====== Sagemcom F@ST 5655v2 ====== {{description>Informações sobre o Sagemcom F@ST 5655v2 ONT/ONU. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.}} ===== Disclaimer ===== A maioria destes dispositivos são fornecidos pelo seu ISP em regime de comodato como parte do serviço fornecido. Todas as informações divulgadas aqui são de caráter informativo e pesquisa, sendo de sua inteira responsabilidade quaisquer implicações, perdas ou danos ao utilizá-las. Todas as informações, métodos, procedimentos, firmwares, aplicativos e material sobre modificações e configurações postadas neste wiki foram criados pelo O3 Labs (salvo menção em contrário) e disponibilizadas **GRATUITAMENTE** desde o dia de sua elaboração. Denuncie quando possível quaisquer tentativas de venda destes material. ===== Hardware ===== {{:ont:dsc_0003b.jpg?direct&400 |}} {{ :ont:dsc_0005b.jpg?direct&400|}} ---- ^ SoC | Broadcom BCM68380IFSBG - Broadcom GPON Processor SoC (MIPS, dual core, 600 MHz) | ^ RAM | Micron NT5CC128M16IP-DI - 2 Gbit (256 MB) DDR3L-1600 | ^ Flash | Spansion S34ML01G1 - 1 Gbit (128 MB) SLC NAND | ^ Switch | Integrado, 4 portas | ^ USB | 1 x 2.0 | ^ Wireless 2.4 GHz| Broadcom BCM43217 2x2 802.11b/g/n| ^ Wireless 5 GHz| Broadcom BCM43602 3x3 802.11ac | ^ GPON Transceiver | ? | ^ FXS | 1 - Microsemi Le9540 | ^ HPNA | Não | ^ Serial | Sim | ^ JTAG | Não | ===== Bootlog ===== HELO CPUI L1CI PLLI PMCB HELO CPUI L1CI 4.1603-1.0.38-116.174 DRAM ---- PHYS ZQDN PHYE DINT TST1 TST2 PASS ---- ZBSS L12F MAIN Version cfe-rom: 7.31.17.1 FPS0 SVOL NGEO FVLY FVLY RVOL J2EP Base: 4.16_03 CFE version 1.0.38-116.174 for BCM96838 (32bit,SP,BE) Build Date: Fri Jan 20 18:54:28 CET 2017 (g601671@rmm-1186759) Copyright (C) 2000-2013 Broadcom Corporation. Version cfe-ram: 7.31.17.1 Boot Strap Register: 0x800078fe Chip ID: BCM68380_B0, MIPS: 600MHz, DDR: 533MHz, Bus: 240MHz RDP: 800MHz Main Thread: TP0 Total Memory: 268435456 bytes (256MB) Boot Address: 0xbfc00000 NextLevelBoot U-boot @ 0x8fe00000 NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes NAND flash device: Spansion S34ML01G1, id 0x01f1 block 128KB size 131072KB Configuring RGMII pinpux Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host/tftp (f/h/c) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Default host ramdisk file name : Default ramdisk store address : Board Id (0-46) : F@ST5655_V2 Number of MAC Addresses (1-32) : 10 Base MAC Address : d8:a7:56:xx:xx:xx PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 0 Main Thread Number [0|1] : 0 GPON Serial Number : "XXXXXXXXXXXX" GPON Password : "1234567890" MC memory allocation (MB) : 4 TM memory allocation (MB) : 20 WLan Feature : 0x00 Voice Board Configuration (0-1) : LE9540 enable IH Wan-Wan forwarding... data_path_go Done!! Set EMAC4 as TMII Set EMAC4 as TMII Creating CPU ring for queue number 0 with 32 packets descriptor=0x80687644 Done initializing Ring 0 Base=0xa2214220K End=0xa2214420K calculated entries= 32 RDD Base=0x02214220K descriptor=0x80687644 Open PHY 1 on MAC 0 : link state = Down Open PHY 2 on MAC 1 : link state = Down Open PHY 3 on MAC 2 : link state = Down Open PHY 4 on MAC 3 : link state = Down Open PHY 0 on MAC 4 : link state = Down Initializing UBI to launch u-boot! Running UbiScan... Found 532 UBI logical blocks on NAND already found a layout volume with higher sqnum UBI Layout volume is on logical block 3d4 initialize_ubi...cferam reading uboot ======================= !!! UBI volume uboot has id 1 read 1065792 bytes from UBI volume 1 Ubi U-Boot Entry at 0x8fe00000 Closing network. Starting program at 0x8fe00000 U-Boot 2011.12 Version: 7.31.17.1-full (Jan 20 2017 - 18:53:37) Copyright (C) 2011 - 2013 Sagemcom All rights reserved Board: Sagemcom fast CPU: Broadcom BCM68380 (Chip1 Rev4) DRAM: 256 MiB NAND: 128 MiB Using default environment Creating 1 MTD partitions on "nand0": 0x0000000c0000-0x000007b00000 : "mtd=2" UBI: attaching mtd1 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 126976 bytes UBI: smallest flash I/O unit: 2048 UBI: VID header offset: 2048 (aligned 2048) UBI: data offset: 4096 UBI: attached mtd1 to ubi0 UBI: MTD device name: "mtd=2" UBI: MTD device size: 122 MiB UBI: number of good PEBs: 978 UBI: number of bad PEBs: 0 UBI: max. allowed volumes: 128 UBI: wear-leveling threshold: 256 UBI: number of internal volumes: 1 UBI: number of user volumes: 8 UBI: available PEBs: 85 UBI: total number of reserved PEBs: 893 UBI: number of PEBs reserved for bad PEB handling: 9 UBI: max/mean erase counter: 1986/1095 Read 6632 bytes from volume permanent_param to 8de25420 Unable to retrive mac_addr from lanBaseMacAddr mac_addr set according to wanBaseMacAddr NVRAM MAC addr:xxxxxxxxxxxxx NVRAM GSN:xxxxxxxxxxxxxxxxxxxxxxxx No need to update NVRAM mac addr/gsn Net: enable IH Wan-Wan forwarding... data_path_go Done!! Set EMAC4 as TMII Set EMAC4 as TMII Creating CPU ring for queue number 0 with 32 packets descriptor=0x8ff04c18 Done initializing Ring 0 Base=0xafa05130 End=0xafa05330 calculated entries= 32 RDD Base=0x0fa05130 descriptor=0x8ff04c18 BCM63xxx_RUN sb3: sb3_sagem_init() sb3: action: 1007 sb3: sb3_wait_for_magic() sb3: action: 1002 Aes_key2 is NOT available Use default one Volume aes_key_operator not found! aes_key_operator has not the good size (is it available?) sb3: sb3_boot( operational ) sb3: top available addr 0x8dcc0000, ram available = 0xd8c0000 sb3: read image operational size=175f000 to address=8c560000 sb3_load_ubivol: max_load_size=227278848 Read 24506368 bytes from volume operational to 8c560000 sb3: image operational has gsdf format sb3: image operational signature OK sb3: No pre-boot commands sb3: setting kernel args bootm 8C57F000 ## Booting kernel from Legacy Image at 8c57f000 ... Image Name: scOS SG3V10000112 (8c.66.67.17v2 Created: 2018-10-17 6:51:38 UTC Image Type: MIPS Linux Kernel Image (gzip compressed) Data Size: 2424832 Bytes = 2.3 MiB Load Address: 80010000 Entry Point: 803c1c70 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... Linux version 3.4.11-rt19 (g503707@shz-p0000665fl) (gcc version 4.6.2 (GCC) ) #21 SMP PREEMPT Wed Oct 17 14:51:30 CST 2018 F@ST5655_V2 prom init CPU revision is: 0002a080 (Broadcom BMIPS4350) Determined physical RAM map: memory: 02400000 @ 0dc00000 (reserved) memory: 00400000 @ 0d800000 (reserved) memory: 00700000 @ 0d100000 (reserved) memory: 0d100000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x0000d100 Movable zone start PFN for each node Early memory PFN ranges 0: 0x00000000 -> 0x0000d100 On node 0 totalpages: 53504 free_area_init_node: node 0, pgdat 804c3420, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 386 pages used for memmap Normal zone: 49022 pages, LIFO batch:15 PERCPU: Embedded 7 pages/cpu @811ac000 s5392 r8192 d15088 u32768 pcpu-alloc: s5392 r8192 d15088 u32768 alloc=8*4096 pcpu-alloc: [0] 0 [0] 1 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 53086 Kernel command line: ro noinitrd root=mtd:rootfs init=/etc/preinit ro rootfstype=squashfs console=ttyS0,115200 rootfs_offset=0x0028b000 rootfs_size=0x014d4000 mtdparts=nand.0:128k(nvram),640k(bcm),5120k@-5120k(data),-@768k(ubi) ubi.mtd=ubi part_main=ubi part_boot=ubi image_ubivol=operational secure board_type=00040040 console=ttyS0,115200 earlyprintk debug init=/etc/preinit irqaffinity=0 UBI image volume: "operational" PID hash table entries: 1024 (order: 0, 4096 bytes) Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Memory: 206720k/214016k available (3840k kernel code, 7296k reserved, 975k data, 212k init, 0k highmem) Preemptible hierarchical RCU implementation. NR_IRQS:256 console [ttyS0] enabled Calibrating delay loop... 598.01 BogoMIPS (lpj=299008) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 --Kernel Config-- SMP=1 PREEMPT=1 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 Broadcom Logger v0.1 Aug 30 2018 21:41:12 CPU revision is: 0002a080 (Broadcom BMIPS4350) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Brought up 2 CPUs NET: Registered protocol family 16 PMC Driver Init... done. registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb PCI host bridge to bus 0000:00 pci_bus 0000:00: root bus resource [mem 0xeff00000-0xefffffff] pci_bus 0000:00: root bus resource [io 0xf1000000-0xf100ffff] pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310 pci 0000:00:09.0: reg 10: [mem 0x15400400-0x154004ff] pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320 pci 0000:00:0a.0: reg 10: [mem 0x15400300-0x154003ff] PCI host bridge to bus 0000:01 pci_bus 0000:01: root bus resource [mem 0xd0000000-0xdfffffff] pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0] pci 0000:01:00.0: [14e4:6838] type 01 class 0x060400 pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:02:00.0: [14e4:aa52] type 00 class 0x028000 pci 0000:02:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit] pci 0000:02:00.0: reg 18: [mem 0x00000000-0x003fffff 64bit] pci 0000:02:00.0: supports D1 D2 pci 0000:01:00.0: BAR 8: assigned [mem 0xd0000000-0xd05fffff] pci 0000:02:00.0: BAR 2: assigned [mem 0xd0000000-0xd03fffff 64bit] pci 0000:02:00.0: BAR 0: assigned [mem 0xd0400000-0xd0407fff 64bit] pci 0000:01:00.0: PCI bridge to [bus 02-02] pci 0000:01:00.0: bridge window [mem 0xd0000000-0xd05fffff] PCI: Enabling device 0000:01:00.0 (0000 -> 0002) PCI host bridge to bus 0000:03 pci_bus 0000:03: root bus resource [mem 0xe0000000-0xefefffff] pci_bus 0000:03: root bus resource [??? 0x00000000 flags 0x0] pci 0000:03:00.0: [14e4:6838] type 01 class 0x060400 pci 0000:03:00.0: PME# supported from D0 D3hot pci 0000:04:00.0: [14e4:a8db] type 00 class 0x028000 pci 0000:04:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit] pci 0000:04:00.0: supports D1 D2 pci 0000:03:00.0: BAR 8: assigned [mem 0xe0000000-0xe00fffff] pci 0000:04:00.0: BAR 0: assigned [mem 0xe0000000-0xe0007fff 64bit] pci 0000:03:00.0: PCI bridge to [bus 04-04] pci 0000:03:00.0: bridge window [mem 0xe0000000-0xe00fffff] PCI: Enabling device 0000:03:00.0 (0000 -> 0002) bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated skbFreeTask created successfully gbpm_do_work scheduled BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 Aug 30 2018 21:43:53 initialized Broadcom GBPM v0.1 Aug 30 2018 21:43:53 initialized Switching to clocksource MIPS NET: Registered protocol family 2 IP route cache hash table entries: 2048 (order: 1, 8192 bytes) TCP established hash table entries: 8192 (order: 4, 65536 bytes) TCP bind hash table entries: 8192 (order: 4, 65536 bytes) TCP: Hash tables configured (established 8192 bind 8192) TCP: reno registered UDP hash table entries: 128 (order: 0, 4096 bytes) UDP-Lite hash table entries: 128 (order: 0, 4096 bytes) NET: Registered protocol family 1 PCI: CLS 16 bytes, default 16 init_bcm_tstamp: unhandled mips_hpt_freq=300000000, adjust constants in bcm_tstamp.c bcm_tstamp initialized, (hpt_freq=300000000 2us_div=300 2ns_mult=0 2ns_shift=0) squashfs: version 4.0 (2009/01/31) Phillip Lougher Registering unionfs 2.5.12 (for 3.4.70) jffs2: version 2.2. (NAND) Â 2001-2006 Red Hat, Inc. fuse init (API version 7.18) msgmni has been set to 403 io scheduler noop registered (default) Broadcom NAND controller (BrcmNand Controller) mtd->oobsize=0, mtd->eccOobSize=0 NAND_CS_NAND_XOR=00000000 B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0 brcmnand_read_id: CS0: dev_id=01f1801d After: NandSelect=40000001, nandConfig=15142200 Block size=00020000, erase shift=17 NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11 busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff timing1 not adjusted: 65424458 timing2 not adjusted: 80000e55 BrcmNAND mfg 1 f1 SPANSION_S30ML01GP_08 128MB on CS0 Found NAND on CS0: ACC=e3441010, cfg=15142200, flashId=01f1801d, tim1=65424458, tim2=80000e55 BrcmNAND version = 0x80000500 128MB @00000000 brcmnand_scan: B4 nand_select = 40000001 brcmnand_scan: After nand_select = 40000001 handle_acc_control: default CORR ERR threshold 1 bits ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16 page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17 Brcm NAND controller version = 5.0 NAND flash size 128MB @18000000 ECC layout=brcmnand_oob_bch4_2k brcmnand_scan: mtd->oobsize=64 brcmnand_scan: oobavail=35, eccsize=512, writesize=2048 brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=4, eccbytes=7 -->brcmnand_default_bbt brcmnand_default_bbt: bbt_td = bbt_slc_bch4_main_descr Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0 Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0 brcmnand_reset_corr_threshold: default CORR ERR threshold 1 bits for CS0 brcmnand_reset_corr_threshold: CORR ERR threshold changed to 3 bits for CS0 brcmnandCET: Status -> Deferred Master size=08000000 rootfs_ofs=0xffffffff, part1ofs=0x00000080, part2ofs=0x0000f600 Part[0] name=bcmfs, size=20000, ofs=0 Part[1] name=bcmfs_update, size=a0000, ofs=20000 Part[2] name=ubi, size=7a40000, ofs=c0000 Part[3] name=data, size=400000, ofs=7b00000 Part[4] name=nvram, size=20000, ofs=0 4 cmdlinepart partitions found on MTD device nand.0 Creating 4 MTD partitions on "nand.0": 0x000000000000-0x000000020000 : "nvram" 0x000000020000-0x0000000c0000 : "bcm" 0x000007b00000-0x000008000000 : "data" 0x0000000c0000-0x000007b00000 : "ubi" UBI: attaching mtd3 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 126976 bytes UBI: smallest flash I/O unit: 2048 UBI: VID header offset: 2048 (aligned 2048) UBI: data offset: 4096 UBI: max. sequence number: 1071104 UBI: attached mtd3 to ubi0 UBI: MTD device name: "ubi" UBI: MTD device size: 122 MiB UBI: number of good PEBs: 978 UBI: number of bad PEBs: 0 UBI: number of corrupted PEBs: 0 UBI: max. allowed volumes: 128 UBI: wear-leveling threshold: 4096 UBI: number of internal volumes: 1 UBI: number of user volumes: 8 UBI: available PEBs: 85 UBI: total number of reserved PEBs: 893 UBI: number of PEBs reserved for bad PEB handling: 9 UBI: max/mean erase counter: 1986/1095 UBI: image sequence number: 0 UBI: background thread "ubi_bgt0d" started, PID 211 Add UBI volume partitions: name=secondaryboot Add UBI volume partitions: name=uboot Add UBI volume partitions: name=uboot-rescue Add UBI volume partitions: name=permanent_param Add UBI volume partitions: name=rescue Add UBI volume partitions: name=operational Creating 3 MTD partitions on "operational": 0x000000000000-0x00000001f000 : "firm_header" 0x00000001f000-0x0000002aa000 : "kernel" 0x00000028b000-0x00000175f000 : "rootfs" Add UBI volume partitions: name=filesystem1 Add UBI volume partitions: name=filesystem2 tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky PPP generic driver version 2.4.2 PPP BSD Compression module registered PPP Deflate Compression module registered NET: Registered protocol family 24 usbcore: registered new interface driver usblp i2c /dev entries driver brcmboard: brcm_board_init entry DYING GASP IRQ Initialized and Enabled Serial: BCM63XX driver $Revision: 3.00 $ Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported commands) ttyS0 at MMIO 0xb4e00500 (irq = 9) is a BCM63XX ttyS1 at MMIO 0xb4e00520 (irq = 10) is a BCM63XX BPM: tot_mem_size=268435456B (256MB), buf_mem_size <15%> =40265310B (38MB), num of buffers=19972, buf size=2016 Broadcom BPM Module Char Driver v0.1 Aug 30 2018 21:43:12 Registered<244> TCP: cubic registered NET: Registered protocol family 10 IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 Initializing MCPD Module Ebtables v2.0 registered ebt_time registered ebt_ftos registered ebt_wmm_mark registered L2TP core: blog_l2tp_rcv_check L2TP core driver, V2.0 PPPoL2TP kernel driver, V2.0 8021q: 802.1Q VLAN Support v1.8 VFS: Mounted root (squashfs filesystem) readonly on device 31:12. Freeing unused kernel memory: 212k freed kernel.hotplug = /sbin/mdev - preinit - - regular preinit - - init - UBIFS: recovery needed UBIFS: recovery completed UBIFS: mounted UBI device 0, volume 6, name "filesystem1" UBIFS: file system size: 6983680 bytes (6820 KiB, 6 MiB, 55 LEBs) UBIFS: journal size: 1015809 bytes (992 KiB, 0 MiB, 6 LEBs) UBIFS: media format: w4/r0 (latest is w4/r0) UBIFS: default compressor: lzo UBIFS: reserved for root: 329856 bytes (322 KiB) UBIFS: recovery needed UBIFS: recovery completed UBIFS: mounted UBI device 0, volume 7, name "filesystem2" UBIFS: file system size: 9015296 bytes (8804 KiB, 8 MiB, 71 LEBs) UBIFS: journal size: 1015809 bytes (992 KiB, 0 MiB, 6 LEBs) UBIFS: media format: w4/r0 (latest is w4/r0) UBIFS: default compressor: lzo UBIFS: reserved for root: 425813 bytes (415 KiB) unionfs: new lower inode mtime (bindex=1, name=tmp) bsp_gpio_data: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint Driver LED and BUTTON init ..... [HAL-BSP]: kSysButtonManaged[41]: WARNING -> Button name >= Max(9) [HAL-BSP]: kSysButtonManaged[41]: WARNING -> Button name >= Max(9) [HAL-BSP]: kSysButtonManaged[41]: WARNING -> Button name >= Max(9) Driver LED and BUTTON ok ..... Endpoint: endpoint_init entry ( MS 4.16L.04 ) Endpoint: HAL-BSP : bsp board found ... SagemcomFast5655_V2 Endpoint: Try to find table matching with : [BaseBoardId=F@ST5655_V2 / VoiceBoardId=LE9540] ... SUCCESS Endpoint: endpoint_init COMPLETED scratchpad RdpaWanType - GPON enable IH Wan-Wan forwarding... data_path_go Done!! Set EMAC4 as TMII Bridge fastpath module. compiled Aug 30 2018 , 20:27:43 brcmchipinfo: brcm_chipinfo_init entry NBUFF v1.0 Initialized Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 Aug 30 2018 20:24:34 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. [FHW] pktDbgLvl[0xc1026f40]=0 [FHW] fhw_construct: Initialized Fcache HW accelerator layer state flwStatsThread created Constructed Broadcom Packet Flow Cache v2.2 Aug 30 2018 20:24:34 i2c i2c-0: Failed to register i2c client gpon_i2c at 0x50 (-16) i2c i2c-0: Failed to register i2c client gpon_i2c at 0x50 (-16) i2c i2c-0: Failed to register i2c client gpon_i2c at 0x50 (-16) i2c i2c-0: Failed to register i2c client gpon_i2c at 0x50 (-16) Broadcom BCM68380_B0 Ethernet Network Device v0.1 Aug 30 2018 20:27:43 dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered eth0: PHY_ID <0x01800001 : 0x01> MAC : 00:00:00:00:00:01 eth1: PHY_ID <0x01800002 : 0x02> MAC : 00:00:00:00:00:01 eth2: PHY_ID <0x01800003 : 0x03> MAC : 00:00:00:00:00:01 eth3: PHY_ID <0x01800004 : 0x04> MAC : 00:00:00:00:00:01 eth4: PHY_ID <0x04e00f00 : 0x00> MAC : 00:00:00:00:00:01 Ethernet Auto Power Down and Sleep: Enabled All Port Bit Map: 0x001f: eth0,eth1,eth2,eth3,eth4 Chip WAN Only Ports 0000, Defined WAN Only Ports 0000, WAN Only Port Result: 0x0000: Chip WAN Preffered Ports 0000, Defined WAN Preffered Ports 0000, WAN Preffered Port Result: 0x0000: Chip LAN Only Ports 0000, Defined LAN Only Ports 0000, LAN Only Port Result: 0x0000: WAN/LAN Both Capable Ports 0x001f:eth0,eth1,eth2,eth3,eth4 Energy Efficient Ethernet: Enabled Creating Enet CPU ring for queue number 1 with 512 packets,Descriptor base=a82e8080 eth4 Link UP 1000 mbps full duplex Creating Enet CPU ring for queue number 0 with 512 packets,Descriptor base=a9e18080 Broadcom Packet Flow Cache HW acceleration enabled. Broadcom Packet Flow Cache HW acceleration enabled. Creating CPU ring for queue number 2 with 1024 packets descriptor=0xc10cd7a4 wfd_bind: Dev (null) wfd_idx 2 wl_radio_idx -1 Type skb configured WFD thread wfd2-thrd minQId/maxQId (10/10), status (0) qmask 0x4 Instantiating WFD 2 thread Wifi Forwarding Driver is initialized! dhd_module_init in dhd_queue_budget = 256 dhd_sta_threshold = 2048 dhd_if_threshold = 65536 no wifi platform data, skip PCI_PROBE: bus 2, slot 0,vendor 14E4, device AA52(good PCI location) dhdpcie_init: can't find adapter info for this chip PCI: Enabling device 0000:02:00.0 (0000 -> 0002) DHD: dongle ram size is set to 983040(orig 983040) at 0x180000 Creating CPU ring for queue number 7 with 128 packets descriptor=0xc0f92ba8 Done initializing Ring 7 Base=0xa82d7080 End=0xa82d7880 calculated entries= 128 RDD Base=0x082d7080 descriptor=0xc0f92ba8 RDPA returned tx wakeup reg = <0x13099004>, val = <0x10000000> RDPA returned rx wakeup reg = <0x1309a004>, val = <0x23000000> dhd_attach: wl0: pre-allocated buffer mode is disabled (allocskbsz=0) dhd_attach(): thread:dhd_watchdog_thread:2a8 started dhd_attach(): thread:dhd0_dpc:2a9 started dhd_deferred_work_init: work queue initialized Creating CPU ring for queue number 0 with 1024 packets descriptor=0xc10cd76c wfd_bind: Dev wl%d wfd_idx 0 wl_radio_idx 0 Type fkb configured WFD thread wfd0-thrd minQId/maxQId (8/8), status (0) qmask 0x1 Instantiating WFD 0 thread dhd_bus_download_firmware: firmware path=/etc/wlan/dhd, nvram path= dhdpcie_ramsize_adj: Enter dhdpcie_download_code_file: download firmware /etc/wlan/dhd/43602a1/rtecdc.bin wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl: ID=pci/2/0/ wl: ID=pci/2/0/ wl: loading /etc/wlan/bcm43602_map.bin wl: updating srom from flash... wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32 wl: reading /etc/wlan/bcm43602_nvramvars.bin, file size=32 Replace or append with internal Mac Address dhdpcie_bus_write_vars: Download, Upload and compare of NVRAM succeeded. PCIe shared addr (0x001eac3c) read took 53023 usec before dongle is ready DMA RX offset from shared Area 0 dhdpcie_readshared: Dongle advertizes 2 size indices dhdpcie_readshared: Host support DMAing indices: H2D:1 - D2H:1. FW supports it H2D DMA WR INDX : array size 272 = 2 * 134 D2H DMA RD INDX : array size 16 = 2 * 3 D2H DMA WR INDX : array size 16 = 2 * 3 H2D DMA RD INDX : array size 272 = 2 * 134 ring_info_raw: 56 00 00 00 00 00 00 00 00 98 00 26 00 a4 00 26 00 aa 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 86 00 00 00 dhdpcie_readshared: max H2D queues 134 dhd_bus_start: Initializing 134 h2drings dhd_runner_flowmgr_init: bootmem name addr size<7340032> dhd_runner_profile_init: N+M profile = 3 01:1024 -1:2048 -1:1024 -1:0512 01:0512 dhd_runner_policy_init: N+M Policy = 0 1 (HW) dhd_bus_cmn_writeshared: 0000: 00 f0 c3 07 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 00 c0 07 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 a0 2c 08 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 c0 c0 07 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 00 c6 07 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 00 f0 07 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 08 00 10 dhd_bus_cmn_writeshared: 0000: 80 eb da 07 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 92 e3 07 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 00 94 e3 07 00 00 00 00 dhd_bus_cmn_writeshared: 0000: 80 ea da 07 00 00 00 00 Attach flowrings pool for 132 rings Runner DHD PCIE: vendor<0x14e4> device<0xaa52> bus<2> slot<0> PCIE_0_MISC::RC_BAR2_CONFIG_LO 0xB2804034 = 0x1000000B PCIE_0_MISC::RC_BAR2_CONFIG_HI 0xB2804038 = 0x00000000 PCIE_0_MISC::UBUS_BAR2_CONFIG_REMAP 0xB280408C = 0x10000001 Initial configuration ================================= rx_post_flow_ring_base_addr : 87c00000 tx_post_flow_ring_base_addr : ad0c4000 rx_complete_flow_ring_base_addr : 87c60000 tx_complete_flow_ring_base_addr : 87c0c000 r2d_wr_arr_base_addr : 87e39400 d2r_rd_arr_base_addr : 87daea82 r2d_rd_arr_base_addr : 87e39200 d2r_wr_arr_base_addr : 87daeb82 tx_post_mgmt_arr_base_addr : 87db0000 tx_post_mgmt_arr_base_phys_addr : 7db0000 Doorbell ISR : c11a205c Doorbell CTX : 87e39800 Runner DHD Offload initialization complete CUR_ETHERADDR : 6 00 00 00 00 00 01 dhd_sync_with_dongle: GET_REVINFO device 0xbc430000, vendor 0xe4140000, chipnum 0x52aa0000 Dongle Host Driver, version 7.14.131.47.cpe4.16L04.2-kdb Compiled in drivers/net/wireless/bcmdhd on Aug 30 2018 at 20:25:24 wfd_registerdevice Successfully registered dev wl0 ifidx 0 wfd_idx 0 dhdpcie_chipmatch: Unsupported vendor 14e4 device a8db dhdpcie_pci_probe: chipmatch failed!! Broadcom PCI Device 0x6838 has allocated with driver pcieport Broadcom PCI Device 0x6838 has allocated with driver pcieport dhd_module_init out --SMP support wl: dsl_tx_pkt_flush_len=338 wl: norm_wmark_tot=12981, pktc_wmark_tot=12981 PCI: Enabling device 0000:04:00.0 (0000 -> 0002) wl: passivemode=1 wl: napimode=0 initvars_cis_pci: Not CIS format Neither SPROM nor OTP has valid image wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl: ID=pci/4/0/ wl: ID=pci/4/0/ wl: loading /etc/wlan/bcm43217_map.bin srom rev:8 wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32 wl1: allocskbmode=1 currallocskbsz=2300 Creating CPU ring for queue number 1 with 1024 packets descriptor=0xc10cd788 wfd_bind: Dev wl%d wfd_idx 1 wl_radio_idx 1 Type skb configured WFD thread wfd1-thrd minQId/maxQId (9/9), status (0) qmask 0x2 Instantiating WFD 1 thread wfd_registerdevice Successfully registered dev wl1 ifidx 0 wfd_idx 1 wl1: Broadcom BCM43227 802.11 Wireless Controller 7.14.131.47.cpe4.16L04.2-kdb dgasp: kerSysRegisterDyingGaspHandler: wl1 registered Board not populated with PMD RDPA Speed Service Command Driver scratchpad RdpaWanType - GPON START GPON SerDes Init script !!!! PLL locked !!!!!! !!!! RX CDR locked !!!!!! !!!! TX CDR locked !!!!!! GPON BEN Calibration Done GPON SerDes Initialization Sequence Done LOGGER driver Init Done : 0x87d9d900 enable IH Wan-Wan forwarding... Creating CPU ring for queue number 6 with 32 packets descriptor=0xc0f92b80 Done initializing Ring 6 Base=0xa623c480 End=0xa623c680 calculated entries= 32 RDD Base=0x0623c480 descriptor=0xc0f92b80 [NTC ploamFsm] printSerialPasswd: SN=xx:xx:xx:xx:xx:xx:xx:xx [NTC ploamFsm] printSerialPasswd: PW=31:32:33:34:35:36:37:38:39:30 dgasp: kerSysRegisterDyingGaspHandler: gpon0 registered [NTC ploamFsm] bcm_ploamCreate: ploam driver created. Creating CPU ring for queue number 5 with 64 packets descriptor=0xc0f92b58 Done initializing Ring 5 Base=0xa62e7880 End=0xa62e7c80 calculated entries= 64 RDD Base=0x062e7880 descriptor=0xc0f92b58 --OUTPUT_DROP--IN= OUT=bcmsw SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=76 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 Ethernet Auto Power Down and Sleep: Enabled Ethernet Auto Power Down and Sleep: Enabled Ethernet Auto Power Down and Sleep: Enabled Ethernet Auto Power Down and Sleep: Enabled Ethernet Auto Power Down and Sleep: Enabled [NTC ploam] ploamIOCstop: ploamIOCstop: error = 0 PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM PCI: Enabling device 0000:00:09.0 (0000 -> 0002) ERR: system_attr_cfg_write#819: system: status:Operation is not supported. MTU out of range 00:01:05 Got config file from /etc/telephonyProfiles.d/ROU_profile.xml (len=10054), validating.... 00:01:05 tpUpdateLocaleProfile: config file from /etc/telephonyProfiles.d/ROU_profile.xml is OK for country 27 BOS: Enter bosInit BOS: Exit bosInit ******* DSP: Found BCM6838 ******* ******* DSP: In APM Mode ******* gInterruptCounter = 0xC0C18594 gInterruptErrors = 0xC0C18590 Binding 0x8cd68968 boardHalInit completed DSP: Interrupt Ids --------------- InterruptId/Location = 87/LOW DSP: Interrupt Masks --------------- IrqMask = 0x00003300 IrqMaskLow = 0x00003300 IrqMask1 = 0x00008000 IrqMaskLow1 = 0x00008000 DSP: Interrupt Status ----------------- IrqStatus = 0x00000000 IrqStatusLow = 0x00000000 IrqStatus1 = 0x00000000 IrqStatusLow1 = 0x00000000 EndpointInit completed 00:01:05 Endpoint Event task started with pid 2098... 00:01:05 RTP read thread started with pid 2098 00:01:05 rtpInit: RTCP task created, taskId = 1972589824 00:01:05 RTP read thread started with pid 2098 00:01:05 RTCP thread started with pid 2098 00:01:05 RTP read thread started with pid 2098 00:01:05 RTP read thread started with pid 2098 00:01:05 Endpoint Packet task started with pid 2098 ... process `sysctl' is using deprecated sysctl (syscall) net.ipv6.neigh.default.retrans_time; Use net.ipv6.neigh.default.retrans_time_ms instead.