====== Sagemcom F@st 5350 GV ====== {{description>Informações sobre o PowerBox GVT Sagemcom F@st 5350 GV. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.}} ===== Disclaimer ===== Modifique o dispositivo **somente** se for o proprietário. A maioria destes são fornecidos pelo seu ISP em regime de comodato como parte do serviço de internet. **Não** faça modificações caso o aparelho não seja seu. Todos os métodos de desbloqueio e material sobre modificações foram criados pelo O3 Labs e disponibilizados **GRATUITAMENTE** desde o dia de sua elaboração. Espalhem esta informação e ajudem a evitar que **PICARETAS** roubem e vendam estas informações por aí, seja no Mercado Livre ou por quaisquer outros meios. ===== Hardware ====== ^ SoC | BCM63168VFKEBG - Broadcom 400 MHz dual-core MIPS ADSL2+/VDSL2 IAD SoC ( BMIPS4350 V8.0 CPU ) | ^ RAM | H5TQ1G63EFR - SK hynix 1 Gbit (128 MB) DDR3 SDRAM | ^ Flash | H27U1G8F2CTR – Hynix 1 Gbit (128 MB) NAND | ^ Switch | BCM53124 – Broadcom 6-Port Integrated GbE | ^ USB | 2 x 2.0 | ^ Wireless | Broadcom BCM435F 2.4 GHz | ^ FXS | 2 ( SiLabs Si32260 Dual ProSLIC ) | ^ xDSL Line Driver | BCM6302 - Broadcom line driver | ^ xDSL PHY Ver | A2pv6F039d.d24k (xdslctl version 1.2) na versão SG790131200418 | ^ HPNA | 3.1 ( CopperGate CG3211QIR + CopperGate CG3213QIR ) | ^ Serial | Sim | ^ JTAG | ? | ===== Configurações ===== Antes de efetuar quaisquer modificações abaixo, execute estas linhas no console de seu navegador: var x = $.xmo; x.init(); x.login("internal", ""); Após a execução, continue com as alterações desejadas. === Listar todos os parâmetros disponíveis no XMO === x.getValuesTree("Device"); === RunLevel === x.setValuesTree(4, "Device/Managers/NetworkData/RunLevel"); Substitua o "4" pelo RunLevel desejado, podendo este ser 2 ou 4. Atenção! O modo 4 pode afetar os serviços de telefonia e TV. A TV pode ser ativada ligando o HPNA, veja [[f5350gv#Ativar HPNA]] (baseado em relatos de usuários). === Servidores DNS === x.setValuesTree("true", "Device/DNS/Relay/Forwardings/Forwarding[@uid='1']/Enable"); x.setValuesTree("8.8.8.8", "Device/DNS/Relay/Forwardings/Forwarding[@uid='1']/DNSServer"); x.setValuesTree("true", "Device/DNS/Relay/Forwardings/Forwarding[@uid='2']/Enable"); x.setValuesTree("8.8.4.4", "Device/DNS/Relay/Forwardings/Forwarding[@uid='2']/DNSServer"); x.setValuesTree("false", "Device/DNS/Relay/Forwardings/Forwarding[@uid='3']/Enable"); x.setValuesTree("false", "Device/DNS/Relay/Forwardings/Forwarding[@uid='4']/Enable"); Para retornar aos servidores fornecidos pelo DHCP do ISP: x.setValuesTree("false", "Device/DNS/Relay/Forwardings/Forwarding[@uid='1']/Enable"); x.setValuesTree("false", "Device/DNS/Relay/Forwardings/Forwarding[@uid='2']/Enable"); x.setValuesTree("true", "Device/DNS/Relay/Forwardings/Forwarding[@uid='3']/Enable"); x.setValuesTree("true", "Device/DNS/Relay/Forwardings/Forwarding[@uid='4']/Enable"); === Ativar HPNA === x.setValuesTree("true", "Device/HPNA/Enable"); === Desativar TR069 === x.setValuesTree("false", "Device/ManagementServer/EnableCWMP"); x.setValuesTree("http://", "Device/ManagementServer/URL"); === Alteração ATM VPI/VCI para ADSL === x.setValuesTree("0/35", "Device/ATM/Links/Link[Alias='ATM_DATA']/DestinationAddress"); === Ativação VoIP === Caso o telefone tenha parado de funcionar após alterações no modem (o perfil de voz/SIP ainda intacto), tente ativá-lo novamente: x.setValuesTree(2,"Device/Services/VoiceServices/VoiceService[1]/VoiceProfiles/VoiceProfile[1]/Lines/Line[1]/Enable"); x.setValuesTree(2,"Device/Services/VoiceServices/VoiceService[1]/VoiceProfiles/VoiceProfile[1]/Enable"); x.setValuesTree("true","Device/Services/VoiceServices/VoiceService[1]/X_SAGEMCOM_VoiceManagement/VoiceServiceEnable"); ===== Bootlog ===== HELO CPUI L1CI HELO CPUI L1CI DRAM ---- PHYS STRF 400H PHYE DDR3 SIZ4 SIZ3 SIZ2 DINT USYN LSYN MFAS LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN FPS0 SVOL NGEO FVLY FVLY RVOL J2EP SeKO CFE version 1.0.38-112.118 for BCM963268 (32bit,SP,BE) Build Date: Fri Jul 12 13:19:06 CEST 2013 (g178451@rmm-p1188627fl) Copyright (C) 2000-2011 Broadcom Corporation. CFE (soft operational) NAND flash device: name Hynix H27U1G8F2B, id 0xadf1 block 128KB size 131072KB Access type is MDIO_BUS External switch id = 53125 Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz Main Thread: TP0 Memory Test Passed Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 NextLevelBoot U-boot @ 0x87f00000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Launch linux/uboot (l/u) : l Board Id (0-7) : F@ST5350GV Number of MAC Addresses (1-32) : 10 Base MAC Address : 00:10:18:00:00:00 PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 110 Initializing UBI to launch u-boot! UBI volume uboot has id 1 read 834456 bytes from UBI volume 1 SHATEST=2. Ubi U-Boot Entry at 0x87f00000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 0 buffers found. Closing DMA Channels. Starting program at 0x87f00000 U-Boot 2011.12 Version: 4.10.0-full (Jul 12 2013 - 13:19:02) Copyright (C) 2011 - 2013 Sagemcom All rights reserved gpio in: 0x40cfdf1f board type: 00020010 board memsize : 0x08000000 CPU: Broadcom BCM63168D0 DRAM: 128 MiB NAND: bcm63xxx nand initialization handle_acc_control: default CORR ERR threshold 1 bits ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16 reqEccLevel=0, eccLevel=4 128 MiB Creating 1 MTD partitions on "nand0": 0x0000000c0000-0x000007b00000 : "mtd=1" UBI: attaching mtd1 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 126976 bytes UBI: smallest flash I/O unit: 2048 UBI: VID header offset: 2048 (aligned 2048) UBI: data offset: 4096 UBI: attached mtd1 to ubi0 UBI: MTD device name: "mtd=1" UBI: MTD device size: 122 MiB UBI: number of good PEBs: 978 UBI: number of bad PEBs: 0 UBI: max. allowed volumes: 128 UBI: wear-leveling threshold: 256 UBI: number of internal volumes: 1 UBI: number of user volumes: 7 UBI: available PEBs: 299 UBI: total number of reserved PEBs: 679 UBI: number of PEBs reserved for bad PEB handling: 9 UBI: max/mean erase counter: 6/1 Volume bootenv not found! *** Warning - bad CRC, using default environment Net: BCM63xxx Hit any key to stop autoboot: 3  2  1  0 sb3: sb3_sagem_init() sb3: action: 1007 sb3: sb3_wait_for_magic() sb3: action: 1002 sb3: sb3_boot( operational ) sb3: top available addr 0x878b0000, ram available = 0x74b0000 sb3_load_ubivol: max_load_size=122355712 Read 20192532 bytes from volume operational to 80400000 sb3: image operational moved to 86570000-878b1d14 gsdf ident string OK gsdf size OK gsdf auth_hash OK sb3: image operational has gsdf format gsdf ident string OK gsdf size OK gsdf auth_hash OK found a root CA certificate in section 0 found a secondary certificate in section 1 certificate chain OK root certificate OK (sagemcom caCert) not a livebox. no subject name verification signature OK section list OK gsdf head_hash OK gsdf data_hash OK sb3: image operational signature OK BCM63xx : unregistering Ethernet driver Disabling Switch ports. Flushing Receive Buffers... 0 buffers found. Closing DMA Channels. sb3: No pre-boot commands sb3: setting kernel args bootm 86570C98 ## Booting kernel from Legacy Image at 86570c98 ... Image Name: scOS SG790131200068 (3.12.35) Created: 2013-07-19 15:34:34 UTC Image Type: MIPS Linux Kernel Image (gzip compressed) Data Size: 2031616 Bytes = 1.9 MiB Load Address: 80010000 Entry Point: 80337e30 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... Linux version 2.6.30 (orange1@rmm08070) (gcc version 4.4.2 (GCC) ) #4 SMP PREEMPT Fri Jul 19 17:34:23 CEST 2013 argc 14 arg a79c032c env a79c0840 memsize board_memsize = 128 env memsize=128 env initrd_start=0xA0000000 env initrd_size=0x0 flash_start 0 env flash_start=0x00000000 board_flash_size ffffffff env flash_size=0xFFFFFFFF env ethaddr=00:01:02:03:04:05 arg[1] root=mtd:rootfs arg[2] init=/etc/preinit arg[3] ro arg[4] rootfstype=squashfs arg[5] console=ttyS0,115200 arg[6] rootfs_offset=0x001f0d14 arg[7] rootfs_size=0x01151000 arg[8] mtdparts=nand:768k(bcm),125184k(partAll),5120k(data) arg[9] ubi.mtd=ubi arg[10] part_main=partAll arg[11] part_boot=partAll arg[12] image_ubivol=operational arg[13] board_type=00020030 BCM Flash API. Flash device is not found. F@ST5350GV prom init CPU revision is: 0002a080 (Broadcom4350) DSL SDRAM reserved: 0x132000 Determined physical RAM map: memory: 07ece000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00007ece Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00007ece On node 0 totalpages: 32462 free_area_init_node: node 0, pgdat 803fc070, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 222 pages used for memmap Normal zone: 28144 pages, LIFO batch:7 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32208 Kernel command line: root=mtd:rootfs init=/etc/preinit ro rootfstype=squashfs console=ttyS0,115200 rootfs_offset=0x001f0d14 rootfs_size=0x01151000 mtdparts=nand:768k(bcm),125184k(partAll),5120k(data) ubi.mtd=ubi part_main=partAll part_boot=partAll image_ubivol=operational board_type=00020030 UBI image volume: "operational" wait instruction: enabled Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes NR_IRQS:128 PID hash table entries: 512 (order: 9, 2048 bytes) console [ttyS0] enabled Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 124024k/129848k available (3263k kernel code, 5652k reserved, 769k data, 160k init, 0k highmem) Calibrating delay loop... 398.33 BogoMIPS (lpj=199168) Mount-cache hash table entries: 512 --Kernel Config-- SMP=1 PREEMPT=1 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 Broadcom Logger v0.1 Jul 19 2013 07:42:11 CPU revision is: 0002a080 (Broadcom4350) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Calibrating delay loop... 402.43 BogoMIPS (lpj=201216) Brought up 2 CPUs net_namespace: 1140 bytes NET: Registered protocol family 16 Total Flash size: 0K with -1 sectors Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (000087b8-000087b4=4<300) registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab at 0 SCSI subsystem initialized pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10013fff] pci 0000:00:00.0: reg 30 32bit mmio: [0x000000-0x0007ff] pci 0000:00:00.0: supports D1 D2 pci 0000:00:00.0: PME# supported from D0 D3hot D3cold pci 0000:00:00.0: PME# disabled pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff] pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff] pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:01:00.0: PME# disabled pci 0000:01:00.0: PCI bridge, secondary bus 0000:02 pci 0000:01:00.0: IO window: disabled pci 0000:01:00.0: MEM window: disabled pci 0000:01:00.0: PREFETCH window: disabled PCI: Setting latency timer of device 0000:01:00.0 to 64 BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 Jul 19 2013 07:45:12 initialized Broadcom GBPM v0.1 Jul 19 2013 07:45:13 initialized NET: Registered protocol family 8 NET: Registered protocol family 20 NET: Registered protocol family 2 Switched to high resolution mode on CPU 1 Switched to high resolution mode on CPU 0 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 3, 32768 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher Registering unionfs 2.5.10 (for 2.6.30.10) JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc. fuse init (API version 7.11) msgmni has been set to 242 io scheduler noop registered io scheduler deadline registered (default) PCI: Setting latency timer of device 0000:01:00.0 to 64 Driver 'sd' needs updating - please use bus_type methods PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered NET: Registered protocol family 24 bcm963xx_mtd driver v1.0 Failed to read image tag from flash Broadcom DSL NAND controller (BrcmNand Controller) -->brcmnand_scan: CS=0, numchips=1, csi=0 mtd->oobsize=0, mtd->eccOobSize=0 NAND_CS_NAND_XOR=00000000 Disabling XOR on CS#0 brcmnand_scan: Calling brcmnand_probe for CS=0 B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0 brcmnand_read_id: CS0: dev_id=adf1801d After: NandSelect=40000001, nandConfig=15142200 Block size=00020000, erase shift=17 NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11 busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff timing1 not adjusted: 6574845b timing2 not adjusted: 00001e96 brcmnand_adjust_acccontrol: gAccControl[CS=0]=00000000, ACC=f7441010 BrcmNAND mfg ad f1 Hynix HY27UF081G2A 128MB on CS0 Found NAND on CS0: ACC=f7441010, cfg=15142200, flashId=adf1801d, tim1=6574845b, tim2=00001e96 BrcmNAND version = 0x0400 128MB @00000000 brcmnand_scan: Done brcmnand_probe brcmnand_scan: B4 nand_select = 40000001 brcmnand_scan: After nand_select = 40000001 100 CS=0, chip->ctrl->CS[0]=0 handle_acc_control: default CORR ERR threshold 1 bits ECC level threshold set to 1 bits ECC level 4, threshold at 1 bits ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16 reqEccLevel=0, eccLevel=4 190 eccLevel=4, chip->ecclevel=4, acc=f7441010 brcmnand_scan 10 200 CS=0, chip->ctrl->CS[0]=0 200 chip->ecclevel=4, acc=f7441010 page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17 brcmnand_scan 220 Brcm NAND controller version = 4.0 NAND flash size 128MB @18000000 brcmnand_scan 230 brcmnand_scan 40, mtd->oobsize=64, chip->ecclayout=00000000 brcmnand_scan 42, mtd->oobsize=64, chip->ecclevel=4, isMLC=0, chip->cellinfo=0 ECC layout=brcmnand_oob_bch4_2k brcmnand_scan: mtd->oobsize=64 brcmnand_scan: oobavail=35, eccsize=512, writesize=2048 brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=4, eccbytes=7 300 CS=0, chip->ctrl->CS[0]=0 500 chip=87a50990, CS=0, chip->ctrl->CS[0]=0 -->brcmnand_default_bbt brcmnand_default_bbt: bbt_td = bbt_slc_bch4_main_descr Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0 Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0 brcmnand_reset_corr_threshold: default CORR ERR threshold 1 bits for CS0 ECC level threshold default value is 1 bits for CS0 brcmnand_reset_corr_threshold: CORR ERR threshold changed to 3 bits for CS0 brcmnandCET: Status -> Deferred brcmnand_scan 99 Creating 5 MTD partitions on "brcmnand.0": 0x000000000000-0x000000020000 : "bcmfs" 0x000000020000-0x0000000c0000 : "bcmfs_update" 0x0000000c0000-0x000007b00000 : "ubi" 0x000007b00000-0x000007f00000 : "data" 0x000000000000-0x000000020000 : "nvram" UBI: attaching mtd2 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 126976 bytes UBI: smallest flash I/O unit: 2048 UBI: VID header offset: 2048 (aligned 2048) UBI: data offset: 4096 Add UBI volume partitions: name=secondaryboot Add UBI volume partitions: name=uboot Add UBI volume partitions: name=permanent_param Add UBI volume partitions: name=operational Creating 3 MTD partitions on "operational": 0x000000000000-0x00000001f000 : "firm_header" 0x00000001f000-0x00000020fd14 : "kernel" mtd: partition "kernel" doesn't end on an erase block -- force read-only 0x0000001f0d14-0x000001341d14 : "rootfs" mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only Add UBI volume partitions: name=rescue Add UBI volume partitions: name=filesystem1 Add UBI volume partitions: name=gui Creating 2 MTD partitions on "gui": 0x000000000000-0x00000001f000 : "gui_header" mtd: partition "gui_header" is out of reach -- disabled 0x000000000000-0x000000000000 : "guifs" mtd: partition "guifs" is out of reach -- disabled UBI: attached mtd2 to ubi0 UBI: MTD device name: "ubi" UBI: MTD device size: 122 MiB UBI: number of good PEBs: 978 UBI: number of bad PEBs: 0 UBI: max. allowed volumes: 128 UBI: wear-leveling threshold: 256 UBI: number of internal volumes: 1 UBI: number of user volumes: 7 UBI: available PEBs: 299 UBI: total number of reserved PEBs: 679 UBI: number of PEBs reserved for bad PEB handling: 9 UBI: max/mean erase counter: 6/1 brcmboard: brcm_board_init entry PCIe: No device found - Powering down Serial: BCM63XX driver $Revision: 6 $ Magic SysRq enabled (type ^ h for list of supported commands) ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX bcmPktDma_init: Broadcom Packet DMA Library initialized Total # RxBds=1448 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized bcmxtmrt: Broadcom BCM3168D0 ATM/PTM Network Device v0.4 Jul 19 2013 07:44:26 p8021ag: p8021ag_init entry IPSEC SPU: SUCCEEDED UBI: background thread "ubi_bgt0d" started, PID 50 GACT probability NOT on Mirror/redirect action on u32 classifier input device check on Actions configured GRE over IPv4 tunneling driver TCP cubic registered Initializing XFRM netlink socket NET: Registered protocol family 10 IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 NET: Registered protocol family 15 Bridge firewalling registered Initializing MCPD Module Ebtables v2.0 registered ebt_time registered ebt_ftos registered ebt_wmm_mark registered 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly on device 31:11. Freeing unused kernel memory: 160k freed Warning: unable to open an initial console. - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - - init - UBIFS: recovery needed UBIFS: recovery completed UBIFS: mounted UBI device 0, volume 5, name "filesystem1" UBIFS: file system size: 11046912 bytes (10788 KiB, 10 MiB, 87 LEBs) UBIFS: journal size: 1015809 bytes (992 KiB, 0 MiB, 6 LEBs) UBIFS: media format: w4/r0 (latest is w4/r0) UBIFS: default compressor: lzo UBIFS: reserved for root: 521772 bytes (509 KiB) _ _ _____ _ _ ___ | | | | __ \ | | |/ __) | |_| | | \/ | | / /__ | _ | | __| |/\| | _ \ | | | | |_\ \ /\ / (_) ) \_| |_/\____/\/ \/ \___/ Embedded Sagemcom Linux Distribution --------------------------------------------------- unionfs: new lower inode mtime (bindex=1, name=dev) Version: SG790131200068 (3.12.35) Built: by orange1@rmm08070 on Fri Jul 19 17:14:38 CEST 2013 (none) login: usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NTFS driver 2.1.29 [Flags: R/W MODULE]. tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky [HAL-BSP]: Load ... [HAL-BSP]: Manufacturer(Sagemcom) Serial Number(xxxxxxxxxxxxxxx) [HAL-BSP]: Sagem Hardware ProductId(SagemcomFast5350_GVT) Version(S.2.0) Revision(1.0) [HAL-BSP]: Customer Hardware ProductId(GVT) Version(Fast5350GV) Revision(1.1) [HAL-BSP]: Firmware Version() Type(Unknown Firmware Type) [HAL-BSP]: Size {Ram -> [Pp(131072) Linux(124356)] Flash ->[Pp(131072)]} [HAL-BSP]: Ok ... Driver LED and BUTTON init ..... Driver LED and BUTTON ok ..... ip_tables: (C) 2000-2006 Netfilter Core Team nf_conntrack version 0.5.0 (2028 buckets, 8112 max) nf_ct_rtsp: Successfully created nf_conntrack_rtsp task Netfilter messages via NETLINK v0.30. ip6_tables: (C) 2000-2006 Netfilter Core Team ctnetlink v0.93: registering with nfnetlink. bcm_ingqos: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint Broadcom Ingress QoS Module Char Driver v0.1 Jul 19 2013 05:39:20 Registered<243> Broadcom Ingress QoS ver 0.1 initialized BPM: tot_mem_size=134217728B (128MB), buf_mem_size=20132655B (19MB), num of buffers=9532, buf size=2112 Broadcom BPM Module Char Driver v0.1 Jul 19 2013 05:39:10 Registered<244> [NTC bpm] bpm_set_status: BPM status : enabled NBUFF v1.0 Initialized Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 Jul 19 2013 05:39:21 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. Constructed Broadcom Packet Flow Cache v2.2 Jul 19 2013 05:39:21 chipId 0x631680D0 Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jul 19 2013 05:39:11 Registered <241> FAP Debug values at 0x00000010 0x00000010 Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done FAP Debug values at 0xa549b720 0xa54db720 Allocated FAP0 GSO Buffers (0xA54A17D0) : 1048576 bytes @ 0xA5500000 Allocated FAP1 GSO Buffers (0xA54E17D0) : 1048576 bytes @ 0xA5600000 Allocated FAP0 TM SDRAM Queue Storage (a54a17d4) : 341376 bytes @ a5700000 Allocated FAP1 TM SDRAM Queue Storage (a54e17d4) : 341376 bytes @ a5780000 [NTC fapProto] fapReset : Reset FAP Protocol layer [FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><6600>, free <56>, total<8192> [FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><6600>, free <56>, total<8192> [FAP0] PSM : addr<0x80002000>, used <24484>, free <92>, total <24576> [FAP1] PSM : addr<0x80002000>, used <24484>, free <92>, total <24576> [FAP0] Flows supported: 217 (dsp 56, psm 21, qsm 140) [FAP1] Flows supported: 217 (dsp 56, psm 21, qsm 140) [FAP0] DQM : availableMemory 15064 bytes, nextByteAddress 0xE0010528 [FAP1] DQM : availableMemory 15064 bytes, nextByteAddress 0xE0010528 [FAP0] GSO Buffer set to 0xA5500000 [FAP1] GSO Buffer set to 0xA5600000 [FAP0] FAP BPM Initialized. [FAP1] FAP BPM Initialized. fapDrv_construct: FAP0: pManagedMemory=b0820710. wastage 8 bytes fapDrv_construct: FAP1: pManagedMemory=b0a20710. wastage 8 bytes bcmPktDma_bind: FAP Driver binding successfull [FAP0] FAP TM: ON [FAP1] FAP TM: ON bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCM63168D0 Ethernet Network Device v0.1 Jul 19 2013 05:41:52 fapDrv_psmAlloc: fapIdx=0, size: 4000, offset=b0820710 bytes remaining 7000 ETH Init: Ch:0 - 200 tx BDs at 0xb0820710 fapDrv_psmAlloc: fapIdx=1, size: 4000, offset=b0a20710 bytes remaining 7000 ETH Init: Ch:1 - 200 tx BDs at 0xb0a20710 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b08216b0 bytes remaining 2184 ETH Init: Ch:0 - 600 rx BDs at 0xb08216b0 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a216b0 bytes remaining 2184 ETH Init: Ch:1 - 600 rx BDs at 0xb0a216b0 ethsw.c : Ext switch TMII Port 5 dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered eth0: MAC Address: 00:00:00:00:00:01 eth1: MAC Address: 00:00:00:00:00:01 eth2: MAC Address: 00:00:00:00:00:01 eth3: MAC Address: 00:00:00:00:00:01 eth4: MAC Address: 00:00:00:00:00:01 eth5: MAC Address: 00:00:00:00:00:01 [NTC arl] arlEnable : Enabled ARL binding to FAP Broadcom Adress Resolution Logic Processor (ARL) Char Driver v0.1 Jul 19 2013 05:39:09 Registered <245> Broadcom 802.1Q VLAN Interface, v0.1 --SMP support wl: dsl_tx_pkt_flush_len=338 wl: high_wmark_tot=6195 PCI: Setting latency timer of device 0000:00:00.0 to 64 wl: passivemode=1 wl: napimode=0 wl0: allocskbmode=1 currallocskbsz=512 otp_read_pci: bad crc Neither SPROM nor OTP has valid image wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl:loading /etc/wlan/bcm6362_vars.bin Failed to open srom image from '/etc/wlan/bcm6362_vars.bin'. wl:loading /etc/wlan/bcm6362_map.bin wl0: Broadcom BCM435f 802.11 Wireless Controller 5.100.138.2008.cpe4.12L06A.4-kdb dgasp: kerSysRegisterDyingGaspHandler: wl0 registered usbcore: registered new interface driver usblp usbcore: registered new interface driver usbserial usbserial: USB Serial Driver core Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. USB Serial support registered for GSM modem (1-port) usbcore: registered new interface driver option option: v0.7.2:USB Driver for GSM modems Endpoint: endpoint_init entry in BpGetVoiceBoardIdin BpGetVoiceParmspszBoardId=SI32260 pszBaseBoardId=F@ST5350GV myBaseBoardId=F@ST5350Endpoint: endpoint_init COMPLETED eth4 (switch port: 5) Link UP 200 mbps full duplex message received before monitor task is initialized kerSysSendtoMonitorTask eth0 (switch port: 1) Link UP 100 mbps full duplex message received before monitor task is initialized kerSysSendtoMonitorTask fapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22980 bytes remaining 584 XTM Init: Ch:0 - 200 rx BDs at 0xb0a22980 fapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a22fc0 bytes remaining 456 XTM Init: Ch:1 - 16 rx BDs at 0xb0a22fc0 bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system bcmxtmcfg: gulBondDslMonitorValid = 1 BcmAdsl_Initialize=0xC0BB9C20, g_pFnNotifyCallback=0xC0BF8014 lmemhdr[2]=0x100CE000, pAdslLMem[2]=0x100CE000 pSdramPHY=0xA7FFFFF8, 0xFFFFFFFF 0xFFFFFFFF *** XfaceOffset: 0x5FF90 => 0x5FF90 *** *** PhySdramSize got adjusted: 0xE3FB4 => 0x11A6E0 *** AdslCoreSharedMemInit: shareMemSize=96509(96512) AdslCoreHwReset: pLocSbSta=84048000 bkupThreshold=3072 AdslCoreHwReset: AdslOemDataAddr = 0xA7FA34F4 ***BcmDiagsMgrRegisterClient: 0 *** dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered ADDRCONF(NETDEV_UP): eth1: link is not ready ADDRCONF(NETDEV_UP): eth2: link is not ready ADDRCONF(NETDEV_UP): eth3: link is not ready eth0 (switch port: 1) Link DOWN. message received before monitor task is initialized kerSysSendtoMonitorTask eth0 (switch port: 1) Link UP 100 mbps full duplex message received before monitor task is initialized kerSysSendtoMonitorTask device eth0 entered promiscuous mode BR_LAN: port 1(eth0) entering learning state BR_LAN: port 1(eth0) entering forwarding state device eth4 entered promiscuous mode BR_LAN: port 2(eth4) entering learning state BR_LAN: port 2(eth4) entering forwarding state device wl0 entered promiscuous mode BR_LAN: port 3(wl0) entering learning state BR_LAN: port 3(wl0) entering forwarding state device wl0.1 entered promiscuous mode BR_HOTSPOT: port 1(wl0.1) entering learning state BR_HOTSPOT: port 1(wl0.1) entering forwarding state device wl0.1 left promiscuous mode BR_HOTSPOT: port 1(wl0.1) entering disabled state BOS: Enter bosInit BOS: Exit bosInit endpoint_open COMPLETED ******* DSP: Found BCM963268 ******* ******* DSP: In PCM Mode ******* ******* DSP: PCM running in 16 bit mode ******* gInterruptCounter = 0xC1A98F40 gInterruptErrors = 0xC1A98F44 gNextRxDesc = 0xC1A99064 gNextTxDesc = 0xC1A99060 gDectTestMode = 0xc18bfe2c dectBuffStart = 0xc18bfe38 gDectRxOutOfSyncCounter = 0xc18bfe3c gDectTxOutOfSyncCounter = 0xc18bfe40 32 ms ECAN tail-length *** gStartRxDesc[0] = 0xA0C00000 *** gBufferSizeBytes = 640 *** gStartTxDesc[0] = 0xA0C01000 halPcmInit 370 nextTxDesc = 0xA0C01000 halPcmInit 370 nextTxDesc = 0xA0C01008 halPcmInit 374 Ownership for TX desc not set. Use this buffer. [DBG xdrv_slic] slicSi32261Init: (ts: 39s 722ms):SLIC: Starting 32261 device and line initializion... [DBG xdrv_slic] deviceSiLabsReset: (ts: 40s 237ms):SLIC: Reset applied on GPIO pin 14 [DBG xdrv_slic] initSiLabsDevice: (ts: 40s 251ms):SLIC: Initializing SiLabs device 0 si3226x : Channel 0 : Type = PROSLIC si3226x : Channel 1 : Type = PROSLIC si3226x : Channel 0 : Chip Type 28 si3226x : Channel 0 : Chip Rev 3 si3226x : Channel 1 : Chip Type 28 si3226x : Channel 1 : Chip Rev 3 VBAT @ 50ms = 58.692 v VBAT Up = 58.692 v VBAT @ 50ms = 58.692 v VBAT Up = 58.901 v ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0: EHCI Host Controller ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1 ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM [DBG xdrv_slic] initSiLabsDevice: (ts: 41s 441ms):SLIC: SiLabs device BOM Type: 0 [DBG xdrv_slic] initSiLabsDevice: (ts: 41s 449ms):SLIC: SiLabs device 0 initialized OK ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500 ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00 [DBG xdrv_slic] initSiLabsLines: (ts: 41s 467ms):SLIC: SiLabs Locale set to 3 [DBG xdrv_slic] initSiLabsLines: (ts: 41s 475ms):SLIC: Initializing SiLabs FXS line 0 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found [DBG xdrv_slic] initSiLabsLines: (ts: 41s 509ms):FXS channel 0 Rx Gain: -11 [DBG xdrv_slic] initSiLabsLines: (ts: 41s 509ms):FXS channel 0 Tx Gain: -4 Si3226x PCMStart [DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: FXS line 0 RX timeslot = 0 [DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: FXS line 0 TX timeslot = 0 [DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: SiLabs FXS line 0 initialized OK [DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: Initializing SiLabs FXS line 1 [DBG xdrv_slic] initSiLabsLines: (ts: 41s 565ms):FXS channel 1 Rx Gain: -11 [DBG xdrv_slic] initSiLabsLines: (ts: 41s 573ms):FXS channel 1 Tx Gain: -4 Si3226x PCMStart [DBG xdrv_slic] initSiLabsLines: (ts: 41s 598ms):SLIC: FXS line 1 RX timeslot = 1 [DBG xdrv_slic] initSiLabsLines: (ts: 41s 606ms):SLIC: FXS line 1 TX timeslot = 1 [DBG xdrv_slic] initSiLabsLines: (ts: 41s 615ms):SLIC: SiLabs FXS line 1 initialized OK [DBG xdrv_slic] slicSi32261Init: (ts: 41s 624ms):SLIC: 32261 device 0 and FXS initializion COMPLETED OK ! boardHalInit completed hub 1-0:1.0: 2 ports detected DSP: Interrupt Masks --------------- IrqMask = 0x00003000 IrqMask1 = 0x00000400 DSP: Interrupt Status ----------------- IrqStatus = 0x00100000 IrqStatus1 = 0x00100000 ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver PCI: Enabling device 0000:00:09.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: OHCI Host Controller ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2 ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600 EndpointInit completed dgasp: kerSysRegisterDyingGaspHandler: endpoint registered 00:01:38 Endpoint Event task started with pid 1245... 00:01:38 Endpoint Packet task started with pid 1246 ... 00:01:38 RTP read thread started with pid 1247 00:01:38 RTP read thread started with pid 1248 00:01:38 RTP read thread started with pid 1249 00:01:38 RTP read thread started with pid 1250 00:01:38 RTP read thread started with pid 1251 00:01:38 RTP read thread started with pid 1252 usb usb2: configuration #1 chosen from 1 choice 00:01:38 RTCP thread started with pid 1253 00:01:38 rtpInit: RTCP task created, taskId = 9226 hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected device wl0 left promiscuous mode BR_LAN: port 3(wl0) entering disabled state device wl0 entered promiscuous mode BR_LAN: port 3(wl0) entering learning state BR_LAN: port 3(wl0) entering forwarding state device wl0 left promiscuous mode BR_LAN: port 3(wl0) entering disabled state device wl0 entered promiscuous mode BR_LAN: port 3(wl0) entering learning state BR_LAN: port 3(wl0) entering forwarding state ===== Firmware ===== ==== Stock Firmware ==== [[http://www.tripleoxygen.net/files/devices/sagemcom/f5350gv/firmware/stock/|Firmwares]] === Instalação === var req = $.xmo.client.newRequest(); req.remoteCall("Device", "download", {id: "0", fileType: "1 Firmware Upgrade Image", url: "http://www.tripleoxygen.net/files/devices/sagemcom/f5350gv/firmware/stock/SG790131200412-sagemcom-5350-gvt-3.12.5901-combined-squashfs.img.gsdf" }, 0, 0, 0, 0); req.send(); ===== Agradecimentos ====== Pessoas envolvidas em discussões, dicas, testes ou bate papo em geral. Lista em ordem alfabética. Italo, Leandro Cell