Sagemcom F@ST 5655v2

Informações sobre o Sagemcom F@ST 5655v2 ONT/ONU. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.

HELO
CPUI
L1CI
PLLI
PMCB
HELO
CPUI
L1CI
4.1603-1.0.38-116.174
DRAM
----
PHYS
ZQDN
PHYE
DINT
TST1
TST2
PASS
----
ZBSS
L12F
MAIN
Version cfe-rom: 7.31.17.1
FPS0
SVOL
NGEO
FVLY
FVLY
RVOL
J2EP


Base: 4.16_03
CFE version 1.0.38-116.174 for BCM96838 (32bit,SP,BE)
Build Date: Fri Jan 20 18:54:28 CET 2017 (g601671@rmm-1186759)
Copyright (C) 2000-2013 Broadcom Corporation.
Version cfe-ram: 7.31.17.1

Boot Strap Register:  0x800078fe
Chip ID: BCM68380_B0, MIPS: 600MHz, DDR: 533MHz, Bus: 240MHz
RDP: 800MHz
Main Thread: TP0
Total Memory: 268435456 bytes (256MB)
Boot Address: 0xbfc00000

NextLevelBoot U-boot @ 0x8fe00000

NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes
NAND flash device: Spansion S34ML01G1, id 0x01f1 block 128KB size 131072KB
Configuring RGMII pinpux
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host/tftp (f/h/c)  : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Default host ramdisk file name    :   
Default ramdisk store address     :   
Board Id (0-46)                   : F@ST5655_V2  
Number of MAC Addresses (1-32)    : 10  
Base MAC Address                  : d8:a7:56:xx:xx:xx  
PSI Size (1-64) KBytes            : 24  
Enable Backup PSI [0|1]           : 0  
System Log Size (0-256) KBytes    : 0  
Auxillary File System Size Percent: 0  
Main Thread Number [0|1]          : 0  
GPON Serial Number                : "XXXXXXXXXXXX"  
GPON Password                     : "1234567890"  
MC memory allocation (MB)         : 4  
TM memory allocation (MB)         : 20  
WLan Feature                      : 0x00  
Voice Board Configuration (0-1)   : LE9540  

enable IH Wan-Wan forwarding...
data_path_go Done!!
Set EMAC4 as TMII
Set EMAC4 as TMII
Creating CPU ring for queue number 0 with 32 packets descriptor=0x80687644
 Done initializing Ring 0 Base=0xa2214220K End=0xa2214420K calculated entries= 32 RDD Base=0x02214220K descriptor=0x80687644
Open PHY 1 on MAC 0 : link state = Down
Open PHY 2 on MAC 1 : link state = Down
Open PHY 3 on MAC 2 : link state = Down
Open PHY 4 on MAC 3 : link state = Down
Open PHY 0 on MAC 4 : link state = Down
Initializing UBI to launch u-boot!
Running UbiScan...

Found 532 UBI logical blocks on NAND
   already found a layout volume with higher sqnum
UBI Layout volume is on logical block 3d4
initialize_ubi...cferam reading uboot  ======================= !!!
UBI volume uboot has id 1
read 1065792 bytes from UBI volume 1
Ubi U-Boot Entry at 0x8fe00000
Closing network.
Starting program at 0x8fe00000

U-Boot 2011.12
Version: 7.31.17.1-full (Jan 20 2017 - 18:53:37) 
Copyright (C) 2011 - 2013 Sagemcom All rights reserved
Board: Sagemcom fast
CPU: Broadcom BCM68380 (Chip1 Rev4)
DRAM:  256 MiB
NAND:  128 MiB
Using default environment

Creating 1 MTD partitions on "nand0":
0x0000000c0000-0x000007b00000 : "mtd=2"
UBI: attaching mtd1 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd1 to ubi0
UBI: MTD device name:            "mtd=2"
UBI: MTD device size:            122 MiB
UBI: number of good PEBs:        978
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    256
UBI: number of internal volumes: 1
UBI: number of user volumes:     8
UBI: available PEBs:             85
UBI: total number of reserved PEBs: 893
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 1986/1095
Read 6632 bytes from volume permanent_param to 8de25420
Unable to retrive mac_addr from lanBaseMacAddr
mac_addr set according to wanBaseMacAddr
NVRAM MAC addr:xxxxxxxxxxxxx
NVRAM GSN:xxxxxxxxxxxxxxxxxxxxxxxx
No need to update NVRAM mac addr/gsn
Net:   enable IH Wan-Wan forwarding...
data_path_go Done!!
Set EMAC4 as TMII
Set EMAC4 as TMII
Creating CPU ring for queue number 0 with 32 packets descriptor=0x8ff04c18
 Done initializing Ring 0 Base=0xafa05130 End=0xafa05330 calculated entries= 32 RDD Base=0x0fa05130 descriptor=0x8ff04c18
BCM63xxx_RUN
sb3: sb3_sagem_init()
sb3: action: 1007
sb3: sb3_wait_for_magic()
sb3: action: 1002
Aes_key2 is NOT available
Use default one
Volume aes_key_operator not found!
aes_key_operator has not the good size (is it available?)
sb3: sb3_boot( operational )
sb3: top available addr 0x8dcc0000, ram available = 0xd8c0000 
sb3: read image operational size=175f000 to address=8c560000
sb3_load_ubivol: max_load_size=227278848
Read 24506368 bytes from volume operational to 8c560000
sb3: image operational has gsdf format
sb3: image operational signature OK
sb3: No pre-boot commands
sb3: setting kernel args
bootm 8C57F000 
## Booting kernel from Legacy Image at 8c57f000 ...
   Image Name:   scOS SG3V10000112 (8c.66.67.17v2
   Created:      2018-10-17   6:51:38 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    2424832 Bytes = 2.3 MiB
   Load Address: 80010000
   Entry Point:  803c1c70
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 3.4.11-rt19 (g503707@shz-p0000665fl) (gcc version 4.6.2 (GCC) ) #21 SMP PREEMPT Wed Oct 17 14:51:30 CST 2018
F@ST5655_V2 prom init
CPU revision is: 0002a080 (Broadcom BMIPS4350)
Determined physical RAM map:
 memory: 02400000 @ 0dc00000 (reserved)
 memory: 00400000 @ 0d800000 (reserved)
 memory: 00700000 @ 0d100000 (reserved)
 memory: 0d100000 @ 00000000 (usable)
Zone PFN ranges:
  DMA      0x00000000 -> 0x00001000
  Normal   0x00001000 -> 0x0000d100
Movable zone start PFN for each node
Early memory PFN ranges
    0: 0x00000000 -> 0x0000d100
On node 0 totalpages: 53504
free_area_init_node: node 0, pgdat 804c3420, node_mem_map 81000000
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 386 pages used for memmap
  Normal zone: 49022 pages, LIFO batch:15
PERCPU: Embedded 7 pages/cpu @811ac000 s5392 r8192 d15088 u32768
pcpu-alloc: s5392 r8192 d15088 u32768 alloc=8*4096
pcpu-alloc: [0] 0 [0] 1 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 53086
Kernel command line: ro noinitrd root=mtd:rootfs init=/etc/preinit ro rootfstype=squashfs console=ttyS0,115200 rootfs_offset=0x0028b000 rootfs_size=0x014d4000 mtdparts=nand.0:128k(nvram),640k(bcm),5120k@-5120k(data),-@768k(ubi) ubi.mtd=ubi part_main=ubi part_boot=ubi image_ubivol=operational secure board_type=00040040 console=ttyS0,115200 earlyprintk debug init=/etc/preinit irqaffinity=0
UBI image volume: "operational"
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Memory: 206720k/214016k available (3840k kernel code, 7296k reserved, 975k data, 212k init, 0k highmem)
Preemptible hierarchical RCU implementation.
NR_IRQS:256
console [ttyS0] enabled
Calibrating delay loop... 598.01 BogoMIPS (lpj=299008)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
--Kernel Config--
  SMP=1
  PREEMPT=1
  DEBUG_SPINLOCK=0
  DEBUG_MUTEXES=0
Broadcom Logger v0.1 Aug 30 2018 21:41:12
CPU revision is: 0002a080 (Broadcom BMIPS4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Brought up 2 CPUs
NET: Registered protocol family 16
PMC Driver Init... done.
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0xeff00000-0xefffffff]
pci_bus 0000:00: root bus resource [io  0xf1000000-0xf100ffff]
pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310
pci 0000:00:09.0: reg 10: [mem 0x15400400-0x154004ff]
pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320
pci 0000:00:0a.0: reg 10: [mem 0x15400300-0x154003ff]
PCI host bridge to bus 0000:01
pci_bus 0000:01: root bus resource [mem 0xd0000000-0xdfffffff]
pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
pci 0000:01:00.0: [14e4:6838] type 01 class 0x060400
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:02:00.0: [14e4:aa52] type 00 class 0x028000
pci 0000:02:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit]
pci 0000:02:00.0: reg 18: [mem 0x00000000-0x003fffff 64bit]
pci 0000:02:00.0: supports D1 D2
pci 0000:01:00.0: BAR 8: assigned [mem 0xd0000000-0xd05fffff]
pci 0000:02:00.0: BAR 2: assigned [mem 0xd0000000-0xd03fffff 64bit]
pci 0000:02:00.0: BAR 0: assigned [mem 0xd0400000-0xd0407fff 64bit]
pci 0000:01:00.0: PCI bridge to [bus 02-02]
pci 0000:01:00.0:   bridge window [mem 0xd0000000-0xd05fffff]
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
PCI host bridge to bus 0000:03
pci_bus 0000:03: root bus resource [mem 0xe0000000-0xefefffff]
pci_bus 0000:03: root bus resource [??? 0x00000000 flags 0x0]
pci 0000:03:00.0: [14e4:6838] type 01 class 0x060400
pci 0000:03:00.0: PME# supported from D0 D3hot
pci 0000:04:00.0: [14e4:a8db] type 00 class 0x028000
pci 0000:04:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit]
pci 0000:04:00.0: supports D1 D2
pci 0000:03:00.0: BAR 8: assigned [mem 0xe0000000-0xe00fffff]
pci 0000:04:00.0: BAR 0: assigned [mem 0xe0000000-0xe0007fff 64bit]
pci 0000:03:00.0: PCI bridge to [bus 04-04]
pci 0000:03:00.0:   bridge window [mem 0xe0000000-0xe00fffff]
PCI: Enabling device 0000:03:00.0 (0000 -> 0002)
bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated
skbFreeTask created successfully
gbpm_do_work scheduled
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS v0.1 Aug 30 2018 21:43:53 initialized
Broadcom GBPM v0.1 Aug 30 2018 21:43:53 initialized
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP: reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
PCI: CLS 16 bytes, default 16
init_bcm_tstamp: unhandled mips_hpt_freq=300000000, adjust constants in bcm_tstamp.c
bcm_tstamp initialized, (hpt_freq=300000000 2us_div=300 2ns_mult=0 2ns_shift=0)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering unionfs 2.5.12 (for 3.4.70)
jffs2: version 2.2. (NAND) Â 2001-2006 Red Hat, Inc.
fuse init (API version 7.18)
msgmni has been set to 403
io scheduler noop registered (default)
Broadcom NAND controller (BrcmNand Controller)
mtd->oobsize=0, mtd->eccOobSize=0
NAND_CS_NAND_XOR=00000000
B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0
brcmnand_read_id: CS0: dev_id=01f1801d
After: NandSelect=40000001, nandConfig=15142200
Block size=00020000, erase shift=17
NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11
busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
timing1 not adjusted: 65424458
timing2 not adjusted: 80000e55
BrcmNAND mfg 1 f1 SPANSION_S30ML01GP_08 128MB on CS0

Found NAND on CS0: ACC=e3441010, cfg=15142200, flashId=01f1801d, tim1=65424458, tim2=80000e55
BrcmNAND version = 0x80000500 128MB @00000000
brcmnand_scan: B4 nand_select = 40000001
brcmnand_scan: After nand_select = 40000001
handle_acc_control: default CORR ERR threshold  1 bits
ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16
page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
Brcm NAND controller version = 5.0 NAND flash size 128MB @18000000
ECC layout=brcmnand_oob_bch4_2k
brcmnand_scan:  mtd->oobsize=64
brcmnand_scan: oobavail=35, eccsize=512, writesize=2048
brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=4, eccbytes=7
-->brcmnand_default_bbt
brcmnand_default_bbt: bbt_td = bbt_slc_bch4_main_descr
Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0
Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0
brcmnand_reset_corr_threshold: default CORR ERR threshold  1 bits for CS0
brcmnand_reset_corr_threshold: CORR ERR threshold changed to 3 bits for CS0
brcmnandCET: Status -> Deferred
Master size=08000000
rootfs_ofs=0xffffffff, part1ofs=0x00000080, part2ofs=0x0000f600
Part[0] name=bcmfs, size=20000, ofs=0
Part[1] name=bcmfs_update, size=a0000, ofs=20000
Part[2] name=ubi, size=7a40000, ofs=c0000
Part[3] name=data, size=400000, ofs=7b00000
Part[4] name=nvram, size=20000, ofs=0
4 cmdlinepart partitions found on MTD device nand.0
Creating 4 MTD partitions on "nand.0":
0x000000000000-0x000000020000 : "nvram"
0x000000020000-0x0000000c0000 : "bcm"
0x000007b00000-0x000008000000 : "data"
0x0000000c0000-0x000007b00000 : "ubi"
UBI: attaching mtd3 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       1071104
UBI: attached mtd3 to ubi0
UBI: MTD device name:            "ubi"
UBI: MTD device size:            122 MiB
UBI: number of good PEBs:        978
UBI: number of bad PEBs:         0
UBI: number of corrupted PEBs:   0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     8
UBI: available PEBs:             85
UBI: total number of reserved PEBs: 893
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 1986/1095
UBI: image sequence number:  0
UBI: background thread "ubi_bgt0d" started, PID 211
Add UBI volume partitions: name=secondaryboot
Add UBI volume partitions: name=uboot
Add UBI volume partitions: name=uboot-rescue
Add UBI volume partitions: name=permanent_param
Add UBI volume partitions: name=rescue
Add UBI volume partitions: name=operational
Creating 3 MTD partitions on "operational":
0x000000000000-0x00000001f000 : "firm_header"
0x00000001f000-0x0000002aa000 : "kernel"
0x00000028b000-0x00000175f000 : "rootfs"
Add UBI volume partitions: name=filesystem1
Add UBI volume partitions: name=filesystem2
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
NET: Registered protocol family 24
usbcore: registered new interface driver usblp
i2c /dev entries driver
brcmboard: brcm_board_init entry
DYING GASP IRQ Initialized and Enabled
Serial: BCM63XX driver $Revision: 3.00 $
Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported commands)
ttyS0 at MMIO 0xb4e00500 (irq = 9) is a BCM63XX
ttyS1 at MMIO 0xb4e00520 (irq = 10) is a BCM63XX
BPM: tot_mem_size=268435456B (256MB), buf_mem_size <15%> =40265310B (38MB), num of buffers=19972, buf size=2016
Broadcom BPM Module Char Driver v0.1 Aug 30 2018 21:43:12 Registered<244>
TCP: cubic registered
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Initializing MCPD Module
Ebtables v2.0 registered
ebt_time registered
ebt_ftos registered
ebt_wmm_mark registered
L2TP core: blog_l2tp_rcv_check 
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
8021q: 802.1Q VLAN Support v1.8
VFS: Mounted root (squashfs filesystem) readonly on device 31:12.
Freeing unused kernel memory: 212k freed
kernel.hotplug = /sbin/mdev
- preinit -
- regular preinit -
- init -
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 6, name "filesystem1"
UBIFS: file system size:   6983680 bytes (6820 KiB, 6 MiB, 55 LEBs)
UBIFS: journal size:       1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  329856 bytes (322 KiB)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 7, name "filesystem2"
UBIFS: file system size:   9015296 bytes (8804 KiB, 8 MiB, 71 LEBs)
UBIFS: journal size:       1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  425813 bytes (415 KiB)
unionfs: new lower inode mtime (bindex=1, name=tmp)
bsp_gpio_data: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Driver LED and BUTTON init .....
[HAL-BSP]: kSysButtonManaged[41]: WARNING -> Button name >= Max(9)
[HAL-BSP]: kSysButtonManaged[41]: WARNING -> Button name >= Max(9)
[HAL-BSP]: kSysButtonManaged[41]: WARNING -> Button name >= Max(9)
 Driver LED and BUTTON ok .....
Endpoint: endpoint_init entry ( MS 4.16L.04 )
Endpoint: HAL-BSP : bsp board  found ... SagemcomFast5655_V2
Endpoint: Try to find table matching with : [BaseBoardId=F@ST5655_V2 / VoiceBoardId=LE9540] ...
 SUCCESS
Endpoint: endpoint_init COMPLETED
scratchpad RdpaWanType - GPON 
enable IH Wan-Wan forwarding...
data_path_go Done!!
Set EMAC4 as TMII
Bridge fastpath module. compiled Aug 30 2018 , 20:27:43
brcmchipinfo: brcm_chipinfo_init entry
NBUFF v1.0 Initialized
Initialized fcache state
Broadcom Packet Flow Cache  Char Driver v2.2 Aug 30 2018 20:24:34 Registered<242>
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Broadcom Packet Flow Cache learning via BLOG enabled.
[FHW]  pktDbgLvl[0xc1026f40]=0
[FHW]  fhw_construct: 
Initialized Fcache HW accelerator layer state
flwStatsThread created
Constructed Broadcom Packet Flow Cache v2.2 Aug 30 2018 20:24:34
i2c i2c-0: Failed to register i2c client gpon_i2c at 0x50 (-16)
i2c i2c-0: Failed to register i2c client gpon_i2c at 0x50 (-16)
i2c i2c-0: Failed to register i2c client gpon_i2c at 0x50 (-16)
i2c i2c-0: Failed to register i2c client gpon_i2c at 0x50 (-16)
Broadcom BCM68380_B0 Ethernet Network Device v0.1 Aug 30 2018 20:27:43
dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered 
eth0: <Int sw port: 0> <Logical : 00> PHY_ID <0x01800001 : 0x01> MAC : 00:00:00:00:00:01
eth1: <Int sw port: 1> <Logical : 01> PHY_ID <0x01800002 : 0x02> MAC : 00:00:00:00:00:01
eth2: <Int sw port: 2> <Logical : 02> PHY_ID <0x01800003 : 0x03> MAC : 00:00:00:00:00:01
eth3: <Int sw port: 3> <Logical : 03> PHY_ID <0x01800004 : 0x04> MAC : 00:00:00:00:00:01
eth4: <Int sw port: 4> <Logical : 04> PHY_ID <0x04e00f00 : 0x00> MAC : 00:00:00:00:00:01
Ethernet Auto Power Down and Sleep: Enabled
All Port Bit Map: 0x001f: eth0,eth1,eth2,eth3,eth4
   Chip WAN Only Ports 0000, Defined WAN Only Ports 0000, WAN Only Port Result: 0x0000:
   Chip WAN Preffered Ports 0000, Defined WAN Preffered Ports 0000, WAN Preffered Port Result: 0x0000:
   Chip LAN Only Ports 0000, Defined LAN Only Ports 0000, LAN Only Port Result: 0x0000:
   WAN/LAN Both Capable Ports 0x001f:eth0,eth1,eth2,eth3,eth4
Energy Efficient Ethernet: Enabled
Creating Enet CPU ring for queue number 1 with 512 packets,Descriptor base=a82e8080
 
eth4 Link UP 1000 mbps full duplex
Creating Enet CPU ring for queue number 0 with 512 packets,Descriptor base=a9e18080
 Broadcom Packet Flow Cache HW acceleration enabled.
Broadcom Packet Flow Cache HW acceleration enabled.
Creating CPU ring for queue number 2 with 1024 packets descriptor=0xc10cd7a4
  wfd_bind: Dev (null) wfd_idx 2 wl_radio_idx -1 Type skb configured WFD thread wfd2-thrd minQId/maxQId (10/10), status (0) qmask 0x4
Instantiating WFD 2 thread
Wifi Forwarding Driver is initialized!
dhd_module_init in
dhd_queue_budget = 256
dhd_sta_threshold = 2048
dhd_if_threshold = 65536
no wifi platform data, skip
PCI_PROBE:  bus 2, slot 0,vendor 14E4, device AA52(good PCI location)
dhdpcie_init: can't find adapter info for this chip
PCI: Enabling device 0000:02:00.0 (0000 -> 0002)
DHD: dongle ram size is set to 983040(orig 983040) at 0x180000
Creating CPU ring for queue number 7 with 128 packets descriptor=0xc0f92ba8
 Done initializing Ring 7 Base=0xa82d7080 End=0xa82d7880 calculated entries= 128 RDD Base=0x082d7080 descriptor=0xc0f92ba8
RDPA returned tx wakeup reg = <0x13099004>, val = <0x10000000>
RDPA returned rx wakeup reg = <0x1309a004>, val = <0x23000000>
dhd_attach: wl0: pre-allocated buffer mode is disabled (allocskbsz=0)
dhd_attach(): thread:dhd_watchdog_thread:2a8 started
dhd_attach(): thread:dhd0_dpc:2a9 started
dhd_deferred_work_init: work queue initialized 
Creating CPU ring for queue number 0 with 1024 packets descriptor=0xc10cd76c
  wfd_bind: Dev wl%d wfd_idx 0 wl_radio_idx 0 Type fkb configured WFD thread wfd0-thrd minQId/maxQId (8/8), status (0) qmask 0x1
Instantiating WFD 0 thread
dhd_bus_download_firmware: firmware path=/etc/wlan/dhd, nvram path=
dhdpcie_ramsize_adj: Enter
dhdpcie_download_code_file: download firmware /etc/wlan/dhd/43602a1/rtecdc.bin
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl: ID=pci/2/0/
wl: ID=pci/2/0/
wl: loading /etc/wlan/bcm43602_map.bin
wl: updating srom from flash...
wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32
wl: reading /etc/wlan/bcm43602_nvramvars.bin, file size=32
Replace or append with internal Mac Address
dhdpcie_bus_write_vars: Download, Upload and compare of NVRAM succeeded.
PCIe shared addr (0x001eac3c) read took 53023 usec before dongle is ready
DMA RX offset from shared Area 0
dhdpcie_readshared: Dongle advertizes 2 size indices
dhdpcie_readshared: Host support DMAing indices: H2D:1 - D2H:1. FW supports it
H2D DMA WR INDX : array size 272 = 2 * 134
D2H DMA RD INDX : array size 16 = 2 * 3
D2H DMA WR INDX : array size 16 = 2 * 3
H2D DMA RD INDX : array size 272 = 2 * 134
ring_info_raw: 56 
00 00 00 00 00 00 00 00 98 00 26 00 a4 00 26 00 
aa 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 86 00 00 00 
dhdpcie_readshared: max H2D queues 134
dhd_bus_start: Initializing 134 h2drings
dhd_runner_flowmgr_init: bootmem name<dhd0> addr<ad100000> size<7340032>
dhd_runner_profile_init: N+M profile = 3 01:1024 -1:2048 -1:1024 -1:0512 01:0512
dhd_runner_policy_init: N+M Policy = 0 1 (HW)
dhd_bus_cmn_writeshared:
  0000: 00 f0 c3 07 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 00 c0 07 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 a0 2c 08 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 c0 c0 07 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 00 c6 07 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 00 f0 07 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 08 00 10 
dhd_bus_cmn_writeshared:
  0000: 80 eb da 07 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 92 e3 07 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 94 e3 07 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 80 ea da 07 00 00 00 00 
Attach flowrings pool for 132 rings
Runner DHD PCIE: vendor<0x14e4> device<0xaa52> bus<2> slot<0>
PCIE_0_MISC::RC_BAR2_CONFIG_LO           0xB2804034 = 0x1000000B
PCIE_0_MISC::RC_BAR2_CONFIG_HI           0xB2804038 = 0x00000000
PCIE_0_MISC::UBUS_BAR2_CONFIG_REMAP      0xB280408C = 0x10000001
Initial configuration
=================================
	rx_post_flow_ring_base_addr : 87c00000
	tx_post_flow_ring_base_addr : ad0c4000
	rx_complete_flow_ring_base_addr : 87c60000
	tx_complete_flow_ring_base_addr : 87c0c000

	r2d_wr_arr_base_addr : 87e39400
	d2r_rd_arr_base_addr : 87daea82
	r2d_rd_arr_base_addr : 87e39200
	d2r_wr_arr_base_addr : 87daeb82
	tx_post_mgmt_arr_base_addr : 87db0000
	tx_post_mgmt_arr_base_phys_addr : 7db0000

	Doorbell ISR : c11a205c
	Doorbell CTX : 87e39800
Runner DHD Offload initialization complete
CUR_ETHERADDR : 6 
00 00 00 00 00 01 
dhd_sync_with_dongle: GET_REVINFO device 0xbc430000, vendor 0xe4140000, chipnum 0x52aa0000
Dongle Host Driver, version 7.14.131.47.cpe4.16L04.2-kdb
Compiled in drivers/net/wireless/bcmdhd on Aug 30 2018 at 20:25:24
wfd_registerdevice Successfully registered dev wl0 ifidx 0 wfd_idx 0
dhdpcie_chipmatch: Unsupported vendor 14e4 device a8db
dhdpcie_pci_probe: chipmatch failed!!
Broadcom PCI Device 0x6838 has allocated with driver pcieport
Broadcom PCI Device 0x6838 has allocated with driver pcieport
dhd_module_init out
--SMP support
wl: dsl_tx_pkt_flush_len=338
wl: norm_wmark_tot=12981, pktc_wmark_tot=12981
PCI: Enabling device 0000:04:00.0 (0000 -> 0002)
wl: passivemode=1
wl: napimode=0
initvars_cis_pci: Not CIS format
Neither SPROM nor OTP has valid image
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl: ID=pci/4/0/
wl: ID=pci/4/0/
wl: loading /etc/wlan/bcm43217_map.bin
srom rev:8
wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32
wl1: allocskbmode=1 currallocskbsz=2300
Creating CPU ring for queue number 1 with 1024 packets descriptor=0xc10cd788
  wfd_bind: Dev wl%d wfd_idx 1 wl_radio_idx 1 Type skb configured WFD thread wfd1-thrd minQId/maxQId (9/9), status (0) qmask 0x2
Instantiating WFD 1 thread
wfd_registerdevice Successfully registered dev wl1 ifidx 0 wfd_idx 1
wl1: Broadcom BCM43227 802.11 Wireless Controller 7.14.131.47.cpe4.16L04.2-kdb
dgasp: kerSysRegisterDyingGaspHandler: wl1 registered 
Board not populated with PMD 
RDPA Speed Service Command Driver
scratchpad RdpaWanType - GPON 
START GPON SerDes Init script
 !!!!   PLL locked !!!!!!     !!!!   RX CDR locked !!!!!!     !!!!   TX CDR locked !!!!!!    GPON BEN Calibration Done 
GPON SerDes Initialization Sequence Done 
LOGGER driver Init Done : 0x87d9d900
enable IH Wan-Wan forwarding...
Creating CPU ring for queue number 6 with 32 packets descriptor=0xc0f92b80
 Done initializing Ring 6 Base=0xa623c480 End=0xa623c680 calculated entries= 32 RDD Base=0x0623c480 descriptor=0xc0f92b80
[NTC ploamFsm] printSerialPasswd: SN=xx:xx:xx:xx:xx:xx:xx:xx
[NTC ploamFsm] printSerialPasswd: PW=31:32:33:34:35:36:37:38:39:30
dgasp: kerSysRegisterDyingGaspHandler: gpon0 registered 
[NTC ploamFsm] bcm_ploamCreate: ploam driver created.
Creating CPU ring for queue number 5 with 64 packets descriptor=0xc0f92b58
 Done initializing Ring 5 Base=0xa62e7880 End=0xa62e7c80 calculated entries= 64 RDD Base=0x062e7880 descriptor=0xc0f92b58
--OUTPUT_DROP--IN= OUT=bcmsw SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=76 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 
Ethernet Auto Power Down and Sleep: Enabled
Ethernet Auto Power Down and Sleep: Enabled
Ethernet Auto Power Down and Sleep: Enabled
Ethernet Auto Power Down and Sleep: Enabled
Ethernet Auto Power Down and Sleep: Enabled
[NTC ploam] ploamIOCstop: 
ploamIOCstop: error = 0 

PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
ERR: system_attr_cfg_write#819: system: status:Operation is not supported. MTU out of range
00:01:05 Got config file from /etc/telephonyProfiles.d/ROU_profile.xml (len=10054), validating....

00:01:05 tpUpdateLocaleProfile: config file from /etc/telephonyProfiles.d/ROU_profile.xml is OK for country 27
BOS: Enter bosInit 
BOS: Exit bosInit 
******* DSP: Found BCM6838 *******
******* DSP: In APM Mode *******
gInterruptCounter    = 0xC0C18594 
gInterruptErrors     = 0xC0C18590 
Binding 0x8cd68968
boardHalInit completed
DSP: Interrupt Ids
---------------
InterruptId/Location      = 87/LOW 

DSP: Interrupt Masks
---------------
IrqMask                   = 0x00003300 
IrqMaskLow                = 0x00003300 
IrqMask1                  = 0x00008000 
IrqMaskLow1               = 0x00008000 

DSP: Interrupt Status
-----------------
IrqStatus                 = 0x00000000 
IrqStatusLow              = 0x00000000 
IrqStatus1                = 0x00000000 
IrqStatusLow1             = 0x00000000 
EndpointInit completed
00:01:05 Endpoint Event task started with pid 2098...

00:01:05  RTP read thread started with pid 2098 

00:01:05 rtpInit: RTCP task created, taskId = 1972589824
00:01:05  RTP read thread started with pid 2098 

00:01:05  RTCP thread started with pid 2098 

00:01:05  RTP read thread started with pid 2098 

00:01:05  RTP read thread started with pid 2098 

00:01:05 Endpoint Packet task started with pid 2098 ...

process `sysctl' is using deprecated sysctl (syscall) net.ipv6.neigh.default.retrans_time; Use net.ipv6.neigh.default.retrans_time_ms instead.