Sercomm H500-s

Devices with Broadcom WiFi chipsets have limited OpenWrt supportability (due to limited FLOSS driver availability for Broadcom chips). Consider this when choosing a device to buy, or when deciding to flash OpenWrt on your device because it is listed as supported. See Broadcom WiFi for details.

DSL will not work at all on devices with BCM63xx DSL chipset (due to unavailability of FLOSS driver for Broadcom chips). Consider this when choosing a device to buy, or when deciding to flash OpenWrt on your device because it is listed as supported.
See Broadcom DSL, Unsupported: DSL modem and Broadcom BCM63xx for details.

h500s-label_lowi.jpg h500s-label_vfes.jpg

The main diffence between lowi and vfes models is the FXS electronic (not supported in OpenWrt):

  • H500-s vfes: comes with the FXS stuff
  • H500-s lowi: no FXS electronic soldered on the board

Warning: If for some reason, you brick the device (non working firmware) you may need to use the sercomm upgrade mode, see → recovery

Warning: On the H500-s lowi model There is no known way to stop the bootloader at the command line on the serial console.

We'll need to get admin access to the OEM firmware web interface. Therefore if you don't know the admin password, first a factory reset to the default config is required, otherwise start at step 4.

  1. Power on the router and wait for the OEM firmware to load.
  2. Press the reset button, hold it about 8 or more seconds until the PHONE LED starts blinking. Release the button. Now the router will restart.
  3. Wait until the router restarted and access to its web interface:
    • Address: http://192.168.0.1
    • User: admin
    • Password: VF-ESVodafone-H-500-s or l033i-h500s
  4. Go to Settings → Firmware Update, and select the Openwrt factory firmware (sercomm_h500-s-squashfs-factory.img)
  5. Press the Update button and wait some minutes until the update process finish

    The router will restart.
  6. ssh to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.

With this procedure you will flash the firmware using the bootloader web interface

Spite this router comes with web interface in the bootloader for flashing purposes, the procedure is still unknown.

Please, first try → failsafe_and_factory_reset, if you bricked Openwrt while configuring after installation.

Broken firmware:

The bootloader (CFE) comes with a proprietary Sercomm module for recovering purposes. If for some reason the router is unable to boot due to a faulty firmware, you can recover the router by putting it into Sercomm Upgrade mode. Follow these steps:

  1. Power off the router
  2. Press the WPS button, don't release it yet!
  3. Power on the router
  4. Wait 5 seconds or more until the power LED blinks in red
  5. Release the WPS button
  6. Execute the sercomm-recovery utility as root in your OS-linux computer:
    sercomm-recovery -v eth0 flash_burn.bin

    If you have the serial console attached to the router, you'll see an output like this:

    ***************************************************
        Sercomm Boot Version 0.0.4.0
     
    ***************************************************
    WPS Button is pressed!
    Correctable ECC Error detected: addr=0x00a8d000, intrCtrl=0x000000B0, accessCtrl=0xE3441010
    Correctable ECC Error detected: addr=0x04c58200, intrCtrl=0x00000090, accessCtrl=0xE3441010
    Disabling Switch ports.
    Flushing Receive Buffers...
    0 buffers found
    Closing DMA Channels
     
    Resetting board in 0 seconds...HELO
  7. Wait until the router restarts and inits completely the stock firmware
OEM firmware
MOD VFES 3.4.17 Vodafone-H-500-s_SERCOMM_VFES_3417_MOD.img telnetd port 2323
VFES 3.5.10 Vodafone-H-500-s_SERCOMM_VFES_3510.img ?
OEM lowi 3.3.05 lowi-h500s_SERCOMM_LOWI_3305_OEM.img telnetd port 2323
OEM Finetwork 3612 ASCK1MZ-W1H-004-0000003612.img telnetd port ?
GPL source code H500s V3305.rar

Default password:

Model User Default Password
H500-s vfes admin VF-ESVodafone-H-500-s
H500-s lowi admin l033i-h500s
H500-s finetwork admin admin
index partition part_name offset size size (KiB)
00 mtd0 cferom 0x0000000 0x0020000 128
01 mtd1 part_map 0x0020000 0x00a0000 640
02 mtd2 cferam1 0x00c0000 0x0140000 1280
03 mtd3 cferam2 0x0200000 0x0140000 1280
04 mtd4 pcba-sn 0x0340000 0x00a0000 640
05 mtd5 protect_data 0x03e0000 0x0140000 1280
06 mtd6 kernel_fs1 0x0520000 0x1e00000 30720
07 mtd12 lib_1 0x2320000 0x1400000 20480
08 mtd7 kernel_fs2 0x3720000 0x1e00000 30720
09 mtd13 lib_2 0x5520000 0x1400000 20480
10 mtd8 boot_flag1 0x6920000 0x0140000 1280
11 mtd9 boot_flag2 0x6a60000 0x0140000 1280
12 mtd10 xml_cfg 0x6ba0000 0x0280000 2560
13 mtd11 app_data 0x6e20000 0x0280000 2560

NAND flash dump: h500s-nand_dump.7z

The part_map (offset 0x0020000) stores the real partition offsets (there might be bad blocks) and sizes. This partition starts with the SCFLMAPOK string. The partitions are at the offset 0x800 grouped in 3 columns (12 bytes). E.g:

$ xxd -g 4 -c 12 -s $((0x800)) -l $((0xb4)) part_map          
00000800: 00000001 00000005 00000005  ............
0000080c: 00000006 0000000f 0000000a  ............
00000818: 00000010 00000019 0000000a  ............
00000824: 0000001a 0000001e 00000005  ............
00000830: 0000001f 00000028 0000000a  .......(....
0000083c: 00000029 00000119 000000f1  ...)........
00000848: 0000011a 000001b9 000000a0  ............
00000854: 000001ba 000002a9 000000f0  ............
00000860: 000002aa 00000349 000000a0  .......I....
0000086c: 0000034a 00000353 0000000a  ...J...S....
00000878: 00000354 0000035d 0000000a  ...T...]....
00000884: 0000035e 00000371 00000014  ...^...q....
00000890: 00000372 00000385 00000014  ...r........
0000089c: 0000eeee 0000eeee 0000eeee  ............
000008a8: 00000000 00000000 00000000  ............

The value in each column should be multiplied by 0x20000 (block size):

real_value = column_value * 0x20000

The first column is the real offset, the second is the end offset and the third is the size.

Instruction set MIPS Big Endian
Vendor Broadcom
bootloader CFE
Board ID 963167REF3
System-On-Chip Broadcom BCM63167 VKREBG
CPU @Frq BMIPS4350 V8.0 @400 MHz
Flash-Chip Macronix MX30LF1G18AC-TI (NAND)
Flash size 128 MiB
RAM-Chip Nanya NT5CC64M16GP-DI / DDR3L-1600
RAM size 128 MiB
Wireless 802.11b/g/n: BCM435f (integrated)
802.11ac: Quantenna QT3740BC (onboard SoC)
Switch BCM53134S connected via MDIO: 3x Gigabit ethernet
USB 1x 2.0
FXS/VoIP Le9672WQC (not present in Lowi version)
PSU 12 VDC, 2.5 A / PS30W120EUG20-BXK-00
Serial Yes
JTAG No

Photo of front and back of the casing:

Opening the case

Note: This will void your warranty!

  • There are 2 screws hidden under the rubber pads at the bottom side of the router, they hold the casing together with additional plastic flanges. Just remove the screws, and carefully separate boths parts of the casing.

Main PCB (lowi version):

Main SoC

The heatsink over the SoC is plastic made. The conductivity is unknown. Furthermore, in some units it's likely loose. Please, check this part to avoid further damage on your unit.

NAND flash

h500s-nand.jpg

We only can configure the internal switch in bcm63xx. The external switch will behave as a dumb switch and viewed as one LAN port in LuCi. The WAN port belongs to the internal switch and can be configured in LuCi.

The external switch can be configured using the bmips target with support for DSA. See commit bmips: add support for Sercomm H-500s

Wi-Fi CERTIFIED n:

  • 2.4 GHz, 5 GHz - Concurrent
  • 2 Spatial Streams 2.4 GHz
  • 3 Spatial Streams 5 GHz
  • Short Guard Interval
  • TX A-MPDU
  • STBC Transmit
  • 40 MHz operation in 2.4 GHz, with coexistence mechanisms
  • 40 MHz operation in 5 GHz
  • HT Duplicate Mode (MCS 32)

Wi-Fi CERTIFIED ac:

  • 4 Spatial Streams 5 GHz
  • Rx MCS 8-9 (256-QAM)
  • Rx A-MPDU of A-MSDU
  • Tx SU beamformer
  • Low Density Parity Check coding

2.4 GHz

The 2.4 GHz wifi is integrated into the main BCM63167 SoC. No known available FLOSS drivers for this part at the moment --- 2020/01/12

Some dumps from the original firmware:

~ # wlctl revinfo vendorid 0x14e4 deviceid 0x435f radiorev 0xc2057000 chipnum 0x6362 chiprev 0x1 chippackage 0x0 corerev 0x16 boardid 0x513 boardvendor 0x14e4 boardrev P230 driverrev 0x70ea413 ucoderev 0x3fc0077 bus 0x0 phytype 0x4 phyrev 0x8 anarev 0x0 nvramrev 0 ~ # wlctl srdump srom[000]: 0x2801 0x0000 0x0566 0x14e4 0x0078 0xedbe 0x0000 0x2bc4 srom[008]: 0x2a64 0x2964 0x2c64 0x3ce7 0x46ff 0x47ff 0x0c00 0x0820 srom[016]: 0x0030 0x1002 0x1f2f 0x7d75 0x8080 0x0032 0x0100 0x8400 srom[024]: 0xd700 0x01c7 0x0083 0x8500 0x2010 0xffff 0x0000 0xffff srom[032]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[040]: 0xffff 0xffff 0x1010 0x0005 0xffff 0xffff 0xffff 0xffff srom[048]: 0x4354 0x8000 0x0002 0x0000 0x1f30 0x1800 0x0000 0x0000 srom[056]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[064]: 0x5372 0x1230 0x0200 0x0000 0x0000 0x0000 0x0000 0x0000 srom[072]: 0x0000 0x0000 0x0000 0xffff 0xffff 0xffff 0x0303 0x0202 srom[080]: 0xff02 0x0033 0xffff 0xffff 0xffff 0xffff 0xffff 0x0315 srom[088]: 0x0315 0x7800 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[096]: 0x2042 0xff0e 0x153a 0xfb23 0x3e42 0x4242 0xff11 0x11eb srom[104]: 0xfc05 0xfed0 0x1297 0xfbad 0xfebf 0x125f 0xfb9e 0x0000 srom[112]: 0x2042 0xff8c 0x1620 0xfb8c 0x3e42 0x4242 0xfede 0x12cd srom[120]: 0xfbb5 0xfebe 0x1478 0xfb1a 0xfec5 0x1294 0xfba3 0x0000 srom[128]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[136]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[144]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[152]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[160]: 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 srom[168]: 0x0000 0x2000 0x4422 0x2000 0x4422 0x2000 0x4422 0x2000 srom[176]: 0x4422 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 srom[184]: 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 srom[192]: 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 srom[200]: 0x0000 0x0000 0x0000 0x0000 0x0000 0xffff 0xffff 0xffff srom[208]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[216]: 0xffff 0xffff 0xffff 0xb908 ~ # wlctl nvram_dump sromrev=8 boardrev=0x1230 boardflags=0x200 boardflags2=0x0 boardtype=0x566 subvid=0x14e4 boardnum=0 regrev=0 pa0b0=0xff0e pa0b1=0x153a pa0b2=0xfb23 pa0itssit=32 pa0maxpwr=66 opo=0 aa2g=3 aa5g=3 ag0=2 ag1=2 ag2=2 ag3=255 pa1b0=0xff11 pa1b1=0x11eb pa1b2=0xfc05 pa1lob0=0xfed0 pa1lob1=0x1297 pa1lob2=0xfbad pa1hib0=0xfebf pa1hib1=0x125f pa1hib2=0xfb9e pa1itssit=62 pa1maxpwr=66 pa1lomaxpwr=66 pa1himaxpwr=66 bxa2g=3 rssisav2g=7 rssismc2g=15 rssismf2g=15 bxa5g=3 rssisav5g=7 rssismc5g=15 rssismf5g=15 tri2g=255 tri5g=255 tri5gl=255 tri5gh=255 rxpo2g=-1 rxpo5g=-1 txchain=3 rxchain=3 antswitch=0 tssipos2g=1 extpagain2g=2 pdetrange2g=2 triso2g=3 antswctl2g=0 tssipos5g=1 extpagain5g=2 pdetrange5g=2 triso5g=3 antswctl5g=0 ccode= macaddr=78:81:02:61:de:ae tempthresh=120 tempoffset=0 rawtempsense=0x1ff measpower=0x7f tempsense_slope=0xff tempcorrx=0x3f tempsense_option=0x3 freqoffset_corr=0xf iqcal_swp_dis=0x1 hw_iqcal_en=0x1 elna2g=255 elna5g=255 phycal_tempdelta=255 temps_period=15 temps_hysteresis=15 measpower1=0x7f measpower2=0x7f cck2gpo=0 ofdm2gpo=0 ofdm5gpo=0 ofdm5glpo=0 ofdm5ghpo=0 mcs2gpo0=8192 mcs2gpo1=17442 mcs2gpo2=8192 mcs2gpo3=17442 mcs2gpo4=8192 mcs2gpo5=17442 mcs2gpo6=8192 mcs2gpo7=17442 mcs5gpo0=0 mcs5gpo1=0 mcs5gpo2=0 mcs5gpo3=0 mcs5gpo4=0 mcs5gpo5=0 mcs5gpo6=0 mcs5gpo7=0 mcs5glpo0=0 mcs5glpo1=0 mcs5glpo2=0 mcs5glpo3=0 mcs5glpo4=0 mcs5glpo5=0 mcs5glpo6=0 mcs5glpo7=0 mcs5ghpo0=0 mcs5ghpo1=0 mcs5ghpo2=0 mcs5ghpo3=0 mcs5ghpo4=0 mcs5ghpo5=0 mcs5ghpo6=0 mcs5ghpo7=0 cddpo=0 stbcpo=0 bw40po=0 bwduppo=0 pcieingress_war=15 eu_edthresh2g=255 eu_edthresh5g=255 rxgainerr2ga0=63 rxgainerr2ga1=31 rxgainerr2ga2=31 rxgainerr5gla0=63 rxgainerr5gla1=31 rxgainerr5gla2=31 rxgainerr5gma0=63 rxgainerr5gma1=31 rxgainerr5gma2=31 rxgainerr5gha0=63 rxgainerr5gha1=31 rxgainerr5gha2=31 rxgainerr5gua0=63 rxgainerr5gua1=31 rxgainerr5gua2=31 noiselvl2ga0=31 noiselvl2ga1=31 noiselvl2ga2=31 noiselvl5gla0=31 noiselvl5gla1=31 noiselvl5gla2=31 noiselvl5gma0=31 noiselvl5gma1=31 noiselvl5gma2=31 noiselvl5gha0=31 noiselvl5gha1=31 noiselvl5gha2=31 noiselvl5gua0=31 noiselvl5gua1=31 noiselvl5gua2=31 noisecaloffset=255 noisecaloffset5g=255 subband5gver=7 maxp2ga0=66 itt2ga0=32 itt5ga0=62 pa2gw0a0=0xff0e pa2gw1a0=0x153a pa2gw2a0=0xfb23 maxp5ga0=66 maxp5gha0=66 maxp5gla0=66 pa5gw0a0=0xff11 pa5gw1a0=0x11eb pa5gw2a0=0xfc05 pa5glw0a0=0xfed0 pa5glw1a0=0x1297 pa5glw2a0=0xfbad pa5ghw0a0=0xfebf pa5ghw1a0=0x125f pa5ghw2a0=0xfb9e maxp2ga1=66 itt2ga1=32 itt5ga1=62 pa2gw0a1=0xff8c pa2gw1a1=0x1620 pa2gw2a1=0xfb8c maxp5ga1=66 maxp5gha1=66 maxp5gla1=66 pa5gw0a1=0xfede pa5gw1a1=0x12cd pa5gw2a1=0xfbb5 pa5glw0a1=0xfebe pa5glw1a1=0x1478 pa5glw2a1=0xfb1a pa5ghw0a1=0xfec5 pa5ghw1a1=0x1294 pa5ghw2a1=0xfba3 maxp2ga2=255 itt2ga2=255 itt5ga2=255 pa2gw0a2=0xffff pa2gw1a2=0xffff pa2gw2a2=0xffff maxp5ga2=255 maxp5gha2=255 maxp5gla2=255 pa5gw0a2=0xffff pa5gw1a2=0xffff pa5gw2a2=0xffff pa5glw0a2=0xffff pa5glw1a2=0xffff pa5glw2a2=0xffff pa5ghw0a2=0xffff pa5ghw1a2=0xffff pa5ghw2a2=0xffff maxp2ga3=255 itt2ga3=255 itt5ga3=255 pa2gw0a3=0xffff pa2gw1a3=0xffff pa2gw2a3=0xffff maxp5ga3=255 maxp5gha3=255 maxp5gla3=255 pa5gw0a3=0xffff pa5gw1a3=0xffff pa5gw2a3=0xffff pa5glw0a3=0xffff pa5glw1a3=0xffff pa5glw2a3=0xffff pa5ghw0a3=0xffff pa5ghw1a3=0xffff pa5ghw2a3=0xffff ~ #


5 GHz

The 5 GHz band is managed by an autonomous wifi subsystem with its own SoC (Quantenna QT3740BC). This SoC transfers network packets via a RGMII port (gigabit ethernet) to the main SoC. See the switch schema.

To make the Quantenna wifi work:

  1. Configure a virtual IP to let the Quantenna SoC communicate with the main SoC. I.e with uci commands:
    uci set network.lan2=interface
    uci set network.lan2.ifname=@lan
    uci set network.lan2.proto=static
    uci set network.lan2.ipaddr=1.1.1.1
    uci set network.lan2.netmask=255.0.0.0
    uci commit network
    /etc/init.d/network/restart
  2. Configure a TFTP server inside OpenWrt, the Quantenna images will be served in the /etc/wlan directory:
    uci set dhcp.@dnsmasq[-1].enable_tftp=1
    uci set dhcp.@dnsmasq[-1].tftp_root=/etc/wlan
    uci commit dhcp
    /etc/init.d/dnsmasq restart

    The quantenna will pick from /etc/wlan the files u-boot.bin and topaz-linux.lzma.img

  3. Install the qcsapi client.
    opkg update
    opkg install libtirpc
    opkg install call_qcsapi_1.0.1-1_mips_mips32.ipk

    The qcsapi client, source code and built package. It includes the Quantenna TFTP files, and a script to make a basic configuration:

Using the command call_qcsapi_sockrpc we can start the wifi. Example:

call_qcsapi_sockrpc --host 1.1.1.2 is_startprod_done
call_qcsapi_sockrpc --host 1.1.1.2 startprod
call_qcsapi_sockrpc --host 1.1.1.2 rfstatus
call_qcsapi_sockrpc --host 1.1.1.2 rfenable 0
call_qcsapi_sockrpc --host 1.1.1.2 rfstatus
call_qcsapi_sockrpc --host 1.1.1.2 rfenable 1

See Quantenna_Configuration_and_Status_APIs-INTERNAL.pdf

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

  • BCM63167 serial port:
    4 J302 GND TX VCC RX

  • QT3740BC serial port:
    4 JXW1 GND TX VCC RX

Only connect GND, TX and RX.

Baud rate: 115200

LEDS

GPIO LED
0 MOBILE red
1 MOBILE green
8 POWER red
9 WIFI green
12 PHONE red
13 WIFI red
14 INTERNET red
15 INTERNET green
16 PHONE green
17 POWER green
23 MOBILE blue

Buttons

GPIO Button
34 WPS
35 RESET

Other

GPIO Location
10 R435 R434
18 R229 (eth switch reset)
19 R23
20 QT3740BC RESET
21 R558 (near main SoC [NAND flash bootstrap])

The board uses CFE. The lowi version seems to be blocked and there is no known way to enter into the CLI. However the vfes version allows to break into the CFE. Both CFEs are interchangeable since the boards are identical.

About the possible boards compatible with this CFE:

CFE> b
Press:  <enter> to use current value
        '-' to go previous parameter
        '.' to clear the current value
        'x' to exit this command
963268SV1                  ------ 0 
963268MBV(obsolete)        ------ 1 
963168VX                   ------ 2 
963168VX_P300              ------ 3 
963268BU                   ------ 4 
963268BU_P300              ------ 5 
963268SV2_EXTSW            ------ 6 
963168MBV_17A              ------ 7 
963168MBV_30A              ------ 8 
963168XH                   ------ 9 
963168XH5                  ------ 10
963168MP                   ------ 11
963268V30A                 ------ 12
963168MEDIA                ------ 13
963268SV2                  ------ 14
963168XFG3                 ------ 15
963168XF                   ------ 16
963168XM                   ------ 17
963168MBV3                 ------ 18
963168MBV17A302            ------ 19
963168MBV30A302            ------ 20
963168VX_P400              ------ 21
963168VX_ext1p8            ------ 22
963269BHR                  ------ 23
963168ACH5                 ------ 24
963168AC5                  ------ 25
963168XN5                  ------ 26
963168XM5                  ------ 27
963168XM5_6302             ------ 28
963168WFAR                 ------ 29
963167REF1                 ------ 30
963167REF3(obsolete)       ------ 31
963168PLC                  ------ 32
963168PLC_MOCAW            ------ 33
Board Id (0-33)                   :  31

1G-FD Using br device TFTP from server 1.1.1.1; our IP address is 1.1.1.2 Filename 'u-boot.bin'. Load address: 0x88000000 Loading: *<0x08>T ##### done Bytes transferred = 69892 (0x11104) Boot reached stage 13 Boot reached stage 12 Valid CRC found in flash restoring env... Boot reached stage 11 hw_config_id 65535: 'Essential_Gateway' Cold boot Reset status: 0x00000001 Info: data uncached: addr=0xc0000000 size=1024MB Info: text at 0x88040000, stack at 0x88013ffc(8192), heap at 0x88000000(73728), uboot size 174476 Info: i-cache is enabled Info: d-cache is enabled Info: CPU freq is 500000000, dev freq is 125000000 Info: Quantenna U-Boot version:v37.4.0.136 Info: build date 'Mar 07 2018', time '15:26:33' SPI flash info: name : mx25l512e jedec_id : 0xc22010 sector size : 4096 number of sector : 16 frequency : 104000000 flags : 0x2 lock : DDR_INIT: type = 16, speed = 3, size = 134217728, rev = 0x43, param = 0x0 DDR_INIT: replacing invalid param = 0x0 with default 0xe7b 400MHz BDA at 0x80002000 In: serial Out: serial Err: serial Boot reached stage 64 Boot reached stage 65 br Hit any key to stop autoboot: 0 Boot reached stage 80 1G-FD Using br device TFTP from server 1.1.1.1; our IP address is 1.1.1.2 Filename 'topaz-linux.lzma.img'. Load address: 0x83000000 Loading: *<0x08>################################################################# ################################################################# ################################################################# ################################################################# ##############################T T T T Retry count exceeded; starting again 1G-FD Using br device TFTP from server 1.1.1.1; our IP address is 1.1.1.2 Filename 'topaz-linux.lzma.img'. Load address: 0x83000000 Loading: *<0x08>################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ########################################################## done Bytes transferred = 5579262 (0x5521fe) Boot reached stage 81 Boot reached stage 84 Boot reached stage 1 ## Booting kernel from Legacy Image at 83000000 ... Boot reached stage 2 Boot reached stage 3 Image Name: topaz-linux Image Type: arc Linux Kernel Image (lzma compressed) Data Size: 5571070 Bytes = 5.3 MB Load Address: 8493a000 Entry Point: 8493a000 Qtn flags: 420dc4a4 Verifying Checksum ... OK Boot reached stage 4 Boot reached stage 5 Boot reached stage 6 Boot reached stage 14 Uncompressing Kernel Image ... OK Boot reached stage 7 Boot reached stage 8 Command line TAG setup Params->u.cmdline.cmdline console=ttyS0,115200n8 earlyprintk=1 hw_config_id=65535 p console=ttyS0,115200n8 earlyprintk=1 hw_config_id=65535 ## Unset TAG qtn_flags 420dc4a4 ## Transferring control to Linux (at address 8493a000) ATAG parameters 88068094 - 880680ec... [ 0.000000] Linux version 2.6.35.12 (adelson@ubuntu) (gcc version 4.2.3 (ARC_2.3)) #2 Wed Mar 7 15:41:13 CST 2018 [ 0.000000] Parsing ATAG parameters from bootloader [ 0.000000] ATAG_CORE: successful parsing [ 0.000000] ATAG_CMDLINE: command line = console=ttyS0,115200n8 earlyprintk=1 hw_config_id=65535 [ 0.000000] Board id: 65535 [ 0.000000] ATAG_HW_CONFIG_ID: hw_config_id = 65535 [ 0.000000] [ 0.000000] Processor Family: ARC 700 [0x33] [ 0.000000] CPU speed : 500.00 Mhz [ 0.000000] Timers: TIMER1 TIMER0 [ 0.000000] Interrupt Vect Base: 0x88052800 [ 0.000000] Peripheral Base: NOT present; assuming 0xCOFC0000 [ 0.000000] Data UNCACHED Base (I/O): start 0xc0 Sz, 1024 MB [ 0.000000] ARC700 MMU Ver [2] [ 0.000000] PAGE SIZE 8k [ 0.000000] JTLB 128 x 2 = 256 entries [ 0.000000] uDTLB 8 entr, uITLB 4 entr [ 0.000000] TLB Refill "will NOT" Flush uTLBs [ 0.000000] Detected I-cache : [ 0.000000] Type=2 way set-assoc, Line length=32, Size=16K (enabled) [ 0.000000] Detected D-cache : [ 0.000000] Type=4 way set-assoc, Line length=32, Size=16K (enabled) [ 0.000000] Extensions: [ 0.000000] MPY: 32x32 with ANY Result Reg MAC MPY: Dual 16 x 16 and 32 x 16 [ 0.000000] DCCM: N/A ICCM: N/A [ 0.000000] CRC: N/A, SWAP: Present NORM: Present [ 0.000000] Min-Max: Present, Barrel Shifter: Present [ 0.000000] Ext Arith Insn: Present [ 0.000000] Floating Point Extension: N/A [ 0.000000] On node 0 totalpages: 16383 [ 0.000000] free_area_init_node: node 0, pgdat 85bd5d94, node_mem_map 85c86024 [ 0.000000] Normal zone: 72 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 16311 pages, LIFO batch:3 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16311 [ 0.000000] Kernel command line: console=ttyS0,115200n8 earlyprintk=1 hw_config_id=65535 [ 0.000000] bootconsole [ruby_early0] enabled [ 0.000000] PID hash table entries: 512 (order: -2, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 3, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 2, 32768 bytes) [ 0.000000] Memory: 35576KB available (2171K code,1204K data, 16376K init) [ 0.000000] Hierarchical RCU implementation. [ 0.000000] RCU debugfs-based tracing is enabled. [ 0.000000] Verbose stalled-CPUs detection is disabled. [ 0.000000] clockevent mode switch to [1] [ 0.000000] clockevent mode switch to [2] [ 0.000000] Calibrating delay loop... 248.21 BogoMIPS (lpj=620544) [ 0.105000] pid_max: default: 4096 minimum: 301 [ 0.110000] Mount-cache hash table entries: 1024 [ 0.115000] Starting run_ksoftirqd, stack (thread_info) at 85bfa000 cpu 0 [ 0.120000] NET: Registered protocol family 16 [ 0.125000] Topaz heap 1 in SRAM 880163c0<->88020000 [ 0.130000] Topaz heap 2 in SRAM 88011000<->88012000 [ 0.140000] bio: create slab <bio-0> at 0 [ 0.150000] watch64: 2003/08/22 Josef 'Jeff' Sipek <jeffpc@xxxxxxxxxxxxx> [ 0.155000] watch64: Enabling Watch64 extensions...done. [ 0.160000] Switching to clocksource ARC Timer1 [ 0.170000] NET: Registered protocol family 2 [ 0.175000] IP route cache hash table entries: 2048 (order: 0, 8192 bytes) [ 0.180000] TCP established hash table entries: 4096 (order: 2, 32768 bytes) [ 0.185000] TCP bind hash table entries: 4096 (order: 1, 16384 bytes) [ 0.190000] TCP: Hash tables configured (established 4096 bind 4096) [ 0.195000] TCP reno registered [ 0.200000] NET: Registered protocol family 1 [ 0.975000] JFFS2 version 2.2. (NAND) <0xc2><0xa9> 2001-2006 Red Hat, Inc. [ 0.980000] msgmni has been set to 69 [ 0.985000] io scheduler noop registered (default) [ 1.450000] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled [ 1.460000] serial8250.0: ttyS0 at MMIO 0xf0000000 (irq = 48) is a 16550A [ 1.465000] console [ttyS0] enabled, bootconsole disabled [ 1.465000] console [ttyS0] enabled, bootconsole disabled [ 1.470000] brd: module loaded [ 1.480000] loop: module loaded [ 1.485000] spi_flash: Force not to support Protect Mode [ 1.490000] Creating 3 MTD partitions on "spi_flash": [ 1.495000] 0x000000000000-0x000000005000 : "uboot" [ 1.505000] 0x000000005000-0x00000000b000 : "uboot_env" [ 1.515000] 0x00000000b000-0x000000010000 : "data" [ 1.520000] spi_flash: SPI flash driver initialized successfully! [ 1.530000] ruby_health loading [ 1.530000] HBM pool: emac rx 0x0 to 0x8000, wmac rx 0x8000 to 0xa000 [ 1.955000] HBM meta: emac rx 0x63c040 to 0x6bc040, wmac rx 0x6bc080 to 0x6dc080 [ 1.960000] topaz_hbm_init_pool_list pool 0 pool_list 0x88000000 bus_range 0x16ec400 to 0x26ec400 sz 2048 count 8192 [ 1.960000] topaz_hbm_init_pool_list pool 1 pool_list 0x88008000 bus_range 0x26fc400 to 0x48fc400 sz 17408 count 2048 [ 1.960000] topaz_hbm_init_pool_list pool 3 pool_list 0x8800a000 bus_range 0x0 to 0x0 sz 0 count 4096 [ 1.965000] topaz_busmon_init success [ 1.970000] topaz_temp_sens_init success [ 1.970000] u32 classifier [ 1.975000] input device check on [ 1.980000] Actions configured [ 1.980000] Netfilter messages via NETLINK v0.30. [ 1.985000] nf_conntrack version 0.5.0 (555 buckets, 2220 max) [ 1.990000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 1.995000] TCP cubic registered [ 2.000000] NET: Registered protocol family 10 [ 2.005000] NET: Registered protocol family 17 [ 2.010000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> [ 2.015000] All bugs added by David S. Miller <davem@redhat.com> [ 2.025000] Freeing unused kernel memory: 16376k freed [8493a000] TO [85938000] [ 2.030000] Common mmap addr-space starts 2c0f0000 init started: BusyBox v1.10.3 (2018-03-07 15:27:06 CST) starting pid 44, tty '': '/etc/init.d/rcS' [ 2.440000] load_module: 'bootcfg' using DRAM (offset:0x87620000, size:0x956c) Starting portmap: done Initializing random number generator... done. /mnt/jffs2/wireless_conf.txt not found. Creating a default conf file restore_wireless_conf restore_wireless_conf: wifi_mode = default restore_wireless_conf: Setting default wireless config params restore_wireless_conf: board_id = 65535 restore_wireless_conf: board_name = Essential_Gateway restore_wireless_conf: Writing config params to /mnt/jffs2/wireless_conf.txt Starting network... [ 6.065000] load_module: 'rtl8367b' using DRAM (offset:0x870c0000, size:0x32a53) [ 6.075000] rtl8367b: module license 'unspecified' taints kernel. [ 6.080000] Disabling lock debugging due to kernel taint [ 6.135000] load_module: 'emaclib' using DRAM (offset:0x87658000, size:0x5401) [ 6.260000] load_module: 'switch_vlan' using DRAM (offset:0x87230000, size:0x2771) [ 6.365000] load_module: 'switch_tqe' using DRAM (offset:0x87470000, size:0x5a79), SRAM (offset:0x880163c8, size:0x4) [ 6.420000] tqe_descs_alloc: 2048 tqe_rx_descriptors at kern uncached 0x580e03e0 bus 0x800163e0 [ 6.510000] load_module: 'fwt_if' using DRAM (offset:0x87602000, size:0x1b07) [ 6.550000] load_module: 'fwt_ctrl' using DRAM (offset:0x87240000, size:0x23a09) [ 6.605000] load_module: 'dpi' using DRAM (offset:0x8766c000, size:0x1db7) [ 6.635000] load_module: 'switch_emac' using DRAM (offset:0x87678000, size:0x25a7), SRAM (offset:0x8801ee38, size:0x2f8) [ 6.715000] emac wbsp: 0 [ 6.715000] enable A2 (single) [ 6.780000] Random stuff CC emac0 is eth1_0, emac1 is unused Stateless mode. Using temporary ip address: Using IP address 1.1.1.2 Netmask is not set [ 7.060000] emac_lib eth1_0: force link (1000/Full) [ 7.190000] device eth1_0 entered promiscuous mode [ 7.195000] br0: port 1(eth1_0) entering forwarding state [ 7.200000] br0: port 1(eth1_0) entering forwarding state /sbin/ifup -a ifconfig: SIOCGIFFLAGS: No such device Version of /proc/bootcfg/qtn_regulatory_db.bin is Regulatory db version: v37.4.0.60 Version of /etc/qtn_regulatory_db.bin is Regulatory db version: v37.4.0.99 Selected database version: Regulatory db version: v37.4.0.99 Using /etc/qtn_regulatory_db.bin Starting qevt_server Starting inetd ... /etc/init.d/S42inetd: line 48: /usr/sbin/inetd: not found /scripts/cmdloop starting /sbin/qevt_server, at 00:00:08 up 0 min, load average: 0.16, 0.03, 0.01 [ 8.570000] load_module: 'hw_rev' using DRAM (offset:0x8767c000, size:0x36cc) Starting wireless... [ 8.920000] FWT: [78:81:02:61:de:ad] add entry, port:emac0 node:0 index:679 entries:1 restore_default_config -nr restore_wireless_conf ap restore_wireless_conf: wifi_mode = ap restore_wireless_conf: Setting default wireless config params restore_wireless_conf: board_id = 65535 restore_wireless_conf: board_name = Essential_Gateway restore_wireless_conf: Writing config params to /mnt/jffs2/wireless_conf.txt restore_default_config: Updating security config files for mode ap restore_default_config: Removing block ACK restrictions restore_default_config: Configuration has been set to default values. Reboot after customizing to ensure correct operation. complete Jan 1 00:00:12 qevt_server: Dot11Msg:Interface status change FALSE Jan 1 00:00:12 qevt_server: Dot11Msg:Interface status change FALSE Jan 1 00:00:12 qevt_server: Dot11Msg:Interface status change TRUE Jan 1 00:00:12 qevt_server: Dot11Msg:Interface status change TRUE /scripts/cmdloop starting /sbin/qcsapi_rpcd, at 00:00:13 up 0 min, load average: 0.22, 0.04, 0.01 /scripts/cmdloop starting /sbin/call_qcsapi_rpcd, at 00:00:13 up 0 min, load average: 0.22, 0.04, 0.01 QCS API error 1036: Script failed QCS API error 1000: System not started 'monitor_temperature' is not enabled/set MAUI service started DHCP client disabled Starting httpd cp: cannot stat '/etc/minihttpd.conf': No such file or directory starting pid 1033, tty '/dev/console': '/bin/sh -l' BusyBox v1.10.3 (2018-03-07 15:27:06 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. quantenna # [ 23.210000] br0.10: no IPv6 routers present [ 87.905000] FWT: [00:1e:8c:90:3d:b4] add entry, port:emac0 node:0 index:104 entries:2 Using IP address 1.1.1.2 Netmask is not set ifconfig: bad address '' Loading modules [ 320.885000] load_module: 'qtn_debug' using DRAM (offset:0x85d59c00, size:0x387) [ 321.010000] load_module: 'i2cbus' using DRAM (offset:0x87480000, size:0x1cfe) [ 321.175000] load_module: 'qtsens' using DRAM (offset:0x8763e800, size:0x7c6) [ 321.315000] load_module: 'pm_interval' using DRAM (offset:0x874d2000, size:0x13c2) [ 321.510000] load_module: 'wlan' using DRAM (offset:0x87300000, size:0xa99de) [ 321.865000] wlan: 0.8.4.2 (0.9.3.3) [ 322.040000] load_module: 'auc_fw' using DRAM (offset:0x8722c000, size:0x8ab) [ 322.155000] load_module: 'qvspmod' using DRAM (offset:0x874b0000, size:0x3f65) [ 322.185000] QVSP module init [ 322.280000] load_module: 'qdrv' using DRAM (offset:0x87700000, size:0xa5144) [ 322.605000] qdrv wbsp: 0 [ 322.765000] load_module: 'wlan_xauth' using DRAM (offset:0x85d58400, size:0x33f) [ 322.960000] load_module: 'wlan_ccmp' using DRAM (offset:0x874d4000, size:0x178e) [ 323.140000] load_module: 'wlan_tkip' using DRAM (offset:0x858bc000, size:0x2642) Loading MuC driver (qtn_driver.qtn_ruby.0.bin) Waiting for Wireless Events from interfaces... QCS API error 22: Invalid argument Warning: Setting randomized MAC address! 00:26:86:42:05:b2 Found power table in /etc/power_tables [ 323.960000] QDRV: power table checksum for /etc/power_tables/tx_power_QSR1000_ca.txt [ 324.010000] QDRV: power table checksum for /etc/power_tables/tx_power_QSR1000_eu.txt [ 324.055000] QDRV: power table checksum for /etc/power_tables/tx_power_QSR1000_us.txt [ 324.350000] set power_selection 0 [ 324.355000] qdrv_soc_publish_params: parames->tqe_sem_en 0, auc_tqe_sem_en 0 [ 324.360000] ..... Current RFIC Chip ID -- 4 [ 324.660000] AuC SRAM start 0x88040000 end 0x88080000 size 262144 [ 324.665000] AuC is configured for non-MU SRAM layout [ 324.670000] AuC SRAM bank 0 start 0x88040000 end 0x88050000 [ 324.680000] AuC SRAM bank 1 start 0x88050000 end 0x88060000 [ 324.685000] AuC SRAM bank 2 start 0x88060000 end 0x88070000 [ 324.690000] AuC SRAM bank 3 start 0x88070000 end 0x88080000 [ 324.715000] MuC: g_tqe_sem_en 0 [ 324.720000] MuC: build date Thu, 01 Feb 2018 22:04:19 -0800 [ 324.725000] MuC: slow heap begin=0x00247360 end=0x003c4360 [ 324.730000] MuC: fast heap begin=0x80030800 end=0x80037000 [ 324.735000] MuC: stack start=0x8003ef80 sp=0x8003f6d4 [ 324.740000] MuC: calstate is 3 (prod), dcache on [ 324.745000] MuC: RFIC version 1 rev 0 [ 324.780000] qdrv_mac_reserve_clear: mac reservation table cleared [ 324.805000] QDRV: I2C dapter not found [ 324.955000] qdrv_mu_stat_init [ 324.965000] MuC: bb_init: FEM 0x7 bw_mode 0 chan 0 11b 0 11a 1 [ 324.970000] MuC: rf_optimizing_rf_register_map, set rf to 0x75 [ 324.975000] MuC: os_uc, after bb_rf_complete_attach. [ 324.980000] MuC: WMAC0: hal fd start=0xe5040300 count=48 size=108 end=0xe5041740 [ 324.985000] MuC: WMAC1: hal fd start=0xe5140d50 count=8 size=84 end=0xe5140ff0 [ 324.990000] MuC: freq 1 proj 1 [ 324.990000] MuC: dynamic one-bit autocorrelation enabled [ 324.995000] MuC: QMAT SRAM base 0x80070000 [ 324.995000] MuC: enable IRQs [ 325.025000] MuC: AuC enabled 0xe5101ccc/0x60062d30 il 0xe5101280/0xe5101284 stats 0x60060870/0x60062a700x6007d840 [ 325.030000] MuC: Update MU debug flag failed. keep old value : 0x00000000 [ 325.035000] QDRV: hardware is 4x4 11n/ac Data Only QD840 [ 325.040000] MuC boot succeeded 0.085 seconds start-vap ap [ 326.240000] load_module: 'wlan_scan_ap' using DRAM (offset:0x876d8000, size:0x2ee2) [ 326.335000] QTM daemon registered [ 326.460000] qvsp_nl_node_init: QVSP not initialized [ 326.465000] MuC: qtn_mu_ndpa_setup: bw_cap 2 done [ 326.480000] VAP create succeeded 0.010 seconds [ 326.490000] MuC: qtn_mu_ndpa_setup: bw_cap 2 done [ 327.105000] MuC: calibration ver 0x801 bss_tm set to 1 neigh_repo reset to 0 radar in 80MHZ mode Setting mode to 11ac80 set_region: Setting regulatory region dev_name=wifi0 region=eu mode=ap repeater=0 radar start with[ 328.995000] DFS_s_radio: parameters updated, region: eu regulatory eu [ 329.000000] MuC: macfw: radar_start......... [ 329.005000] MuC: radar_start, region eu = 2 [ 329.250000] qdrv_radar_enable_action: ERROR - radar already enabled ICAC: max_boot_cac is greater than 0, hence the parameter non_dfs_channel is ignored. To avoid doing initial CAC set max_boot_cac to 0. dfs_s_radio 0 dfs 0 non-dfs 0 scan 0 auto-channel 0 channel 36 Configure max_boot_cac to 80 [ 330.275000] device wifi0 entered promiscuous mode [ 330.405000] Enabling SSDP flooding Beamforming enabled [ 331.235000] Enabling SCS SCS enabled QTM: load profile off QTM enabled: 0 [ 332.425000] BRIDGE WLAN report flood-forwarding enabled QCS API error 1010: Cannot contact security manager No core dump generated [ 334.030000] qdrv_radar_is_rdetection_required: ERROR - channel not yet set [ 334.120000] Build name: v37.4.0.146 [ 334.125000] Build revision: 76097 [ 334.130000] Build type: SDK [ 334.135000] Build timestamp: 1517552013 [ 334.140000] Platform ID: 432 [ 334.140000] Hardware ID: QD840 [ 334.145000] Hardware revision: bbic4_rev_a2 [ 334.150000] Band: 5GHz [ 334.155000] Kernel version: 2.6.35 [ 334.160000] Calibration version: disabled [ 334.165000] DC/IQ cal version: V8.1 [ 334.165000] Power cal version: V8.1 [ 334.170000] MuC firmware: qtn_driver.qtn_ruby.0.bin [ 334.175000] DSP firmware: rdsp_driver.0.bin [ 334.180000] AuC firmware: auc_driver.nomu.0.bin [ 334.185000] MAC address 0: 00:26:86:42:05:b2 [ 334.190000] MAC address 1: 00:00:00:00:00:00 [ 334.195000] Recommended U-Boot: v37.4.0.136 Carrier ID 0, uboot update flag 0 complete complete complete MU-MIMO is not supported on this device Starting qrpe daemon... qtna-rpe(4.0.3-402d89b) started PTA request polarity set to 0 PTA grant polarity set to 0 PTA disabled [ 446.560000] qdrv_radar_is_rdetection_required: ERROR - channel not yet set [ 446.565000] MuC: ioctl_power_save, level: 0 -> 5 [ 752.300000] MuC: #RX data path optimal flag 0 [ 752.305000] MuC: rx_post_init: free 0 rxq 9 9 394 descr 0x8000f000/6592 cache 0x80029b00/13184 [ 752.305000] MuC: auto cs is enabled [ 752.310000] qdrv_radar_is_rdetection_required: ERROR - channel not yet set [ 752.370000] WPS: push button is not configured [ 752.370000] br0: port 2(wifi0) entering forwarding state [ 752.370000] br0: port 2(wifi0) entering forwarding state [ 752.370000] MuC: ioctl_power_save, level: 5 -> 1 [ 752.370000] MuC: pduty_stop start-prod: adding default "manufacturer=Quantenna" to /mnt/jffs2/hostapd.conf start-prod: adding default "device_name=Reference Design" to /mnt/jffs2/hostapd.conf start-prod: adding default "model_name=Topaz" to /mnt/jffs2/hostapd.conf start-prod: adding default "model_number=QD840.432" to /mnt/jffs2/hostapd.conf start-prod: adding default "serial_number=0026864205B2" to /mnt/jffs2/hostapd.conf start-prod: adding default "friendly_name=UPnP Access Point" to /mnt/jffs2/hostapd.conf start-prod: adding default "device_type=6-0050F204-1" to /mnt/jffs2/hostapd.conf Enable ap pin setup in all BSSes [ 753.685000] br0: port 2(wifi0) entering forwarding state [ 754.385000] br0: port 2(wifi0) entering forwarding state [ 754.385000] br0: port 2(wifi0) entering forwarding state [ 759.200000] RADAR: CAC started for channel 108 (5540 MHz) [ 783.230000] ICAC: Aborted ICAC due to set channel request [ 784.190000] RADAR: CAC stopped for channel 108 (5540 MHz) [ 872.800000] MuC: ioctl_power_save, level: 1 -> 5 quantenna # cat /proc/cpuinfo Processor Family: ARC 700 [0x33] CPU speed : 500.00 Mhz Timers: TIMER1 TIMER0 Interrupt Vect Base: 0x88052800 Peripheral Base: NOT present; assuming 0xCOFC0000 Data UNCACHED Base (I/O): start 0xc0 Sz, 1024 MB Bogo MIPS : 248.21 ARC700 MMU Ver [2] PAGE SIZE 8k JTLB 128 x 2 = 256 entries uDTLB 8 entr, uITLB 4 entr TLB Refill "will NOT" Flush uTLBs Detected I-cache : Type=2 way set-assoc, Line length=32, Size=16K (enabled) Detected D-cache : Type=4 way set-assoc, Line length=32, Size=16K (enabled) Extensions: MPY: 32x32 with ANY Result Reg MAC MPY: Dual 16 x 16 and 32 x 16 DCCM: N/A ICCM: N/A CRC: N/A, SWAP: Present NORM: Present Min-Max: Present, Barrel Shifter: Present Ext Arith Insn: Present Floating Point Extension: N/A quantenna #


HELO CPUI L1CI HELO CPUI L1CI 4.1605-1.0.38-118.3 DRAM ---- PHYS STRF 400H PHYE DDR3 SIZ4 SIZ3 SIZ2 DINT USYN LSYN MFAS LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN FPS0 FDPM PMOK GFOK F002 F001 RAM1 NAN9 NAN3 RFS0 NAN5 Base: 4.16_05 CFE version 1.0.38-118.3 for BCM963268 (32bit,SP,BE) Build Date: Fri Aug 19 13:10:18 CST 2016 (jeremy@Ubuntu) Copyright (C) 2000-2015 Broadcom Corporation. Boot Strap Register: 0x1ff90bf Chip ID: BCM63167D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz Main Thread: TP0 Memory Test Passed Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes NAND flash device: MXIC MX30LF1G08AA, id 0xc2f1 block 128KB size 131072KB GPIOOverlays is 0x8010 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host/tftp (f/h/c) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Default host ramdisk file name : Default ramdisk store address : Board Id (0-33) : 963167REF3 Number of MAC Addresses (1-32) : 16 Base MAC Address : 78:81:02:61:de:ad PSI Size (1-128) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 0 Main Thread Number [0|1] : 0 WLan Feature : 0x00 Voice Board Configuration (0-19) : LE9672_ZSI Partition 1 Size (MB) : Partition 2 Size (MB) : Partition 3 Size (MB) : Partition 4 Size (MB) (Data) : 4MB External switch id = a750 SC_DEBUG: Nand Partition Table Magic Found at 20000. part 0, logic_offset 00000000, logic_length 00020000, real_offset 00000000, real_length 00020000 part 1, logic_offset 00020000, logic_length 000a0000, real_offset 00020000, real_length 000a0000 part 2, logic_offset 000c0000, logic_length 00140000, real_offset 000c0000, real_length 00140000 part 3, logic_offset 00200000, logic_length 00140000, real_offset 00200000, real_length 00140000 part 4, logic_offset 00340000, logic_length 000a0000, real_offset 00340000, real_length 000a0000 part 5, logic_offset 003e0000, logic_length 00140000, real_offset 003e0000, real_length 00140000 part 6, logic_offset 00520000, logic_length 01e00000, real_offset 00520000, real_length 01e00000 part 7, logic_offset 02320000, logic_length 01400000, real_offset 02320000, real_length 01400000 part 8, logic_offset 03720000, logic_length 01e00000, real_offset 03720000, real_length 01e00000 part 9, logic_offset 05520000, logic_length 01400000, real_offset 05520000, real_length 01400000 part 10, logic_offset 06920000, logic_length 00140000, real_offset 06920000, real_length 00140000 part 11, logic_offset 06a60000, logic_length 00140000, real_offset 06a60000, real_length 00140000 part 12, logic_offset 06ba0000, logic_length 00280000, real_offset 06ba0000, real_length 00280000 part 13, logic_offset 06e20000, logic_length 00280000, real_offset 06e20000, real_length 00280000 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 *************************************************** Sercomm Boot Version 0.0.4.0 *************************************************** Entering Firmware : Everything is OK. Boot Flag's Magic Found at 6920000. Boot Flag's Magic Found at 6a60000. Find bootFlag successfully. BootFlag1: eRcOmM.002 BootFlag2: eRcOmM.001 Booting from first image (0xb8520000) ... Checksum ... OK! Correctable ECC Error detected: addr=0x0052aa00, intrCtrl=0x00000090, accessCtrl=0xE3441010 Correctable ECC Error detected: addr=0x0052aa00, intrCtrl=0x00000090, accessCtrl=0xE3441010 Correctable ECC Error detected: addr=0x005f9000, intrCtrl=0x000000B0, accessCtrl=0xE3441010 Decompression LZMA Image OK! Entry at 0x80455f10 Closing network. Disabling Switch ports. Flushing Receive Buffers... 1 buffers found Closing DMA Channels Starting program at 0x80455f10 Linux version 3.4.11-rt19 (west@ubuntu) (gcc version 4.6.2 (Buildroot 2011.11) ) #3 SMP PREEMPT Thu May 31 16:56:36 CST 2018 963167REF3 prom init CPU revision is: 0002a080 (Broadcom BMIPS4350) DSL SDRAM reserved: 0x132000 Determined physical RAM map: memory: 07ece000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00007ece Movable zone start PFN for each node Early memory PFN ranges 0: 0x00000000 -> 0x00007ece On node 0 totalpages: 32462 free_area_init_node: node 0, pgdat 8056e6d0, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 222 pages used for memmap Normal zone: 28144 pages, LIFO batch:7 PERCPU: Embedded 7 pages/cpu @81103000 s5520 r8192 d14960 u32768 pcpu-alloc: s5520 r8192 d14960 u32768 alloc=8*4096 pcpu-alloc: [0] 0 [0] 1 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32208 Kernel command line: root=mtd:rootfs rw rootfstype=jffs2 irqaffinity=0 PID hash table entries: 512 (order: -1, 2048 bytes) Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Memory: 122632k/129848k available (4432k kernel code, 7216k reserved, 1068k data, 220k init, 0k highmem) Preemptible hierarchical RCU implementation. NR_IRQS:128 console [ttyS0] enabled Allocating memory for DSP module core and initialization code Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0 Calibrating delay loop... 397.31 BogoMIPS (lpj=198656) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 --Kernel Config-- SMP=1 PREEMPT=1 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 Broadcom Logger v0.1 May 31 2018 16:03:32 CPU revision is: 0002a080 (Broadcom BMIPS4350) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Brought up 2 CPUs NET: Registered protocol family 16 Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (0000845b-00008457=4<300) registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb PCI host bridge to bus 0000:00 pci_bus 0000:00: root bus resource [mem 0xa0f00000-0xa0ffffff] pci_bus 0000:00: root bus resource [io 0xa2000000-0xa200ffff] pci 0000:00:00.0: [14e4:435f] type 00 class 0x028000 pci 0000:00:00.0: reg 10: [mem 0x10004000-0x10005fff] pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310 pci 0000:00:09.0: reg 10: [mem 0x10002600-0x100026ff] pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320 pci 0000:00:0a.0: reg 10: [mem 0x10002500-0x100025ff] PCI host bridge to bus 0000:01 pci_bus 0000:01: root bus resource [mem 0x11000000-0x11efffff] pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0] pci 0000:01:00.0: [14e4:6326] type 01 class 0x060400 pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:01:00.0: PCI bridge to [bus 02-02] bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated bcmleg_spi bcmleg_spi.0: master is unqueued, this is deprecated skb_free_task created successfully gbpm_do_work scheduled BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 May 31 2018 16:10:05 initialized Broadcom GBPM v0.1 May 31 2018 16:10:05 initialized NET: Registered protocol family 8 NET: Registered protocol family 20 Switching to clocksource MIPS NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 3, 32768 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP: reno registered UDP hash table entries: 128 (order: 0, 4096 bytes) UDP-Lite hash table entries: 128 (order: 0, 4096 bytes) NET: Registered protocol family 1 PCI: CLS mismatch (64 != 16), using 16 bytes bcm_tstamp initialized, (hpt_freq=200000000 2us_div=200 2ns_mult=5 2ns_shift=0) squashfs: version 4.0 (2009/01/31) Phillip Lougher NTFS driver 2.1.30 [Flags: R/W]. jffs2: version 2.2. (NAND) (SUMMARY) �� 2001-2006 Red Hat, Inc. fuse init (API version 7.18) msgmni has been set to 239 io scheduler noop registered (default) Broadcom NAND controller (BrcmNand Controller) mtd->oobsize=0, mtd->eccOobSize=0 NAND_CS_NAND_XOR=00000000 B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0 brcmnand_read_id: CS0: dev_id=c2f18095 After: NandSelect=40000001, nandConfig=15142200 DevId c2f18095 may not be supported. Will use config info Spare Area Size = 16B/512B Block size=00020000, erase shift=17 NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11 busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff ECC level changed to 4 OOB size changed to 16 BrcmNAND mfg 0 0 UNSUPPORTED NAND CHIP 128MB on CS0 Found NAND on CS0: ACC=e3441010, cfg=15142200, flashId=c2f18095, tim1=6532845b, tim2=00001e94 BrcmNAND version = 0x0400 128MB @00000000 brcmnand_scan: B4 nand_select = 40000001 brcmnand_scan: After nand_select = 40000001 handle_acc_control: default CORR ERR threshold 1 bits ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16 page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17 Brcm NAND controller version = 4.0 NAND flash size 128MB @18000000 ECC layout=brcmnand_oob_bch4_2k brcmnand_scan: mtd->oobsize=64 brcmnand_scan: oobavail=35, eccsize=512, writesize=2048 brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=4, eccbytes=7 -->brcmnand_default_bbt brcmnand_default_bbt: bbt_td = bbt_slc_bch4_main_descr Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0 Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0 brcmnand_reset_corr_threshold: default CORR ERR threshold 1 bits for CS0 brcmnand_reset_corr_threshold: CORR ERR threshold changed to 3 bits for CS0 brcmnandCET: Status -> Deferred PPP generic driver version 2.4.2 PPP BSD Compression module registered PPP Deflate Compression module registered NET: Registered protocol family 24 ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) ehci_hcd 0000:00:0a.0: setting latency timer to 64 ehci_hcd 0000:00:0a.0: EHCI Host Controller ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1 ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500 ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00 hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver PCI: Enabling device 0000:00:09.0 (0000 -> 0002) ohci_hcd 0000:00:09.0: setting latency timer to 64 ohci_hcd 0000:00:09.0: OHCI Host Controller ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2 ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600 hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected usbcore: registered new interface driver usblp Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. brcmboard: brcm_board_init entry DYING GASP IRQ Initialized and Enabled Serial: BCM63XX driver $Revision: 3.00 $ Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported commands) ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX Total # RxBds=1448 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized bcmPktDma_init: Broadcom Packet DMA Library initialized IPSEC SPU: SUCCEEDED GACT probability NOT on Mirror/redirect action on u32 classifier input device check on Actions configured Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (1916 buckets, 7664 max) ip_tables: (C) 2000-2006 Netfilter Core Team TCP: cubic registered Initializing XFRM netlink socket NET: Registered protocol family 10 ip6_tables: (C) 2000-2006 Netfilter Core Team IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 NET: Registered protocol family 15 Initializing MCPD Module Ebtables v2.0 registered ebt_time registered ebt_tcpmss registered ebt_ftos registered ebt_wmm_mark registered 8021q: 802.1Q VLAN Support v1.8 hub 1-0:1.0: over-current condition on port 2 VFS: Mounted root (jffs2 filesystem) readonly on device 31:6. Freeing unused kernel memory: 220k freed init started: BusyBox v1.15.3 () starting pid 296, tty '': '/etc/rcS' bcm_ingqos: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint Broadcom Ingress QoS Module Char Driver v0.1 May 31 2018 16:06:16 Registered<243> Broadcom Ingress QoS ver 0.1 initialized BPM: tot_mem_size=134217728B (128MB), buf_mem_size <15%> =20132655B (19MB), num of buffers=9986, buf size=2016 Broadcom BPM Module Char Driver v0.1 May 31 2018 16:05:56 Registered<244> bcmxtmrt: Broadcom BCM3167D0 ATM/PTM Network Device v0.9 May 31 2018 16:08:15 NBUFF v1.0 Initialized Initialized fcache state Broadcom Packet Flow Cache Char Driver v3.0 May 31 2018 16:06:16 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. [FHW] pktDbgLvl[0x85d5f040]=0 [FHW] fhw_construct: Initialized Fcache HW accelerator layer state flwStatsThread created Constructed Broadcom Packet Flow Cache v3.0 May 31 2018 16:06:16 chipId 0x631670D0 Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 May 31 2018 16:06:00 Registered <241> Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done FAP Debug values at 0xa5f246f0 0xa5fa46f0 fapGso_LoopBkThread created successfully Allocated FAP0 SWQ_HOST2FAP_GSO_LOOPBACK_Q mem=a7998000 : 16384 bytes Allocated FAP0 SWQ_FAP2HOST_GSO_LOOPBACK_Q mem=a7aa0000 : 16384 bytes GSO LOOPBACK Cached HOST2FAP Q INFO: Swq =b0825ef8 qStart=a7998000 qEnd=a799c000 msgSize=4 dqm=18 fapId=0 GSO LOOPBACK Cached FAP2HOST Q INFO: Swq =b0825ec8 qStart=a7aa0000 qEnd=a7aa4000 msgSize=2 dqm=19 fapId=0 Allocated FAP0 SWQ_FAP2HOST_WFD_Q mem=a5df4000 : 7200 bytes Allocated FAP1 SWQ_FAP2HOST_WFD_Q mem=a5cfc000 : 7200 bytes Allocated FAP0 SWQ_FAP2HOST_WFD_Q mem=a5cfa000 : 7200 bytes Allocated FAP1 SWQ_FAP2HOST_WFD_Q mem=a5efc000 : 7200 bytes Allocated FAP0 TM SDRAM Queue Storage (a5f35780) : 390144 bytes @ a5400000 Allocated FAP1 TM SDRAM Queue Storage (a5fb5780) : 390144 bytes @ a5480000 [NTC fapProto] fapReset : Reset FAP Protocol layer [FAP0] DSPRAM : stack <0x80000000><1792>, global <0x80000700><4568>, free <1832>, total<8192> [FAP1] DSPRAM : stack <0x80000000><1792>, global <0x80000700><4568>, free <1832>, total<8192> [FAP0] PSM : addr<0x80002000>, used <24472>, free <104>, total <24576> [FAP1] PSM : addr<0x80002000>, used <24472>, free <104>, total <24576> [FAP0] DQM : availableMemory 14668 bytes, nextByteAddress 0xE00048B0 [FAP1] DQM : availableMemory 14668 bytes, nextByteAddress 0xE00048B0 [FAP0] Initializing FAP4KE GSO LOOPBACK on fapIdx=0 ... [FAP1] IC Timer started [FAP0] SWQ: HOST2FAP_GSO_LOOPBACK [FAP1] FAP4KE WFD Init Done... [FAP0] >>>>------------------ [FAP0] swq =80007ef8 msgSize =4 words , maxDepth=1024 [FAP0] qStart =a7998000 qEnd=a799c000 [FAP0] rdPtr =a7998000 wrPtr=a7998000 count=0 [FAP0] swq->interrupts 0 processed =0 dropped =0 [FAP0] Associated DQM=18 dir HOST2FAP [FAP0] ------------------<<<< [FAP0] SWQ: FAP2HOST_GSO_LOOPBACK [FAP0] >>>>------------------ [FAP0] swq =80007ec8 msgSize =2 words , maxDepth=2048 [FAP0] qStart =a7aa0000 qEnd=a7aa4000 [FAP0] rdPtr =a7aa0000 wrPtr=a7aa0000 count=0 [FAP0] swq->interrupts 0 processed =0 dropped =0 [FAP0] Associated DQM=19 dir FAP2HOST [FAP0] ------------------<<<< [FAP0] FAP4KE GSO LOOPBACK Init Done... [FAP0] IC Timer started [FAP0] FAP4KE WFD Init Done... [FAP1] FAP BPM Initialized. [FAP0] FAP BPM Initialized. Broadcom Packet Flow Cache HW acceleration enabled. fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes bcmPktDma_bind: FAP Driver binding successfull [FAP0] FAP TM: ON [FAP1] FAP TM: ON bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCM63167D0 Ethernet Network Device v0.1 May 31 2018 16:07:57 Broadcom GMAC Char Driver v0.1 May 31 2018 16:08:11 Registered<249> Broadcom GMAC Driver v0.1 May 31 2018 16:08:11 Initialized fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000 ETH Init: Ch:0 - 200 tx BDs at 0xb0a20650 fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000 ETH Init: Ch:1 - 200 tx BDs at 0xb0820650 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184 ETH Init: Ch:0 - 600 rx BDs at 0xb0821910 [FAP0] enetRxChannel 0 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184 ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910 [FAP1] enetRxChannel 1 dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered eth0: <Ext sw port: 1> <Logical : 09> PHY_ID <0x20180001 : 0x01> MAC : 78:81:02:61:DE:AD eth1: <Ext sw port: 2> <Logical : 10> PHY_ID <0x20180002 : 0x02> MAC : 78:81:02:61:DE:AD eth2: <Ext sw port: 3> <Logical : 11> PHY_ID <0x20180003 : 0x03> MAC : 78:81:02:61:DE:AD eth3: <Ext sw port: 5> <Logical : 13> PHY_ID <0x22600e00 : 0x00> MAC : 78:81:02:61:DE:AD eth4: <Int sw port: 3> <Logical : 03> PHY_ID <0x0010000c : 0x0c> MAC : 78:81:02:61:DE:AD Ethernet Auto Power Down and Sleep: Enabled All Port Bit Map: 0x2e08: eth4,eth0,eth1,eth2,eth3 Chip WAN Only Ports 0000, Defined WAN Only Ports 0000, WAN Only Port Result: 0x0000: Chip WAN Preffered Ports 0008, Defined WAN Preffered Ports 0000, WAN Preffered Port Result: 0x0008:eth4 Chip LAN Only Ports 0000, Defined LAN Only Ports 0000, LAN Only Port Result: 0x0000: WAN/LAN Both Capable Ports 0x2e00:eth0,eth1,eth2,eth3 [NTC arl] arlEnable : Enabled ARL binding to FAP Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 May 31 2018 16:05:56 Registered <245> Broadcom 802.1Q VLAN Interface, v0.1 PCIe: No device found - Powering down Endpoint: endpoint_init entry Endpoint: endpoint_init COMPLETED Initializing WLCSM Module WLCSM Module loaded successfully Wifi Forwarding Driver is initialized! gre: GRE over IPv4 demultiplexor driver ip_gre: GRE over IPv4 tunneling driver PPTP driver version 0.8.5 Loading PCM shim driver insmod: can't insert '/lib/modules/qwerpe.ko': No such file or directory --SMP support wl: dsl_tx_pkt_flush_len=338 wl: norm_wmark_tot=3552, pktc_wmark_tot=3552 wl 0000:00:00.0: setting latency timer to 64 wl: passivemode=1 wl0: creating kthread wl0-kthrd wl: napimode=0 Neither SPROM nor OTP has valid image wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl: ID=sb/0/ wl: ID=sb/0/ wl: loading /etc/wlan/bcm6362_map.bin srom rev:8 wl0: allocskbmode=1 currallocskbsz=1024 wfd_bind: Dev wl%d wfd_idx 0 wl_radio_idx 0 Type skb configured WFD thread wfd0-thrd minQId/maxQId (20/1073741844), status (0) qmask 0x3 Instantiating WFD 0 thread +++++ Added gso loopback support for dev=wl0 <84ce4800> wfd_registerdevice Successfully registered dev wl0 ifidx 0 wfd_idx 0 wl0: Broadcom BCM435f 802.11 Wireless Controller 7.14.164.307.cpe4.16L05.1-kdb dgasp: kerSysRegisterDyingGaspHandler: wl0 registered Success Note: Loading 6300 MDK (default) driver for 63167 chip Note: Forcing 53115 driver for 53134 Switch MDK: num_switches = 2 Switch MDK: unit = 0; phy_pbmp = 0x8; config_pbmp = 0x18 Switch MDK: unit = 1; phy_pbmp = 0xe; config_pbmp = 0x2e Switch MDK link poll thread: unit=0; phypbmp=0x8 config_pbmp=0x18 Switch MDK link poll thread: unit=1; phypbmp=0xe config_pbmp=0x2e Energy Efficient Ethernet: Enabled eth3 (Ext switch port: 5) (Logical Port: 13) Link UP 1000 mbps full duplex [LAN] LAN5 Link UP 1000 mbps full duplex device eth3 entered promiscuous mode br0: port 1(eth3) entered forwarding state br0: port 1(eth3) entered forwarding state device eth3.10 entered promiscuous mode br10: port 1(eth3.10) entered forwarding state br10: port 1(eth3.10) entered forwarding state Vodafone-H-500-s-v3.4.17 br0: port 1(eth3) entered forwarding state Thu May 31 17:00:50 UTC 2018 ap_name=syslogd, action=start ap_name=coredump, action=start ap_name=energy_saving, action=start ap_name=dnsmasq, action=start ap_name=phy, action=start device eth3 is already a member of a bridge; can't enslave it to bridge br0. ap_name=dhcpd, action=create Success Success Success Success ap_name=lanip, action=start ap_name=firewall, action=start ap_name=telnetd, action=start ap_name=sshd, action=start ap_name=httpd, action=start ap_name=redirect, action=start bind: Address already in use bind: Address already in use ap_name=dnsmasq, action=start ap_name=ftpd, action=start ap_name=networkmap, action=start ap_name=srt, action=restart ap_name=rp, action=start ap_name=udpecho, action=start ap_name=ntp, action=start ap_name=wlan, action=start ap_name=ingress_qos, action=start /bin/wlctl: Not Found ap_name=ingress_classify, action=start /bin/wlctl: Not Found ap_name=qos_cls, action=start Setting SSID: "caramelo2" Setting SSID: "_ONOWiFi" Setting SSID: "_AUTO_ONOWiFi" Setting SSID: "Vodafone-H-500-s3" /bin/wlctl: Not In Range /bin/wlctl: Not In Range killall: wifi_radar_2g: no process killed killall: wifi_wd_2g: no process killed acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: scan in progress ... acsd: selected channel spec: 0x100a acsd: Adjusted channel spec: 0x100a acsd: selected channel spec: 0x100a 7200 sec flags: 0xb index: 0 : Default 5 sec 2 sample period 1 28800 sec killall: wps_det: no process killed ap_name=qos_remark, action=start ap_name=ipv6wd, action=start ap_name=duplexmode, action=start ap_name=cpm, action=start ap_name=wanip, action=stop ap_name=dnsmasq, action=stop ap_name=dnsmasq, action=stop ap_name=igd_upnp, action=start ap_name=dnsr, action=start ap_name=cron, action=start ap_name=cups, action=start ap_name=snmp, action=start ap_name=3g, action=start ap_name=emrd, action=start ap_name=fon, action=start ap_name=tr069, action=start killall: cwmp: no process killed ap_name=voip_qos, action=start starting pid 1467, tty '': '/sbin/getty ttyS0 115200' Vodafone-H-500-s login: complete device eth3.300 is not a slave of br0 complete complete device eth3 is already a member of a bridge; can't enslave it to bridge br0. complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete Invalid QCSAPI option obss_coexist complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete complete killall: wifi_radar_5g: no process killed complete could not open /proc/892/statcould not open /proc/893/stat Vodafone-H-500-s login: admin process '/sbin/getty ttyS0 15200' (pid 1467) exited. Scheduling for restart. starting pid 1559, tty '': '/sbin/getty ttyS0 115200' Vodafone-H-500-s login: admin process '/sbin/getty ttyS0 15200' (pid 1559) exited. Scheduling for restart. starting pid 1560, tty '': '/sbin/getty ttyS0 115200' Vodafone-H-500-s login: #


HELO CPUI L1CI HELO CPUI L1CI 4.1605-1.0.38-118.3 DRAM ---- PHYS STRF 400H PHYE DDR3 SIZ4 SIZ3 SIZ2 DINT USYN LSYN MFAS LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN FPS0 FDPM PMOK GFOK F008 F007 RAM1 NAN9 NAN3 RFS0 NAN5 Base: 4.16_05 CFE version 1.0.38-118.3 for BCM963268 (32bit,SP,BE) Build Date: Fri Aug 19 13:10:18 CST 2016 (jeremy@Ubuntu) Copyright (C) 2000-2015 Broadcom Corporation. Boot Strap Register: 0x1ff90bf Chip ID: BCM63167D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz Main Thread: TP0 Memory Test Passed Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes NAND flash device: MXIC MX30LF1G08AA, id 0xc2f1 block 128KB size 131072KB GPIOOverlays is 0x8010 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host/tftp (f/h/c) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Default host ramdisk file name : Default ramdisk store address : Board Id (0-33) : 963167REF3 Number of MAC Addresses (1-32) : 16 Base MAC Address : 78:81:02:61:de:ad PSI Size (1-128) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 0 Main Thread Number [0|1] : 0 WLan Feature : 0x00 Voice Board Configuration (0-19) : LE9672_ZSI Partition 1 Size (MB) : Partition 2 Size (MB) : Partition 3 Size (MB) : Partition 4 Size (MB) (Data) : 4MB External switch id = a750 SC_DEBUG: Nand Partition Table Magic Found at 20000. part 0, logic_offset 00000000, logic_length 00020000, real_offset 00000000, real_length 00020000 part 1, logic_offset 00020000, logic_length 000a0000, real_offset 00020000, real_length 000a0000 part 2, logic_offset 000c0000, logic_length 00140000, real_offset 000c0000, real_length 00140000 part 3, logic_offset 00200000, logic_length 00140000, real_offset 00200000, real_length 00140000 part 4, logic_offset 00340000, logic_length 000a0000, real_offset 00340000, real_length 000a0000 part 5, logic_offset 003e0000, logic_length 00140000, real_offset 003e0000, real_length 00140000 part 6, logic_offset 00520000, logic_length 01e00000, real_offset 00520000, real_length 01e00000 part 7, logic_offset 02320000, logic_length 01400000, real_offset 02320000, real_length 01400000 part 8, logic_offset 03720000, logic_length 01e00000, real_offset 03720000, real_length 01e00000 part 9, logic_offset 05520000, logic_length 01400000, real_offset 05520000, real_length 01400000 part 10, logic_offset 06920000, logic_length 00140000, real_offset 06920000, real_length 00140000 part 11, logic_offset 06a60000, logic_length 00140000, real_offset 06a60000, real_length 00140000 part 12, logic_offset 06ba0000, logic_length 00280000, real_offset 06ba0000, real_length 00280000 part 13, logic_offset 06e20000, logic_length 00280000, real_offset 06e20000, real_length 00280000 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 *************************************************** Sercomm Boot Version 0.0.4.0 *************************************************** Entering Firmware : Everything is OK. Boot Flag's Magic Found at 6920000. Boot Flag's Magic Found at 6a60000. Find bootFlag successfully. BootFlag1: eRcOmM.008 BootFlag2: eRcOmM.007 Booting from first image (0xb8520000) ... Checksum ... OK! Correctable ECC Error detected: addr=0x006ac000, intrCtrl=0x000000B0, accessCtrl=0xE3441010 Decompression LZMA Image OK! Entry at 0x80010000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 2 buffers found Closing DMA Channels Starting program at 0x80010000 [ 0.000000] Linux version 5.4.43 (dani@tool) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r13247-631c437a91)) #0 SMP Sun Jun 7 18:59:39 2020 [ 0.000000] Detected Broadcom 0x63268 CPU revision d0 [ 0.000000] CPU frequency is 400 MHz [ 0.000000] 128MB of RAM installed [ 0.000000] board_bcm963xx: Boot address 0xb8000000 [ 0.000000] board_bcm963xx: CFE version: 1.0.38-118.3 [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0002a080 (Broadcom BMIPS4350) [ 0.000000] board: board name: BXK00C-1.6 [ 0.000000] MIPS: machine is Sercomm H500-s vfes [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] percpu: Embedded 14 pages/cpu s26048 r8192 d23104 u57344 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480 [ 0.000000] Kernel command line: rootfstype=squashfs,ubifs noinitrd console=ttyS0,115200 [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 120956K/131072K available (5728K kernel code, 212K rwdata, 1224K rodata, 1340K init, 206K bss, 10116K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=16, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 [ 0.000000] rcu: Hierarchical RCU implementation. [ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies. [ 0.000000] NR_IRQS: 256 [ 0.000000] random: get_random_bytes called from start_kernel+0x338/0x564 with crng_init=0 [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns [ 0.000014] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns [ 0.008132] Calibrating delay loop... 397.82 BogoMIPS (lpj=795648) [ 0.046451] pid_max: default: 32768 minimum: 301 [ 0.051539] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.059074] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.071981] rcu: Hierarchical SRCU implementation. [ 0.078118] smp: Bringing up secondary CPUs ... [ 0.084299] SMP: Booting CPU1... [ 0.092881] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.092898] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.093173] CPU1 revision is: 0002a080 (Broadcom BMIPS4350) [ 0.119806] Synchronize counters for CPU 1: [ 0.119825] SMP: CPU1 is running [ 0.119846] done. [ 0.150359] smp: Brought up 1 node, 2 CPUs [ 0.165897] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns [ 0.175965] futex hash table entries: 512 (order: 1, 8192 bytes, linear) [ 0.183268] pinctrl core: initialized pinctrl subsystem [ 0.190021] NET: Registered protocol family 16 [ 0.266577] clocksource: Switched to clocksource MIPS [ 0.275718] NET: Registered protocol family 2 [ 0.281987] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear) [ 0.290735] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.298669] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear) [ 0.305993] TCP: Hash tables configured (established 1024 bind 1024) [ 0.312989] UDP hash table entries: 256 (order: 1, 8192 bytes, linear) [ 0.319813] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear) [ 0.327584] NET: Registered protocol family 1 [ 0.332118] PCI: CLS 0 bytes, default 16 [ 0.340491] workingset: timestamp_bits=14 max_order=15 bucket_order=1 [ 0.358611] random: fast init done [ 0.366928] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.372963] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.400800] bcm63268-pinctrl 100000c0.pin-controller: registered at mmio (ptrval) [ 0.409912] 10000180.serial: ttyS0 at MMIO 0x10000180 (irq = 13, base_baud = 1562500) is a bcm63xx_uart [ 0.419645] printk: console [ttyS0] enabled [ 0.419645] printk: console [ttyS0] enabled [ 0.428208] printk: bootconsole [early0] disabled [ 0.428208] printk: bootconsole [early0] disabled [ 0.444202] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xf1 [ 0.450836] nand: Macronix MX30LF1G18AC [ 0.454744] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 0.462587] bcm6368_nand 10000200.nand: detected 128MiB total, 128KiB blocks, 2KiB pages, 16B OOB, 8-bit, BCH-4 [ 0.473945] Bad block table found at page 65472, version 0x01 [ 0.480941] Bad block table found at page 65408, version 0x01 [ 0.488309] 9 fixed-partitions partitions found on MTD device brcmnand.0 [ 0.495268] Creating 9 MTD partitions on "brcmnand.0": [ 0.500559] 0x000000000000-0x000000020000 : "cferom" [ 0.508272] 0x000000020000-0x0000000c0000 : "part_map" [ 0.516318] 0x0000000c0000-0x000000200000 : "cferam1" [ 0.524173] 0x000000200000-0x000000340000 : "cferam2" [ 0.532027] 0x000006920000-0x000006a60000 : "bootflag1" [ 0.540103] 0x000006a60000-0x000006ba0000 : "bootflag2" [ 0.548104] 0x000000520000-0x000006920000 : "wfi" [ 0.559004] sercomm: bootflag1=8 [ 0.562919] sercomm: bootflag2=7 [ 0.620525] 4 ser-wfi-fw partitions found on MTD device wfi [ 0.626248] Creating 4 MTD partitions on "wfi": [ 0.630902] 0x000000000000-0x000003200000 : "firmware" [ 0.639153] 0x000000000000-0x000000500000 : "kernel" [ 0.647059] 0x000000500000-0x000003200000 : "ubi" [ 0.654787] 0x000003200000-0x000006400000 : "img2" [ 0.662613] 0x000006ba0000-0x000006e20000 : "xml_cfg" [ 0.670312] 0x000006e20000-0x0000070a0000 : "app_data" [ 0.681266] bcm63xx-spi 10000800.spi: at [mem 0x10000800-0x10000f0b flags 0x200] (irq 88, FIFOs size 542) [ 0.695721] libphy: Fixed MDIO Bus: probed [ 0.747934] b53_common: found switch: BCM63xx, rev 0 [ 0.753803] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.764581] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) [ 0.771781] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) [ 0.778921] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) [ 0.786080] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) [ 0.793252] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) [ 0.804008] NET: Registered protocol family 10 [ 0.812296] Segment Routing with IPv6 [ 0.816300] NET: Registered protocol family 17 [ 0.820958] 8021q: 802.1Q VLAN Support v1.8 [ 0.848287] UBI: auto-attach mtd9 [ 0.851786] ubi0: attaching mtd9 [ 1.227247] ubi0: scanning is finished [ 1.249059] ubi0: attached mtd9 (name "ubi", size 45 MiB) [ 1.254654] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 1.261699] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 1.268681] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 1.275862] ubi0: good PEBs: 360, bad PEBs: 0, corrupted PEBs: 0 [ 1.282028] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128 [ 1.289471] ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1591556379 [ 1.298877] ubi0: available PEBs: 0, total reserved PEBs: 360, PEBs reserved for bad PEB handling: 20 [ 1.308550] ubi0: background thread "ubi_bgt0d" started, PID 446 [ 1.318183] block ubiblock0_0: created from ubi0:0(rootfs) [ 1.323923] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem [ 1.340352] VFS: Mounted root (squashfs filesystem) readonly on device 254:0. [ 1.362289] Freeing unused kernel memory: 1340K [ 1.366941] This architecture does not have kernel memory protection. [ 1.373547] Run /sbin/init as init process [ 2.227561] init: Console is alive [ 2.231406] init: - watchdog - [ 4.118647] random: crng init done [ 4.320967] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 4.516464] usbcore: registered new interface driver usbfs [ 4.522298] usbcore: registered new interface driver hub [ 4.527979] usbcore: registered new device driver usb [ 4.611329] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 4.635198] SCSI subsystem initialized [ 4.648035] ehci-fsl: Freescale EHCI Host controller driver [ 4.656310] ehci-platform: EHCI generic platform driver [ 4.766567] ehci-platform ehci-platform: EHCI Host Controller [ 4.772526] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1 [ 4.781011] ehci-platform ehci-platform: irq 18, io mem 0xb0002500 [ 4.802547] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 4.812282] hub 1-0:1.0: USB hub found [ 4.816275] hub 1-0:1.0: 1 port detected [ 4.830760] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 4.839198] ohci-platform: OHCI generic platform driver [ 4.844818] ohci-platform ohci-platform: Generic Platform OHCI controller [ 4.851843] ohci-platform ohci-platform: new USB bus registered, assigned bus number 2 [ 4.860160] ohci-platform ohci-platform: irq 17, io mem 0xb0002600 [ 4.931991] hub 2-0:1.0: USB hub found [ 4.935987] hub 2-0:1.0: 1 port detected [ 4.949705] usbcore: registered new interface driver usb-storage [ 4.956235] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 4.973581] init: - preinit - [ 7.179506] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 8.174552] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 11.643622] UBIFS (ubi0:1): Mounting in unauthenticated mode [ 11.649913] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 594 [ 11.727513] UBIFS (ubi0:1): recovery needed [ 11.894621] UBIFS (ubi0:1): recovery completed [ 11.899447] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data" [ 11.907487] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 11.917689] UBIFS (ubi0:1): FS size: 38092800 bytes (36 MiB, 300 LEBs), journal size 1904640 bytes (1 MiB, 15 LEBs) [ 11.928434] UBIFS (ubi0:1): reserved for root: 1799217 bytes (1757 KiB) [ 11.935249] UBIFS (ubi0:1): media format: w4/r0 (latest is w5/r0), UUID 0C1CF45E-9F83-46EC-B47A-579E55587222, small LPT model [ 11.952375] mount_root: switching to ubifs overlay [ 11.999928] overlayfs: upper fs does not support xattr, falling back to index=off and metacopy=off. [ 12.016477] urandom-seed: Seeding with /etc/urandom.seed [ 12.245440] procd: - early - [ 12.248557] procd: - watchdog - [ 12.938664] procd: - watchdog - [ 12.942247] procd: - ubus - [ 13.163777] procd: - init - Please press Enter to activate this console. [ 14.164173] kmodloader: loading kernel modules from /etc/modules.d/* [ 14.351889] Loading modules backported from Linux version v5.7-rc3-0-g6a8b55ed4056 [ 14.359771] Backport generated by backports.git v5.7-rc3-1-0-gc0c7d2bb [ 14.417820] xt_time: kernel timezone is -0000 [ 14.534938] urngd: v1.0.2 started. [ 14.685937] PPP generic driver version 2.4.2 [ 14.693800] NET: Registered protocol family 24 [ 14.760580] Broadcom 43xx driver loaded [ Features: PNL ] [ 14.776837] kmodloader: done loading kernel modules from /etc/modules.d/* [ 28.169294] br-lan: port 1(eth0.1) entered blocking state [ 28.174915] br-lan: port 1(eth0.1) entered disabled state [ 28.181068] device eth0.1 entered promiscuous mode [ 28.186054] device eth0 entered promiscuous mode [ 28.408134] br-lan: port 1(eth0.1) entered blocking state [ 28.413714] br-lan: port 1(eth0.1) entered forwarding state [ 29.135556] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready BusyBox v1.31.1 () built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt SNAPSHOT, r13518-c37487a63d ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@OpenWrt:/#


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/07/24 19:38
  • by deerhunter