====== Pace V5471 ======
{{description>Informações sobre o PowerBox GVT Pace V5471. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.}}
===== Disclaimer =====
Modifique o dispositivo **somente** se for o proprietário. A maioria destes são fornecidos pelo seu ISP em regime de comodato como parte do serviço de internet. **Não** faça modificações caso o aparelho não seja seu.
Todos os métodos de desbloqueio e material sobre modificações foram criados pelo O3 Labs e disponibilizados **GRATUITAMENTE** desde o dia de sua elaboração. Espalhem esta informação e ajudem a evitar que **PICARETAS** roubem e vendam estas informações por aí, seja no Mercado Livre ou por quaisquer outros meios.
===== Hardware =====
^ SoC | BCM63168VFKEBG - Broadcom 400 MHz dual-core MIPS ADSL2+/VDSL2 IAD SoC ( BMIPS4350 V8.0 CPU ) |
^ RAM | NT5CB64M16DP-CF - Nanya 1 Gbit (128 MB) DDR3 SDRAM |
^ Flash | TC58NVG0S3ETA10 – Toshiba ou S34ML01G1 - Spansion 1 Gbit (128 MB) NAND |
^ Switch | BCM53124 – Broadcom 6-Port Integrated GbE |
^ USB | 2 x 2.0 |
^ Wireless | Broadcom BCM435F 2.4 GHz |
^ FXS | 2 x ( Le89116 (SLAC) + Le89810 (SLIC) ) |
^ xDSL Line Driver | BCM6302 - Broadcom line driver |
^ xDSL PHY Ver | A2pv6F038f.d24f (xdslctl version 1.0) na versão 98509 |
^ HPNA | 3.1 ( CopperGate CG3211QIR + CopperGate CG3213QIR ) |
^ Serial | Sim |
^ JTAG | ? |
===== Bootlog =====
HELO
CPUI
L1CI
HELO
CPUI
L1CI
DRAM
----
PHYS
STRF
400H
PHYE
DDR3
SIZ4
SIZ3
SIZ2
DINT
USYN
LSYN
MFAS
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
M
CPU speed = 400 MHz
Detected NAND Flash : Spansion S34ML01G1 , size=128MB, block=128KB, page=2048B, spare=64, bad block offsets = (0,1)
Found bad block table in Flash...
External switch id = 53125
_
| |__ _____ ____ _ _ __
| '_ \ / _ \ \ /\ / / _` | '_ \
| |_) | __/\ V V / (_| | | | |
|_.__/ \___| \_/\_/ \__,_|_| |_|
Portions Copyright (c) 2005-2009 bewan systems
www.bewan.com
Parameters:
Product : B14103
Product family : B14100
Flash size : 8000000
DRAM size : 8000000
LAN MAC address : 00:0c:c3:xx:xx:xx
WAN MAC address : 00:0c:c3:xx:xx:xx
Dual bank boot : yes
Reset : no
Pairing : no
Serial number : xxxxxxxxxxxxxxxx
Manufacturing ID: xxxxxxxxxxxxxxxx
Agile PCA :
WEP key : xxxxxxxxxxxxxxxx
WPA key : xxxxxxxxxxxxxxxx
Loader version : 82150
Capabilities : 80000000
Found valid bootable partition 0:
Copyright (c) 2006-2010 BeWAN Systems
V5471 iBoxNG GVT
B14103
2015-10-19-18:05:20
B14103-GVT-OXY-0.bin
Root FS in RAM
Found valid bootable partition 1:
Copyright (c) 2006-2010 BeWAN Systems
V5471 iBoxNG GVT
B14103
2013-11-18-09:30:01
B14103-GVT-RC2-92276.bin
Root FS in RAM
Booting from partition 0 in flash.
Saving linux command line before uncompression
Loading linux kernel image
Load address = 80010000
Uncompressing Linux.............................................
Flushing cache...
done, booting the kernel.
start addr = 80483fd0
Linux version 2.6.30 (devbuild@lxc-lxc_gvt_dsl_rc2) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #2 SMP PREEMPT Wed Mar 4 16:58:05 UTC 2015
BCM Flash API. Flash device is not found.
963168XHM prom init
CPU revision is: 0002a080 (Broadcom4350)
DSL SDRAM reserved: 0x132000
Determined physical RAM map:
memory: 07ece000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 07200000 @ 00000000 (usable)
Zone PFN ranges:
DMA 0x00000000 -> 0x00001000
Normal 0x00001000 -> 0x00007200
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00007200
On node 0 totalpages: 29184
free_area_init_node: node 0, pgdat 80685a40, node_mem_map 81000000
DMA zone: 32 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 4064 pages, LIFO batch:0
Normal zone: 196 pages used for memmap
Normal zone: 24892 pages, LIFO batch:7
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 28956
Kernel command line: console=ttyS0,115200n1 bewan_fs_in_ram bewan_fs_addr=0x872ed000 bewan_fs_size=0xb13000 root=/dev/mtdblock7 mtdparts=brcmnand.0:0x200000@0x0(Loader),0x200000@0x200000(Nvram),0x2000000@0x400000(Firmware),0x2000000@0x2400000(OldFirmware),0x800000@0x4400000(Nvlog),0x3380000@0x4c00000(Extra_5) mem=114M
wait instruction: enabled
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
NR_IRQS:128
PID hash table entries: 512 (order: 9, 2048 bytes)
console [ttyS0] enabled
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0
Memory: 108348k/116736k available (4592k kernel code, 8204k reserved, 2041k data, 176k init, 0k highmem)
Calibrating delay loop... 399.36 BogoMIPS (lpj=199680)
Mount-cache hash table entries: 512
--Kernel Config--
SMP=1
PREEMPT=1
DEBUG_SPINLOCK=0
DEBUG_MUTEXES=0
Broadcom Logger v0.1 Mar 4 2015 16:51:47
CPU revision is: 0002a080 (Broadcom4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Calibrating delay loop... 402.43 BogoMIPS (lpj=201216)
Brought up 2 CPUs
net_namespace: 1144 bytes
NET: Registered protocol family 16
Total Flash size: 0K with -1 sectors
Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (00008ace-00008ad3=-5<300)
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10005fff]
pci 0000:00:00.0: supports D1 D2
pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
pci 0000:00:00.0: PME# disabled
pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff]
pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff]
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:01:00.0: PME# disabled
pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
pci 0000:01:00.0: IO window: disabled
pci 0000:01:00.0: MEM window: disabled
pci 0000:01:00.0: PREFETCH window: disabled
PCI: Setting latency timer of device 0000:01:00.0 to 64
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS v0.1 Mar 4 2015 16:57:13 initialized
Broadcom GBPM v0.1 Mar 4 2015 16:57:14 initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
squashfs: version 4.0 with LZMA457 ported by BRCM
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.11)
msgmni has been set to 211
io scheduler noop registered (default)
PCI: Setting latency timer of device 0000:01:00.0 to 64
brd: module loaded
Driver 'sd' needs updating - please use bus_type methods
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
Broadcom DSL NAND controller (BrcmNand Controller)
-->brcmnand_scan: CS=0, numchips=1, csi=0
mtd->oobsize=0, mtd->eccOobSize=0
NAND_CS_NAND_XOR=00000000
Disabling XOR on CS#0
brcmnand_scan: Calling brcmnand_probe for CS=0
B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0
brcmnand_read_id: CS0: dev_id=01f1001d
After: NandSelect=40000001, nandConfig=15142200
Block size=00020000, erase shift=17
NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11
busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
timing1 not adjusted: 6574845b
timing2 not adjusted: 00001e96
brcmnand_adjust_acccontrol: gAccControl[CS=0]=00000000, ACC=f7ff1010
BrcmNAND mfg 1 f1 SPANSION_S30ML01GP_08 128MB on CS0
Found NAND on CS0: ACC=f7ff1010, cfg=15142200, flashId=01f1001d, tim1=6574845b, tim2=00001e96
BrcmNAND version = 0x0400 128MB @00000000
brcmnand_scan: Done brcmnand_probe
brcmnand_scan: B4 nand_select = 40000001
brcmnand_scan: After nand_select = 40000001
100 CS=0, chip->ctrl->CS[0]=0
ECC level 15, threshold at 1 bits
reqEccLevel=0, eccLevel=15
190 eccLevel=15, chip->ecclevel=15, acc=f7ff1010
brcmnand_scan 10
200 CS=0, chip->ctrl->CS[0]=0
200 chip->ecclevel=15, acc=f7ff1010
page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
brcmnand_scan 220
Brcm NAND controller version = 4.0 NAND flash size 128MB @18000000
brcmnand_scan 230
brcmnand_scan 40, mtd->oobsize=64, chip->ecclayout=00000000
brcmnand_scan 42, mtd->oobsize=64, chip->ecclevel=15, isMLC=0, chip->cellinfo=0
ECC layout=brcmnand_oob_bch4_4k
brcmnand_scan: mtd->oobsize=64
brcmnand_scan: oobavail=50, eccsize=512, writesize=2048
brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=15, eccbytes=3
300 CS=0, chip->ctrl->CS[0]=0
500 chip=86ea6990, CS=0, chip->ctrl->CS[0]=0
-->brcmnand_default_bbt
brcmnand_default_bbt: bbt_td = bbt_main_descr
Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0
Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0
brcmnandCET: Status -> Deferred
brcmnand_scan 99
6 cmdlinepart partitions found on MTD device brcmnand.0
Creating 6 MTD partitions on "brcmnand.0":
0x000000000000-0x000000200000 : "Loader"
0x000000200000-0x000000400000 : "Nvram"
0x000000400000-0x000002400000 : "Firmware"
0x000002400000-0x000004400000 : "OldFirmware"
0x000004400000-0x000004c00000 : "Nvlog"
0x000004c00000-0x000007f80000 : "Extra_5"
Creating 1 MTD partitions on "RAM":
0x000000000000-0x000000b13000 : "Root FS"
usbcore: registered new interface driver usblp
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
Bewan LedButton init
brcmboard: brcm_board_init entry
PCIe: No device found - Powering down
Serial: BCM63XX driver $Revision: 3.00 $
Magic SysRq enabled (type ^ h for list of supported commands)
ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX
ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX
Total # RxBds=1448
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized
bcmPktDma_init: Broadcom Packet DMA Library initialized
bcmxtmrt: Broadcom BCM3168D0 ATM/PTM Network Device v0.4 Mar 4 2015 16:56:53
DSP Driver: DSP init stub
p8021ag: p8021ag_init entry
IPSEC SPU: SUCCEEDED
GACT probability NOT on
Mirror/redirect action on
u32 classifier
input device check on
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1824 buckets, 7296 max)
GRE over IPv4 tunneling driver
nf_nat_pt: no ports specified
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
ip6tnl0: Disabled Privacy Extensions
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Initializing MCPD Module
Ebtables v2.0 registered
ebt_time registered
ebt_ftos registered
ebt_wmm_mark registered
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
VFS: Mounted root (squashfs filesystem) readonly on device 31:7.
Freeing unused kernel memory: 176k freed
Algorithmics/MIPS FPU Emulator v1.5
Loading drivers and kernel modules...
chipinfo: module license 'proprietary' taints kernel.
Disabling lock debugging due to kernel taint
brcmchipinfo: brcm_chipinfo_init entry
Broadcom Ingress QoS Module Char Driver v0.1 Mar 4 2015 16:54:13 Registered<243>
Broadcom Ingress QoS ver 0.1 initialized
BPM: tot_mem_size=134217728B (128MB), buf_mem_size=20132655B (19MB), num of buffers=9460, buf size=2128
Broadcom BPM Module Char Driver v0.1 Mar 4 2015 16:52:16 Registered<244>
[NTC bpm] bpm_set_status: BPM status : enabled
NBUFF v1.0 Initialized
Initialized fcache state
Broadcom Packet Flow Cache Char Driver v2.2 Mar 4 2015 16:54:14 Registered<242>
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Broadcom Packet Flow Cache learning via BLOG enabled.
Constructed Broadcom Packet Flow Cache v2.2 Mar 4 2015 16:54:14
chipId 0x631680D0
Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Mar 4 2015 16:54:04 Registered <241>
Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
FAP Debug values at 0xa519dfa0 0xa521dfa0
Allocated FAP0 GSO Buffers (0xA51AF028) : 1048576 bytes @ 0xA5300000
Allocated FAP1 GSO Buffers (0xA522F028) : 1048576 bytes @ 0xA4C00000
Allocated FAP0 TM SDRAM Queue Storage (a51af02c) : 341376 bytes @ a5280000
Allocated FAP1 TM SDRAM Queue Storage (a522f02c) : 341376 bytes @ a4d00000
[NTC fapProto] fapReset : Reset FAP Protocol layer
fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes
fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes
bcmPktDma_bind: FAP Driver binding successfull
[FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3976>, free <2680>, total<8192>
[FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3976>, free <2680>, total<8192>
[FAP0] PSM : addr<0x80002000>, used <23452>, free <1124>, total <24576>
[FAP1] PSM : addr<0x80002000>, used <23452>, free <1124>, total <24576>
[FAP0] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948
[FAP1] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948
[FAP0] GSO Buffer set to 0xA5300000
[FAP1] GSO Buffer set to 0xA4C00000
[FAP0] FAP BPM Initialized.
[FAP1] FAP BPM Initialized.
[FAP0] FAP TM: ON
[FAP1] FAP TM: ON
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
Broadcom BCM63168D0 Ethernet Network Device v0.1 Mar 4 2015 16:56:42
Broadcom GMAC Char Driver v0.1 Mar 4 2015 16:56:49 Registered<249>
Broadcom GMAC Driver v0.1 Mar 4 2015 16:56:49 Initialized
fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000
ETH Init: Ch:0 - 200 tx BDs at 0xb0a20650
fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000
ETH Init: Ch:1 - 200 tx BDs at 0xb0820650
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184
ETH Init: Ch:0 - 600 rx BDs at 0xb0821910
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184
ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910
dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered
eth0: MAC Address: 00:0C:C3:60:FF:FE
eth1: MAC Address: 00:0C:C3:60:FF:FE
eth2: MAC Address: 00:0C:C3:60:FF:FE
eth3: MAC Address: 00:0C:C3:60:FF:FE
eth4: MAC Address: 00:0C:C3:60:FF:FE
eth5: MAC Address: 00:0C:C3:60:FF:FE
[NTC arl] arlEnable : Enabled ARL binding to FAP
Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 Mar 4 2015 16:52:15 Registered <245>
--SMP support
wl: dsl_tx_pkt_flush_len=338
wl: high_wmark_tot=6149
PCI: Setting latency timer of device 0000:00:00.0 to 64
wl: passivemode=1
wl: napimode=0
wl0: allocskbmode=1 currallocskbsz=512
Neither SPROM nor OTP has valid image
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl:loading /etc/wlan/bcm6362_map.bin
srom rev:8
wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=16
wl0: Broadcom BCM435f 802.11 Wireless Controller 6.30.102.3.cpe4.12L07.0
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
Endpoint: endpoint_init entry
Endpoint: endpoint_init COMPLETED
Broadcom 802.1Q VLAN Interface, v0.1
_
| |__ _____ ____ _ _ __
| '_ \ / _ \ \ /\ / / _` | '_ \
| |_) | __/\ V V / (_| | | | |
|_.__/ \___| \_/\_/ \__,_|_| |_|
/etc/bewan/init.d/update-config
update-config done
Broadcom hardware timer margin = 20 secs.
Bewan Watchdog Timer: V2.0, timer margin: 100 sec.
SOFTDOG: setting margin to 180 seconds.
LED and Buttons driver: v2.0 (C) Copyright Bewan Systems
######### USBFS
/etc/bewan/init.d/syslog start
/etc/bewan/init.d/time start
/etc/bewan/init.d/rtsp_conntrack start
nf_conntrack_rtsp v0.6.30 loading
nf_conntrack_rtsp: registering port #0: 554
nf_nat_rtsp v0.6.30 loading
/etc/bewan/init.d/dsl start
BcmAdsl_Initialize=0xC026ADD8, g_pFnNotifyCallback=0xC02ABEE4
lmemhdr[2]=0x100CE000, pAdslLMem[2]=0x100CE000
pSdramPHY=0xA7FFFFF8, 0x33863246 0x128474C7
*** XfaceOffset: 0x5FF90 => 0x5FF90 ***
*** PhySdramSize got adjusted: 0xE3FB4 => 0x11A6E0 ***
AdslCoreSharedMemInit: shareMemSize=96509(96512)
**** SetupReferenceClockTo6306 ****
AdslCoreHwReset: pLocSbSta=83c00000 bkupThreshold=3072
AdslCoreHwReset: AdslOemDataAddr = 0xA7FA34F4
***BcmDiagsMgrRegisterClient: 0 ***dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
fapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22be0 bytes remaining 584
XTM Init: Ch:0 - 200 rx BDs at 0xb0a22be0
fapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a23220 bytes remaining 456
XTM Init: Ch:1 - 16 rx BDs at 0xb0a23220
bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system
bcmxtmcfg: gulBondDslMonitorValid = 1
/etc/bewan/init.d/ethernet start 1
/etc/bewan/init.d/interface start LANEthernetInterface 1
ADDRCONF(NETDEV_UP): eth0: link is not ready
/etc/bewan/init.d/ethernet start 2
/etc/bewan/init.d/interface start LANEthernetInterface 2
ADDRCONF(NETDEV_UP): eth1: link is not ready
/etc/bewan/init.d/ethernet start 3
/etc/bewan/init.d/interface start LANEthernetInterface 3
ADDRCONF(NETDEV_UP): eth2: link is not ready
/etc/bewan/init.d/ethernet start 4
/etc/bewan/init.d/interface start LANEthernetInterface 4
ADDRCONF(NETDEV_UP): eth3: link is not ready
/etc/bewan/init.d/ethernet start 5
/etc/bewan/init.d/interface start LANEthernetInterface 5
ADDRCONF(NETDEV_UP): eth5: link is not ready
/etc/bewan/init.d/ethernet nothing 6
This functionality is a work in progress, please don't use it
/etc/bewan/init.d/ethled nothing
/etc/bewan/init.d/switch_vlan_8021q nothing 1
/etc/bewan/init.d/switch_vlan_8021q nothing 2
/etc/bewan/init.d/switch_vlan_portbased nothing 1
/etc/bewan/init.d/switch_vlan_portbased nothing 2
/etc/bewan/init.d/lan start 1
/etc/bewan/init.d/lanif start 1
add eth0 to lan1 bridge
device eth0 entered promiscuous mode
add eth1 to lan1 bridge
device eth1 entered promiscuous mode
add eth2 to lan1 bridge
device eth2 entered promiscuous mode
add eth3 to lan1 bridge
device eth3 entered promiscuous mode
add eth5 to lan1 bridge
device eth5 entered promiscuous mode
ADDRCONF(NETDEV_UP): lan1: link is not ready
/etc/bewan/init.d/lanip start 1
/etc/bewan/scripts/ip-up-dhcp lan1 192.168.25.100/255.255.255.0
/etc/bewan/ip-up-lan.d/S01sroutes 1
/etc/bewan/ip-up-lan.d/S10nat 1
/etc/bewan/ip-up-lan.d/S19lanneighbor 1
/etc/bewan/init.d/lanneighbor restart lan1
/etc/bewan/ip-up-lan.d/S20lanarp 1
/etc/bewan/init.d/lanarp start 1
/etc/bewan/ip-up-lan.d/S50samba 1
/etc/bewan/ip-up-lan.d/S51ippos 1
/etc/bewan/ip-up-lan.d/S60-igmp 1
/etc/bewan/ip-up-lan.d/S60-miniupnpd 1
/etc/bewan/ip-up-lan.d/S60mdns 1
/etc/bewan/ip-up-lan.d/S60ntp 1
/etc/bewan/ip-up-lan.d/S62lynx 1
/etc/bewan/ip-up-lan.d/S70-voip 1
/etc/bewan/ip-up-lan.d/S90hosts 1
/etc/bewan/init.d/host restart
/etc/bewan/ip-up-lan.d/S90webauth 1
/etc/bewan/ip-up-lan.d/S91superdlna 1
/etc/bewan/init.d/landhcp start 1
/etc/bewan/init.d/dhcpclient nothing lan1
/etc/bewan/init.d/lanip6 nothing 1
/etc/bewan/init.d/lanacl start 1
/etc/bewan/init.d/wifiacl restart 1
/etc/bewan/init.d/passthrough nothing 1
/etc/bewan/init.d/lan start 2
/etc/bewan/init.d/lanif start 2
ADDRCONF(NETDEV_UP): lan2: link is not ready
/etc/bewan/init.d/lanip nothing 2
/etc/bewan/init.d/lanip6 nothing 2
/etc/bewan/init.d/lanacl start 2
/etc/bewan/init.d/wifiacl stop 2
/etc/bewan/init.d/passthrough start 2
/etc/bewan/init.d/wan start 5
/etc/bewan/init.d/wannet start 5 ipv4
/etc/bewan/init.d/wanvpn start 1
/etc/bewan/init.d/wan nothing 5
/etc/bewan/init.d/wanbr nothing 5
ethmux: Unknown symbol platform_unregister_ethermux_dev
ethmux: Unknown symbol platform_register_ethermux_dev
Ethernet Multiplexer Support v2.0 Christophe Piel (c) 2010 BeWAN systems
/etc/bewan/init.d/wanip nothing 5
/etc/bewan/init.d/wanppp nothing 5
/etc/bewan/init.d/firewall ipv4 nothing 5
/etc/bewan/init.d/wannet start 5 ipv6
/etc/bewan/init.d/wanvpn start 1
/etc/bewan/init.d/wan nothing 5
/etc/bewan/init.d/wanbr start 5
/etc/bewan/init.d/wanip6 nothing 5
/etc/bewan/init.d/firewall ipv6 nothing 5
/etc/bewan/init.d/inetd start
/etc/bewan/init.d/dnsmasq start all
/etc/bewan/init.d/host start
/etc/bewan/init.d/users start
import diag
import unix
import web
/etc/bewan/user.d/unix: root
/etc/bewan/user.d/diag: admin
/etc/bewan/user.d/web: admin/iad_basic
/etc/bewan/user.d/web: admin/iad_admin
/etc/bewan/init.d/fwrules ipv4 start
Switch MDK: num_switches = 2
Switch MDK: unit = 0; phy_pbmp = 0x18; config_pbmp = 0x58
Switch MDK link poll thread: unit=0; phypbmp=0x18
Switch MDK link poll thread: unit=1; phypbmp=0x1e
eth5 (switch port: 12) Link UP 100 mbps full duplex
ADDRCONF(NETDEV_CHANGE): eth5: link becomes ready
lan1: port 5(eth5) entering forwarding state
eth5 port state changing -- lan1 carrier on.
ADDRCONF(NETDEV_CHANGE): lan1: link becomes ready
/etc/bewan/init.d/fwrules ipv6 nothing
/etc/bewan/init.d/iptables start
/etc/bewan/init.d/ip6tables start
eth0 (switch port: 1) Link UP 1000 mbps full duplex
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
lan1: port 1(eth0) entering forwarding state
/etc/bewan/init.d/conntrack start
/etc/bewan/init.d/ebtables start
/etc/bewan/init.d/igmp start
/etc/bewan/init.d/routes ipv4 start
/etc/bewan/init.d/routes ipv6 nothing
/etc/bewan/init.d/igmp start
/etc/bewan/init.d/ledbutton nothing
/etc/bewan/init.d/dyndns nothing 1
/etc/bewan/init.d/ntp start
/etc/bewan/init.d/cron start
/etc/bewan/init.d/cron restart
/etc/bewan/init.d/tr069 start
/etc/bewan/init.d/web_iad start
/etc/bewan/init.d/http start 1
/etc/bewan/init.d/webauth start
/etc/bewan/init.d/wanvpn start 1
/etc/bewan/init.d/wan nothing 5
/etc/bewan/init.d/web_nas nothing
/etc/bewan/init.d/phy start all all
/etc/bewan/init.d/phy start 1 1
Restarting autonegotiation...
/etc/bewan/init.d/phy nothing 1 2
/etc/bewan/init.d/phy start 2 1
Restarting autonegotiation...
/etc/bewan/init.d/phy start 2 2
Restarting autonegotiation...
/etc/bewan/init.d/phy start 2 3
Restarting autonegotiation...
/etc/bewan/init.d/phy start 2 4
Restarting autonegotiation...
SOFTDOG: setting margin to 60 seconds.
/etc/bewan/init.d/ethlink start 1
eth0 (switch port: 1) Link DOWN.
lan1: port 1(eth0) entering disabled state
Please press Enter to activate this console. bewan rc complete
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usb 1-2: new high speed USB device using ehci_hcd and address 2
usb 1-2: configuration #1 chosen from 1 choice
scsi0 : SCSI emulation for USB Mass Storage devices
usb-storage: device found at 2
usb-storage: waiting for device to settle before scanning
/etc/bewan/init.d/cron nothing
/etc/bewan/init.d/wifi start 1
/etc/bewan/init.d/easyp start
eth0 (switch port: 1) Link UP 1000 mbps full duplex
lan1: port 1(eth0) entering forwarding state
/etc/bewan/init.d/wificountry restart
/etc/bewan/init.d/wificom restart
/etc/bewan/init.d/wifi nothing 2
/etc/bewan/init.d/easyp nothing
/etc/bewan/init.d/lanacl start 1
/etc/bewan/init.d/wifiacl restart 1
/etc/bewan/init.d/lanacl start 2
/etc/bewan/init.d/wifiacl stop 2
/etc/bewan/init.d/samba start
scsi 0:0:0:0: Direct-Access OCZ RALLY2 1100 PQ: 0 ANSI: 0 CCS
/etc/bewan/init.d/voip start
usb-storage: device scan complete
sd 0:0:0:0: [sda] 31326208 512-byte hardware sectors: (16.0 GB/14.9 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Mode Sense: 43 00 00 00
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Assuming drive cache: write through
sda: sda1
sd 0:0:0:0: [sda] Attached SCSI removable disk
/etc/bewan/init.d/miniupnpd start
Entering storage superdlna.
Action drop-add pre dropped
/etc/bewan/init.d/mdns start
/etc/bewan/init.d/webauth nothing
/etc/bewan/init.d/hpna nothing
/etc/bewan/init.d/superdlna.init start
/etc/bewan/init.d/lynx.init start
/etc/bewan/init.d/cron restart
/etc/bewan/init.d/ippos.init start
Entering storage samba.
Action drop-add pre dropped.
rc2 complete
unknown or non-unique volume type (--probe-all lists possibly conflicting types)
Entering storage superdlna.
Action drop-add post dropped
Entering storage samba.
/etc/bewan/init.d/samba refresh-shares
add wl0 to lan1 bridge
device wl0 entered promiscuous mode
lan1: port 6(wl0) entering forwarding state
lan1: port 6(wl0) entering disabled state
lan1: port 6(wl0) entering forwarding state
===== Configurações =====
O modem contém uma ferramenta para editar suas configurações: CLI. Antes de executar quaisquer modificações abaixo, faça login via SSH e execute:
cli
Execute os comandos desejados abaixo e logo após:
fcommit
Algumas alterações necessitam de um reboot:
reboot
Exemplo:
cli
set Services_GvtConfig_AccessClass 4
fcommit
reboot
=== RunLevel ===
set Services_GvtConfig_AccessClass 4
Substitua o "4" pelo RunLevel desejado, podendo este ser 2 ou 4. Atenção! O modo 4 afetará os serviços de telefonia e TV.
=== Ativar HPNA ===
set HPNA_Enable 1
=== Desativar TR069 ===
set Services_TR069_Enable 0
=== Modulação xDSL ===
set WANDSLInterfaceConfig_ModulationType mode
Onde mode: ADSL_multi, ADSL_G.dmt, ADSL_G.lite, ADSL_ANSI_T1.413, ADSL_G.dmt.bis, ADSL_2plus, ADSL_multi_AM, xDSL_multi, VDSL
=== Porta WAN no modo PPPoE ===
set WANEthernetInterface_1_VLANInterface_1_VID 0
set WANConnectionDevice_1_WANPPPConnection_Username "usuario"
set WANConnectionDevice_1_WANPPPConnection_Password "senha"
=== Porta WAN no modo IP ===
set WANEthernetInterface_1_VLANInterface_1_VID 0
set WANConnectionDevice_1_WANPPPConnection_Enable 0
set WANConnectionDevice_1_WANIPConnection_Enable 1
Para modo DHCP
set WANConnectionDevice_1_WANIPConnection_AddressingType "DHCP"
Para modo IP estático
set WANConnectionDevice_1_WANIPConnection_AddressingType "Static"
set WANConnectionDevice_1_WANIPConnection_IPAddress "10.0.0.10"
set WANConnectionDevice_1_WANIPConnection_SubnetMask "255.255.255.0"
set WANConnectionDevice_1_WANIPConnection_DefaultGateway "10.0.0.1"
=== Ativar stack IPv6 ===
set Device_IPv6Enable 1
=== SIP para Vono ===
(Configuração basica)
set VoiceProfile_1_Enable 1
set VoiceProfile_1_NumberOfLines 1
set VoiceProfile_1_WANInterface 1
set VoiceProfile_1_Name 'Vono'
set VoiceProfile_1_SignalingProtocol 'SIP'
set VoiceProfile_1_SIP_ProxyServer 'vono.net.br'
set VoiceProfile_1_SIP_ProxyServerPort 5060
set VoiceProfile_1_SIP_ProxyServerTransport 'UDP'
set VoiceProfile_1_SIP_OutboundProxy 'vono.net.br'
set VoiceProfile_1_SIP_OutboundProxyPort 1571
set VoiceProfile_1_SIP_RegisterExpires 300
fcommit
(Configurando a linha telefônica)
set VoiceProfile_1_Line_1_Enable 1
set VoiceProfile_1_Line_1_SIP_AuthUserName 'user_vono'
set VoiceProfile_1_Line_1_SIP_AuthPassword 'senha_vono'
fcommit
(Configuração caso tenha duas contas Vono com linhas e números diferentes)
set VoiceProfile_1_NumberOfLines 2
set VoiceProfile_1_Line_1_Enable 1
set VoiceProfile_1_Line_1_SIP_AuthUserName 'user_vono_linha1'
set VoiceProfile_1_Line_1_SIP_AuthPassword 'senha_vono_linha1'
set VoiceProfile_1_Line_2_Enable 1
set VoiceProfile_1_Line_2_SIP_AuthUserName 'user_vono_linha2'
set VoiceProfile_1_Line_2_SIP_AuthPassword 'senha_vono_linha2'
fcommit
(Exemplo de configuração caso tenha uma única linha, mas queira poder completar duas chamadas de dois aparelhos ao mesmo tempo, e quando receber chamadas, caso a linha 1 esteja ocupada, a ligação seja redirecionada para a linha 2)
set VoiceProfile_1_NumberOfLines 2
set VoiceProfile_1_Line_1_Enable 1
set VoiceProfile_1_Line_1_SIP_AuthUserName 'user_vono'
set VoiceProfile_1_Line_1_SIP_AuthPassword 'senha_vono'
set VoiceProfile_1_Line_2_Enable 1
set VoiceProfile_1_Line_2_SIP_AuthUserName 'user_vono$1'
set VoiceProfile_1_Line_2_SIP_AuthPassword 'senha_vono'
fcommit
=== Permitir ping remoto/externo ===
set WANConnectionDevice_1_Firewall_AllowRemotePing 1
=== Backup do perfil SIP / telefone ===
Execute via SSH (fora do cli):
/etc/bewan/scripts/backup-voice-profile
Será criado um arquivo com as configurações em /nvram/gvt/voice-backup.cli. Este comando está disponível apenas em versões >= 42004 do [[modem:v5471#custom_firmware|42k Series]].
=== Alterar MTU ===
set WANConnectionDevice_1_MaxMTUSize valor
Valor: entre 500 a 1500. Padrão = 1492.
=== Habilitar SIP/telefone no modo bridge ===
set WANConnectionDevice_2_Enable 1
===== Firmware =====
==== Stock Firmware ====
Repositório das imagens oficiais: [[https://www.tripleoxygen.net/files/devices/pace/v5471/firmware/stock|Link]].
Para instalar, basta seguir os mesmos passos das imagens custom, utilizando cURL ou o pacefwuploader.
==== Custom Firmware ====
Apesar do processo de gravação de imagens ter sido testado e ser seguro, sempre há riscos no procedimento, tal como queda de energia no momento da gravação. Quaisquer eventualidades é de sua responsabilidade. **NÃO** desligue o modem ou remova o cabo de rede por todo o processo de gravação.
=== 42k Series ===
A série 42k de imagens são baseadas na versão original 98509. Elas conterão correções, melhorias e/ou novos recursos em comparação as originais.
== 42000 ==
* Ativado
* Console serial
* [[modem:v5471#SSH]]
* Usuário root (com shell completo). Senha padrão: //toor//
* Desativado
* TR069
* Access Class padrão 4 (ativa portas USB, libera o modo bridge e desativa HPNA/TV)
* o modo atual é mantido. Para forçar o nível 4, restaure as configurações de fábrica após a instalação desta imagem.
[[https://www.tripleoxygen.net/files/devices/pace/v5471/firmware/custom/B14103-GVT-OXY-42000.bin|Download]] (SHA-1: 31fa9869be02f6eb1b5102c9c839c0aae0a488f3)
== 42001 ==
* Página de configuração avançada, permitindo alterar:
* Access Class
* HPNA
* Parâmetro VPI/VCI para ADSL (ATM)
* Parâmetro VLAN ID para VDSL (PTM)
A página encontra-se em "Gerenciamento" > "Ferramentas" > aba "Avançado".
[[https://www.tripleoxygen.net/files/devices/pace/v5471/firmware/custom/B14103-GVT-OXY-42001.bin|Download]] (SHA-1: 4d5ca0ca3b0262fe1f8521be01aab59d0778b7eb)
== 42002 ==
* Possível alterar na página de configuração avançada, seção ATM:
* Tipo de link (Auto, EoA, IPoA, PPPoA, PPPoE)
* Encapsulamento (LLC, VCMUX)
* Removido regra da porta do TR069 no firewall
A página encontra-se em "Gerenciamento" > "Ferramentas" > aba "Avançado".
{{ https://www.tripleoxygen.net/files/devices/pace/v5471/firmware/custom/42002.png?300 }}
[[https://www.tripleoxygen.net/files/devices/pace/v5471/firmware/custom/B14103-GVT-OXY-42002.bin|Download]] (SHA-1: e77bf6ff94f4bd80d85c6bd5983ce02e823da6c8)
== 42003 ==
* Correção na apresentação da potência de TX/RX no modo xDSL
* Perfis pré-configurados para operadoras com VDSL2 (atualmente para GVT, Oi, TIM)
[[https://www.tripleoxygen.net/files/devices/pace/v5471/firmware/custom/B14103-GVT-OXY-42003.bin|Download]] (SHA-1: 4bb885b25107ab5aff4a7833ed5fd4bccb41b663)
== 42004 ==
* Removido tag "-test" nos informs/reports
* Script de backup do perfil de voz
* Backup automático do perfil de voz no primeiro boot com a imagem
* O perfil será armazenado em /nvram/gvt/backup-voice.cli, restaure com:
* cli -q < /nvram/gvt/voice-backup.cli
* echo "fcommit" | cli -q
[[https://www.tripleoxygen.net/files/devices/pace/v5471/firmware/custom/B14103-GVT-OXY-42004.bin|Download]] (SHA-1: 6474a9be27a6a3eff6817faa4f2e481659af92ec)
== 42005 ==
* Novas opções na aba avançada:
* TR069
* IPv6 (experimental)
* Backup automático de toda a configuração no primeiro boot com a imagem
* O perfil será armazenado em /nvram/gvt/config-backup.tar, restaure com:
* tar xf config-backup.tar -C /tmp
* echo "applydiff /tmp/router.diff" | cli -q
* Reinicie o modem
* Estatísticas avançadas para xDSL:
* Acesse em Gerenciamento > Estatísticas > xDSL
* As atenuações de linha são por banda do espectro xDSL (apenas retiradas do modem, exatidão deve ser verificada experimentalmente). O campo original de atenuação permanece em 0 na maior parte das vezes, conhecido bug do SoC/driver;
* O SNR é amostrado a cada 1 minuto
* Os gráficos são gerados a cada 5 minutos (caso veja "Sem dados", aguarde os 5 minutos)
* Se quiser desativar a geração de gráficos e coleta periódica de SNR, execute via SSH:
* touch /nvram/disable_stats
* O campo "Modulação" em "Detalhes da conexão" agora mostra o perfil VDSL2, caso seja esta a tecnologia em uso.
[[https://www.tripleoxygen.net/files/devices/pace/v5471/firmware/custom/B14103-GVT-OXY-42005.bin|Download]] (SHA-1: c787d14ea4f8a16132ee1e4c62ec3fb6c05e52f9)
== 42006 ==
* Estatísticas avançadas para modo bridge;
* No modo bridge, o modem não ajusta o relógio interno, portanto as imagens terão o timestamp errado, o que pode causar um "buraco" nos gráficos do RRDTool;
* Aviso que informações de banda são somente para VDSL2;
* Melhoria nos scripts de stats para falharem corretamente quando o link cair.
[[https://www.tripleoxygen.net/files/devices/pace/v5471/firmware/custom/B14103-GVT-OXY-42006.bin|Download]] (SHA-1: 2c77265c164db9934ef049618f97f781501ef65a)
== 42007 ==
* Suporte a script de usuário na inicialização do V5471
* Caso exista, o script **/nvram/user.sh** será chamado na inicialização
* Uma restauração de fábrica/reset **remove** este arquivo automaticamente (um mecanismo de segurança, caso você crie algo que coloque o modem em bootloop, por exemplo)
* Use o **ash** como interpretador de seu script, pois o sh é modificado e não vai gostar dele :) :
* Shebang: **#!/bin/ash**
* Rebased na última versão oficial/stock até o dia 11/07/2017: **103961**
* Como não temos changelogs oficiais, uma breve análise revela as seguintes diferenças entre stock **103961** e antiga **98509**:
* Diversas correções no subsistema de wifi (interno e UI);
* Aumento no Conntrack_MaxEntries de 9000 para 40000
[[https://www.tripleoxygen.net/files/devices/pace/v5471/firmware/custom/B14103-GVT-OXY-42007.bin|Download]] (SHA-1: 8476a793e172a75ae4069ac49d12bc052cf628c6)
=== SSH ===
Caso receba o seguinte erro ao conectar-se via SSH:
Unable to negotiate with 192.168.25.1: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1
Consulte [[http://www.openssh.com/legacy.html|este link]].
=== Instalação ===
Caso já tenha o [[http://curl.haxx.se/download.html|cURL]] instalado em sua máquina, siga os passos em "[[modem:v5471#cURL]]". Caso não tenha e utilize Windows, vá para "[[modem:v5471#pacefwuploader]]"; é a maneira mais fácil e simples para enviar a imagem.
== cURL ==
Execute o seguinte comando no terminal/prompt:
curl -H "Expect:" "http://192.168.25.1/cgi-bin/firmware.cgi" -F sFirmwareFile=@B14103-GVT-OXY-42000.bin
Certifique-se de executar o comando na mesma pasta onde a imagem se encontra. Substitua o IP na URL caso o de seu modem seja diferente e o nome da imagem que irá mandar. Exemplo:
... sFirmwareFile=@B14103-GVT-OXY-42000.bin
Para
... sFirmwareFile=@B14103-GVT-OXY-42001.bin
== pacefwuploader ==
Baixe o utilitário [[https://www.tripleoxygen.net/files/devices/pace/v5471/tools/pacefwuploader.zip|pacefwuploader]] e execute. Escolha a imagem a ser gravada, insira o IP do modem e clique em "Gravar". Pronto. :-)
Este utilitário apenas envia a imagem via HTTP POST para a URL correta. Caso queiram os [[https://www.tripleoxygen.net/files/devices/pace/v5471/tools/pacefwuploader_src.zip|fontes]]. É simples e ridículo!
== Gravação ==
Em ambos os métodos acima, a imagem será enviada ao modem e o LED "Ligado" piscará em vermelho indicando a gravação. Aguarde até que ele pare e acenda verde. Abra a página de configuração do dispositivo, vá em:
Gerenciamento > Reiniciar > Reiniciar
Após reinicializar, verifique que a imagem foi instalada com sucesso olhando a versão em "Sobre o Power Box".
Caso opte por reconfigurar o modem (restauração de fábrica), o nível 4 do AccessClass será forçado. A restauração pode ser feita acessando:
Gerenciamento > Reiniciar > Reconfigurar
Ou apertando e segurando o botão "Reconfigurar" atrás do modem (acima da entrada da fonte) por 10 segundos.
== Agradecimentos ==
Pessoas envolvidas em discussões, dicas ou bate papo em geral. Lista em ordem alfabética.
Anderson, Carlos Anselmo, fgrep, Rudson, Striker