP... SUCCESS
sec SUCCESS
### Start /etc/rc3.d/sec_fw_1100
### Start /etc/rc3.d/runtime_pm
runtime_pm SUCCESS
sec_fw_1100 SUCCESS
/bin/init_man: dhsauto_init: waiting on service rpc_management_srv_init (10 sec)                                           ...
/bin/init_man: inetd: waiting on service network (10 sec)...
/bin/init_man: portmap_init: waiting on service rpc_ifconfig_init (10 sec)...
/bin/init_man: network: waiting on service rpc_ifconfig_init (10 sec)...
/bin/init_man: init_punit_fw_upgrade_notification: waiting on service rpc_manage                                           ment_srv_init (10 sec)...
/bin/init_man: rpc_up_and_running: waiting on service dhsauto_init (10 sec)...
/bin/init_man: arris_rpc_srv_init: waiting on service portmap_init (10 sec)...
/bin/init_man: samba: waiting on service network (10 sec)...
/bin/init_man: arris_wlan_rpc_init: waiting on service portmap_init (10 sec)...
/bin/init_man: slave_cli_init: waiting on service arris_rpc_srv_init (10 sec)...
/bin/init_man: rpc_management_srv_init: waiting on service portmap_init (10 sec)                                           ...
/bin/init_man: icepm_gateway: waiting on service rpc_management_srv_init (10 sec                                           )...
/bin/init_man: init_man.sh: waiting on service dhsauto_init (10 sec)...
rpc_ifconfig:mgm_rpc_NetIfSetup RPC IF INFO:
rpc_ifconfig:mgm_rpc_NetIfSetup NP-CPU IPV4 ADDR 192.168.254.253
rpc_ifconfig:mgm_rpc_NetIfSetup APP-CPU IPV4 ADDR 192.168.254.254
rpc_ifconfig:mgm_rpc_NetIfSetup Network MASK ADDR 255.255.255.0
rpc_ifconfig:mgm_rpc_NetIfSetup RPC-IF Vlan-ID 4093
rpc_ifconfig:mgm_rpc_NetIfSetup Bring up the APP-CPU RPC IF
rpc_ifconfig DEBUG:mgm_rpc_NetIfSetup vconfig add eth0 4093
rpc_ifconfig DEBUG:mgm_rpc_NetIfSetup ifconfig eth0.4093 192.168.254.254
rpc_ifconfig_init SUCCESS
### Start network
### Start /etc/rc3.d/portmap_init
portmap_init SUCCESS
network SUCCESS
### Start /etc/rc3.d/rpc_management_srv_init
### Start /etc/rc3.d/arris_rpc_srv_init
### Start /etc/rc3.d/arris_wlan_rpc_init


-------------------------------------------------------------------------
                            N O T I C E :

Could not find the script associated with the '/etc/rc3.d/inetd' init script.
This is likely because the component providing this script was disabled
during your build. If you did not disable this component manually please
contact the component owner to correct this issue.

-------------------------------------------------------------------------


inetd SUCCESS
rpc_management_srv_init SUCCESS
arris_rpc_srv_init SUCCESS
### Start /etc/rc3.d/icepm_gateway
arris_wlan_rpc_init SUCCESS
### Start /etc/rc3.d/dhsauto_init
is being skipped.
dhsauto_init SUCCESS
### Start /etc/rc3.d/slave_cli_init
slave_cli_init SUCCESS
### Start /etc/rc3.d/samba
### Start /etc/rc3.d/init_punit_fw_upgrade_notification
### Start /etc/rc3.d/rpc_up_and_running
samba :: found no /var/samba/smb.conf. creating it in /var/samba/smb.conf
Sending the RPC notification -UP_AND_RUNNING to NP...
samba :: done
samba :: found invalid parameter in conf file -  - for tdb files. deleting it..
samba :: done
samba :: found invalid parameter in conf file -  - for pid files. deleting it..
icepm_gateway SUCCESS
samba :: done
This is a CEFDK failsafe upgrade ready platform.
Standalone punit in field upgrade is not supported.
init_punit_fw_upgrade_notification SUCCESS
Server IP addr 192.168.254.254
Client IP addr 192.168.254.253
RPC management server bind successfully to 192.168.254.254
QCA WLAN RPC Server pid=1948 forked child pid=1993
QCA WLAN RPC server bind successfully to 192.168.254.254:60001
Debug: rpcMgm_registerRpc RPC client registered with RPC server 192.168.254.253
ARRIS RPC Server pid=1942 forked child pid=1995
ARRIS RPC server bind successfully to 192.168.254.254:60000
Debug: rpcMgm_registerRpc RPC client registered with RPC server 192.168.254.253
Debug: rpcMgm_sendUpAndRunning RPC rpcMgm_sendUpAndRunning done with result OK
rpc_up_and_running SUCCESS
samba SUCCESS
##### Starting Scripts Complete ######


Please press Enter to activate this console.
starting pid 2001, tty '': '-/usr/sbin/mini_cli_bin'
192.168.254.253: RPC: Program not registered
setLgiButtonAction: setLgiButtonAction

UART ARRIS Dump 1 of 2

NPCPU Only Mode = 0


Cat Mountain D0 - Boot Ram.
Version: 0.1.16 (Apr 10 2014, 18:52:35)
Boot Param memory dump:
[0x1FFC] - 0x00010016
[0x1FF8] - 0x00000001
[0x1FF4] - 0x00000001
[0x1FF0] - 0x00000002
[0x1FEC] - 0x00000001
[0x1FE8] - 0x10000000
[0x1FE4] - 0x10000000
[0x1FE0] - 0x00200000
[0x1FDC] - 0x00220000
[0x1FD8] - 0x00240000
[0x1FD4] - 0x00040000
[0x1FD0] - 0x00280000
[0x1FCC] - 0x00280000
[0x1FC8] - 0x00020000
[0x1FC4] - 0x00000000
[0x1FC0] - 0x00000000
[0x1FBC] - 0x00000000
[0x1FB8] - 0x00000000
[0x1FB4] - 0x00000000
[0x1FB0] - 0x00000000
[0x1FAC] - 0x00000000
[0x1FA8] - 0x00000000
[0x1FA4] - 0x00000000
[0x1FA0] - 0x00000000
[0x1F9C] - 0x06050201
[0x1F98] - 0x09030807
[0x1F94] - 0x0E0D0C0A
[0x1F90] - 0x00000001
[0x1F8C] - 0x0000000C
[0x1F88] - 0x00020111
[0x1F84] - 0x00201000
[0x1F80] - 0x00000070
[0x1F7C] - 0x00221000
[0x1F78] - 0x00008000
[0x1F74] - 0x00000020
[0x1F70] - 0x00180000
[0x1F6C] - 0x00010000
[0x1F68] - 0x00190000
[0x1F64] - 0x00009400
[0x1F60] - 0x00199400
[0x1F5C] - 0x00065400
[0x1F58] - 0x001FF000
[0x1F54] - 0x00000800
[0x1F50] - 0x001FF800
[0x1F4C] - 0x00000800
[0x1F48] - 0x001FE800
[0x1F44] - 0x00000800
[0x1F40] - 0x00000001
[0x1F3C] - 0x00000000
[0x1F38] - 0x00000000
[0x1F34] - 0x00000000
[0x1F30] - 0x00000000
[0x1F2C] - 0x00000000
[0x1F28] - 0x00000000
[0x1F24] - 0x00000000
Load U-Boot from eMMC/NAND Flash
eMMC/NAND copy from 0x00240000 to 0x51FB0000 (len:262144).
Done.


U-Boot 1.2.0 (Jul  2 2015 - 05:38:54)
PSPU-Boot 4.2.0.45

DRAM:  256 MB
Flash:  0 kB
MMC:   sdhci_puma6: 0
MMC info:
  Manufacturer ID: 0
  OEM ID: 0
  Name: MMC128
  MMC version 4.4
  High Capacity: No
  Dual Data Rate (DDR): No
  Bus Width: 8-bit
  Clock: 50000000
  Rd Block Len: 512
  Capacity: 112.4 MB (117833728 bytes)
In:    serial
Out:   serial
Err:   serial
Read AID 1
Board-Type:  harborpark-mg
AEP:         Disable
Boot Device: mmc
ACTIMAGE:    1
*** ACTIMAGE = 1, will try to boot UBFI1 stored @0x002A0000
## Executing script at 002a0000
========== Running script (puma6) ver 2.5 =========
*** Running from UBFI1 partition @0x52000000 (eMMC)
Load address ............. 0x2a23c0
Kernel partition offset .. 0x240c
kernel size .............. 0x1697f4
Root FS partition offset . 0x16bc00
Root FS size ............. 0x8d7c00
Additional FS ............
========== Script Done ============================

*** UBFI1 bootscript executed successfully.
Start booting...
## Booting image at 002a23c0 ...
ARM MBX sending 'eMMC done.' notification...
   Image Name:   Multi Image File
   Image Type:   ARM Linux Multi-File Image (uncompressed)
   Data Size:    10753024 Bytes = 10.3 MB
   Load Address: 00a00000
   Entry Point:  00a00000
   Contents:
   Image 0:  1480692 Bytes =  1.4 MB
   Image 1:  9272320 Bytes =  8.8 MB
OK

Starting kernel ...

Starting LZMA Uncompression Algorithm.
Compressed file is LZMA format.
[Debug - Kerenl] LZMA Uncompression - Done.
CPU: ARMv6-compatible processor [410fb764] revision 4 (ARMv7), cr=00c538ff
CPU: VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: puma6
Ignoring unrecognised tag 0x00000000
Memory policy: ECC disabled, Data cache writeback
Reserved 4096k DSP memory starting from Physical 0x5fc00000
Initialized Peripheral Port Remap Register to base : 0x20000000
Puma-6 system_rev = 1505 -- docsis ip rev = 32
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 64008
Interrupt controller revision : 4e822100
Precise sched_clock: load 35156, nsec/count 284
Puma6 Timer0 initialized
INITIAL_JIFFIES 4294937296
jiffies 4294937297
Sync FRC (hi 0 lo 38) to timer0 (0)

PAL_cppi4Init : domain is 0, cfg ptr is 0x80419C58
PAL_cppi4Init: CPPI 4.1 API initialized successfully.

PAL_cppi4Init : domain is 0, cfg ptr is 0x00000000
0 = result from request_irq

==============================================================================
P-UNIT : FW version is [ 1.2.0 ]
P-UNIT : FW is backward compatible down to Silicon Stepping [A0]
P-UNIT : FW build version is [ R-20a ]
P-UNIT : Last reset reason   = 0x00000000 [ RESET_COLD_BOOT                ]
P-UNIT : Last reset origin   = 0x00000000 [ RESET_ORIGIN_HW                ]
P-UNIT : Reset duration from shadow register = 0.0 Seconds
P-UNIT : Last reset duration = 0.0 Seconds
P-UNIT : Shadow duration     = 0.0 Seconds
==============================================================================
TI LED driver initialized [major=248]
Serial Flash [Bus:0 CS:0] : No device found
Serial Flash [Bus:0 CS:1] : No device found
 MODULE: PDSP Start ...
 MODULE: PP Start ...
HIL Core: Profile intrusive_pp2k has been Loaded.
receive_specific_event_notification Event=0x4  parameter = 0x30
init started: BusyBox v1.19.2 (2016-01-25 02:34:35 EST)
starting pid 34, tty '/dev/tts/0': '/etc/init.d/rcS > /dev/console 2> /dev/console'
Calibrate: prev cal 0, new cal 0

About to set realtime runtime...


About to initialize PP ...


PAL_cppi4Init : domain is 0, cfg ptr is 0x00000000
LOG (pid=45): hal_pp_fw_download SUCCESS!


The PP Should be running now ...

/dev/mmcblk0p3: recovering journal
/dev/mmcblk0p3: clean, 172/256 files, 1337/2048 blocks
The device /dev/mmcblk0p3 was scan with fsck.ext3 and the return value is 0
mount -t ext3 /dev/mmcblk0p3 /nvram -o data=journal -o barrier=1
eMMC F/W Auto-Upgrade: /nvram/mmc_settings.cfg not exist.
************** ARRIS NVM Init ***************
NV Memory Manager Initialization complete
****** ARRIS TR69 NVM_Initialize started ******
LOG (pid=53): TR69 NVM Initialization complete
****** ARRIS MOCA NVM_Initialize started ******
LOG (pid=53): MOCA NVM Initialization complete
/etc/init.d/rcS: /etc/config: line 2150: CROSS: not found

Running Intel GW...
Running Intel eSAFE loader...
Processing eSAFE sector: /dev/mmcblk0p7-FS1 - /dev/mmcblk0p7 - FS1

========================================================
ARRIS Touchstone Docsis 3.0 Firmware
Firmware Revision 9.1.88T
Build VGWSDK Base Release 4.5.0.18
Build date: Monday, January 25 2016, 03:10:38
Copyright (c) 2007 - 2014 ARRIS Group Inc.
========================================================

LOG (pid=179): Restoring production DB from NVRAM ... SUCCESS
Running /etc/scripts/z_arris_check.sh...
Running /etc/scripts/sys_check.sh...
/etc/scripts/sys_check.sh: /etc/config: line 2150: CROSS: not found
Running /etc/scripts/pacm_check.sh...
Running /etc/scripts/memcfg_check.sh...
Setup memory config from file "/etc/sysctl_mem.conf"
vm.panic_on_oom = 2
vm.swappiness = 0
vm.overcommit_memory = 2
vm.overcommit_ratio = 100
Running /etc/scripts/gw_check.sh...
Running /etc/scripts/docsis_check.sh...
----------------------------------------------------------
Enable_Startup = 1
Startup_File = /etc/scripts/sys_startup.sh
----------------------------------------------------------
Starting the voice PCD files
running vgwsdk PCD!
Using DOCSIS MAC Manager parameters: -x -m
VoPP NVRAM flag setting NOT exist, setting default value to 1, MAS_PP_SUPPORT=1 (enable/on)
ARRIS disabled MAS_PP_SUPPORT
starting pid 227, tty '/dev/tts/0': '/bin/sh --login /etc/scripts/start_cli.sh > /dev/console 2> /dev/console'
pcd: (226): Starting TI Process Control Daemon.
pcd: (226): Error: Unable to open configuration file /etc/scripts/bbu.pcd.
pcd: (226): Error: Unable to open configuration file /etc/scripts/dsg.pcd.
pcd: (226): Loaded 150 rules.
pcd: Initialization complete.
pcd: (226): Starting process /etc/scripts/l2switch_drvinit.sh (Rule PUMA6SYSTEM_L2SW_INSMODE).
pcd: (226): Starting process echo (Rule PUMA6SYSTEM_DECT_UART_IRQ_P).
pcd: (226): Starting process mknod (Rule PUMA6SYSTEM_CRU_CTRL_MKNOD).
pcd: (226): Starting process /usr/sbin/watchdog_rt (Rule SYSTEM_WATCHDOG).
pcd: (226): Starting process /sbin/ti_syslogd (Rule SYSTEM_SYSLOGD).
pcd: (226): Starting process /usr/sbin/logger (Rule SYSTEM_LOGGER).
pcd: (226): Starting process /usr/sbin/gptimer (Rule SYSTEM_GPTIMER).
pcd: (226): Rule SYSTEM_WATCHDOG: Success (Process /usr/sbin/watchdog_rt (231)).
pcd: (226): Rule PUMA6SYSTEM_CRU_CTRL_MKNOD: Success (Process mknod (230)).
TI Watchdog-RT daemon started <kick interval = 10 seconds>
pcd: (226): Rule PUMA6SYSTEM_DECT_UART_IRQ_P: Success (Process echo (229)).
Installing L2 Switch drivers...
LOG (pid=234): Initialized successfully, timer tick 50ms
pcd: (226): Rule SYSTEM_GPTIMER: Success (Process /usr/sbin/gptimer (234)).
L2switch internal MAC: c0.05.c2.43.57.90
Has get MAIN_isLGI
Has opened libarris_main.so. dl_ptr_checkLGI = 2ad58f95, dl_ptr_NvmTrive = 2ad5e151,
nvmget = 0.
lgi = 1.
Allocated parts table for 1024 file descriptors.
Starting.
Called init.
Called allocate_log, nlogs = -1.
cfline(kern.info                        /dev/null)
symbolic name: info ==> 6
symbolic name: kern ==> 0
leading char in action: /
filename: /dev/null
Opened UNIX socket `/dev/log'.
 0: 7F  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /dev/null
logmsg: syslog.info<46>, flags 4, from ARRIS DOCSIS 3, msg syslogd 1.4.1: restart.
syslogd: restarted.
decmp_init[2634]
decmp_init[2653] decmd=/fss/gw/bin/sc_compress -u -s /nvram/8/fwlogcmp -d /var/log/firewall.log
Debugging disabled, SIGUSR1 to turn on debugging.

PAL_cppi4Init : domain is 0, cfg ptr is 0x00000000

PAL_cppi4Init : domain is 0, cfg ptr is 0x00000000
PP Operation PP_EV_PID_CREATED, pid_handle=0 @ l2sd0 device

PAL_cppi4Init : domain is 0, cfg ptr is 0x00000000
PP Operation PP_EV_PID_CREATED, pid_handle=1 @ l2sm0 device
enable_proxy_pdsp_hw: Run Proxy PDSP
L2 Switch drivers installed successfully
pcd: (226): Rule PUMA6SYSTEM_L2SW_INSMODE: Success (Process /etc/scripts/l2switch_drvinit.sh (228)).
Delaying mini_cli execution until init complete
TI Logger: Init complete
pcd: (226): Rule SYSTEM_LOGGER: Success (Process /usr/sbin/logger (233)).
pcd: (226): Starting process /usr/sbin/arris_klogd (Rule DOCSIS_ARRIS_KLOGD).
pcd: (226): Starting process /usr/sbin/l2switch_init (Rule PUMA6SYSTEM_L2SWITCH).
pcd: (226): Rule DOCSIS_ARRIS_KLOGD: Success (Process /usr/sbin/arris_klogd (250)).
pcd: (226): Starting process /usr/sbin/gim (Rule SYSTEM_GIM).
[INFO] [COMMON_COMPONENTS.GIM(pid=252)]: GIM initializing...
[INFO] [COMMON_COMPONENTS.GIM(pid=252)]: GIM initialization complete. GIM_MODULE=3086
pcd: (226): Rule SYSTEM_GIM: Success (Process /usr/sbin/gim (252)).
pcd: (226): Starting process /usr/sbin/sync_app_np_reboot (Rule PUMA6SYSTEM_SYNC_APP_NP_REB).
[INFO] [COMMON_COMPONENTS.L2SWITCH(pid=251)]: Initializing L2switch library...
[INFO] [COMMON_COMPONENTS.L2SWITCH(pid=251)]: Initializing L2switch...
pcd: (226): Rule PUMA6SYSTEM_SYNC_APP_NP_REB: Success (Process /usr/sbin/sync_app_np_reboot (253)).
[INFO] [COMMON_COMPONENTS.L2SWITCH(pid=251)]: L2switch initialized successfully
pcd: (226): Rule PUMA6SYSTEM_L2SWITCH: Success (Process /usr/sbin/l2switch_init (251)).
pcd: (226): Starting process /usr/sbin/ext_switch_init (Rule PUMA6SYSTEM_SWITCH_INIT).
[INFO] [COMMON_COMPONENTS.EXT_SWITCH(pid=254)]: main - 59 Initialized external switch DB
pcd: (226): Rule PUMA6SYSTEM_SWITCH_INIT: Success (Process /usr/sbin/ext_switch_init (254)).
pcd: (226): Starting process /usr/sbin/rpc_ifconfig (Rule PUMA6SYSTEM_RPC_IFCONFIG).
pcd: (226): Starting process /usr/sbin/portmap (Rule SYSTEM_RPC_PORTMAP).
pcd: (226): Rule SYSTEM_RPC_PORTMAP: Success (Process /usr/sbin/portmap (259)).
pcd: (226): Starting process /usr/sbin/rpc_management_server (Rule PUMA6SYSTEM_RPC_MANAGEMENT).
pcd: (226): Rule PUMA6SYSTEM_RPC_MANAGEMENT: Success (Process /usr/sbin/rpc_management_server (260)).

UART ARRIS Dump 2 of 2

pcd: (226): Rule PUMA6SYSTEM_RPC_IFCONFIG: Success (Process /usr/sbin/rpc_ifconfig (255)).
pcd: (226): Rule PUMA6_RPC_LASTRULE: Success.
pcd: (226): Rule PUMA6SYSTEM_LASTRULE: Success.
pcd: (226): Rule SYSTEM_LASTRULE: Success.
pcd: (226): Rule PREDOCSIS_LASTRULE: Success.
pcd: (226): Starting process echo (Rule DOCSIS_APPRUN).
pcd: (226): Rule DOCSIS_APPRUN: Success (Process echo (261)).
pcd: (226): Starting process /usr/sbin/docsis_init_once (Rule DOCSIS_INITONCE).
iniparser: cannot open /var/tmp/lsddb_rt.ini
[INFO] [DOCSIS.INIT(pid=262)]: Exec NvramDb_Init
[INFO] [DOCSIS.NVRAM_DB(pid=262)]: Restoring NVRAM DB from NVRAM ... SUCCESS
[INFO] [DOCSIS.INIT(pid=262)]: Exec Bpi_DbInit
[INFO] [DOCSIS.INIT(pid=262)]: Exec Bpi_BpiAuthDb_DbInit
[INFO] [DOCSIS.INIT(pid=262)]: Exec Bpi_BpiTekDb_DbInit
[INFO] [DOCSIS.INIT(pid=262)]: Exec Bpi_SaMapDb_DbInit
[INFO] [DOCSIS.INIT(pid=262)]: Exec SWDL_SwDlDb_Init
[INFO] [DOCSIS.INIT(pid=262)]: Exec HalDb_Init
[INFO] [DOCSIS.INIT(pid=262)]: Exec UpstreamParamsDb_Init
[INFO] [DOCSIS.INIT(pid=262)]: Exec qos_IntDb_Init
sched `ps | grep -v grep | grep irq | grep irq/24 | cut -c-5` 1 1
[WARNING] [DOCSIS.QOS(pid=262)]: Failed reset DSX TA SM to IDLE on TA DB Reset
pcd: (226): Rule DOCSIS_INITONCE: Success (Process /usr/sbin/docsis_init_once (262)).
pcd: (226): Starting process /usr/sbin/upstream_manager_1q (Rule DOCSIS_US1Q).
pcd: (226): Starting process insmod (Rule DOCSIS_SOCIFDRV).
pcd: (226): Rule DOCSIS_SOCIFDRV: Success (Process insmod (317)).
pcd: (226): Starting process mknod (Rule DOCSIS_MKNODSOCIFDRV).
pcd: (226): Starting process insmod (Rule DOCSIS_BRIDGE).
pcd: (226): Rule DOCSIS_MKNODSOCIFDRV: Success (Process mknod (320)).
pcd: (226): Starting process insmod (Rule DOCSIS_MNG).
pcd: (226): Rule DOCSIS_US1Q: Success (Process /usr/sbin/upstream_manager_1q (316)).
pcd: (226): Rule DOCSIS_BRIDGE: Success (Process insmod (321)).
pcd: (226): Rule DOCSIS_MNG: Success (Process insmod (322)).
[INFO] [DOCSIS.INIT(pid=262)]: Exec CoSDb_Init
[INFO] [DOCSIS.INIT(pid=262)]: Exec PrimaryDsFreqOverrideDb_Init
[INFO] [DOCSIS.INIT(pid=262)]: Exec L2vpnDb_Init
[INFO] [DOCSIS.INIT(pid=262)]: Looking for LSDDB /nvram/1/lsddb.ini
[INFO] [DOCSIS.INIT(pid=262)]: Docsis LSDDB: created link from /nvram/1/lsddb.ini to /nvram/3/lsddb.ini
pcd: (226): Starting process mknod (Rule DOCSIS_MKNODMNG).
pcd: (226): Starting process insmod (Rule DOCSIS_KINTR).
pcd: (226): Starting process insmod (Rule DOCSIS_CNI).
pcd: (226): Rule DOCSIS_MKNODMNG: Success (Process mknod (325)).
pcd: (226): Starting process insmod (Rule DOCSIS_FILTERCLASS).
pcd: (226): Rule DOCSIS_CNI: Success (Process insmod (327)).
pcd: (226): Rule DOCSIS_KINTR: Success (Process insmod (326)).
pcd: (226): Starting process /usr/sbin/hal_event_mbox (Rule DOCSIS_HALEVENTMBOX).
pcd: (226): Starting process /usr/sbin/hal_cmd_mbox (Rule DOCSIS_HALCMDMBOX).
pcd: (226): Rule DOCSIS_FILTERCLASS: Success (Process insmod (344)).
pcd: (226): Starting process /bin/sh (Rule DOCSIS_FCDEV).
pcd: (226): Rule DOCSIS_HALCMDMBOX: Success (Process /usr/sbin/hal_cmd_mbox (375)).
pcd: (226): Rule DOCSIS_HALEVENTMBOX: Success (Process /usr/sbin/hal_event_mbox (374)).
pcd: (226): Starting process /usr/sbin/mlx (Rule DOCSIS_MLX).
pcd: (226): Rule DOCSIS_MLX: Success (Process /usr/sbin/mlx (382)).
pcd: (226): Starting process /usr/sbin/hal_tuner_mgr (Rule DOCSIS_HALTUNERMGR).
pcd: (226): Rule DOCSIS_FCDEV: Success (Process /bin/sh (377)).
pcd: (226): Starting process /usr/sbin/dbridge_init (Rule DOCSIS_DBRIDGEINIT).
pcd: (226): Rule DOCSIS_HALTUNERMGR: Success (Process /usr/sbin/hal_tuner_mgr (390)).
[ERROR] [COMMON_COMPONENTS.LSDDB(pid=391)]: LSDDB - actualDb == NULL
pcd: (226): Rule DOCSIS_DBRIDGEINIT: Success (Process /usr/sbin/dbridge_init (391)).
pcd: (226): Starting process /bin/sh (Rule DOCSIS_DBRIDGEMDFINIT).
pcd: (226): Starting process /bin/sh (Rule DOCSIS_DBRIDGEL2VPNDSI).
pcd: (226): Starting process /usr/sbin/arris_init (Rule DOCSIS_ARRIS_INIT).
pcd: (226): Rule DOCSIS_DBRIDGEL2VPNDSI: Success (Process /bin/sh (400)).
pcd: (226): Rule DOCSIS_DBRIDGEMDFINIT: Success (Process /bin/sh (399)).
pcd: (226): Starting process insmod (Rule DOCSIS_PP).
pcd: (226): Rule DOCSIS_PP: Success (Process insmod (412)).
pcd: (226): Starting process /bin/sh (Rule DOCSIS_PPDEV).
pcd: (226): Rule DOCSIS_PPDEV: Success (Process /bin/sh (414)).
pcd: (226): Rule DOCSIS_HALREADY: Success.
pcd: (226): Starting process /usr/sbin/dispatcher (Rule DOCSIS_DISPATCHER).
netlink_open: initialized fd 7
pcd: (226): Rule DOCSIS_DISPATCHER: Success (Process /usr/sbin/dispatcher (423)).
[INFO] [ARRIS.INIT(pid=401)]: ************** ARRIS Init ***************
[INFO] [ARRIS.DB(pid=401)]: Database Manager Initialization complete
[INFO] [ARRIS.INIT(pid=401)]: **************** App Mode ***************
[INFO] [ARRIS.DB(pid=401)]: Gateway shared memory initialization complete
[INFO] [ARRIS.DB(pid=401)]: HomePlug shared memory initialization complete
[INFO] [ARRIS.DB(pid=401)]: ARRIS MTA Surveillance Port Initialization complete
[INFO] [ARRIS.DB(pid=401)]: ARRIS TR143 SPEEDTEST Database Manager Initialization complete
[INFO] [ARRIS.DB(pid=401)]: ARRIS npm Database Manager Initialization complete
[INFO] [ARRIS.DB(pid=401)]: ARRIS SIP Database Manager Initialization complete
[INFO] [ARRIS.INIT(pid=401)]: *********** SIP DB init done. ************
[INFO] [ARRIS.INIT(pid=401)]: ****** HWRESET *******
[INIT] [ARRIS.RF_SCAN(pid=401)]: Initializing RF frequency scanner
[INFO] [ARRIS.RF(pid=401)]: RF Initialization complete
[INFO] [ARRIS.INIT(pid=401)]: ******** Initializing Webserver *********
pcd: (226): Starting process lighttpd (Rule DOCSIS_LHTTPD).
pcd: (226): Rule DOCSIS_LHTTPD: Success (Process lighttpd (431)).
[ERROR] [ARRIS.INIT(pid=401)]: Failed to disable ATOM UART
[INFO] [ARRIS.INIT(pid=401)]: ********* ARRIS Init Complete  **********
pcd: (226): Rule DOCSIS_ARRIS_INIT: Success (Process /usr/sbin/arris_init (401)).
pcd: (226): Starting process /usr/sbin/wlan_rpc_server (Rule DOCSIS_ARRIS_RPCSERVER).
pcd: (226): Starting process /usr/sbin/qos_dsx_sm (Rule DOCSIS_QOSDSXSM).
pcd: (226): Starting process /usr/sbin/docsis_mac_driver (Rule DOCSIS_MACDRIVER).
pcd: (226): Starting process /usr/sbin/cm_status (Rule DOCSIS_CMSTATUS).
pcd: (226): Starting process /usr/sbin/ledd (Rule DOCSIS_ARRIS_LED).
pcd: (226): Rule DOCSIS_ARRIS_LED: Success (Process /usr/sbin/ledd (436)).
pcd: (226): Rule GW_APPRUN: Success.
pcd: (226): Rule DOCSIS_ARRIS_RPCSERVER: Success (Process /usr/sbin/wlan_rpc_server (432)).
pcd: (226): Starting process gw_reinitd (Rule GW_RESTARTD).
pcd: (226): Starting process gw_prov (Rule GW_GWPROV).
pcd: (226): Starting process gw_clientdb (Rule GW_CLIENTDB).
pcd: (226): Starting process /sbin/udhcpd (Rule DOCSIS_ARRIS_DHCP_SERV).
pcd: (226): Rule DOCSIS_ARRIS_DHCP_SERV: Success (Process /sbin/udhcpd (440)).
[ERROR] [DOCSIS.HAL_PHY(pid=433)]: DS[25]: PHY_ConfigDsReceiver() failed, PHY supprort only 24DS.
pcd: (226): Rule DOCSIS_QOSDSXSM: Success (Process /usr/sbin/qos_dsx_sm (433)).



                           `!MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM::~
                               ``!MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM!:~` ~
                                    !MMMMMMMMMMMMMMMMMMMMMMM!:`     :~~
                                     :MMMMMMMMMMMMMMMM!~        :~~~~
                                   .:MMMMMMMMMM!:~           ~~~~~~
                              ..:MMMMMMM!:~`             :~~~~~~~
                         .:MMMMMM:~`                ::~~~~~~~~~
                    .:MMMMM:~                    .!!!!!!: ~~~~
              ..:MMM:~`                         .!!!!`      ~
        ..:MM:~`                                !!`
   .:M:~`


        AA              RRRRRRR          RRRRRRR          III         SSSSS
       AAAA             RRRRRRRRR        RRRRRRRRR        III       SSSSSSSSS
      AAAAAA            RRR    RRR       RRR    RRR       III      SSS    SS
     AAA  AAA           RRR   RRRR       RRR   RRRR       III       SSSS
    AAA    AAA          RRRRRRRRR        RRRRRRRRR        III         SSSSSS
   AAAAAAAAAAAA         RRR  RRR         RRR  RRR         III            SSSS
  AAA        AAA        RRR   RRR        RRR   RRR        III       SS    SSS
 AA            AA       RRR    RRR       RRR    RRR       III      SSSSSSSSS
A                A      RRR       R      RRR       R      III        SSSSS


          Copyright ARRIS Enterprises, Inc. 2016 All rights reserved

To extract the firmware you will nee the following

• Soldering iron with a smallish tip, fine solder (0.35 is good), flux maybe not as much as I used, and a steady hand.
• Microscope or a good magnifying glass.
• craft knife
• Magnet wire
• Transcend TS-RDF5 SD card reader !IMPORTANT
• SD card breakout such as this or this which I used.
• Optionaly but recomended header pins and jumper wires.
• A Linux operating system. Kali would be a good choice.

The board I used was of a 2015-2016 vintage so newer boards may have a different layout but the principle is the same. You need to connect VCC, GND, CMD, CLK and DAT0 to your SD breakout. Below is a picture of where you need to solder your magnet wire to. For DATO you will need to carefully scrape away some of the solder mask and solder a wire directly to the copper trace.

14 VCC
16 CMD
25 CLK
22 DAT0
GND use Ethernet shield

Once your soldering is done connect all the cables to your SD breakout and insert into the SD card reader (must support 1 bit mode). Make sure your router is turned off and connect the SD card reader to your computer You should now see many paritions mounted in your operating system.

Here are some interesting locations

sdf13/usr/dvr_app

U-Boot

There are 2 U-Boot partitions both are identical. The partition contains multiple images, to extract do the following. You can omit binwalk and fdsik if using the attached image but if you are using your own router you will have to use them.

binwalk tg2492-2015-v1.bin
fdisk -l -uS tg2492-2015-v1.bin
dd if=tg2492-2015-v1.bin of=part1.bin skip=5376 count=11519

binwalk part1.bin
dd if=part1.bin of=p1multi0.uImage bs=1 count=9152 skip=0
dd if=part1.bin of=p1multi1.uImage bs=1 count=3145728 skip=9152
dd if=part1.bin of=p1multi2.uImage bs=1 count=3154880 skip=3145728
dd if=part1.bin of=p1multi3.uImage bs=1 skip=3154880
dumpimage -i p1multi0.uImage ppc.txt

binwalk p1multi1.uImage
dd if=p1multi1.uImage of=p1multi1a.uImage bs=1 count=3136576 skip=0
dd if=p1multi1.uImage of=p1multi1b.uImage bs=1 skip=3136576
dumpimage -i p1multi1a.uImage 1abinary.img
dumpimage -i p1multi1b.uImage puma6.txt

Further reading

Python API + CLI for the Virgin Super Hub 3 https://github.com/KarlJorgensen/virgin-media-hub3

Dan the Man's Arris Firmware, Static route and Cert decrypt https://blog.danman.eu/about-adding-a-static-route-to-my-docsis-modem/

Compal Decrypt https://gist.github.com/danielkucera/fa9df248f6e0ea5dc2908743360d5cb7

eMMC https://www.blackhat.com/docs/us-17/wednesday/us-17-Etemadieh-Hacking-Hardware-With-A-$10-SD-Card-Reader-wp.pdf

eMMC https://www.blackhat.com/docs/us-17/wednesday/us-17-Etemadieh-Hacking-Hardware-With-A-$10-SD-Card-Reader.pdf