O3 Labs

Essa página está em modo somente de leitura. Você pode visualizar a fonte, mas não alterá-la. Informe-se com o administrador do Wiki, caso você ache que isso está incorreto.
====== Sagemcom F@st 5350 GV ======

{{description>Informações sobre o PowerBox GVT Sagemcom F@st 5350 GV. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.}}

===== Disclaimer =====

<WRAP center round important 80%>
Modifique o dispositivo **somente** se for o proprietário. A maioria destes são fornecidos pelo seu ISP em regime de comodato como parte do serviço de internet. **Não** faça modificações caso o aparelho não seja seu.
</WRAP>

<WRAP center round important 80%>
Todos os métodos de desbloqueio e material sobre modificações foram criados pelo O3 Labs e disponibilizados **GRATUITAMENTE** desde o dia de sua elaboração. Espalhem esta informação e ajudem a evitar que **PICARETAS** roubem e vendam estas informações por aí, seja no Mercado Livre ou por quaisquer outros meios.
</WRAP>

===== Hardware ======

^ SoC | BCM63168VFKEBG - Broadcom 400 MHz dual-core MIPS ADSL2+/VDSL2 IAD SoC ( BMIPS4350 V8.0 CPU ) |
^ RAM | H5TQ1G63EFR - SK hynix 1 Gbit (128 MB) DDR3 SDRAM |
^ Flash | H27U1G8F2CTR – Hynix 1 Gbit (128 MB) NAND |
^ Switch | BCM53124 – Broadcom 6-Port Integrated GbE |
^ USB | 2 x 2.0 |
^ Wireless | Broadcom BCM435F 2.4 GHz |
^ FXS | 2 ( SiLabs Si32260 Dual ProSLIC ) |
^ xDSL Line Driver | BCM6302 - Broadcom line driver |
^ xDSL PHY Ver | A2pv6F039d.d24k (xdslctl version 1.2) na versão SG790131200418 |
^ HPNA | 3.1 ( CopperGate CG3211QIR + CopperGate CG3213QIR ) |
^ Serial | Sim |
^ JTAG | ? |

===== Configurações =====

Antes de efetuar quaisquer modificações abaixo, execute estas linhas no console de seu navegador:

  var x = $.xmo;
  x.init();
  x.login("internal", "");

Após a execução, continue com as alterações desejadas.

=== Listar todos os parâmetros disponíveis no XMO ===

  x.getValuesTree("Device");

=== RunLevel ===

  x.setValuesTree(4, "Device/Managers/NetworkData/RunLevel");
  
Substitua o "4" pelo RunLevel desejado, podendo este ser 2 ou 4. Atenção! O modo 4 pode afetar os serviços de telefonia e TV. A TV pode ser ativada ligando o HPNA, veja [[f5350gv#Ativar HPNA]] (baseado em relatos de usuários).

=== Servidores DNS ===

  x.setValuesTree("true", "Device/DNS/Relay/Forwardings/Forwarding[@uid='1']/Enable");
  x.setValuesTree("8.8.8.8", "Device/DNS/Relay/Forwardings/Forwarding[@uid='1']/DNSServer");
  x.setValuesTree("true", "Device/DNS/Relay/Forwardings/Forwarding[@uid='2']/Enable");
  x.setValuesTree("8.8.4.4", "Device/DNS/Relay/Forwardings/Forwarding[@uid='2']/DNSServer");
  x.setValuesTree("false", "Device/DNS/Relay/Forwardings/Forwarding[@uid='3']/Enable");
  x.setValuesTree("false", "Device/DNS/Relay/Forwardings/Forwarding[@uid='4']/Enable");

Para retornar aos servidores fornecidos pelo DHCP do ISP:

  x.setValuesTree("false", "Device/DNS/Relay/Forwardings/Forwarding[@uid='1']/Enable");
  x.setValuesTree("false", "Device/DNS/Relay/Forwardings/Forwarding[@uid='2']/Enable");
  x.setValuesTree("true", "Device/DNS/Relay/Forwardings/Forwarding[@uid='3']/Enable");
  x.setValuesTree("true", "Device/DNS/Relay/Forwardings/Forwarding[@uid='4']/Enable");

=== Ativar HPNA ===

  x.setValuesTree("true", "Device/HPNA/Enable");

=== Desativar TR069 ===

  x.setValuesTree("false", "Device/ManagementServer/EnableCWMP");
  x.setValuesTree("http://", "Device/ManagementServer/URL");

=== Alteração ATM VPI/VCI para ADSL ===

  x.setValuesTree("0/35", "Device/ATM/Links/Link[Alias='ATM_DATA']/DestinationAddress");
  
=== Ativação VoIP ===

Caso o telefone tenha parado de funcionar após alterações no modem (o perfil de voz/SIP ainda intacto), tente ativá-lo novamente:
  x.setValuesTree(2,"Device/Services/VoiceServices/VoiceService[1]/VoiceProfiles/VoiceProfile[1]/Lines/Line[1]/Enable");
  x.setValuesTree(2,"Device/Services/VoiceServices/VoiceService[1]/VoiceProfiles/VoiceProfile[1]/Enable");
  x.setValuesTree("true","Device/Services/VoiceServices/VoiceService[1]/X_SAGEMCOM_VoiceManagement/VoiceServiceEnable");
===== Bootlog =====

<code>
HELO
CPUI
L1CI
HELO
CPUI
L1CI
DRAM
----
PHYS
STRF
400H
PHYE
DDR3
SIZ4
SIZ3
SIZ2
DINT
USYN
LSYN
MFAS
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
FPS0
SVOL
NGEO
FVLY
FVLY
RVOL
J2EP
SeKO


CFE version 1.0.38-112.118 for BCM963268 (32bit,SP,BE)
Build Date: Fri Jul 12 13:19:06 CEST 2013 (g178451@rmm-p1188627fl)
Copyright (C) 2000-2011 Broadcom Corporation.

CFE (soft operational)
NAND flash device: name Hynix H27U1G8F2B, id 0xadf1 block 128KB size 131072KB
Access type is MDIO_BUS
External switch id = 53125 
Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000

NextLevelBoot U-boot @ 0x87f00000

Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Launch linux/uboot (l/u)          : l  
Board Id (0-7)                    : F@ST5350GV  
Number of MAC Addresses (1-32)    : 10  
Base MAC Address                  : 00:10:18:00:00:00  
PSI Size (1-64) KBytes            : 24  
Enable Backup PSI [0|1]           : 0  
System Log Size (0-256) KBytes    : 0  
Main Thread Number [0|1]          : 0  

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 110
Initializing UBI to launch u-boot!
UBI volume uboot has id 1
read 834456 bytes from UBI volume 1
SHATEST=2.
Ubi U-Boot Entry at 0x87f00000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x87f00000

U-Boot 2011.12
Version: 4.10.0-full (Jul 12 2013 - 13:19:02) 
Copyright (C) 2011 - 2013 Sagemcom All rights reserved
gpio in: 0x40cfdf1f 
board type: 00020010
board memsize : 0x08000000
CPU: Broadcom BCM63168D0
DRAM:  128 MiB
NAND:  bcm63xxx nand initialization
handle_acc_control: default CORR ERR threshold  1 bits
ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16
reqEccLevel=0, eccLevel=4
128 MiB
Creating 1 MTD partitions on "nand0":
0x0000000c0000-0x000007b00000 : "mtd=1"
UBI: attaching mtd1 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd1 to ubi0
UBI: MTD device name:            "mtd=1"
UBI: MTD device size:            122 MiB
UBI: number of good PEBs:        978
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    256
UBI: number of internal volumes: 1
UBI: number of user volumes:     7
UBI: available PEBs:             299
UBI: total number of reserved PEBs: 679
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 6/1
Volume bootenv not found!
*** Warning - bad CRC, using default environment

Net:   BCM63xxx
Hit any key to stop autoboot:  3  2  1  0 
sb3: sb3_sagem_init()
sb3: action: 1007
sb3: sb3_wait_for_magic()
sb3: action: 1002
sb3: sb3_boot( operational )
sb3: top available addr 0x878b0000, ram available = 0x74b0000 
sb3_load_ubivol: max_load_size=122355712
Read 20192532 bytes from volume operational to 80400000
sb3: image operational moved to 86570000-878b1d14
gsdf ident string OK
gsdf size OK
gsdf auth_hash OK
sb3: image operational has gsdf format
gsdf ident string OK
gsdf size OK
gsdf auth_hash OK
found a root CA certificate in section 0
found a secondary certificate in section 1
certificate chain OK
root certificate OK  (sagemcom caCert)
not a livebox. no subject name verification
signature OK
section list OK
gsdf head_hash OK
gsdf data_hash OK
sb3: image operational signature OK
BCM63xx : unregistering Ethernet driver 
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
sb3: No pre-boot commands
sb3: setting kernel args
bootm 86570C98 
## Booting kernel from Legacy Image at 86570c98 ...
   Image Name:   scOS SG790131200068 (3.12.35)
   Created:      2013-07-19  15:34:34 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    2031616 Bytes = 1.9 MiB
   Load Address: 80010000
   Entry Point:  80337e30
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 2.6.30 (orange1@rmm08070) (gcc version 4.4.2 (GCC) ) #4 SMP PREEMPT Fri Jul 19 17:34:23 CEST 2013
argc 14 arg a79c032c env a79c0840 
memsize  board_memsize = 128
env memsize=128 
env initrd_start=0xA0000000 
env initrd_size=0x0 
flash_start 0
env flash_start=0x00000000 
board_flash_size ffffffff
env flash_size=0xFFFFFFFF 
env ethaddr=00:01:02:03:04:05 
arg[1] root=mtd:rootfs 
arg[2] init=/etc/preinit 
arg[3] ro 
arg[4] rootfstype=squashfs 
arg[5] console=ttyS0,115200 
arg[6] rootfs_offset=0x001f0d14 
arg[7] rootfs_size=0x01151000 
arg[8] mtdparts=nand:768k(bcm),125184k(partAll),5120k(data) 
arg[9] ubi.mtd=ubi 
arg[10] part_main=partAll 
arg[11] part_boot=partAll 
arg[12] image_ubivol=operational 
arg[13] board_type=00020030 
BCM Flash API. Flash device is not found.
F@ST5350GV prom init
CPU revision is: 0002a080 (Broadcom4350)
DSL SDRAM reserved: 0x132000
Determined physical RAM map:
 memory: 07ece000 @ 00000000 (usable)
Zone PFN ranges:
  DMA      0x00000000 -> 0x00001000
  Normal   0x00001000 -> 0x00007ece
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00007ece
On node 0 totalpages: 32462
free_area_init_node: node 0, pgdat 803fc070, node_mem_map 81000000
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 222 pages used for memmap
  Normal zone: 28144 pages, LIFO batch:7
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32208
Kernel command line: root=mtd:rootfs init=/etc/preinit ro rootfstype=squashfs console=ttyS0,115200 rootfs_offset=0x001f0d14 rootfs_size=0x01151000 mtdparts=nand:768k(bcm),125184k(partAll),5120k(data) ubi.mtd=ubi part_main=partAll part_boot=partAll image_ubivol=operational board_type=00020030 
UBI image volume: "operational"
wait instruction: enabled
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
NR_IRQS:128
PID hash table entries: 512 (order: 9, 2048 bytes)
console [ttyS0] enabled
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 124024k/129848k available (3263k kernel code, 5652k reserved, 769k data, 160k init, 0k highmem)
Calibrating delay loop... 398.33 BogoMIPS (lpj=199168)
Mount-cache hash table entries: 512
--Kernel Config--
  SMP=1
  PREEMPT=1
  DEBUG_SPINLOCK=0
  DEBUG_MUTEXES=0
Broadcom Logger v0.1 Jul 19 2013 07:42:11
CPU revision is: 0002a080 (Broadcom4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Calibrating delay loop... 402.43 BogoMIPS (lpj=201216)
Brought up 2 CPUs
net_namespace: 1140 bytes
NET: Registered protocol family 16
Total Flash size: 0K with -1 sectors
Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (000087b8-000087b4=4<300)
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10013fff]
pci 0000:00:00.0: reg 30 32bit mmio: [0x000000-0x0007ff]
pci 0000:00:00.0: supports D1 D2
pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
pci 0000:00:00.0: PME# disabled
pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff]
pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff]
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:01:00.0: PME# disabled
pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
pci 0000:01:00.0:   IO window: disabled
pci 0000:01:00.0:   MEM window: disabled
pci 0000:01:00.0:   PREFETCH window: disabled
PCI: Setting latency timer of device 0000:01:00.0 to 64
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS v0.1 Jul 19 2013 07:45:12 initialized
Broadcom GBPM v0.1 Jul 19 2013 07:45:13 initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
Switched to high resolution mode on CPU 1
Switched to high resolution mode on CPU 0
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering unionfs 2.5.10 (for 2.6.30.10)
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.11)
msgmni has been set to 242
io scheduler noop registered
io scheduler deadline registered (default)
PCI: Setting latency timer of device 0000:01:00.0 to 64
Driver 'sd' needs updating - please use bus_type methods
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
bcm963xx_mtd driver v1.0
Failed to read image tag from flash
Broadcom DSL NAND controller (BrcmNand Controller)
-->brcmnand_scan: CS=0, numchips=1, csi=0
mtd->oobsize=0, mtd->eccOobSize=0
NAND_CS_NAND_XOR=00000000
Disabling XOR on CS#0
brcmnand_scan: Calling brcmnand_probe for CS=0
B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0
brcmnand_read_id: CS0: dev_id=adf1801d
After: NandSelect=40000001, nandConfig=15142200
Block size=00020000, erase shift=17
NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11
busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
timing1 not adjusted: 6574845b
timing2 not adjusted: 00001e96
brcmnand_adjust_acccontrol: gAccControl[CS=0]=00000000, ACC=f7441010
BrcmNAND mfg ad f1 Hynix HY27UF081G2A 128MB on CS0

Found NAND on CS0: ACC=f7441010, cfg=15142200, flashId=adf1801d, tim1=6574845b, tim2=00001e96
BrcmNAND version = 0x0400 128MB @00000000
brcmnand_scan: Done brcmnand_probe
brcmnand_scan: B4 nand_select = 40000001
brcmnand_scan: After nand_select = 40000001
100 CS=0, chip->ctrl->CS[0]=0
handle_acc_control: default CORR ERR threshold  1 bits
ECC level threshold set to 1 bits
ECC level 4, threshold at 1 bits
ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16
reqEccLevel=0, eccLevel=4
190 eccLevel=4, chip->ecclevel=4, acc=f7441010
brcmnand_scan 10
200 CS=0, chip->ctrl->CS[0]=0
200 chip->ecclevel=4, acc=f7441010
page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
brcmnand_scan 220
Brcm NAND controller version = 4.0 NAND flash size 128MB @18000000
brcmnand_scan 230
brcmnand_scan 40, mtd->oobsize=64, chip->ecclayout=00000000
brcmnand_scan 42, mtd->oobsize=64, chip->ecclevel=4, isMLC=0, chip->cellinfo=0
ECC layout=brcmnand_oob_bch4_2k
brcmnand_scan:  mtd->oobsize=64
brcmnand_scan: oobavail=35, eccsize=512, writesize=2048
brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=4, eccbytes=7
300 CS=0, chip->ctrl->CS[0]=0
500 chip=87a50990, CS=0, chip->ctrl->CS[0]=0
-->brcmnand_default_bbt
brcmnand_default_bbt: bbt_td = bbt_slc_bch4_main_descr
Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0
Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0
brcmnand_reset_corr_threshold: default CORR ERR threshold  1 bits for CS0
ECC level threshold default value is 1 bits for CS0
brcmnand_reset_corr_threshold: CORR ERR threshold changed to 3 bits for CS0
brcmnandCET: Status -> Deferred
brcmnand_scan 99
Creating 5 MTD partitions on "brcmnand.0":
0x000000000000-0x000000020000 : "bcmfs"
0x000000020000-0x0000000c0000 : "bcmfs_update"
0x0000000c0000-0x000007b00000 : "ubi"
0x000007b00000-0x000007f00000 : "data"
0x000000000000-0x000000020000 : "nvram"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
Add UBI volume partitions: name=secondaryboot
Add UBI volume partitions: name=uboot
Add UBI volume partitions: name=permanent_param
Add UBI volume partitions: name=operational
Creating 3 MTD partitions on "operational":
0x000000000000-0x00000001f000 : "firm_header"
0x00000001f000-0x00000020fd14 : "kernel"
mtd: partition "kernel" doesn't end on an erase block -- force read-only
0x0000001f0d14-0x000001341d14 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
Add UBI volume partitions: name=rescue
Add UBI volume partitions: name=filesystem1
Add UBI volume partitions: name=gui
Creating 2 MTD partitions on "gui":
0x000000000000-0x00000001f000 : "gui_header"
mtd: partition "gui_header" is out of reach -- disabled
0x000000000000-0x000000000000 : "guifs"
mtd: partition "guifs" is out of reach -- disabled
UBI: attached mtd2 to ubi0
UBI: MTD device name:            "ubi"
UBI: MTD device size:            122 MiB
UBI: number of good PEBs:        978
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    256
UBI: number of internal volumes: 1
UBI: number of user volumes:     7
UBI: available PEBs:             299
UBI: total number of reserved PEBs: 679
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 6/1
brcmboard: brcm_board_init entry
PCIe: No device found - Powering down
Serial: BCM63XX driver $Revision: 6 $
Magic SysRq enabled (type ^ h for list of supported commands)
ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX
ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX
bcmPktDma_init: Broadcom Packet DMA Library initialized
Total # RxBds=1448
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized

bcmxtmrt: Broadcom BCM3168D0 ATM/PTM Network Device v0.4 Jul 19 2013 07:44:26
p8021ag: p8021ag_init entry
IPSEC SPU: SUCCEEDED 
UBI: background thread "ubi_bgt0d" started, PID 50
GACT probability NOT on
Mirror/redirect action on
u32 classifier
    input device check on 
    Actions configured 
GRE over IPv4 tunneling driver
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Initializing MCPD Module
Ebtables v2.0 registered
ebt_time registered
ebt_ftos registered
ebt_wmm_mark registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:11.
Freeing unused kernel memory: 160k freed
Warning: unable to open an initial console.
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
- init -
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 5, name "filesystem1"
UBIFS: file system size:   11046912 bytes (10788 KiB, 10 MiB, 87 LEBs)
UBIFS: journal size:       1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  521772 bytes (509 KiB)

       _   _ _____ _    _  ___ 
      | | | |  __ \ |  | |/ __)
      | |_| | |  \/ |  | / /__ 
      |  _  | | __| |/\| |  _ \
      | | | | |_\ \  /\  / (_) )
      \_| |_/\____/\/  \/ \___/

   Embedded Sagemcom Linux Distribution
 ---------------------------------------------------
unionfs: new lower inode mtime (bindex=1, name=dev)

  Version: SG790131200068 (3.12.35)
  Built: by orange1@rmm08070 on Fri Jul 19 17:14:38 CEST 2013

(none) login: usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NTFS driver 2.1.29 [Flags: R/W MODULE].
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[HAL-BSP]: Load ...
[HAL-BSP]: 	Manufacturer(Sagemcom) Serial Number(xxxxxxxxxxxxxxx)
[HAL-BSP]: 	Sagem Hardware ProductId(SagemcomFast5350_GVT) Version(S.2.0) Revision(1.0)
[HAL-BSP]: 	Customer Hardware ProductId(GVT) Version(Fast5350GV) Revision(1.1)
[HAL-BSP]: 	Firmware Version() Type(Unknown Firmware Type)
[HAL-BSP]: 	Size {Ram -> [Pp(131072) Linux(124356)] Flash ->[Pp(131072)]}
[HAL-BSP]: Ok ...
 Driver LED and BUTTON init .....
 Driver LED and BUTTON ok .....
ip_tables: (C) 2000-2006 Netfilter Core Team
nf_conntrack version 0.5.0 (2028 buckets, 8112 max)
nf_ct_rtsp: Successfully created nf_conntrack_rtsp task
Netfilter messages via NETLINK v0.30.
ip6_tables: (C) 2000-2006 Netfilter Core Team
ctnetlink v0.93: registering with nfnetlink.
bcm_ingqos: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Broadcom Ingress QoS Module  Char Driver v0.1 Jul 19 2013 05:39:20 Registered<243>

Broadcom Ingress QoS ver 0.1 initialized
BPM: tot_mem_size=134217728B (128MB), buf_mem_size=20132655B (19MB), num of buffers=9532, buf size=2112
Broadcom BPM Module Char Driver v0.1 Jul 19 2013 05:39:10 Registered<244>
[NTC bpm] bpm_set_status: BPM status : enabled 

NBUFF v1.0 Initialized
Initialized fcache state
Broadcom Packet Flow Cache  Char Driver v2.2 Jul 19 2013 05:39:21 Registered<242>
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Broadcom Packet Flow Cache learning via BLOG enabled.
Constructed Broadcom Packet Flow Cache v2.2 Jul 19 2013 05:39:21
chipId 0x631680D0
Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jul 19 2013 05:39:11 Registered <241>
FAP Debug values at 0x00000010 0x00000010
Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
FAP Debug values at 0xa549b720 0xa54db720
Allocated FAP0 GSO Buffers (0xA54A17D0) : 1048576 bytes @ 0xA5500000
Allocated FAP1 GSO Buffers (0xA54E17D0) : 1048576 bytes @ 0xA5600000
Allocated FAP0 TM SDRAM Queue Storage (a54a17d4) : 341376 bytes @ a5700000
Allocated FAP1 TM SDRAM Queue Storage (a54e17d4) : 341376 bytes @ a5780000
[NTC fapProto] fapReset  : Reset FAP Protocol layer
[FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><6600>, free <56>, total<8192>
[FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><6600>, free <56>, total<8192>
[FAP0] PSM : addr<0x80002000>, used <24484>, free <92>, total <24576>
[FAP1] PSM : addr<0x80002000>, used <24484>, free <92>, total <24576>
[FAP0] Flows supported: 217 (dsp 56, psm 21, qsm 140)
[FAP1] Flows supported: 217 (dsp 56, psm 21, qsm 140)
[FAP0] DQM : availableMemory 15064 bytes, nextByteAddress 0xE0010528
[FAP1] DQM : availableMemory 15064 bytes, nextByteAddress 0xE0010528
[FAP0] GSO Buffer set to 0xA5500000
[FAP1] GSO Buffer set to 0xA5600000
[FAP0] FAP BPM Initialized.
[FAP1] FAP BPM Initialized.
fapDrv_construct: FAP0: pManagedMemory=b0820710. wastage 8 bytes
fapDrv_construct: FAP1: pManagedMemory=b0a20710. wastage 8 bytes
bcmPktDma_bind: FAP Driver binding successfull
[FAP0] FAP TM: ON
[FAP1] FAP TM: ON
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
Broadcom BCM63168D0 Ethernet Network Device v0.1 Jul 19 2013 05:41:52
fapDrv_psmAlloc: fapIdx=0, size: 4000, offset=b0820710 bytes remaining 7000
ETH Init: Ch:0 - 200 tx BDs at 0xb0820710
fapDrv_psmAlloc: fapIdx=1, size: 4000, offset=b0a20710 bytes remaining 7000
ETH Init: Ch:1 - 200 tx BDs at 0xb0a20710
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b08216b0 bytes remaining 2184
ETH Init: Ch:0 - 600 rx BDs at 0xb08216b0
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a216b0 bytes remaining 2184
ETH Init: Ch:1 - 600 rx BDs at 0xb0a216b0
ethsw.c : Ext switch TMII Port 5
dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered 
eth0: MAC Address: 00:00:00:00:00:01
eth1: MAC Address: 00:00:00:00:00:01
eth2: MAC Address: 00:00:00:00:00:01
eth3: MAC Address: 00:00:00:00:00:01
eth4: MAC Address: 00:00:00:00:00:01
eth5: MAC Address: 00:00:00:00:00:01
[NTC arl] arlEnable : Enabled ARL binding to FAP
Broadcom Adress Resolution Logic Processor (ARL) Char Driver v0.1 Jul 19 2013 05:39:09 Registered <245>
Broadcom 802.1Q VLAN Interface, v0.1
--SMP support
wl: dsl_tx_pkt_flush_len=338
wl: high_wmark_tot=6195
PCI: Setting latency timer of device 0000:00:00.0 to 64
wl: passivemode=1
wl: napimode=0
wl0: allocskbmode=1 currallocskbsz=512
otp_read_pci: bad crc
Neither SPROM nor OTP has valid image
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl:loading /etc/wlan/bcm6362_vars.bin
Failed to open srom image from '/etc/wlan/bcm6362_vars.bin'.
wl:loading /etc/wlan/bcm6362_map.bin
wl0: Broadcom BCM435f 802.11 Wireless Controller 5.100.138.2008.cpe4.12L06A.4-kdb
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered 
usbcore: registered new interface driver usblp
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
option: v0.7.2:USB Driver for GSM modems
Endpoint: endpoint_init entry
in BpGetVoiceBoardIdin BpGetVoiceParmspszBoardId=SI32260  pszBaseBoardId=F@ST5350GV myBaseBoardId=F@ST5350Endpoint: endpoint_init COMPLETED
eth4 (switch port: 5) Link UP 200 mbps full duplex
message received before monitor task is initialized kerSysSendtoMonitorTask 
eth0 (switch port: 1) Link UP 100 mbps full duplex
message received before monitor task is initialized kerSysSendtoMonitorTask 
fapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22980 bytes remaining 584
XTM Init: Ch:0 - 200 rx BDs at 0xb0a22980
fapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a22fc0 bytes remaining 456
XTM Init: Ch:1 - 16 rx BDs at 0xb0a22fc0
bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system 
bcmxtmcfg: gulBondDslMonitorValid = 1 
BcmAdsl_Initialize=0xC0BB9C20, g_pFnNotifyCallback=0xC0BF8014
lmemhdr[2]=0x100CE000, pAdslLMem[2]=0x100CE000
pSdramPHY=0xA7FFFFF8, 0xFFFFFFFF 0xFFFFFFFF
*** XfaceOffset: 0x5FF90 => 0x5FF90 ***
*** PhySdramSize got adjusted: 0xE3FB4 => 0x11A6E0 ***
AdslCoreSharedMemInit: shareMemSize=96509(96512)
AdslCoreHwReset:  pLocSbSta=84048000 bkupThreshold=3072
AdslCoreHwReset:  AdslOemDataAddr = 0xA7FA34F4
***BcmDiagsMgrRegisterClient: 0 ***
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered 
ADDRCONF(NETDEV_UP): eth1: link is not ready
ADDRCONF(NETDEV_UP): eth2: link is not ready
ADDRCONF(NETDEV_UP): eth3: link is not ready
eth0 (switch port: 1)  Link DOWN.
message received before monitor task is initialized kerSysSendtoMonitorTask 
eth0 (switch port: 1) Link UP 100 mbps full duplex
message received before monitor task is initialized kerSysSendtoMonitorTask 
device eth0 entered promiscuous mode
BR_LAN: port 1(eth0) entering learning state
BR_LAN: port 1(eth0) entering forwarding state
device eth4 entered promiscuous mode
BR_LAN: port 2(eth4) entering learning state
BR_LAN: port 2(eth4) entering forwarding state
device wl0 entered promiscuous mode
BR_LAN: port 3(wl0) entering learning state
BR_LAN: port 3(wl0) entering forwarding state
device wl0.1 entered promiscuous mode
BR_HOTSPOT: port 1(wl0.1) entering learning state
BR_HOTSPOT: port 1(wl0.1) entering forwarding state
device wl0.1 left promiscuous mode
BR_HOTSPOT: port 1(wl0.1) entering disabled state
BOS: Enter bosInit 
BOS: Exit bosInit 
endpoint_open COMPLETED
******* DSP: Found BCM963268 *******
******* DSP: In PCM Mode *******
******* DSP: PCM running in 16 bit mode *******
gInterruptCounter     = 0xC1A98F40 
gInterruptErrors      = 0xC1A98F44 
gNextRxDesc           = 0xC1A99064 
gNextTxDesc           = 0xC1A99060 
gDectTestMode         = 0xc18bfe2c 
dectBuffStart         = 0xc18bfe38 
gDectRxOutOfSyncCounter = 0xc18bfe3c 
gDectTxOutOfSyncCounter = 0xc18bfe40 
32 ms ECAN tail-length
*** gStartRxDesc[0] = 0xA0C00000 
*** gBufferSizeBytes = 640 
*** gStartTxDesc[0] = 0xA0C01000 
halPcmInit 370 nextTxDesc = 0xA0C01000 
halPcmInit 370 nextTxDesc = 0xA0C01008 
halPcmInit 374 Ownership for TX desc not set. Use this buffer. 
[DBG xdrv_slic] slicSi32261Init: (ts: 39s 722ms):SLIC: Starting 32261 device and line initializion...
[DBG xdrv_slic] deviceSiLabsReset: (ts: 40s 237ms):SLIC: Reset applied on GPIO pin 14
[DBG xdrv_slic] initSiLabsDevice: (ts: 40s 251ms):SLIC: Initializing SiLabs device 0
si3226x : Channel 0 : Type = PROSLIC
si3226x : Channel 1 : Type = PROSLIC
si3226x : Channel 0 : Chip Type 28
si3226x : Channel 0 : Chip Rev 3
si3226x : Channel 1 : Chip Type 28
si3226x : Channel 1 : Chip Rev 3
VBAT @ 50ms = 58.692 v
VBAT Up = 58.692 v
VBAT @ 50ms = 58.692 v
VBAT Up = 58.901 v
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
[DBG xdrv_slic] initSiLabsDevice: (ts: 41s 441ms):SLIC: SiLabs device BOM Type: 0
[DBG xdrv_slic] initSiLabsDevice: (ts: 41s 449ms):SLIC: SiLabs device 0 initialized OK
ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 467ms):SLIC: SiLabs Locale set to 3
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 475ms):SLIC: Initializing SiLabs FXS line 0
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 509ms):FXS channel 0 Rx Gain: -11
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 509ms):FXS channel 0 Tx Gain: -4
Si3226x PCMStart
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: FXS line 0 RX timeslot = 0 
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: FXS line 0 TX timeslot = 0 
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: SiLabs FXS line 0 initialized OK
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 525ms):SLIC: Initializing SiLabs FXS line 1
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 565ms):FXS channel 1 Rx Gain: -11
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 573ms):FXS channel 1 Tx Gain: -4
Si3226x PCMStart
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 598ms):SLIC: FXS line 1 RX timeslot = 1 
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 606ms):SLIC: FXS line 1 TX timeslot = 1 
[DBG xdrv_slic] initSiLabsLines: (ts: 41s 615ms):SLIC: SiLabs FXS line 1 initialized OK
[DBG xdrv_slic] slicSi32261Init: (ts: 41s 624ms):SLIC: 32261 device 0 and FXS initializion COMPLETED OK !
boardHalInit completed
hub 1-0:1.0: 2 ports detected
DSP: Interrupt Masks
---------------
IrqMask                   = 0x00003000 
IrqMask1                  = 0x00000400 

DSP: Interrupt Status
-----------------
IrqStatus                 = 0x00100000 
IrqStatus1                = 0x00100000 
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
EndpointInit completed
dgasp: kerSysRegisterDyingGaspHandler: endpoint registered 
00:01:38 Endpoint Event task started with pid 1245...
00:01:38 Endpoint Packet task started with pid 1246 ...
00:01:38  RTP read thread started with pid 1247 
00:01:38  RTP read thread started with pid 1248 
00:01:38  RTP read thread started with pid 1249 
00:01:38  RTP read thread started with pid 1250 
00:01:38  RTP read thread started with pid 1251 
00:01:38  RTP read thread started with pid 1252 
usb usb2: configuration #1 chosen from 1 choice
00:01:38  RTCP thread started with pid 1253 
00:01:38 rtpInit: RTCP task created, taskId = 9226
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
device wl0 left promiscuous mode
BR_LAN: port 3(wl0) entering disabled state
device wl0 entered promiscuous mode
BR_LAN: port 3(wl0) entering learning state
BR_LAN: port 3(wl0) entering forwarding state
device wl0 left promiscuous mode
BR_LAN: port 3(wl0) entering disabled state
device wl0 entered promiscuous mode
BR_LAN: port 3(wl0) entering learning state
BR_LAN: port 3(wl0) entering forwarding state
</code>

===== Firmware =====

==== Stock Firmware ====

[[http://www.tripleoxygen.net/files/devices/sagemcom/f5350gv/firmware/stock/|Firmwares]]

=== Instalação ===

  var req = $.xmo.client.newRequest();
  req.remoteCall("Device", "download", {id: "0", fileType: "1 Firmware Upgrade Image", url: "http://www.tripleoxygen.net/files/devices/sagemcom/f5350gv/firmware/stock/SG790131200412-sagemcom-5350-gvt-3.12.5901-combined-squashfs.img.gsdf" }, 0, 0, 0, 0);
  req.send();

===== Agradecimentos ======

Pessoas envolvidas em discussões, dicas, testes ou bate papo em geral. Lista em ordem alfabética.

  Italo, Leandro Cell