zaterdag 2 maart 2013

Huawei HG655d VDSL router


With the arrival of VDSL in our area I had to abandon my old DGN3500 ADSL2+ modem on which I installed OpenWRT. VDSL is a huge relief, no more fluctuations in speed, constant 30Mbit down and 3Mbit up. In the future this will probably go up and the service will start lagging when more people are using VDSL :(

From my previous provider I received a new router from Huawei. It is a decent modem, has a fast interface en 802.11bgn. A downside is the lack of Gigabit Ethernet. More information on the modem here.

As many modems this model is equipped with some form of remote management (TR-069). That means somebody else can access your modem and who knows what... Time for OpenWRT!

Opening the device is easy, lots of click-connections, minimal amount of screws.

The PCB looks quite nasty, some chemicals that dried up during production probably...


Whats on the PCB:
Spansion S29GL064N90TF104 - 8MByte of NOR flash
Ralink RT3062F - An old fashioned PCI device for 802.11bgn up to 300Mbps
ESMT M13S2561616A - 2x 32MByte of 200MHz SDRAM
Le89316 - 2x Zarlink 1xFXO/1xFXS
BCM6302 - A VDSL2 line driver
PCB Antennas only, pigtail connectors present though.
CPU still is a big mistery, guessing BCM63168
A uart/jtag connector with pinout in silk -> Thank you Huawei

Whats not assembled:
An additional Ethernet physical + connector
Some 4-pin interface, could be a full RS232 debug header
An EEPROM directly behind the Wifi chip -> Oh no, calibration data is somewhere in NOR flash


I've connected a UART to the PCB to get some details on the software. The logging of the kernel and applications is really dirty, all kinds debug messages and proprietary kernel modules. You can login to a limited root shell with "admin", "admin" and run the "sh" command.

I seems the bootloader is crippled, the only command I can execute is "reset". Ideally I would configure the bootloader to load a custom kernel over tftp. There seems to be a setting that allows this but I see no way to change it.

Run from flash/host (f/h)         : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel

My plan is to create a static linked MIPS application that can dump the NOR flash contents for analysis and find more bootloader commands. Luckily the flash is memory mapped so I can easily read it from /dev/mem @ 0xb8000000.

Here is a set of links that can be useful:

http://huaweihg612hacking.wordpress.com/2011/07/17/the-atp-cli-and-equipcmd/
http://huaweihg612hacking.wordpress.com/2011/07/05/hexdumping-the-firmware/
http://wiki.openwrt.org/toh/comtrend/ct5813
http://xinu.mscs.mu.edu/Common_Firmware_Environment
https://forum.openwrt.org/viewtopic.php?id=26405

To be continued....



Bootlog

CFE version 1.0.37-102.6 for BCM96368 (32bit,SP,BE)


Build Date: Mon Jun 14 15:35:14 CST 2010 (songchen@IBM_x3500)
Copyright (C) 2000-2008 Broadcom Corporation.

Parallel flash device: name AM29LV320MB, id 0x2200, size 8192KB
CPU type 0x2A031: 400MHz, Bus: 160MHz, Ref: 64MHz
CPU running TP0
Total memory: 67108864 bytes (64MB)
Boot Address 0xb8000000


Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :
Run from flash/host (f/h)         : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Boot image (0=latest, 1=previous) : 0
Board Id (0-6)                    : HW65x
Number of MAC Addresses (1-32)    : 11
Base MAC Address                  : 02:10:18:11:11:11
PSI Size (1-64) KBytes            : 64
Main Thread Number [0|1]          : 0

*** Press any key to stop auto run (2 seconds) ***
Auto run second count down: 0
Decompression OK!
Entry at 0x80292000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x80292000
Linux version 2.6.21.5 (lihua@IBM_x3500) (gcc version 4.2.3) #1247 Sat Feb 19 19:53:56 CST 2011
Pri Table Addr = 0040
ulBootFlag = 0002
Flash 0 at 0xb8000000
  Size : 8 MB
  Regions : 2
    0 : 0x00000000 - 0x00002000 *  8
    1 : 0x00010000 - 0x00010000 * 127
CPU revision is: 0002a031
Determined physical RAM map:
 memory: 03f00000 @ 00000000 (usable)
On node 0 totalpages: 16128
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 94 pages used for memmap
  Normal zone: 11938 pages, LIFO batch:1
Built 1 zonelists.  Total pages: 16002
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 64kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (21 instructions).
Synthesized TLB load handler fastpath (33 instructions).
Synthesized TLB store handler fastpath (33 instructions).
Synthesized TLB modify handler fastpath (32 instructions).
PID hash table entries: 256 (order: 8, 1024 bytes)
Using 200.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 59492k/64512k available (2076k kernel code, 5004k reserved, 487k data, 104k init, 0k highmem)
KLOB Pool 1 Initialized: 1048576 bytes <0x80300000 ... 0x80400000>
Calibrating delay loop... 398.33 BogoMIPS (lpj=199168)
Mount-cache hash table entries: 512
wait instruction: enabled
bhal: bhalInit entry
NET: Registered protocol family 16
registering PCI controller with io_map_base unset
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 8
NET: Registered protocol family 20
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 128 (order: -3, 512 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.8)
io scheduler noop registered (default)
PPP generic driver version 2.4.2
NET: Registered protocol family 24
IMQ starting with 3 devices...
IMQ driver loaded successfully.
        Hooking IMQ before NAT on PREROUTING.
        Hooking IMQ after NAT on POSTROUTING.

==boot from main kernel==
Registered device mtd[BCM63XX RootFS] dev[0] Flash[0xb8020100,4296704]
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: irq 15, io mem 0x10001500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 13, io mem 0x10001600
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
drivers/usb/serial/usb-serial.c: USB Serial Driver core
MoniterInit entry
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xb0000100 (irq = 10) is a BCM63XX
ttyS1 at MMIO 0xb0000120 (irq = 11) is a BCM63XX
bcmxtmrt: Broadcom BCM6368B2 ATM/PTM Network Device v0.3 Feb 19 2011 19:52:32
GACT probability on
Mirror/redirect action on
u32 classifier
    input device check on
    Actions configured
Netfilter messages via NETLINK v0.30.
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 104k freed
init started: BusyBox vv1.9.1 (2011-02-19 19:55:12 CST)
starting pid 106, tty '': '/etc/init.d/rcS'
RCS DONE
starting pid 108, tty '': '/bin/sh'


BusyBox vv1.9.1 (2011-02-19 19:55:12 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

-/bin/sh: usbdiagd: not found
Loading drivers and kernel modules...
pktflow: module license 'Proprietary' taints kernel.
Broadcom Packet Flow Cache  Char Driver v2.1 Mar 17 2010 13:26:21 Registered<242>
NBUFF v1.0 Initialized
Broadcom Packet Flow Cache learning via BLOG enabled.
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Constructed Broadcom Packet Flow Cache v2.1 Mar 17 2010 13:26:20
Broadcom Packet CMF (Experimental) Char Driver v0.1 Mar 17 2010 02:52:58 Registered<232>
Broadcom Packet CMF (Experimental) [6368-B2] v0.1 Mar 17 2010 02:52:58 Loaded
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
KLOB extended to 2 pools
KLOB extended to 3 pools
KLOB extended to 4 pools
KLOB extended to 5 pools
KLOB extended to 6 pools
KLOB extended to 7 pools
KLOB extended to 8 pools
Broadcom Packet CMF (Experimental) SWC RESET.
Broadcom Packet CMF (Experimental) SWC INITIALIZED.
Broadcom Packet CMF (Experimental) Forwarder Net Device 0 v0.1 Mar 17 2010 02:52:58 Registered
Broadcom Packet CMF (Experimental) Forwarder Net Device 0 v0.1 Mar 17 2010 02:52:58 Registered
Broadcom Packet CMF (Experimental) ENABLED.
eth0.5: MAC Address: 54:A5:1B:DE:6E:B2
eth0.4: MAC Address: 54:A5:1B:DE:6E:B2
eth0.3: MAC Address: 54:A5:1B:DE:6E:B2
eth0.2: MAC Address: 54:A5:1B:DE:6E:B2
DSP Driver: DSP init stub
Endpoint: endpoint_init entry
PROV(ts: 5 s 69 ms):ALLOC item = 0000 location = 0x83931900 size = 40 line = 0
PROV(ts: 5 s 76 ms):ALLOC item = 0001 location = 0x83931880 size = 40 line = 0
PROV(ts: 5 s 83 ms):ALLOC item = 0002 location = 0x83931800 size = 40 line = 0
PROV(ts: 5 s 90 ms):ALLOC item = 0003 location = 0x83931780 size = 40 line = 0
PROV(ts: 5 s 97 ms):ALLOC item = 0004 location = 0x83931700 size = 40 line = 0
PROV(ts: 5 s 104ms):ALLOC item = 0005 location = 0x83931680 size = 40 line = 0
PROV(ts: 5 s 112ms):ALLOC item = 0006 location = 0x83931600 size = 40 line = 0
PROV(ts: 5 s 119ms):ALLOC item = 0007 location = 0x83931580 size = 40 line = 0
PROV(ts: 5 s 126ms):ALLOC item = 0008 location = 0x83931500 size = 40 line = 0
PROV(ts: 5 s 133ms):ALLOC item = 0009 location = 0x83931480 size = 40 line = 0
PROV(ts: 5 s 140ms):ALLOC item = 0011 location = 0x83D5DD00 size = 4 line = 0
PROV(ts: 5 s 147ms):ALLOC item = 0200 location = 0x83C33E80 size = 248 line = 0
PROV(ts: 5 s 155ms):ALLOC item = 0201 location = 0x83C33D80 size = 248 line = 0
PROV(ts: 5 s 162ms):ALLOC item = 0202 location = 0x83C33C80 size = 248 line = 0
PROV(ts: 5 s 169ms):ALLOC item = 0203 location = 0x83C33B80 size = 248 line = 0
PROV(ts: 5 s 176ms):ALLOC item = 0204 location = 0x83C33A80 size = 248 line = 0
PROV(ts: 5 s 184ms):ALLOC item = 0205 location = 0x83C33980 size = 248 line = 0
PROV(ts: 5 s 191ms):ALLOC item = 0206 location = 0x83C33880 size = 248 line = 0
PROV(ts: 5 s 198ms):ALLOC item = 0207 location = 0x83C33780 size = 248 line = 0
PROV(ts: 5 s 205ms):ALLOC item = 0208 location = 0x83C33680 size = 248 line = 0
PROV(ts: 5 s 213ms):ALLOC item = 0209 location = 0x83C33580 size = 248 line = 0
PROV(ts: 5 s 220ms):ALLOC item = 0210 location = 0x83C33480 size = 248 line = 0
PROV(ts: 5 s 227ms):ALLOC item = 0211 location = 0x83C33380 size = 248 line = 0
PROV(ts: 5 s 234ms):ALLOC item = 0212 location = 0x83C33280 size = 248 line = 0
PROV(ts: 5 s 242ms):ALLOC item = 0217 location = 0x83C33180 size = 248 line = 0
PROV(ts: 5 s 249ms):ALLOC item = 0218 location = 0x83C33080 size = 248 line = 0
PROV(ts: 5 s 256ms):ALLOC item = 0219 location = 0x837DFE80 size = 248 line = 0
PROV(ts: 5 s 264ms):ALLOC item = 0220 location = 0x837DFD80 size = 248 line = 0
PROV(ts: 5 s 271ms):ALLOC item = 0221 location = 0x837DFC80 size = 248 line = 0
PROV(ts: 5 s 278ms):ALLOC item = 0222 location = 0x837DFB80 size = 248 line = 0
PROV(ts: 5 s 285ms):ALLOC item = 0223 location = 0x837DFA80 size = 248 line = 0
PROV(ts: 5 s 293ms):ALLOC item = 0224 location = 0x837DF980 size = 248 line = 0
PROV(ts: 5 s 300ms):ALLOC item = 0400 location = 0x83D5DC80 size = 4 line = 0
PROV(ts: 5 s 307ms):ALLOC item = 0401 location = 0x83D5DC00 size = 4 line = 0
PROV(ts: 5 s 314ms):ALLOC item = 0402 location = 0x83D5DB80 size = 4 line = 0
PROV(ts: 5 s 321ms):ALLOC item = 0403 location = 0x83D5DB00 size = 4 line = 0
PROV(ts: 5 s 328ms):ALLOC item = 0404 location = 0x83D5DA80 size = 4 line = 0
PROV(ts: 5 s 335ms):ALLOC item = 0405 location = 0x83D5DA00 size = 4 line = 0
PROV(ts: 5 s 342ms):ALLOC item = 0406 location = 0x83D5D980 size = 4 line = 0
PROV(ts: 5 s 349ms):ALLOC item = 0407 location = 0x83D5D900 size = 4 line = 0
PROV(ts: 5 s 356ms):ALLOC item = 0408 location = 0x83D5D880 size = 4 line = 0
PROV(ts: 5 s 364ms):ALLOC item = 0409 location = 0x83D5D800 size = 4 line = 0
PROV(ts: 5 s 371ms):ALLOC item = 0410 location = 0x83D5D780 size = 4 line = 0
PROV(ts: 5 s 378ms):ALLOC item = 0411 location = 0x83D5D700 size = 4 line = 0
PROV(ts: 5 s 385ms):ALLOC item = 0412 location = 0x83D5D680 size = 4 line = 0
PROV(ts: 5 s 392ms):ALLOC item = 0413 location = 0x83D5D600 size = 4 line = 0
PROV(ts: 5 s 399ms):ALLOC item = 0423 location = 0x83D5D580 size = 4 line = 0
PROV(ts: 5 s 406ms):ALLOC item = 0424 location = 0x83D5D500 size = 4 line = 0
PROV(ts: 5 s 413ms):ALLOC item = 0414 location = 0x83D5D480 size = 4 line = 0
PROV(ts: 5 s 420ms):ALLOC item = 0416 location = 0x83D5D400 size = 4 line = 0
PROV(ts: 5 s 427ms):ALLOC item = 0417 location = 0x83D5D380 size = 4 line = 0
PROV(ts: 5 s 434ms):ALLOC item = 0418 location = 0x83D5D300 size = 4 line = 0
PROV(ts: 5 s 441ms):ALLOC item = 0600 location = 0x83D5D280 size = 4 line = 0
PROV(ts: 5 s 448ms):ALLOC item = 0608 location = 0x83D5D200 size = 4 line = 0
PROV(ts: 5 s 456ms):ALLOC item = 0609 location = 0x83D5D180 size = 4 line = 0
PROV(ts: 5 s 463ms):ALLOC item = 0610 location = 0x83D5D100 size = 4 line = 0
PROV(ts: 5 s 470ms):ALLOC item = 0611 location = 0x83196F80 size = 4 line = 0
PROV(ts: 5 s 477ms):ALLOC item = 0612 location = 0x83196F00 size = 4 line = 0
PROV(ts: 5 s 484ms):ALLOC item = 0613 location = 0x83196E80 size = 4 line = 0
PROV(ts: 5 s 491ms):ALLOC item = 0617 location = 0x83196E00 size = 4 line = 0
PROV(ts: 5 s 498ms):ALLOC item = 0618 location = 0x83196D80 size = 4 line = 0
PROV(ts: 5 s 505ms):ALLOC item = 0619 location = 0x83196D00 size = 4 line = 0
PROV(ts: 5 s 512ms):ALLOC item = 0620 location = 0x83196C80 size = 4 line = 0
PROV(ts: 5 s 519ms):ALLOC item = 2000 location = 0x83196C00 size = 4 line = 0
PROV(ts: 5 s 526ms):ALLOC item = 0805 location = 0x83196B80 size = 4 line = 0
PROV(ts: 5 s 533ms):ALLOC item = 2200 location = 0x83196B00 size = 4 line = 0
PROV(ts: 5 s 540ms):ALLOC item = 2201 location = 0x83196A80 size = 4 line = 0
PROV(ts: 5 s 548ms):ALLOC item = 2202 location = 0x83196A00 size = 4 line = 0
PROV(ts: 5 s 555ms):ALLOC item = 2203 location = 0x83196980 size = 4 line = 0
PROV(ts: 5 s 562ms):ALLOC item = 0616 location = 0x83196900 size = 4 line = 0
PROV(ts: 5 s 569ms):ALLOC item = 2204 location = 0x83196880 size = 4 line = 0
PROV(ts: 5 s 576ms):ALLOC item = 2600 location = 0x83196800 size = 4 line = 0
PROV(ts: 5 s 583ms):ALLOC item = 2601 location = 0x83196780 size = 4 line = 0
PROV(ts: 5 s 590ms):ALLOC item = 2602 location = 0x83196700 size = 4 line = 0
PROV(ts: 5 s 597ms):ALLOC item = 2603 location = 0x83196680 size = 4 line = 0
PROV(ts: 5 s 604ms):ALLOC item = 2604 location = 0x83196600 size = 4 line = 0
PROV(ts: 5 s 611ms):ALLOC item = 2605 location = 0x83196580 size = 4 line = 0
PROV(ts: 5 s 618ms):ALLOC item = 2606 location = 0x83196500 size = 4 line = 0
PROV(ts: 5 s 625ms):ALLOC item = 2800 location = 0x83196480 size = 4 line = 0
PROV(ts: 5 s 632ms):ALLOC item = 2801 location = 0x83196400 size = 4 line = 0
PROV(ts: 5 s 640ms):ALLOC item = 2802 location = 0x83C02C00 size = 1024 line = 0
PROV(ts: 5 s 647ms):ALLOC item = 2803 location = 0x83196380 size = 4 line = 0
PROV(ts: 5 s 654ms):ALLOC item = 0428 location = 0x83196300 size = 4 line = 0
PROV(ts: 5 s 661ms):ALLOC item = 0429 location = 0x83196280 size = 4 line = 0
PROV(ts: 5 s 668ms):ALLOC item = 0430 location = 0x83196200 size = 4 line = 0
PROV(ts: 5 s 675ms):ALLOC item = 0415 location = 0x83196180 size = 4 line = 0
PROV(ts: 5 s 682ms):ALLOC item = 0427 location = 0x83196100 size = 4 line = 0
PROV(ts: 5 s 689ms):ALLOC item = 0000 location = 0x83931400 size = 40 line = 1
PROV(ts: 5 s 697ms):ALLOC item = 0001 location = 0x83931380 size = 40 line = 1
PROV(ts: 5 s 704ms):ALLOC item = 0002 location = 0x83931300 size = 40 line = 1
PROV(ts: 5 s 711ms):ALLOC item = 0003 location = 0x83931280 size = 40 line = 1
PROV(ts: 5 s 718ms):ALLOC item = 0004 location = 0x83931200 size = 40 line = 1
PROV(ts: 5 s 725ms):ALLOC item = 0005 location = 0x83931180 size = 40 line = 1
PROV(ts: 5 s 732ms):ALLOC item = 0006 location = 0x83931100 size = 40 line = 1
PROV(ts: 5 s 740ms):ALLOC item = 0007 location = 0x837DEF80 size = 40 line = 1
PROV(ts: 5 s 747ms):ALLOC item = 0008 location = 0x837DEF00 size = 40 line = 1
PROV(ts: 5 s 754ms):ALLOC item = 0009 location = 0x837DEE80 size = 40 line = 1
PROV(ts: 5 s 761ms):ALLOC item = 0011 location = 0x837DDF80 size = 4 line = 1
PROV(ts: 5 s 768ms):ALLOC item = 0200 location = 0x837DF880 size = 248 line = 1
PROV(ts: 5 s 775ms):ALLOC item = 0201 location = 0x837DF780 size = 248 line = 1
PROV(ts: 5 s 783ms):ALLOC item = 0202 location = 0x837DF680 size = 248 line = 1
PROV(ts: 5 s 790ms):ALLOC item = 0203 location = 0x837DF580 size = 248 line = 1
PROV(ts: 5 s 797ms):ALLOC item = 0204 location = 0x837DF480 size = 248 line = 1
PROV(ts: 5 s 804ms):ALLOC item = 0205 location = 0x837DF380 size = 248 line = 1
PROV(ts: 5 s 812ms):ALLOC item = 0206 location = 0x837DF280 size = 248 line = 1
PROV(ts: 5 s 819ms):ALLOC item = 0207 location = 0x837DF180 size = 248 line = 1
PROV(ts: 5 s 826ms):ALLOC item = 0208 location = 0x837DF080 size = 248 line = 1
PROV(ts: 5 s 833ms):ALLOC item = 0209 location = 0x837DCE80 size = 248 line = 1
PROV(ts: 5 s 841ms):ALLOC item = 0210 location = 0x837DCD80 size = 248 line = 1
PROV(ts: 5 s 848ms):ALLOC item = 0211 location = 0x837DCC80 size = 248 line = 1
PROV(ts: 5 s 855ms):ALLOC item = 0212 location = 0x837DCB80 size = 248 line = 1
PROV(ts: 5 s 863ms):ALLOC item = 0217 location = 0x837DCA80 size = 248 line = 1
PROV(ts: 5 s 870ms):ALLOC item = 0218 location = 0x837DC980 size = 248 line = 1
PROV(ts: 5 s 877ms):ALLOC item = 0219 location = 0x837DC880 size = 248 line = 1
PROV(ts: 5 s 884ms):ALLOC item = 0220 location = 0x837DC780 size = 248 line = 1
PROV(ts: 5 s 892ms):ALLOC item = 0221 location = 0x837DC680 size = 248 line = 1
PROV(ts: 5 s 899ms):ALLOC item = 0222 location = 0x837DC580 size = 248 line = 1
PROV(ts: 5 s 906ms):ALLOC item = 0223 location = 0x837DC480 size = 248 line = 1
PROV(ts: 5 s 913ms):ALLOC item = 0224 location = 0x837DC380 size = 248 line = 1
PROV(ts: 5 s 921ms):ALLOC item = 0400 location = 0x837DDF00 size = 4 line = 1
PROV(ts: 5 s 928ms):ALLOC item = 0401 location = 0x837DDE80 size = 4 line = 1
PROV(ts: 5 s 935ms):ALLOC item = 0402 location = 0x837DDE00 size = 4 line = 1
PROV(ts: 5 s 942ms):ALLOC item = 0403 location = 0x837DDD80 size = 4 line = 1
PROV(ts: 5 s 949ms):ALLOC item = 0404 location = 0x837DDD00 size = 4 line = 1
PROV(ts: 5 s 956ms):ALLOC item = 0405 location = 0x837DDC80 size = 4 line = 1
PROV(ts: 5 s 963ms):ALLOC item = 0406 location = 0x837DDC00 size = 4 line = 1
PROV(ts: 5 s 970ms):ALLOC item = 0407 location = 0x837DDB80 size = 4 line = 1
PROV(ts: 5 s 977ms):ALLOC item = 0408 location = 0x837DDB00 size = 4 line = 1
PROV(ts: 5 s 984ms):ALLOC item = 0409 location = 0x837DDA80 size = 4 line = 1
PROV(ts: 5 s 991ms):ALLOC item = 0410 location = 0x837DDA00 size = 4 line = 1
PROV(ts: 5 s 998ms):ALLOC item = 0411 location = 0x837DD980 size = 4 line = 1
PROV(ts: 6 s 6  ms):ALLOC item = 0412 location = 0x837DD900 size = 4 line = 1
PROV(ts: 6 s 13 ms):ALLOC item = 0413 location = 0x837DD880 size = 4 line = 1
PROV(ts: 6 s 20 ms):ALLOC item = 0423 location = 0x837DD800 size = 4 line = 1
PROV(ts: 6 s 27 ms):ALLOC item = 0424 location = 0x837DD780 size = 4 line = 1
PROV(ts: 6 s 34 ms):ALLOC item = 0414 location = 0x837DD700 size = 4 line = 1
PROV(ts: 6 s 41 ms):ALLOC item = 0416 location = 0x837DD680 size = 4 line = 1
PROV(ts: 6 s 48 ms):ALLOC item = 0417 location = 0x837DD600 size = 4 line = 1
PROV(ts: 6 s 55 ms):ALLOC item = 0418 location = 0x837DD580 size = 4 line = 1
PROV(ts: 6 s 62 ms):ALLOC item = 0600 location = 0x837DD500 size = 4 line = 1
PROV(ts: 6 s 69 ms):ALLOC item = 0608 location = 0x837DD480 size = 4 line = 1
PROV(ts: 6 s 76 ms):ALLOC item = 0609 location = 0x837DD400 size = 4 line = 1
PROV(ts: 6 s 83 ms):ALLOC item = 0610 location = 0x837DD380 size = 4 line = 1
PROV(ts: 6 s 90 ms):ALLOC item = 0611 location = 0x837DD300 size = 4 line = 1
PROV(ts: 6 s 98 ms):ALLOC item = 0612 location = 0x837DD280 size = 4 line = 1
PROV(ts: 6 s 105ms):ALLOC item = 0613 location = 0x837DD200 size = 4 line = 1
PROV(ts: 6 s 112ms):ALLOC item = 0617 location = 0x837DD180 size = 4 line = 1
PROV(ts: 6 s 119ms):ALLOC item = 0618 location = 0x837DD100 size = 4 line = 1
PROV(ts: 6 s 126ms):ALLOC item = 0619 location = 0x837DBF80 size = 4 line = 1
PROV(ts: 6 s 133ms):ALLOC item = 0620 location = 0x837DBF00 size = 4 line = 1
PROV(ts: 6 s 140ms):ALLOC item = 2000 location = 0x837DBE80 size = 4 line = 1
PROV(ts: 6 s 147ms):ALLOC item = 0805 location = 0x837DBE00 size = 4 line = 1
PROV(ts: 6 s 154ms):ALLOC item = 2200 location = 0x837DBD80 size = 4 line = 1
PROV(ts: 6 s 161ms):ALLOC item = 2201 location = 0x837DBD00 size = 4 line = 1
PROV(ts: 6 s 168ms):ALLOC item = 2202 location = 0x837DBC80 size = 4 line = 1
PROV(ts: 6 s 175ms):ALLOC item = 2203 location = 0x837DBC00 size = 4 line = 1
PROV(ts: 6 s 182ms):ALLOC item = 0616 location = 0x837DBB80 size = 4 line = 1
PROV(ts: 6 s 190ms):ALLOC item = 2204 location = 0x837DBB00 size = 4 line = 1
PROV(ts: 6 s 197ms):ALLOC item = 2600 location = 0x837DBA80 size = 4 line = 1
PROV(ts: 6 s 204ms):ALLOC item = 2601 location = 0x837DBA00 size = 4 line = 1
PROV(ts: 6 s 211ms):ALLOC item = 2602 location = 0x837DB980 size = 4 line = 1
PROV(ts: 6 s 218ms):ALLOC item = 2603 location = 0x837DB900 size = 4 line = 1
PROV(ts: 6 s 225ms):ALLOC item = 2604 location = 0x837DB880 size = 4 line = 1
PROV(ts: 6 s 232ms):ALLOC item = 2605 location = 0x837DB800 size = 4 line = 1
PROV(ts: 6 s 239ms):ALLOC item = 2606 location = 0x837DB780 size = 4 line = 1
PROV(ts: 6 s 246ms):ALLOC item = 2800 location = 0x837DB700 size = 4 line = 1
PROV(ts: 6 s 253ms):ALLOC item = 2801 location = 0x837DB680 size = 4 line = 1
PROV(ts: 6 s 260ms):ALLOC item = 2802 location = 0x83C02800 size = 1024 line = 1
PROV(ts: 6 s 268ms):ALLOC item = 2803 location = 0x837DB600 size = 4 line = 1
PROV(ts: 6 s 275ms):ALLOC item = 0428 location = 0x837DB580 size = 4 line = 1
PROV(ts: 6 s 282ms):ALLOC item = 0429 location = 0x837DB500 size = 4 line = 1
PROV(ts: 6 s 289ms):ALLOC item = 0430 location = 0x837DB480 size = 4 line = 1
PROV(ts: 6 s 296ms):ALLOC item = 0415 location = 0x837DB400 size = 4 line = 1
PROV(ts: 6 s 303ms):ALLOC item = 0427 location = 0x837DB380 size = 4 line = 1
PROV(ts: 6 s 310ms):ALLOC item = 0000 location = 0x837DEE00 size = 40 line = 2
PROV(ts: 6 s 317ms):ALLOC item = 0001 location = 0x837DED80 size = 40 line = 2
PROV(ts: 6 s 324ms):ALLOC item = 0002 location = 0x837DED00 size = 40 line = 2
PROV(ts: 6 s 332ms):ALLOC item = 0003 location = 0x837DEC80 size = 40 line = 2
PROV(ts: 6 s 339ms):ALLOC item = 0004 location = 0x837DEC00 size = 40 line = 2
PROV(ts: 6 s 346ms):ALLOC item = 0005 location = 0x837DEB80 size = 40 line = 2
PROV(ts: 6 s 353ms):ALLOC item = 0006 location = 0x837DEB00 size = 40 line = 2
PROV(ts: 6 s 360ms):ALLOC item = 0007 location = 0x837DEA80 size = 40 line = 2
PROV(ts: 6 s 367ms):ALLOC item = 0008 location = 0x837DEA00 size = 40 line = 2
PROV(ts: 6 s 375ms):ALLOC item = 0009 location = 0x837DE980 size = 40 line = 2
PROV(ts: 6 s 382ms):ALLOC item = 0011 location = 0x837DB300 size = 4 line = 2
PROV(ts: 6 s 389ms):ALLOC item = 0200 location = 0x837DC280 size = 248 line = 2
PROV(ts: 6 s 396ms):ALLOC item = 0201 location = 0x837DC180 size = 248 line = 2
PROV(ts: 6 s 403ms):ALLOC item = 0202 location = 0x837DC080 size = 248 line = 2
PROV(ts: 6 s 411ms):ALLOC item = 0203 location = 0x837DAE80 size = 248 line = 2
PROV(ts: 6 s 418ms):ALLOC item = 0204 location = 0x837DAD80 size = 248 line = 2
PROV(ts: 6 s 425ms):ALLOC item = 0205 location = 0x837DAC80 size = 248 line = 2
PROV(ts: 6 s 432ms):ALLOC item = 0206 location = 0x837DAB80 size = 248 line = 2
PROV(ts: 6 s 440ms):ALLOC item = 0207 location = 0x837DAA80 size = 248 line = 2
PROV(ts: 6 s 447ms):ALLOC item = 0208 location = 0x837DA980 size = 248 line = 2
PROV(ts: 6 s 454ms):ALLOC item = 0209 location = 0x837DA880 size = 248 line = 2
PROV(ts: 6 s 461ms):ALLOC item = 0210 location = 0x837DA780 size = 248 line = 2
PROV(ts: 6 s 469ms):ALLOC item = 0211 location = 0x837DA680 size = 248 line = 2
PROV(ts: 6 s 476ms):ALLOC item = 0212 location = 0x837DA580 size = 248 line = 2
PROV(ts: 6 s 483ms):ALLOC item = 0217 location = 0x837DA480 size = 248 line = 2
PROV(ts: 6 s 491ms):ALLOC item = 0218 location = 0x837DA380 size = 248 line = 2
PROV(ts: 6 s 498ms):ALLOC item = 0219 location = 0x837DA280 size = 248 line = 2
PROV(ts: 6 s 505ms):ALLOC item = 0220 location = 0x837DA180 size = 248 line = 2
PROV(ts: 6 s 512ms):ALLOC item = 0221 location = 0x837DA080 size = 248 line = 2
PROV(ts: 6 s 520ms):ALLOC item = 0222 location = 0x83199E80 size = 248 line = 2
PROV(ts: 6 s 527ms):ALLOC item = 0223 location = 0x83199D80 size = 248 line = 2
PROV(ts: 6 s 534ms):ALLOC item = 0224 location = 0x83199C80 size = 248 line = 2
PROV(ts: 6 s 541ms):ALLOC item = 0400 location = 0x837DB280 size = 4 line = 2
PROV(ts: 6 s 548ms):ALLOC item = 0401 location = 0x837DB200 size = 4 line = 2
PROV(ts: 6 s 555ms):ALLOC item = 0402 location = 0x837DB180 size = 4 line = 2
PROV(ts: 6 s 563ms):ALLOC item = 0403 location = 0x837DB100 size = 4 line = 2
PROV(ts: 6 s 570ms):ALLOC item = 0404 location = 0x837D8F80 size = 4 line = 2
PROV(ts: 6 s 577ms):ALLOC item = 0405 location = 0x837D8F00 size = 4 line = 2
PROV(ts: 6 s 584ms):ALLOC item = 0406 location = 0x837D8E80 size = 4 line = 2
PROV(ts: 6 s 591ms):ALLOC item = 0407 location = 0x837D8E00 size = 4 line = 2
PROV(ts: 6 s 598ms):ALLOC item = 0408 location = 0x837D8D80 size = 4 line = 2
PROV(ts: 6 s 605ms):ALLOC item = 0409 location = 0x837D8D00 size = 4 line = 2
PROV(ts: 6 s 612ms):ALLOC item = 0410 location = 0x837D8C80 size = 4 line = 2
PROV(ts: 6 s 619ms):ALLOC item = 0411 location = 0x837D8C00 size = 4 line = 2
PROV(ts: 6 s 626ms):ALLOC item = 0412 location = 0x837D8B80 size = 4 line = 2
PROV(ts: 6 s 633ms):ALLOC item = 0413 location = 0x837D8B00 size = 4 line = 2
PROV(ts: 6 s 640ms):ALLOC item = 0423 location = 0x837D8A80 size = 4 line = 2
PROV(ts: 6 s 647ms):ALLOC item = 0424 location = 0x837D8A00 size = 4 line = 2
PROV(ts: 6 s 655ms):ALLOC item = 0414 location = 0x837D8980 size = 4 line = 2
PROV(ts: 6 s 662ms):ALLOC item = 0416 location = 0x837D8900 size = 4 line = 2
PROV(ts: 6 s 669ms):ALLOC item = 0417 location = 0x837D8880 size = 4 line = 2
PROV(ts: 6 s 676ms):ALLOC item = 0418 location = 0x837D8800 size = 4 line = 2
PROV(ts: 6 s 683ms):ALLOC item = 0600 location = 0x837D8780 size = 4 line = 2
PROV(ts: 6 s 690ms):ALLOC item = 0608 location = 0x837D8700 size = 4 line = 2
PROV(ts: 6 s 697ms):ALLOC item = 0609 location = 0x837D8680 size = 4 line = 2
PROV(ts: 6 s 704ms):ALLOC item = 0610 location = 0x837D8600 size = 4 line = 2
PROV(ts: 6 s 711ms):ALLOC item = 0611 location = 0x837D8580 size = 4 line = 2
PROV(ts: 6 s 718ms):ALLOC item = 0612 location = 0x837D8500 size = 4 line = 2
PROV(ts: 6 s 725ms):ALLOC item = 0613 location = 0x837D8480 size = 4 line = 2
PROV(ts: 6 s 732ms):ALLOC item = 0617 location = 0x837D8400 size = 4 line = 2
PROV(ts: 6 s 740ms):ALLOC item = 0618 location = 0x837D8380 size = 4 line = 2
PROV(ts: 6 s 747ms):ALLOC item = 0619 location = 0x837D8300 size = 4 line = 2
PROV(ts: 6 s 754ms):ALLOC item = 0620 location = 0x837D8280 size = 4 line = 2
PROV(ts: 6 s 761ms):ALLOC item = 2000 location = 0x837D8200 size = 4 line = 2
PROV(ts: 6 s 768ms):ALLOC item = 0805 location = 0x837D8180 size = 4 line = 2
PROV(ts: 6 s 775ms):ALLOC item = 2200 location = 0x837D8100 size = 4 line = 2
PROV(ts: 6 s 782ms):ALLOC item = 2201 location = 0x837D9F80 size = 4 line = 2
PROV(ts: 6 s 789ms):ALLOC item = 2202 location = 0x837D9F00 size = 4 line = 2
PROV(ts: 6 s 796ms):ALLOC item = 2203 location = 0x837D9E80 size = 4 line = 2
PROV(ts: 6 s 803ms):ALLOC item = 0616 location = 0x837D9E00 size = 4 line = 2
PROV(ts: 6 s 810ms):ALLOC item = 2204 location = 0x837D9D80 size = 4 line = 2
PROV(ts: 6 s 817ms):ALLOC item = 2600 location = 0x837D9D00 size = 4 line = 2
PROV(ts: 6 s 824ms):ALLOC item = 2601 location = 0x837D9C80 size = 4 line = 2
PROV(ts: 6 s 832ms):ALLOC item = 2602 location = 0x837D9C00 size = 4 line = 2
PROV(ts: 6 s 839ms):ALLOC item = 2603 location = 0x837D9B80 size = 4 line = 2
PROV(ts: 6 s 846ms):ALLOC item = 2604 location = 0x837D9B00 size = 4 line = 2
PROV(ts: 6 s 853ms):ALLOC item = 2605 location = 0x837D9A80 size = 4 line = 2
PROV(ts: 6 s 860ms):ALLOC item = 2606 location = 0x837D9A00 size = 4 line = 2
PROV(ts: 6 s 867ms):ALLOC item = 2800 location = 0x837D9980 size = 4 line = 2
PROV(ts: 6 s 874ms):ALLOC item = 2801 location = 0x837D9900 size = 4 line = 2
PROV(ts: 6 s 881ms):ALLOC item = 2802 location = 0x83C02400 size = 1024 line = 2
PROV(ts: 6 s 888ms):ALLOC item = 2803 location = 0x837D9880 size = 4 line = 2
PROV(ts: 6 s 895ms):ALLOC item = 0428 location = 0x837D9800 size = 4 line = 2
PROV(ts: 6 s 903ms):ALLOC item = 0429 location = 0x837D9780 size = 4 line = 2
PROV(ts: 6 s 910ms):ALLOC item = 0430 location = 0x837D9700 size = 4 line = 2
PROV(ts: 6 s 917ms):ALLOC item = 0415 location = 0x837D9680 size = 4 line = 2
PROV(ts: 6 s 924ms):ALLOC item = 0427 location = 0x837D9600 size = 4 line = 2
PROV(ts: 6 s 931ms):Allocated memory = 20556
Endpoint: endpoint_init COMPLETED
drivers/usb/serial/usb-serial.c: USB Serial support registered for option1
usbcore: registered new interface driver option
drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1
Start mic now ...
load cfm ok.
start log proc...
ifconfig: SIOCSIFNETMASK: Cannot assign requested address
ifconfig: SIOCGIFFLAGS: No such device
wlancmd: wlan driver adapter not found
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCGIFFLAGS: No such device
wlancmd: wlan driver adapter not found
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCGIFFLAGS: No such device
wlancmd: wlan driver adapter not found
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCGIFFLAGS: No such device
wlancmd: wlan driver adapter not found
ifconfig: SIOCGIFFLAGS: No such device
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:01.0 to 64


=== pAd = c03c0000, size = 448000 ===

<-- RTMPAllocAdapterBlock, Status=0
pAd->CSRBaseAddress =0xb1000000, csr_addr=0xb1000000!
sh: cannot kill pid 352: No such process
device wl0 is not a slave of br0
interface wl0.1 does not exist!
interface wl0.2 does not exist!
interface wl0.3 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCGIFFLAGS: No such device

 begin WlanUpInterfaces...
RX DESC a3243000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
===Ralink RF DATA check ok====
1. Phy Mode = 0
2. Phy Mode = 0
3. Phy Mode = 0
RTMPSetPhyMode: channel is out of range, use first channel=0
MCS Set = 00 00 00 00 00
RTMPFilterCalibration - can't find a valid value, loopcnt=102 stop calibratingSYNC - BBP R4 to 20MHz.l
Main bssid = 7a:a5:1b:de:6e:b0
<==== rt28xx_init, Status=0
0x1300 = 00064220
@@@RTPRIV_IOCTL_SET CMD=[SSID=HG655D-DE6EB3], LEN=[19]
@@@RTPRIV_IOCTL_SET CMD=[HideSSID=0], LEN=[11]
@@@RTPRIV_IOCTL_SET CMD=[SSID=HG655D-DE6EB3], LEN=[19]
@@@RTPRIV_IOCTL_SET CMD=[HideSSID=0], LEN=[11]
@@@RTPRIV_IOCTL_SET CMD=[SSID=HT_AP1], LEN=[12]
@@@RTPRIV_IOCTL_SET CMD=[HideSSID=0], LEN=[11]
@@@RTPRIV_IOCTL_SET CMD=[SSID=HT_AP2], LEN=[12]
@@@RTPRIV_IOCTL_SET CMD=[HideSSID=0], LEN=[11]
@@@RTPRIV_IOCTL_SET CMD=[SSID=HT_AP3], LEN=[12]
@@@RTPRIV_IOCTL_SET CMD=[CountryRegion=0], LEN=[16]

 wlan_mode set@@@RTPRIV_IOCTL_SET CMD=[WirelessMode=9], LEN=[15]
 come in , argv[2] = bgnmixed
@@@RTPRIV_IOCTL_SET CMD=[HtOpMode=0], LEN=[11]
@@@RTPRIV_IOCTL_SET CMD=[BasicRate=15], LEN=[13]
@@@RTPRIV_IOCTL_SET CMD=[FixedTxMode=HT], LEN=[15]
@@@RTPRIV_IOCTL_SET CMD=[HtGi=1], LEN=[7]
@@@RTPRIV_IOCTL_SET CMD=[HtBw=0], LEN=[7]
@@@RTPRIV_IOCTL_SET CMD=[HtMcs=33], LEN=[9]
@@@RTPRIV_IOCTL_SET CMD=[HtAutoBa=1], LEN=[11]
@@@RTPRIV_IOCTL_SET CMD=[HtRdg=1], LEN=[8]
@@@RTPRIV_IOCTL_SET CMD=[HtStbc=1], LEN=[9]
@@@RTPRIV_IOCTL_SET CMD=[BGProtection=0], LEN=[15]
@@@RTPRIV_IOCTL_SET CMD=[ShortSlot=1], LEN=[12]
@@@RTPRIV_IOCTL_SET CMD=[HtOpMode=0], LEN=[11]
@@@RTPRIV_IOCTL_SET CMD=[BasicRate=15], LEN=[13]
@@@RTPRIV_IOCTL_SET CMD=[FixedTxMode=HT], LEN=[15]
@@@RTPRIV_IOCTL_SET CMD=[RTSThreshold=2347], LEN=[18]
@@@RTPRIV_IOCTL_SET CMD=[FragThreshold=2346], LEN=[19]
@@@RTPRIV_IOCTL_SET CMD=[DtimPeriod=1], LEN=[13]
@@@RTPRIV_IOCTL_SET CMD=[BeaconPeriod=100], LEN=[17]
@@@RTPRIV_IOCTL_SET CMD=[NoForwarding=0], LEN=[15]
@@@RTPRIV_IOCTL_SET CMD=[MaxStaNum=32], LEN=[13]
@@@RTPRIV_IOCTL_SET CMD=[IgmpSnEnable=1], LEN=[15]
@@@RTPRIV_IOCTL_SET CMD=[WmmCapable=0], LEN=[13]
@@@RTPRIV_IOCTL_SET CMD=[TxBurst=1], LEN=[10]
@@@RTPRIV_IOCTL_SET CMD=[TxPower=95], LEN=[11]
@@@RTPRIV_IOCTL_SET CMD=[ACLClearAll=1], LEN=[14]
@@@RTPRIV_IOCTL_SET CMD=[ACLClearAll=1], LEN=[14]
@@@RTPRIV_IOCTL_SET CMD=[ACLClearAll=1], LEN=[14]
@@@RTPRIV_IOCTL_SET CMD=[ACLClearAll=1], LEN=[14]
@@@RTPRIV_IOCTL_SET CMD=[AccessPolicy=0], LEN=[15]
@@@RTPRIV_IOCTL_SET CMD=[AccessPolicy=0], LEN=[15]
@@@RTPRIV_IOCTL_SET CMD=[AccessPolicy=0], LEN=[15]
@@@RTPRIV_IOCTL_SET CMD=[AccessPolicy=0], LEN=[15]

 begin WlanSetupBridge...
device wl0 entered promiscuous mode
br0: port 1(wl0) entering learning state
br0: topology change detected, propagating
br0: port 1(wl0) entering forwarding state

 begin WlanStartServices...
@@@RTPRIV_IOCTL_SET CMD=[AuthMode=WPA2PSK], LEN=[17]
@@@RTPRIV_IOCTL_SET CMD=[EncrypType=TKIPAES], LEN=[19]
@@@RTPRIV_IOCTL_SET CMD=[IEEE8021X=0], LEN=[12]
@@@RTPRIV_IOCTL_SET CMD=[SSID=HG655D-DE6EB3], LEN=[19]
@@@RTPRIV_IOCTL_SET CMD=[WPAPSK=%_phneutraal_%], LEN=[22]
@@@RTPRIV_IOCTL_SET CMD=[DefaultKeyID=1], LEN=[15]
@@@RTPRIV_IOCTL_SET CMD=[SSID=HG655D-DE6EB3], LEN=[19]
@@@RTPRIV_IOCTL_SET CMD=[SSID=HG655D-DE6EB3], LEN=[19]
@@@RTPRIV_IOCTL_SET CMD=[WscConfMode=0], LEN=[14]
ATP_WLAN_Init SUCCESS!!
bcmxtmrt: MAC address: 54 a5 1b de 6e b3
Use default bin /var/cwmp now ...
FILE is  cwmp.c LINE  is  47   0   ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿAùpÿÿÿÿ
Load default  certificate
bcmxtmrt: MAC address: 54 a5 1b de 6e b4
BcmAdsl_Initialize=0xC00AD834, g_pFnNotifyCallback=0xC00D57B4
Clocks for QPROC and AFE are being aligned with step through ...
AFE is aligned, i = 055, PhaseValue = -072, PhaseCntl = 0x7FCA0000
QPROC is aligned, i = 055, PhaseValue = -048, PhaseCntl = 0x7FCA3FC9
Clocks for QPROC and AFE are aligned with syn_status AFE = 0x78, QPROC = 0x70
AFE  phase control reg @0xb0f570f8 default actual = 0x0021C38F, exp = 0x0021c38f
QPRC phase control reg @0xb0f5f0c0 default actual = 0x0421C38F, exp = 0x0421c38f
pSdramPHY=0xA3FFFFF8, 0x44440444 0x46444644
*** PhySdramSize got adjusted: 0xC65D0 => 0xE681A ***
AdslCoreSharedMemInit: shareMemAvailable=104384
AdslCoreHwReset:  AdslOemDataAddr = 0xA3FA3A48
insmod: can't open '/lib/extra/vnet.ko': No such file or directory
device eth0.2 entered promiscuous mode
device eth0.3 entered promiscuous mode
device eth0.4 entered promiscuous mode
device eth0.5 entered promiscuous mode
device eth0 is not a slave of br0
atp: cur kernel version:[2.6.21.5]
/var/wan/nas_a1_0/dial: line 1: 3: not found
FILE:voicecfg.c,LINE:80,sizeof(TAPI)=880,sizeof(SVC)=36460,sizeof(STATE)=12488

Set Mirror direction in disabled to eth0.5 Successfully...
Set Mirror direction in disabled to eth0.5 Successfully...
Set Mirror direction out disabled to eth0.5 Successfully...
Set Mirror direction out disabled to eth0.5 Successfully...
Sean@All modules init return 0.
DEBUG[tapi.c:L1294]TAPI_GetCfg
BOS: Enter bosIniBOS: Enter bosInit
t
bosTimerInitEnter bosAppInit

Enter bosAppInExit bosAppInit
it
Exit bosAppBOS: Exit bosInit
Init
BOS: Exitendpoint_open COMPLETED
 bosInit
Created message queue "HDSP", depth 60, id 1
00:00:18 CAEnter bosStartApp
LLCLIENT: Initializing endpoints callSipClientMain
Error getting IP address
sipConfig: sipzParamp=0x7edffa44 sipzParamp->regname=129.102.100.1

bosAppRootTask() - Is it morning already? Spawning app task (epoch #0)...

1 line 62 file  AppResetDetectionEnable() - Enabled reset detection.
hsip.c
sipConfiExit bosStartApp
g: sipzParamp=0x7edffa44line 72 file  hsip.c
sipConfig: &mgscb=0x5247acline 85 file  hsip.c
00:00:18 CALLCLIENT: Initializing endpoints
00:00:18 Endpoint will be initialized for country NLD (country code = 15)

00:00:18 Endpoint Event task started with pid 899...

00:00:18 Endpoint Packet task started with pid 900 ...

) error write AT dial command(ATH
cannot rm /var/wan/ppp259
br0: port 2(eth0.2) entering disabled state
br0: port 3(eth0.3) entering disabled state
br0: port 4(eth0.4) entering disabled state
br0: port 5(eth0.5) entering disabled state
ifconfig: SIOCSIFFLAGS: Cannot assign requested address
PPP:pppd_ath[2587]:ATH set erro!
) error write AT dial command(ATH
PPP:pppd_ath[2590]:ATH set erro!

 ppp disconnect ,modem hungup failed
tcgetattr: Inappropriate ioctl for device(25)
sh: -c requires an argument
disconnect script failed

***pppc clear tcp mss
pppc -I ppp259 exit.
bridge br0:9 doesn't exist; can't delete it
Append upnp ssdp listener ok.
Use default bin /var/upnp now ...
Enable Got value: 1
NATEnabled Got value: 1

BHAL(ts: 19s 817ms):Initializing board HAL...
Codec Support: PCMA/PCMU
Codec Support: G722
Codec Support: G729A
Codec Support: G729B
Codec Support: G723
Codec Support: G726
Codec Support: BV16
Codec Support: BV32
Codec Support: LINPCM128
Codec Support: LINPCM256
Codec Support: ILBC
Codec Support: AMRNB
Codec Support: AMRWB
Codec Support: T.38
PCM: Interrupt Masks
---------------
IrqMask                    = 0x000007070000A0B4
IrqMask1                   = 0x0000000000000000
PCM_IUDMA->ctrl[0].intMask = 0x00000000
PCM_IUDMA->ctrl[1].intMask = 0x00000000

PCM: Interrupt Status
-----------------
IrqStatus                  = 0x0000000000000040
IrqStatus1                 = 0x0000000000000040
PCM_IUDMA->ctrl[0].intStat = 0x00000000
PCM_IUDMA->ctrl[1].intStat = 0x00000000
PCM->pcm_pll_ctrl1         = 0xFC80287D
PCM->pcm_pll_ctrl2         = 0xD0000000
PCM->pcm_pll_ctrl3         = 0x380005C0
PCM->pcm_pll_ctrl4         = 0x00000000
PCM->pcm_int_pending       = 0x00000000
PCM->pcm_int_mask          = 0x00000000
PCM->pcm_ctrl              = 0x00000000
PCM->pcm_chan_ctrl         = 0x00000000
PCM_IUDMA->regs.ctrlConfig = 0x00000001
PCM_IUDMA->ctrl[0].maxBurst                  = 0x00000008
PCM_IUDMA->ctrl[0].config                    = 0x00000000
PCM_IUDMA->stram[0].baseDescPointer          = 0x8BE50CE0
PCM_IUDMA->stram[0].stateBytesDoneRingOffset = 0xF9C20BBC
PCM_IUDMA->stram[0].flagsLengthStatus        = 0x4C235B36
PCM_IUDMA->stram[0].currentBufferPointer     = 0x96AC8932
PCM_IUDMA->ctrl[1].maxBurst                  = 0x00000008
PCM_IUDMA->ctrl[1].config                    = 0x00000000
PCM_IUDMA->stram[1].baseDescPointer          = 0xB71060A0
PCM_IUDMA->stram[1].stateBytesDoneRingOffset = 0xE940122A
PCM_IUDMA->stram[1].flagsLengthStatus        = 0xAC8651B1
PCM_IUDMA->stram[1].currentBufferPointer     = 0x62021172
PLL init completed. PLL registers set to:
PCM->pcm_pll_ctrl1       = 0x0080147D
PCM->pcm_pll_ctrl2       = 0x10000000
PCM->pcm_pll_ctrl3       = 0x38000700
PCM->pcm_pll_ctrl4       = 0x00000015
Set up PCM registers
XDRV:pcm6368_timeslotAlloc 0xB0004040: 0x80000000

Channel 0 assigned to timeslot 0
XDRV:pcm6368_timeslotAlloc 0xB0004040: 0x89000000

Channel 1 assigned to timeslot 1
XDRV:pcm6368_timeslotAlloc 0xB0004040: 0x89A00000

Channel 2 assigned to timeslot 2
rxDescriptorArea       = 24
txDescriptorArea       = 24
Unaligned dmaRxDesc_c  = 0xA02D5000
Unaligned dmaTxDesc_c  = 0xA0292000
rxBufferArea          = 1312
txBufferArea          = 1312
Unaligned dmaRxData   = 0xA0293000
Unaligned dmaTxData   = 0xA02D6000
Aligned Tx Desc (0xA0292000): chan 0, buf 0, sts 0xe000, len 640, bufp 0x2d6000
Aligned Tx Desc (0xA0292008): chan 0, buf 1, sts 0x7000, len 640, bufp 0x2d6290
Aligned Rx Desc (0xA02D5000): chan 0, buf 0, sts 0x8000, len 640, bufp 0x293000
Aligned Rx Desc (0xA02D5008): chan 0, buf 1, sts 0x9000, len 640, bufp 0x293290
initIudma: chan 0, descBase 0xa02d5000, descBaseIudma 0x2d5000
initIudma: chan 1, descBase 0xa0292000, descBaseIudma 0x292000
Enter TaskCreate CMT_EXCEPTION_IST
TaskCreate - spawn new task CMT_EXCEPTION_IST
Exit TaskCreate
BHAL(ts: 20s 276ms):DSP build date: Fri_Nov_6_2009_15:10:14

regStatus (reg 12 sel 0)    = 0x10008501
regStatus (reg 12 sel 7)    = 0x00000101
regCause  (reg 13 sel 0)    = 0x00000000
regCause  (reg 13 sel 7)    = 0x00808000
regCMT    (reg 22 sel 0)    = 0xe31e1406
regCMT    (reg 22 sel 1)    = 0x10008001
XDRV:Kicking off secondary thread processor at entry point 0x8108C740 ...

XDRV:Secondary thread processor entry point at 0x8108c740

*** DSP TP: Entered main() ***
XDRV:Thread processor handshake. Secondary app initialized properly.

Enter TaskCreate HTSK
TaskCreate - spawn new task HTSK
Exit TaskCreate
MSPI INITIALIZED
SLIC reset pin: GPIO 32778
SLIC reset pin: GPIO 32778
SLIC 0 relay pin: GPIO 65535
SLIC 1 relay pin: GPIO 65535
Initializing 89116 device 0 ...
---
SLIC: Starting 89116 device and line initializion...
SLIC: Resetting device using GPIO 32778 ...
SLIC: Reset applied on GPIO pin 32778SLIC: Initializing 89116 device 0
BcmSpiReserveSlave <0,2,6250000>, spiStatus=0
SLIC: Received VP_DEV_EVID_DEV_INIT_CMP event (i = 0)
SLIC: Found event: pEvent.eventCategory = 2 pEvent.eventId = 1024
SLIC: 89116 device 0 initialized OK
SLIC: Initializing 89116 FXS line
SLIC: Received VP_LINE_EVID_LINE_INIT_CMP event (i = 0)
SLIC: Found event: pEvent.eventCategory = 2 pEvent.eventId = 2048
SLIC: Received VP_EVID_CAL_CMP event (i= 122)
SLIC: Found event: pEvent.eventCategory = 2 pEvent.eventId = 64
SLIC: FXS line RX timeslot = 0
SLIC: FXS line TX timeslot = 0
SLIC: 89116 FXS line initialized OK
SLIC: 89116 device 0 and FXS/FXO initializion COMPLETED OK !
---
Initializing 89316 device 0 ...
---
SLICDAA: Starting 89316 device and line initializion...
SLICDAA: Skipping SLIC chip reset
SLICDAA: Initializing 89316 device 0
Sean@Vp890SetFxoLineState state=<12>VP_LINE_FXO_OHT=<11>Sean@Vp890SetFxoLineState state=<12>VP_LINE_FXO_OHT=<11>SLIC: Received VP_DEV_EVID_DEV_INIT_CMP event (i = 0)
SLIC: Found event: pEvent.eventCategory = 2 pEvent.eventId = 1024
SLICDAA: 89316 device 0 initialized OK
SLICDAA: Initializing 89316 FXS line
SLIC: Received VP_LINE_EVID_LINE_INIT_CMP event (i = 0)
SLIC: Found event: pEvent.eventCategory = 2 pEvent.eventId = 2048
SLIC: Received VP_EVID_CAL_CMP event (i= 114)
SLIC: Found event: pEvent.eventCategory = 2 pEvent.eventId = 64
SLICDAA: FXS line RX timeslot = 2
SLICDAA: FXS line TX timeslot = 2
SLICDAA: 89316 FXS line initialized OK
SLICDAA: Initializing 89316 FXO line
SLICDAA: Locale 15
SLICDAA: Locale 15
Sean@Vp890SetFxoLineState state=<12>VP_LINE_FXO_OHT=<11>Sean@Vp890SetFxoLineState state=<12>VP_LINE_FXO_OHT=<11>Sean@Vp890SetFxoLineState state=<12>VP_LINE_FXO_OHT=<11>SLICDAA: FXO line RX timeslot = 4
SLICDAA: FXO line TX timeslot = 4
SLICDAA: 89316 FXO line initialized OK
SLICDAA: 89316 device 0 and FXS/FXO initializion COMPLETED OK !
---
Sean1@boardHalSlicGetDriver addr<0xc02d4e98>
Sean0@boardHalSlicGetDriver addr<0xc02d4ec0>
BHAL(ts: 23s 95 ms):COMPLETED Initializing board HAL
boardHalInit completed
Codec Support: PCMA/PCMU
Codec Support: G722
Codec Support: G729A
Codec Support: G729B
Codec Support: G723
Codec Support: G726
Codec Support: BV16
Codec Support: BV32
Codec Support: LINPCM128
Codec Support: LINPCM256
Codec Support: ILBC
Codec Support: AMRNB
Codec Support: AMRWB
Codec Support: T.38
Enter TaskCreate HRTBEAT
TaskCreate - spawn new task HRTBEAT
Exit TaskCreate
HEARTBEAT: Initialized!
Enter TaskCreate VRGEVPR
TaskCreate - spawn new task VRGEVPR
Exit TaskCreate
Enter TaskCreate HCAS
TaskCreate - spawn new task HCAS
Exit TaskCreate
gInterruptCounter     = 0x8115BF98
gInterruptErrors      = 0x81149490
gNextRxDesc           = 0x81149484
gNextTxDesc           = 0x81149480
32 ms ECAN tail-length
*** gStartRxDesc[0] = 0xA02D5000
*** gBufferSizeBytes = 640
*** gStartTxDesc[0] = 0xA0292000
hal6368PcmInit 350 nextTxDesc = 0xA0292000
hal6368PcmInit 350 nextTxDesc = 0xA0292008
hal6368PcmInit 354 Ownership for TX desc not set. Use this buffer.
DSP: Interrupt Masks
---------------
IrqMask_high               = 0x00000707
IrqMask                    = 0x0000A0B4
IrqMask1_high              = 0x40000000
IrqMask1                   = 0x00000000
PCM_IUDMA->ctrl[0].intMask = 0x00000005
PCM_IUDMA->ctrl[1].intMask = 0x00000005

DSP: Interrupt Status
-----------------
IrqStatus_high             = 0x00000000
IrqStatus                  = 0x00000040
IrqStatus1_high            = 0x00000000
IrqStatus1                 = 0x00000040
PCM_IUDMA->ctrl[0].intStat = 0x00000000
PCM_IUDMA->ctrl[1].intStat = 0x00000000
EPT(ts: 23s 354ms):hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x50) of type: 0x0
EPT(ts: 23s 481ms):Setting T.38 error correction mode for vhd 80 to 0x104
EPT(ts: 23s 737ms):hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x51) of type: 0x0
EPT(ts: 23s 865ms):Setting T.38 error correction mode for vhd 81 to 0x104
EPT(ts: 24s 121ms):hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x52) of type: 0x0
EPT(ts: 24s 248ms):Setting T.38 error correction mode for vhd 82 to 0x104
EPT(ts: 24s 504ms):hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x53) of type: 0x0
EPT(ts: 24s 632ms):Setting T.38 error correction mode for vhd 83 to 0x104
Created message queue "PSTN_CTL_EVQ", depth 8, id 1
Enter TaskCreate PSTN
TaskCreate - spawn new task PSTN
Exit TaskCreate
EPT(ts: 24s 809ms):pstnCtlInit successful
EndpointInit completed
00:00:24
Enter EPT(ts: 24s 815ms):ENDPT CREATE: Starting initialization for endpt 0
vrgEndptCasTimePEPT(ts: 24s 823ms):EPTYPE_FXS
aramControl... minHookFlash = 50, maxHookFlash = 600.

Codec Support: PCMA/PCMU
Codec Support: G722
Codec Support: G729A
Codec Support: G729B
Codec Support: G723
Codec Support: G726
Codec Support: BV16
Codec Support: BV32
Codec Support: LINPCM128
Codec Support: LINPCM256
Codec Support: ILBC
Codec Support: AMRNB
Codec Support: AMRWB
Codec Support: T.38
EPT(ts: 24s 977ms):hdspVhdOpen Line VHD success. DSP 0, VHD (0x54) of type: 0x7
HDSP(ts: 24s 995ms):VHD 0x54: Frame size = 40, Mode = Narrowband
HDSP(ts: 25s 19 ms):Switchboard ON (type Duplex): VHD 0x54/1 with VHD 0x0/0
Sean1@boardHalSlicGetDriver addr<0xc02d4e98>
Sean1@boardHalSlicGetDriver addr<0xc02d4e98>
EPT(ts: 25s 35 ms):Default value for provItemId '608' did not exist
EPT(ts: 25s 41 ms):Default value for provItemId '600' did not exist
SLIC: Mode for FXS channel changed to 1
SLIC: Mode for FXS channel changed to 1
EPT(ts: 25s 88 ms):COMPLETED successful initialization for endpt 0
PROV:No item 426 in the endpoint provisioning table
00:00:25 SIGNAL: EPT(ts: 25s 99 ms):SIGNAL: ept:0 cnx:-1 s:78 v:0 d:-1 p:-1 r:-1
endpt 0, cnx -1,EPT(ts: 25s 107ms):COMPLETED SIGNAL 78
 evt 112 (TxGainEPT(ts: 25s 112ms):SIGNAL: ept:0 cnx:-1 s:79 v:0 d:-1 p:-1 r:-1
), value 0
00:0EPT(ts: 25s 119ms):COMPLETED SIGNAL 79
0:25 SIGNAL: endEPT(ts: 25s 124ms):ENDPT CREATE: Starting initialization for endpt 1
pt 0, cnx -1, evEPT(ts: 25s 132ms):EPTYPE_FXS
t 113 (RxGain), value 0
Codec Support: PCMA/PCMU
Codec Support: G722
Codec Support: G729A
Codec Support: G729B
Codec Support: G723
Codec Support: G726
Codec Support: BV16
Codec Support: BV32
Codec Support: LINPCM128
Codec Support: LINPCM256
Codec Support: ILBC
Codec Support: AMRNB
Codec Support: AMRWB
Codec Support: T.38
EPT(ts: 25s 286ms):hdspVhdOpen Line VHD success. DSP 0, VHD (0x55) of type: 0x7
HDSP(ts: 25s 304ms):VHD 0x55: Frame size = 40, Mode = Narrowband
HDSP(ts: 25s 329ms):Switchboard ON (type Duplex): VHD 0x55/1 with VHD 0x1/0
Sean0@boardHalSlicGetDriver addr<0xc02d4ec0>
Sean0@boardHalSlicGetDriver addr<0xc02d4ec0>
EPT(ts: 25s 344ms):Default value for provItemId '608' did not exist
EPT(ts: 25s 350ms):Default value for provItemId '600' did not exist
zarlinkFxsLineIsOffhook 219 UNEXPECTED event (cat 2 id 2048)
SLICDAA: Mode for FXS channel changed to 1
SLICDAA: Mode for FXS channel changed to 1
EPT(ts: 25s 403ms):COMPLETED successful initialization for endpt 1
PROV:No item 426 in the endpoint provisioning table
00:00:25 SIGNAL: EPT(ts: 25s 414ms):SIGNAL: ept:1 cnx:-1 s:78 v:0 d:-1 p:-1 r:-1
endpt 1, cnx -1,EPT(ts: 25s 422ms):COMPLETED SIGNAL 78
 evt 112 (TxGainEPT(ts: 25s 427ms):SIGNAL: ept:1 cnx:-1 s:79 v:0 d:-1 p:-1 r:-1
), value 0
00:0EPT(ts: 25s 434ms):COMPLETED SIGNAL 79
0:25 SIGNAL: endEPT(ts: 25s 439ms):ENDPT CREATE: Starting initialization for endpt 2
pt 1, cnx -1, evEPT(ts: 25s 447ms):EPTYPE_PSTN
t 113 (RxGain), value 0
Codec Support: PCMA/PCMU
Codec Support: G722
Codec Support: G729A
Codec Support: G729B
Codec Support: G723
Codec Support: G726
Codec Support: BV16
Codec Support: BV32
Codec Support: LINPCM128
Codec Support: LINPCM256
Codec Support: ILBC
Codec Support: AMRNB
Codec Support: AMRWB
Codec Support: T.38
EPT(ts: 25s 521ms):hdspVhdOpen PSTN VHD success. DSP 0, VHD (0x56) of type: 0x6
Codec Support: PCMA/PCMU
Codec Support: G722
Codec Support: G729A
Codec Support: G729B
Codec Support: G723
Codec Support: G726
Codec Support: BV16
Codec Support: BV32
Codec Support: LINPCM128
Codec Support: LINPCM256
Codec Support: ILBC
Codec Support: AMRNB
Codec Support: AMRWB
Codec Support: T.38
EPT(ts: 25s 677ms):hdspVhdOpen Line VHD success. DSP 0, VHD (0x57) of type: 0x7
HDSP(ts: 25s 695ms):VHD 0x57: Frame size = 40, Mode = Narrowband
HDSP(ts: 25s 720ms):Switchboard ON (type Duplex): VHD 0x57/1 with VHD 0x2/0
HDSP(ts: 25s 746ms):Switchboard ON (type Duplex): VHD 0x56/1 with VHD 0x57/0
EPT(ts: 25s 753ms):Default value for provItemId '600' did not exist
PROV:No item 426 in the endpoint provisioning table
EPT(ts: 25s 764ms):FskClidRx Service is Disabled
pLineCtx = 0xC03023F0, pDevCtx = 0xC0302210, liu = 0, disconnect = 1, feedDisable = 1
DAA: Enable on-hook Caller ID receive.
Sean@Vp890SetFxoLineState state=<11>VP_LINE_FXO_OHT=<11><5>EPT(ts: 25s 851ms):COMPLETED successful initialization for endpt 2
PROV:No item 426 in the endpoint provisioning table
00:00:25  RTCP thread started with pid 952

00:00:25 rtpInit: RTCP task created, taskId = 10251
00:00:25 CALLCLIENT: Initialization complete callSipClientMain




16 opmerkingen:

  1. Probeer eens TOYBOX (http://landley.net/code/toybox/bin/) en pak uiteraard de MIPS versie. Deze werkt bij mijn Huawei HG665D. Ik wil namelijk een wake-on-lan doen vanuit de shell. Je mag mij contacteren: convolution86@gmail.com

    BeantwoordenVerwijderen
  2. En verder kan ik melden dat het uitvoeren van bash-static voor mips versie 4.1.5 werkt:

    [I have no name! /]# set
    BASH=/mnt/XFER/bash-static
    BASHOPTS=cmdhist:expand_aliases:extquote:force_fignore:hostcomplete:interactive_comments:progcomp:promptvars:sourcepath
    BASH_ALIASES=()
    BASH_ARGC=()
    BASH_ARGV=()
    BASH_CMDS=()
    BASH_LINENO=()
    BASH_SOURCE=()
    BASH_VERSINFO=([0]="4" [1]="1" [2]="5" [3]="1" [4]="release" [5]="mips-unknown-linux-gnu")
    BASH_VERSION='4.1.5(1)-release'
    COLUMNS=80
    DIRSTACK=()
    EUID=0
    GROUPS=()
    HISTFILE=//.bash_history
    HISTFILESIZE=500
    HISTSIZE=500
    HOME=/
    HOSTNAME='(none)'
    HOSTTYPE=mips

    BeantwoordenVerwijderen
  3. Het ziet er naar uit dat het is gelukt met de volgende combinatie:
    - toybox-mips
    - bash-static (voor mips, bash versie 4.1.5)
    - busybox-1.20.5 (mips)

    Busybox 1.20.5 bevat de ether-wake.

    BeantwoordenVerwijderen
  4. Als je de binaries nog wilt hebben, dan weet je me wel te vinden ;-). Verder kan ik opmerken dat ik aanzienlijk moeilijk een SSH server/daemon ter beschikking kan krijgen op de router. Ik heb namelijk een port forwarding gedaan naar 443, 902 en 903 voor vmware ESX (virtualisatieserver). Daarbij staat me iets van bij dat wanneer de 443 poort wordt gekoppeld, ssh poort wordt uitgeschakeld, maar ik kan me hierin vergissen.

    BeantwoordenVerwijderen
  5. Overigens denk ik dat je eens moet kijken naar dd-wrt. Ik heb trouwens een vervangende HG655D gekregen, aangezien de 'eerste' vast bleef zitten tijdens het opstarten. De power led stond toen aan en als ik een kabel verbond, dan deed hij het 5 seconden en daarna viel de verbinding weg. DHCP kreeg ik er niet door, maar wel statisch IP. Maarja... aan 5 seconden statisch IP kun je niet veel ... lol.

    Misschien een keer leuk om hier mee te prutsen?

    BeantwoordenVerwijderen
  6. Was dit met een 1gb of 100mb verbinding? Misschien is de voeding stuk en reset ie bij het maken van een gigabit verbinding. Als ie echt fysiek stuk is, is er weinig mee te hobby-en.

    Er zijn wel eigen Linux kernels te draaien op deze hardware, waarschijnlijk ook wel met switch en wifi support. Ik heb alleen nog geen makkelijke manier om deze op de flash te krijgen en te booten...

    BeantwoordenVerwijderen
  7. Hallo Pieter,

    I am trying to JTAG the router but have problem detecting the flash chip.
    The cpu is detected correctly:

    CPU Chip ID: 00000110001101101000000101111111 (0636817F)
    *** Found a Broadcom manufactured BCM6368 REV 01 CPU ***

    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (00818904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32


    CPU Chip ID: 00000110001101101000000101111111 (0636817F)
    *** Found a Broadcom manufactured BCM6368 REV 01 CPU ***

    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (00818904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32

    But after that: *** Unknown or NO Flash Chip Detected ***
    In your blog you say the flash chip is a Spansion S29GL064N90TF104 - 8MByte of NOR flash. Can you indicate how you found this? As I do not see any chip with this type or brand on the pcb. Which chip on the pcb picture you posted should be the flash chip?

    Thanks in advance! Bij voorbaat dank!

    BeantwoordenVerwijderen
    Reacties
    1. http://2.bp.blogspot.com/-quEfZ4Ymlxk/UTzHIEdSfhI/AAAAAAAAFCM/7XQpbuLAoH0/s1600/72565F14-A275-480C-9FCF-CA3D94B3F73D.JPG

      you will see an IC in this picture, that's the Spansion IC located at the "bottom" of the PCB.

      Verwijderen
    2. Then apparently Huawei shipped different version of the HG655D. On the back of my pcb there is a no Spansion but a Macronix MX29LV640EBTI-70G. However, I am still stuck at "Unknown or no flash chip detected" using JTAG. However, I could succesfully log the booting process with an UART connector, just as Pieter did. I posted my experiences +code here: http://forums.modem-help.co.uk/viewtopic.php?t=11413
      Any help appreciated, do not know how to proceed!

      Verwijderen
    3. I don't think the flash brand matters, the interface (hw/sw) is standard..

      The kernel says the address is "Flash 0 at 0xb8000000", but this is probably a virtual address. Have you seen this: http://huaweihg612hacking.wordpress.com/2012/11/07/jtaging-the-broadcom-bcm6368-hg612/

      There you see the same chip with flash on the same virtual address, accessed via physical address 0x38000000... (jtag> detectflash 0x38000000)

      Verwijderen
    4. Yes, I saw that already. I tried that address but no result. I have a very simple slef-made jtag cable only containing 3 100 Ohms resistors (Xilinx dlc5). Maybe I have to buy a more sophisticated one and try again, who knows this will be succesfull. Btw, the UART connection went smoothly.

      Verwijderen
    5. Deze reactie is verwijderd door de auteur.

      Verwijderen
    6. I bought a new JTAG cable ('Altera' USBBlaster) and connected it. It looks like something is wrong with the JTAG chain. The Altera JTAG debugger program says "Error: no device detected". When I run UrJTAG, the cable is correctly recognized, but the "detect" command does not give any reply.
      Any suggestions how I can solve this JTAG issue?

      Ok, I looked with a magnifying glass next to the JTAG connection on the board: it seems that 4 SMD resistors are missing: R354, R355, R287, R376. Maybe that is the reason why it is not working. I will have a look to what pins they are connected.

      Verwijderen
    7. However, when I checked the 4 missing SMD resistors close to the connector (R354, R355, R287, R376), they appear all to be connected to the TRST pin, I guess that is not important to me as the JTAG cable does not have a TRST pin.
      I did some Ohm measurements on the JTAG pins, this is what I measure with the board switched of:
      Vcc --> TDI: 4.7 kOhm
      Vcc --> TMS: 4.7 kOhm
      Vcc --> TDO: infinite
      (Vcc --> TRST: 1.7 kOhm)
      GND --> TCK: 5.8 kOhm

      [And to be complete:
      GND --> TDI: 5.8 kOhm
      GND --> TMS: 5.8 kOhm
      GND --> TDO: infinite kOhm
      (GND --> TRST: 2.0 kOhm)
      Vcc --> TCK: 4.7 kOhm]

      Anyone an idea whether the measured Ohms are normal?
      Could some pull up or pull down resistor be missing or having the wrong value?

      Anyone an idea whether the measured Ohms are normal?
      Could some pull up or pull down resistor be missing or having the wrong value?

      Verwijderen
    8. Finally I succeeded to read the flash memory with an adapted version of zjtag 1.5. I posted more details here: http://forums.modem-help.co.uk/viewtopic.php?t=11413

      Verwijderen
  8. Who knows if there are any OpenWRT implementations with this Broadcom chip with a working VDSL modem? I cannot find any proof of that. For me that is a requirement to continue “hacking” this modem.

    BeantwoordenVerwijderen