Motorola NVG510

From WikiDevi
Jump to: navigation, search

Motorola NVG510
Availability: AT&T UVerse, possibly others

FCC approval date: 22 April 2011
Country of manuf.: Thailand

Amazon image

B007P6ZLM4 (Flag of the United States.svg, On Amazon, On CCC)

Type: wireless router, dsl modem, analog phone gateway

Industry Canada ID: 2525B-NVG510

Power: 12 VDC, 2 A
Connector type: barrel

CPU1: Broadcom BCM6362 (210 MHz)
FLA1: 16 MiB
16,777,216 B
131,072 Kib
16,384 KiB
128 Mib
0.0156 GiB
(Winbond W25Q128BVFG)
RAM1: 64 MiB
67,108,864 B
524,288 Kib
65,536 KiB
512 Mib
0.0625 GiB
(Winbond W9751G6JB-25)

Expansion IFs: none specified
Serial: yes, (57600,8,N,1)

WI1 chip1: Broadcom BCM6362
WI1 802dot11 protocols: bgn
WI1 MIMO config: 2x2:2
WI1 antenna connector: none

ETH chip1: Broadcom BCM6362
Switch: Broadcom BCM6362
LAN speed: 10/100
LAN ports: 4


Stock FW OS: Linux

Flags: ADSL2+, boot log

Default SSID: ATTXXX (1 addl. devices)
Default IP address:
the IP is used by 139 additional devices
of which 1 are Motorola devices

802dot11 OUI: 20:E5:64, E4:83:99 (1 E, 1 W, 2010), 7C:BF:B1
Ethernet OUI: 20:E5:64, E4:83:99 (1 E, 1 W, 2010), 7C:BF:B1

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.


Sold by AT&T for use with UVerse, in areas where UVerse TV is not available. This device supports internet and VoIP use, but not TV.


  • ADSL2+ modem/wap/router
  • Uses BCM6362 SoC - CFE describes it as BCM6362, and the output also mentions DECT. (some chips described as 6362 are actually BCM6361's; that is unlikely in this case because the 6361 lacks DECT)
  • CPU is capable of 400MHz but is clocked at 210MHz
  • 16M flash, 64M RAM
  • Linux


These two images are sized and aligned for use with [dePCB] ([latest source]), a board reversing tool. The bottom image needs to be flipped, but is not.

[Additional images]


Motorola Arris GPL archive

Reconfigure without screwdriver or soldering iron[edit]

Enabling Telnet[edit]

There is a remote vulnerability that allows telnet to be enabled. Once that is enabled, it is trivial to access the root shell by just two commands at the telnet prompt.

Grabbing Files[edit]

NOTE: /media is a ramdisk, and the system has limited memory! Do not grab files in /dev unless you know exactly what they are - some are infinite in length!

Get busybox

   cd /media
   chmod +x busybox-mips

Set up symlinks

   ln -s busybox-mips tar
   ln -s busybox-mips nc
   ln -s busybox-mips lsusb
   ln -s busybox-mips lspci
   ln -s busybox-mips lsmod
   ln -s busybox-mips uname
   ln -s busybox-mips dmesg
   ln -s busybox-mips less

Grab an mtd image

  • on nvg510: cat /dev/mtdblock0|./nc -l -p 555
  • Then, on the pc: nc 555 >mtdblock0

Grab the filesystem, except for /dev and /proc

  • on nvg510: ./tar cf - /bin /boot /etc /lib /sbin /tftpboot /tmp /usr /var /www |./nc -l -p 555
  • Then, on the pc: nc 555 >root.tar

Alternatively, there is also a tftp client on the modem. This can be used to transfer files on and off of the modem, if you setup a tftp server on your local network.

MTD Layout[edit]

 * MTD Partitioning scheme for Motopia systems:
 * +---------------------+
 * | Boot                |
 * +---------+-----------+
 * | Image   | Kernel    |
 * |         +-----------+
 * |         | Rootfs    |
 * +---------+-----------+
 * | Motopia             | <- motopia_mtd
 * +---------------------+

# cd /dev
# wc -c mtdblock*
   131072 mtdblock0
   953344 mtdblock1
  8409088 mtdblock2
 16384000 mtdblock3
   262144 mtdblock4
 26139648 total

PCI and USB bus[edit]

   ./lsusb -vv
   Bus 001 Device 001: ID 1d6b:0002    Linux Foundation 2.0 root hub
   Bus 002 Device 001: ID 1d6b:0001    Linux Foundation 1.1 root hub
   ./lspci -vv
   00:00.0 Class 0280: 14e4:435f    this class code is for "network device: other"
   00:09.0 Class 0c03: 14e4:6300
   00:0a.0 Class 0c03: 14e4:6300


  • J10 is a 3.3V serial port - 57600 8N1
1 2 3 4
GND 3.3V Rx Tx
  • J11 is a 14-pin unpopulated connector that probably includes JTAG. Based upon /www/residential/cgi-bin/usb_disk.ha, this probably also contains USB signals.

Serial output from boot sequence[edit]

  • No phone line attached
  • Some possibly-identifying values have been replaced
  • Light starts blinking red when DoDyingGaspCommand is printed


CFE version 3.0.0 for BCM6362 (32bit,SP,BE,MIPS)
Copyright (C) 2000,2001,2002,2003,2004,2005 Broadcom Corporation.

Initializing Arena.
Initializing Devices.
HS Serial flash device: name ID_W25X128, id 0xef17 size 16384KB
Total Flash size: 16384K with 256 sectors
Partition information:
#00   00000000 -> 0001FFFF  (131072)
#01   00020000 -> 00FFFFFF  (16646144)
CPU type 0x2A070: 210MHz
CPU running TP1
Total memory: 0x4000000 bytes (64MB)

Total memory used by CFE:  0x82D00000 - 0x82F3B480 (2339968)
Initialized Data:          0x82D2C670 - 0x82D2E128 (6840)
BSS Area:                  0x82D2E140 - 0x82D39480 (45888)
Local Heap:                0x82D39480 - 0x82F39480 (2097152)
Stack Area:                0x82F39480 - 0x82F3B480 (8192)
Text (code) segment:       0x82D00000 - 0x00027D20 (2100460832)
Boot area (physical):      0x83000000 - 0x84000000
Relocation Factor:         I:00000000 - D:00000000

Reading the image ..... 
Loading POST ....
Running POST.....
POST version 1.0.1
Total POST tests: 3
Test: Memory........Pass
Test: MII........Pass
Test: Slic........Pass
Updating the POST results......Done

Completed POST.....
Linux version (fwbuild@ninex) (gcc version 4.2.3) #1 Thu Sep 22 17:25:01 EDT 2011
Broadcom BCM63xx prom init
Boot loader is : CFE
console [early0] enabled
CPU revision is: 0002a070 (Broadcom BCM6362)
Determined physical RAM map:
 memory: 03f00000 @ 00000000 (usable)
Zone PFN ranges:
  DMA      0x00000000 -> 0x00001000
  Normal   0x00001000 -> 0x00003f00
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00003f00
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16002
Kernel command line: root=/dev/mtdblock2 console=ttyMTD5 console=ttyS0
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
PID hash table entries: 256 (order: 8, 1024 bytes)m¬Ëk׋«
�+ˋëË«–—'$¬ë‹m•…ɱåÁu²ò�’•…±mÑÑåMÁv52þDentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x8108c740 SIZE=1690032, INIT=0x812290f0 SIZE=44
Memory: 59020k/64512k available (2582k kernel code, 5472k reserved, 387k data, 128k init, 0k highmem)
Calibrating delay loop... 399.36 BogoMIPS (lpj=199680)
Mount-cache hash table entries: 512
net_namespace: 980 bytes
NET: Registered protocol family 16
registering PCI controller with io_map_base unset
Skipping PCI bus scan due to resource conflict
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
pci 0000:00:00.0: PME# disabled
BLOG v3.0 Initialized
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 3.4 (2008/08/26) Phillip Lougher
squashfs: LZMA suppport for by jro
msgmni has been set to 115
io scheduler noop registered
io scheduler cfq registered (default)
Serial: Motopia BCM63XX driver $Revision: 1.4 $
ttyS0 at MMIO 0xb0000100 (irq = 11) is a BCM63XX
ttyS1 at MMIO 0xb0000120 (irq = 12) is a BCM63XX
Driver 'sd' needs updating - please use bus_type methods
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <>
Parallel flash not supported on this CPU
Detected SPI Flash
Probing for SPI flash
5 motopiapart partitions found on MTD device bcm_HSSpiDev0
Creating 5 MTD partitions on "bcm_HSSpiDev0":
0x000000000000-0x000000020000 : "Boot"
0x000000020118-0x000000108d65 : "Kernel"
0x000000108d65-0x00000090dd65 : "Rootfs"
0x000000020000-0x000000fc0000 : "Image"
0x000000fc0000-0x000001000000 : "Motopia"
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
GACT probability NOT on
u32 classifier
    Actions configured 
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1008 buckets, 4032 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Bridge firewalling registered
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <>
All bugs added by David S. Miller <>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 128k freed

Initiating system startup...

Algorithmics/MIPS FPU Emulator v1.5
mount: mounting procfs on /proc failed: Device or resource busy
Starting UDEV...
cannot open /dev/null
motopia: module license 'Motorola Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Motopia driver loading
console [MotCrashDump-1] enabled
crashdump_init done, registered console driver successfully 
Motopia event ready
Reset button ready
Push button ready
LEDs ready: Power Dsl Internet SimpleConfig LAN WIFI VOIP1 VOIP2
pfs: Continuing in background
sdb: detaching to run in the background.

Hit the enter key to continue...arp_tables: (C) 2002 David S. Miller
ip6_tables: (C) 2000-2006 Netfilter Core Team
Broadcom BCM6362B0 Ethernet Network Device v0.1 Sep 22 2011 17:20:37
eth0: MAC Address: 00:00:00:00:00:00
eth1: MAC Address: 00:00:00:00:00:00
eth2: MAC Address: 00:00:00:00:00:00
eth3: MAC Address: 00:00:00:00:00:00
ethsw_init_config: multiple queues and SP scheduling enabled
wl: passivemode=0
wl: napimode=1
wl: allocskbmode=1
wl:srom strapped
wl:(srom strapped) probe/present=0
wl: Read SROM/WLCAL from mfg info, sig:0x5372, rev 8, clk_offset 0 - SUCCESS
wl[435f]:Core revision: 16,D11CONF: 65c51800
wl0: MAC Address: 40:b7:f3:21:12:90

wl0: Beacon padding set to 512
NET: Registered protocol family 8
NET: Registered protocol family 20
PPP generic driver version 2.4.2
bcmxtmrt: Broadcom BCM6362B0 ATM/PTM Network Device v0.3 Sep 22 2011 17:18:59
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
DSP Driver: DSP init stub
Endpoint: endpoint_init entry 
Endpoint: endpoint_init COMPLETED
ADDRCONF(NETDEV_UP): eth0: link is not ready
ADDRCONF(NETDEV_UP): eth1: link is not ready
ADDRCONF(NETDEV_UP): eth2: link is not ready
ADDRCONF(NETDEV_UP): eth3: link is not ready
NET: Registered protocol family 24
ADDRCONF(NETDEV_UP): eth0: link is not ready
ADDRCONF(NETDEV_UP): eth1: link is not ready
ADDRCONF(NETDEV_UP): eth2: link is not ready
ADDRCONF(NETDEV_UP): eth3: link is not ready
BcmAdsl_Initialize=0xC0B01B70, g_pFnNotifyCallback=0xC0BAB8F4
*** demodCapabilities=0x008040fa
*** subChannelInfop5 = 0x00d00000, adslDemodCap2Value = 0x00d00000
pSdramPHY=0xA3FFFFF8, 0xD092 0x0
*** PhySdramSize got adjusted: 0x82CDC => 0x98878 ***
AdslCoreSharedMemInit: shareMemAvailable=423776
AdslCoreHwReset:  AdslOemDataAddr = 0xA3F77D28
MOTOPIA AFEID 0x000hex00
*** demodCapabilities=0x009044fa
*** subChannelInfop5 = 0x00d00000, adslDemodCap2Value = 0x00d00000
***DoDyingGaspCommand: Dying Gasp command received ***
***DoDyingGaspCommand: Value is 0 ***
bcmxtmrt: MAC address: 42 b7 f3 21 12 9f
[DoCreateDeviceReq.2576]: register_netdev
[DoCreateDeviceReq.2578]: register_netdev done
device ptm0.0 entered promiscuous mode
device ptm0 entered promiscuous mode
br2: port 1(ptm0.0) entering forwarding state
device eth0.16 entered promiscuous mode
device eth0 entered promiscuous mode
br1: port 1(eth0.16) entering forwarding state
device eth1.16 entered promiscuous mode
device eth1 entered promiscuous mode
br1: port 2(eth1.16) entering forwarding state
device eth2.16 entered promiscuous mode
device eth2 entered promiscuous mode
br1: port 3(eth2.16) entering forwarding state
device eth3.16 entered promiscuous mode
device eth3 entered promiscuous mode
br1: port 4(eth3.16) entering forwarding state
device wl0 entered promiscuous mode
device wl0.1 entered promiscuous mode
device wl0.2 entered promiscuous mode
device wl0.3 entered promiscuous mode
Initialized fcache state
Broadcom Packet Flow Cache  Char Driver v2.2 Sep 24 2010 19:06:36 Registered<242>
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Broadcom Packet Flow Cache learning via BLOG enabled.
Constructed Broadcom Packet Flow Cache v2.2 Sep 24 2010 19:06:36
endpt 0 deviceId 0 indexCount 0 
 deviceChannelMap[0].txTimeslot = 0 
endpt 1 deviceId 0 indexCount 0 
 deviceChannelMap[1].txTimeslot = 2 
BOS: Enter bosInit 
Enter bosAppInit 
Exit bosAppInit 
BOS: Exit bosInit 
endpoint_open COMPLETED
Enter bosStartApp

AppResetRootTask() - Is it morning already? Spawning app task...

AppResetDetectionEnable() - Enabled reset detection.
Exit bosStartApp
	   ***** bhiPrepareChannelTimeslotMap 1025 chanTsMap[0].chan = 0 
	   ***** bhiPrepareChannelTimeslotMap 1026 chanTsMap[0].txTimeslot = 0 
	   ***** bhiPrepareChannelTimeslotMap 1027 chanTsMap[0].rxTimeslot = 0 
	   ***** bhiPrepareChannelTimeslotMap 1025 chanTsMap[1].chan = 1 
	   ***** bhiPrepareChannelTimeslotMap 1026 chanTsMap[1].txTimeslot = 1 
	   ***** bhiPrepareChannelTimeslotMap 1027 chanTsMap[1].rxTimeslot = 1 
TaskCreate - spawn new task CMT_EXCEPTION_IST
Exit TaskCreate 
Enter TaskCreate HTSK
TaskCreate - spawn new task HTSK
Exit TaskCreate 
boardHalInit completed
Enter TaskCreate HRTBEAT
TaskCreate - spawn new task HRTBEAT
Exit TaskCreate 
Enter TaskCreate VRGEVPR
TaskCreate - spawn new task VRGEVPR
Exit TaskCreate 
Enter TaskCreate HCAS
TaskCreate - spawn new task HCAS
Exit TaskCreate 
******* DSP: Found BCM96362 *******
******* DSP: In PCM Mode *******
******* DSP: PCM running in 16 bit mode *******
gInterruptCounter     = 0x8114C4E4 
gInterruptErrors      = 0x8114C4E8 
gNextRxDesc           = 0x8114C4C4 
gNextTxDesc           = 0x8114C4C0 
gDectTestMode         = 0x8114c48c 
gDectBuffStart        = 0x8114c490 
32 ms ECAN tail-length
*** gStartRxDesc[0] = 0xA0C16000 
*** gBufferSizeBytes = 640 
*** gStartTxDesc[0] = 0xA0C33000 
halPcmInit 341 nextTxDesc = 0xA0C33000 
halPcmInit 341 nextTxDesc = 0xA0C33008 
halPcmInit 345 Ownership for TX desc not set. Use this buffer. 
DSP MAIN: Date=Jun 13 2011, Time=15:52:59
DSP: Interrupt Masks
IrqMask                   = 0x00003B03 
IrqMask1                  = 0x00000010 

DSP: Interrupt Status
IrqStatus                 = 0x00000000 
IrqStatus1                = 0x00000000 
EndpointInit completed

Other Resources[edit]

Broadcom BCM63xx on the OpenWRT wiki

Broadcom SOCs on the Linux-MIPS wiki

The BCM6362 may also used in the Linksys X3000, the Boblite (nay, BCM6361), and the SKY FAST2504n.

The French Neufbox_6 uses the very similar BCM6361.