Adding OpenWrt support for NetComm NF18ACV

jimbot · February 13, 2024, 3:18pm

The NetComm NF18ACV is described as a "VDSL2/ADSL2+ Dual Band AC1600 Gigabit Gateway with VoIP". It has ports for DSL(x1), VoIP(x2), Gigabit Ethernet(x4), Gigabit WAN(x1), USB 2.0(x1) and radios for 2.4GHz and 5GHz Wi-Fi. It has been commonly supplied by several Australian ISPs, making them plentiful and cheap. Of course the factory firmware doesn't make the most of the hardware.

I'm hoping someone can give me a hand to get openwrt running on it. It's been a while since I've done embedded development, and I'd appreciate some pointers when I'm taking a wrong turn. I figured I'd start writing up my process so far while my (very slow) build machine is compiling openwrt.

I understand that if I get openwrt running on this device, the best I'm likely to achieve is partial support (no xDSL, no FXS /VoIP, and half the radios at best), and I'm fine with that. In that configuration, I can still find a use for the platform.

Hardware

CPU: SoC Broadcom BCM63167
Flash: 128MB NAND Micron MT29F1G08AAC
RAM: 128MB Nanya NT5CC64M16GP-DI
Switch: Broadcom BCM53134S
WiFi (5g): Broadcom BCM43602kmlg
WiFi (2.4G): Broadcom BCM435f (integrated with Soc)
xDSL: Broadcom BCM6303KMLG
VoIP: Microsemi Le9642PQC

Process so far...
Looking in the forums and wiki, it looks pretty close to the Sercomm H500-s vfes but with a different 5G wifi chip. It also has xDSL and a different variant of the VoIP chip, but neither of those are supported in any case.

I opened it up and took a bunch of pics. I couldn't find a JTAG port, but it does have a serial port (and the header was already populated). Connecting to it, I could see the CFE boot sequence (bootlog to follow) and interrupted it to get into a CFE terminal.

I used the cfenand.py (thanks danitool) to dump the contents of the NAND.

The CFE supports the 'r' command to download a program from the host via TFTP and run it in RAM, so I was hoping to load an image into RAM, test and iterate until I have something that works.

I have openwrt running on another device (TP-LINK MR3020 v1), but since that was already supported I was able to get it up and running without having to understand the build process, source structure, toolchain configuration, etc. I tried to make the appropriate choices based on the hardware I had identified, but the build failed. I've dropped back to the release version and loaded the config for the BCM63xx target, making minimal changes (just added the ramfs output). Hoping that this gets me a successful build and I can load it up.

If anyone has tips or advice, please share.

jimbot · February 13, 2024, 3:22pm

Boot log (part 1)

HELO
CPUI
L1CI
HELO
CPUI
L1CI
4.1605-1.0.38-118.3
DRAM
----
PHYS
STRF
400H
PHYE
DDR3
SIZ4
SIZ3
SIZ2
DINT
USYN
LSYN
MFAS
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
FPS0
BT00
0001
BT01
0492
NAN3
RFS2
NAN5

Base: 4.16_05
CFE version 1.0.38-118.3 for BCM963268 (32bit,SP,BE)
Build Date: Fri Dec 18 14:08:54 CST 2020 (xuchao@(none))
Copyright (C) 2000-2015 Broadcom Corporation.

Boot Strap Register:  0x1ff97bf
Chip ID: BCM63167D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000

NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes
NAND flash device: Micron MT29F1G08AAC, id 0x2cf1 block 128KB size 131072KB
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host/tftp (f/h/c)  : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Boot image (0=latest, 1=previous) : 0  
Default host ramdisk file name    :   
Default ramdisk store address     :   
Board Id (0-0)                    : 963167GWV_004R  
Number of MAC Addresses (1-32)    : 11  
Base MAC Address                  : 18:f1:45:9e:b9:b7  
PSI Size (1-128) KBytes           : 48  
Enable Backup PSI [0|1]           : 1  
System Log Size (0-256) KBytes    : 0  
Auxillary File System Size Percent: 0  
Main Thread Number [0|1]          : 0  
WLan Feature                      : 0x00  
Voice Board Configuration (0-0)   : LE9642_ZSI_BB  
Partition 1 Size (MB)             :   
Partition 2 Size (MB)             :   
Partition 3 Size (MB)             :   
Partition 4 Size (MB) (Data)      : 4MB  

External switch id = 5075 
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 110
Booting from latest image (address 0xbbd80000, flash offset 0x03d80000) ...
Correctable ECC Error detected: addr=0x03ec1c00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03ecf400, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03ed7c00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03ec1c00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03ecf400, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03ed7c00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03ef0000, intrCtrl=0x000000B0, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03ef0a00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03ef2e00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03f06800, intrCtrl=0x000000B0, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03f0ee00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03f19800, intrCtrl=0x000000B0, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03f34c00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03f3b400, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03f47e00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03f54600, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03f5b000, intrCtrl=0x000000B0, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03f5b200, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03f67e00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03f6e200, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03fbda00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03fdba00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03feee00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03ffa600, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x03ffea00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x0400d600, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x0400fc00, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x04048200, intrCtrl=0x00000090, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x0406e800, intrCtrl=0x000000B0, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x04075800, intrCtrl=0x000000B0, accessCtrl=0xE3441010
Correctable ECC Error detected: addr=0x0407f000, intrCtrl=0x000000B0, accessCtrl=0xE3441010
Decompression LZMA Image OK!
Entry at 0x8042c3c0
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found
Closing DMA Channels
Starting program at 0x8042c3c0
Linux version 3.4.11-rt19 (xuchao@(none)) (gcc version 4.6.2 (Buildroot 2011.11) ) #1 SMP PREEMPT Fri Dec 18 14:11:49 CST 2020
963167GWV_004R prom init
CPU revision is: 0002a080 (Broadcom BMIPS4350)
DSL SDRAM reserved: 0x132000
Determined physical RAM map:
 memory: 07ece000 @ 00000000 (usable)
Zone PFN ranges:
  DMA      0x00000000 -> 0x00001000
  Normal   0x00001000 -> 0x00007ece
Movable zone start PFN for each node
Early memory PFN ranges
    0: 0x00000000 -> 0x00007ece
On node 0 totalpages: 32462
free_area_init_node: node 0, pgdat 8052d220, node_mem_map 81000000
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 222 pages used for memmap
  Normal zone: 28144 pages, LIFO batch:7
PERCPU: Embedded 7 pages/cpu @81103000 s5088 r8192 d15392 u32768
pcpu-alloc: s5088 r8192 d15392 u32768 alloc=8*4096
pcpu-alloc: [0] 0 [0] 1 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32208
Kernel command line: ro noinitrd  irqaffinity=0
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Memory: 122956k/129848k available (4265k kernel code, 6892k reserved, 973k data, 220k init, 0k highmem)
Preemptible hierarchical RCU implementation.
NR_IRQS:128
console [ttyS0] enabled
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0
Calibrating delay loop... 397.31 BogoMIPS (lpj=198656)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
--Kernel Config--
  SMP=1
  PREEMPT=1
  DEBUG_SPINLOCK=0
  DEBUG_MUTEXES=0
Broadcom Logger v0.1 Dec 18 2020 14:09:20
CPU revision is: 0002a080 (Broadcom BMIPS4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Brought up 2 CPUs
NET: Registered protocol family 16
Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (000085ad-000085ad=0<300)
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0xa0f00000-0xa0ffffff]
pci_bus 0000:00: root bus resource [io  0xa2000000-0xa200ffff]
pci 0000:00:00.0: [14e4:435f] type 00 class 0x028000
pci 0000:00:00.0: reg 10: [mem 0x10004000-0x10005fff]
pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310
pci 0000:00:09.0: reg 10: [mem 0x10002600-0x100026ff]
pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320
pci 0000:00:0a.0: reg 10: [mem 0x10002500-0x100025ff]
PCI host bridge to bus 0000:01
pci_bus 0000:01: root bus resource [mem 0x11000000-0x11efffff]
pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
pci 0000:01:00.0: [14e4:6326] type 01 class 0x060400
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:02:00.0: [14e4:aa52] type 00 class 0x028000
pci 0000:02:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit]
pci 0000:02:00.0: reg 18: [mem 0x00000000-0x003fffff 64bit]
pci 0000:02:00.0: supports D1 D2
pci 0000:01:00.0: Checking PCIe ASPM for vendor 14e4 device aa52
pci 0000:01:00.0: Disabling PCIe ASPM for vendor 14e4 device aa52
pci 0000:01:00.0: BAR 8: assigned [mem 0x11000000-0x115fffff]
pci 0000:02:00.0: BAR 2: assigned [mem 0x11000000-0x113fffff 64bit]
pci 0000:02:00.0: BAR 0: assigned [mem 0x11400000-0x11407fff 64bit]
pci 0000:01:00.0: PCI bridge to [bus 02-02]
pci 0000:01:00.0:   bridge window [mem 0x11000000-0x115fffff]
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated
bcmleg_spi bcmleg_spi.0: master is unqueued, this is deprecated
skb_free_task created successfully
gbpm_do_work scheduled
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS v0.1 Dec 18 2020 14:11:36 initialized
Broadcom GBPM v0.1 Dec 18 2020 14:11:36 initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
PCI: CLS mismatch (64 != 16), using 16 bytes
bcm_tstamp initialized, (hpt_freq=200000000 2us_div=200 2ns_mult=5 2ns_shift=0)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) (SUMMARY)    2001-2006 Red Hat, Inc.
fuse init (API version 7.18)
msgmni has been set to 240
io scheduler noop registered (default)
Broadcom NAND controller (BrcmNand Controller)
mtd->oobsize=0, mtd->eccOobSize=0
NAND_CS_NAND_XOR=00000000
B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0
brcmnand_read_id: CS0: dev_id=2cf18095
After: NandSelect=40000001, nandConfig=15142200
Block size=00020000, erase shift=17
NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11
busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
BrcmNAND mfg 2c f1 MICRON MT29F1G08ABA 128MB on CS0

Found NAND on CS0: ACC=e3441010, cfg=15142200, flashId=2cf18095, tim1=6532845b, tim2=00001e94
BrcmNAND version = 0x0400 128MB @00000000
brcmnand_scan: B4 nand_select = 40000001
brcmnand_scan: After nand_select = 40000001
handle_acc_control: default CORR ERR threshold  1 bits
ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16
page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
Brcm NAND controller version = 4.0 NAND flash size 128MB @18000000
ECC layout=brcmnand_oob_bch4_2k
brcmnand_scan:  mtd->oobsize=64
brcmnand_scan: oobavail=35, eccsize=512, writesize=2048
brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=4, eccbytes=7
-->brcmnand_default_bbt
brcmnand_default_bbt: bbt_td = bbt_slc_bch4_main_descr
Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0
Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0
brcmnand_reset_corr_threshold: default CORR ERR threshold  1 bits for CS0
brcmnand_reset_corr_threshold: CORR ERR threshold changed to 3 bits for CS0
brcmnandCET: Status -> Deferred
Creating 8 MTD partitions on "brcmnand.0":
0x000003d80000-0x000007ae0000 : "rootfs"
0x000000020000-0x000003d80000 : "rootfs_update"
0x000007b00000-0x000007f00000 : "data"
0x000000000000-0x000000020000 : "nvram"
0x000003d80000-0x000007ae0000 : "image"
0x000000020000-0x000003d80000 : "image_update"
0x000000000000-0x000008000000 : "dummy1"
0x000000000000-0x000008000000 : "dummy2"
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
NET: Registered protocol family 24
usbcore: registered new interface driver asix
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver cdc_eem
usbcore: registered new interface driver rndis_host
usbcore: registered new interface driver cdc_ncm
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
ehci_hcd 0000:00:0a.0: setting latency timer to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
ohci_hcd 0000:00:09.0: setting latency timer to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver usblp
brcmboard: brcm_board_init entry
SES: LED GPIO 0x8011 is enabled
DYING GASP IRQ Initialized and Enabled
Serial: BCM63XX driver $Revision: 3.00 $
Magic SysRq with Auxilliary trigger char enabled (type ^ # h for list of supported commands)
ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX
ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX
Total # RxBds=1448
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized

bcmPktDma_init: Broadcom Packet DMA Library initialized
IPSEC SPU: SUCCEEDED 
GACT probability NOT on
Mirror/redirect action on
u32 classifier
    input device check on
    Actions configured
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Initializing MCPD Module
Ebtables v2.0 registered
ebt_time registered
ebt_ftos registered
ebt_wmm_mark registered
8021q: 802.1Q VLAN Support v1.8
hub 1-0:1.0: over-current condition on port 2
VFS: Mounted root (jffs2 filesystem) readonly on device 31:0.
Freeing unused kernel memory: 220k freed
init started: BusyBox v1.17.2 (2020-12-18 14:20:14 CST)
starting pid 288, tty '': '/bin/sh -l -c "bcm_boot_launcher start"'
Mounting filesystems...
usbfs: unrecognised mount option "defaults" or missing value
usbfs: mount parameter error.
Configuring system...
wlcsm: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Initializing WLCSM Module
WLCSM Module loaded successfully 
is_nand:1  is_manufacturer:0
usage:nvram [get]	  :get nvram value
	[set name=value]  :set name with value
	[unset name]	  :remove nvram entry
	[show]		  :show all nvrams
	[save]	  	  :save nvram to a file
	[restore]	  :restore nvram from saved file
	[godefault]	  :restore to default nvram
	[commit [restart]]:save nvram [optional] to restart wlan
Loading drivers and kernel modules... 

brcmchipinfo: brcm_chipinfo_init entry
bcmxtmrt: Broadcom BCM3167D0 ATM/PTM Network Device v0.9 Dec 18 2020 14:09:48
Broadcom Ingress QoS Module  Char Driver v0.1 Dec 18 2020 14:09:41 Registered<243>

Broadcom Ingress QoS ver 0.1 initialized
BPM: tot_mem_size=134217728B (128MB), buf_mem_size <10%> =13421770B (12MB), num of buffers=6657, buf size=2016
Broadcom BPM Module Char Driver v0.1 Dec 18 2020 14:09:40 Registered<244>
NBUFF v1.0 Initialized
Initialized fcache state
Broadcom Packet Flow Cache  Char Driver v3.0 Dec 18 2020 14:09:41 Registered<242>
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Broadcom Packet Flow Cache learning via BLOG enabled.
[FHW]  pktDbgLvl[0xc012e080]=0
[FHW]  fhw_construct: 
Initialized Fcache HW accelerator layer state
flwStatsThread created
Constructed Broadcom Packet Flow Cache v3.0 Dec 18 2020 14:09:41
chipId 0x631670D0
Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Dec 18 2020 14:09:41 Registered <241>
Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
FAP Debug values at 0xa6024720 0xa60a4720
fapGso_LoopBkThread created successfully
Allocated FAP0 SWQ_HOST2FAP_GSO_LOOPBACK_Q mem=a79c0000 : 16384 bytes
Allocated FAP0 SWQ_FAP2HOST_GSO_LOOPBACK_Q mem=a66dc000 : 16384 bytes
GSO LOOPBACK Cached HOST2FAP Q INFO:
 Swq =b0825ef8 qStart=a79c0000 qEnd=a79c4000 msgSize=4 dqm=18 fapId=0
GSO LOOPBACK Cached FAP2HOST Q INFO:
 Swq =b0825ec8 qStart=a66dc000 qEnd=a66e0000 msgSize=2 dqm=19 fapId=0
Allocated FAP0 SWQ_FAP2HOST_WFD_Q mem=a6720000 : 7200 bytes
Allocated FAP1 SWQ_FAP2HOST_WFD_Q mem=a70d0000 : 7200 bytes
Allocated FAP0 SWQ_FAP2HOST_WFD_Q mem=a66c6000 : 7200 bytes
Allocated FAP1 SWQ_FAP2HOST_WFD_Q mem=a6614000 : 7200 bytes
Allocated FAP0 TM SDRAM Queue Storage (a60357b0) : 390144 bytes @ a6100000
Allocated FAP1 TM SDRAM Queue Storage (a60b57b0) : 390144 bytes @ a6180000
[NTC fapProto] fapReset  : Reset FAP Protocol layer
[FAP1] DSPRAM : stack <0x80000000><1792>, global <0x80000700><4568>, free <1832>, total<8192>
[FAP1] PSM : addr<0x80002000>, used <24472>, free <104>, total <24576>
[FAP1] DQM : availableMemory 14668 bytes, nextByteAddress 0xE00048B0
[FAP1] IC Timer started
[FAP1] FAP4KE WFD Init Done...
[FAP1] FAP BPM Initialized.
[FAP0] DSPRAM : stack <0x80000000><1792>, global <0x80000700><4568>, free <1832>, total<8192>
[FAP0] PSM : addr<0x80002000>, used <24472>, free <104>, total <24576>
Broadcom Packet Flow Cache HW acceleration enabled.
[FAP0] DQM : availableMemory 14668 bytes, nextByteAddress 0xE00048B0
[FAP0] Initializing FAP4KE GSO LOOPBACK on fapIdx=0 ...
[FAP0] SWQ: HOST2FAP_GSO_LOOPBACK 
[FAP0] >>>>------------------
[FAP0] swq =80007ef8 msgSize =4 words , maxDepth=1024
[FAP0] qStart =a79c0000 qEnd=a79c4000
[FAP0] rdPtr =a79c0000 wrPtr=a79c0000 count=0
[FAP0]  swq->interrupts 0 processed =0 dropped =0 
[FAP0]  Associated DQM=18 dir HOST2FAP
[FAP0] ------------------<<<<
[FAP0] SWQ: FAP2HOST_GSO_LOOPBACK 
[FAP0] >>>>------------------
[FAP0] swq =80007ec8 msgSize =2 words , maxDepth=2048
[FAP0] qStart =a66dc000 qEnd=a66e0000
[FAP0] rdPtr =a66dc000 wrPtr=a66dc000 count=0
[FAP0]  swq->interrupts 0 processed =0 dropped =0 
[FAP0]  Associated DQM=19 dir FAP2HOST
[FAP0] ------------------<<<<
[FAP0] FAP4KE GSO LOOPBACK Init Done...
[FAP0] IC Timer started
[FAP0] FAP4KE WFD Init Done...
[FAP0] FAP BPM Initialized.
fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes
fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes
bcmPktDma_bind: FAP Driver binding successfull
[FAP0] FAP TM: ON
[FAP1] FAP TM: ON
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
Broadcom BCM63167D0 Ethernet Network Device v0.1 Dec 18 2020 14:09:47
Broadcom GMAC Char Driver v0.1 Dec 18 2020 14:09:49 Registered<249>
Broadcom GMAC Driver v0.1 Dec 18 2020 14:09:49 Initialized
fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000
ETH Init: Ch:0 - 200 tx BDs at 0xb0a20650
fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000
ETH Init: Ch:1 - 200 tx BDs at 0xb0820650
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184
ETH Init: Ch:0 - 600 rx BDs at 0xb0821910
[FAP0] enetRxChannel 0
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184
ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910
[FAP1] enetRxChannel 1
dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered 
eth0: <Ext sw port: 0> <Logical : 08> PHY_ID <0x20180000 : 0x00> MAC : 18:F1:45:9E:B9:B7
eth1: <Ext sw port: 1> <Logical : 09> PHY_ID <0x20180001 : 0x01> MAC : 18:F1:45:9E:B9:B7
eth2: <Ext sw port: 2> <Logical : 10> PHY_ID <0x20180002 : 0x02> MAC : 18:F1:45:9E:B9:B7
eth3: <Ext sw port: 3> <Logical : 11> PHY_ID <0x20180003 : 0x03> MAC : 18:F1:45:9E:B9:B7
eth4: <Int sw port: 3> <Logical : 03> PHY_ID <0x00000004 : 0x04> MAC : 18:F1:45:9E:B9:B7
All Port Bit Map: 0x0f08: eth4,eth0,eth1,eth2,eth3
   Chip WAN Only Ports 0000, Defined WAN Only Ports 0000, WAN Only Port Result: 0x0000:
   Chip WAN Preffered Ports 0008, Defined WAN Preffered Ports 0000, WAN Preffered Port Result: 0x0008:eth4
   Chip LAN Only Ports 0000, Defined LAN Only Ports 0000, LAN Only Port Result: 0x0000:
   WAN/LAN Both Capable Ports 0x0f00:eth0,eth1,eth2,eth3
NComm TMS V6.80 Kernel Module loaded.
[NTC arl] arlEnable : Enabled ARL binding to FAP
Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 Dec 18 2020 14:09:40 Registered <245>
Wifi Forwarding Driver is initialized!
insmod: can't insert '/lib/modules/3.4.11-rt19/extra/wlcsm.ko': File exists
DHD_FKB_POOL size is:1280 and entry size:2016
fkbpool address range: 85800000 <-> 85a76000
DHD_PKTTAG POOL size is:1280 and entry size:48
dhd_module_init in
dhd_queue_budget = 256
dhd_sta_threshold = 2048
dhd_if_threshold = 65536
no wifi platform data, skip
dhdpcie_chipmatch: Unsupported vendor 14e4 device 435f
dhdpcie_pci_probe: chipmatch failed!!
PCI_PROBE:  bus 2, slot 0,vendor 14E4, device AA52(good PCI location)
dhdpcie_init: can't find adapter info for this chip
PCI: Enabling device 0000:02:00.0 (0000 -> 0002)
DHD: dongle ram size is set to 983040(orig 983040) at 0x180000
dhd:0: fw path:/etc/wlan/dhd nv path:(null)
dhd_attach: wl0: pre-allocated buffer mode is enabled (allocskbsz=2048)
dhd_attach(): thread:dhd_watchdog_thread:17d started
dhd_attach(): thread:dhd0_dpc:17e started
dhd_deferred_work_init: work queue initialized 
 wfd_bind: Dev wl%d wfd_idx 0 wl_radio_idx 0 Type fkb configured WFD thread wfd0-thrd minQId/maxQId (20/1073741844), status (0) qmask 0x3
Instantiating WFD 0 thread
dhd:0: fw path:/etc/wlan/dhd nv path:(null)
dhd_bus_download_firmware: firmware path=/etc/wlan/dhd, nvram path=
dhdpcie_ramsize_adj: Enter
dhdpcie_download_code_file: download firmware /etc/wlan/dhd/43602a1/rtecdc.bin
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl: ID=pci/2/0/
wl: ID=pci/2/0/
wl: loading /etc/wlan/bcm43602_map.bin
wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32
wl: reading /etc/wlan/bcm43602_nvramvars.bin, file size=32
Replace or append with internal Mac Address
dhdpcie_bus_write_vars: Download, Upload and compare of NVRAM succeeded.
PCIe shared addr (0x001e7684) read took 44023 usec before dongle is ready
DMA RX offset from shared Area 0
dhdpcie_readshared: Dongle advertizes 2 size indices
dhdpcie_readshared: Host support DMAing indices: H2D:1 - D2H:1. FW supports it
H2D DMA WR INDX : array size 268 = 2 * 134
D2H DMA RD INDX : array size 6 = 2 * 3
D2H DMA WR INDX : array size 6 = 2 * 3
H2D DMA RD INDX : array size 268 = 2 * 134
ring_info_raw: 56 
f0 a3 26 00 80 ac 26 00 8c ad 26 00 98 ae 26 00 
9e ae 26 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 86 00 00 00 
dhdpcie_readshared: max H2D queues 134
dhd_bus_start: Initializing 134 h2drings
dhd_bus_cmn_writeshared:
  0000: 00 e0 7e 06 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 c0 c9 05 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 c0 7c 06 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 00 35 06 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 40 35 06 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 00 e0 05 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 14 10 00 
dhd_bus_cmn_writeshared:
  0000: 80 31 2f 05 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 66 c9 05 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 68 c9 05 00 00 00 00 
dhd_bus_cmn_writeshared:
  0000: 00 32 2f 05 00 00 00 00 
Attach flowrings pool for 132 rings
CUR_ETHERADDR : 6 
18 f1 45 9e b9 b8 
dhd_sync_with_dongle: GET_REVINFO device 0xbc430000, vendor 0xe4140000, chipnum 0x52aa0000

Dongle Host Driver, version 7.14.164.23.cpe4.16L05.0-kdb
+++++ Added gso loopback support for dev=wl0 <866ff000>
wfd_registerdevice Successfully registered dev wl0 ifidx 0 wfd_idx 0
Broadcom PCI Device 0x6300 has allocated with driver ohci_hcd
Broadcom PCI Device 0x6300 has allocated with driver ehci_hcd
Broadcom PCI Device 0x6326 has allocated with driver pcieport
dhd_module_init out
--SMP support
wl: dsl_tx_pkt_flush_len=338
wl: norm_wmark_tot=1389, pktc_wmark_tot=1389
wl 0000:00:00.0: setting latency timer to 64
wl: passivemode=1
wl1: creating kthread wl1-kthrd
wl: napimode=0
Neither SPROM nor OTP has valid image
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl: ID=sb/0/
wl: ID=sb/0/
wl: loading /etc/wlan/bcm6362_map.bin
srom rev:8
wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32
wl1: allocskbmode=1 currallocskbsz=2300
 wfd_bind: Dev wl%d wfd_idx 1 wl_radio_idx 1 Type skb configured WFD thread wfd1-thrd minQId/maxQId (21/1073741845), status (0) qmask 0xc
Instantiating WFD 1 thread
+++++ Added gso loopback support for dev=wl1 <85c0c000>
wfd_registerdevice Successfully registered dev wl1 ifidx 0 wfd_idx 1
wl1: Broadcom BCM435f 802.11 Wireless Controller 7.14.164.23.cpe4.16L05.0-kdb
dgasp: kerSysRegisterDyingGaspHandler: wl1 registered 
Loading PCM shim driver
Endpoint: endpoint_init entry
Endpoint: endpoint_init COMPLETED
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
Broadcom 802.1Q VLAN Interface, v0.1
Lightbox, debug:register with led manager
-n rmem_max is changed from 
180224
-n to 
524288
-n max_dgram_qlen is changed from 
10
-n to 
100
/etc/rc_vtp2.0: line 26: twbox: not found
pc Compile Time: Dec 18 2020 14:12:56 
main, close unneed files
main, pc_server_fd 3.
main 205, pc_server_lfd 4.
main 216, pc_chld_fd 5.
pc, enter loop .
===unused fd_index:6
===unused fd_index:7
g_pc_cur_max_fd:6
Initializing signal_handler
Jan  1 00:00:21 vtp_logic: [start_socket:81] expected value(512K), actual value(1024K)

[log_start_syslogd_process:90]ip:127.0.0.1 port:514 path:/var/log/vtp_log
init_all_entitys, 388, install 2 entities.

before init ua event

before init diagnostics

provision_init success
iptables_init:OK
 voice_app is not  ready OK !!
Jan  1 00:00:22 save_flash: [start_socket:81] expected value(512K), actual value(1024K)

main.c: signal, SIGTERM 15, SIGINT 2, SIGCHLD 18. 
main.c,main: entering while loop 
pc_msg_handle 1247 msg->msg_type:9
Start: name = vtp_syslogd, pid = syslogd
===unused fd_index:6
fork
 pid is 436
 pid is 0
exec vtp_syslogd  -R 127.0.0.1:514 -P /var/log/vtp_log (436)
Starting SWMDK...
Note: Loading 6300 MDK (default) driver for 63167 chip 
Note: Forcing 53115 driver for 53134 
Switch MDK: num_switches = 2
Switch MDK: unit = 0; phy_pbmp = 0x8; config_pbmp = 0x18 
Switch MDK: unit = 1; phy_pbmp = 0xf; config_pbmp = 0xf 
Switch MDK link poll thread: unit=0; phypbmp=0x8 config_pbmp=0x18
Switch MDK link poll thread: unit=1; phypbmp=0xf config_pbmp=0xf
Energy Efficient Ethernet: Enabled
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
writing RSA key
Saving kernel bootup messages for dumpsysinfo...
Starting CMS smd...

===== Release Version 4.16L.05 (build timestamp 201218_1417) =====

Initializing CMS MDM in Legacy98 mode
backup_psi_number_blk=1 result=49152
try read BPSI
Ignoring unrecognized param/obj tag PeriodicStatistics
Ignoring unrecognized param/obj tag MinSampleInterval inside PeriodicStatistics
Ignoring unrecognized param/obj tag MaxReportSamples inside PeriodicStatistics
Ignoring unrecognized param/obj tag SampleSetNumberOfEntries inside PeriodicStatistics
try read MPSI
Ignoring unrecognized param/obj tag PeriodicStatistics
Ignoring unrecognized param/obj tag MinSampleInterval inside PeriodicStatistics
Ignoring unrecognized param/obj tag MaxReportSamples inside PeriodicStatistics
Ignoring unrecognized param/obj tag SampleSetNumberOfEntries inside PeriodicStatistics
BPSI same to MPSI
MPSI valid, load into MDM
Ignoring unrecognized param/obj tag PeriodicStatistics
Ignoring unrecognized param/obj tag MinSampleInterval inside PeriodicStatistics
Ignoring unrecognized param/obj tag MaxReportSamples inside PeriodicStatistics
Ignoring unrecognized param/obj tag SampleSetNumberOfEntries inside PeriodicStatistics
ssk:error:31.537:mdm_processFirst_Config:604:don't need reset config!!!
ssk:error:32.206:lck_checkBeforeEntry:229:lock required during cmsObj_getNextInSubTreeFlags
do_signal 15
Host MIPS Clock divider pwrsaving is enabled
DDR Self Refresh pwrsaving is enabled
Adaptive Voltage Scaling is disabled because the internal regulator is powered down
Netfilter messages via NETLINK v0.30.
Broadcom SNTP Stack v0.1 (Dec 18 2020, 14:19:28)
ip_tables: (C) 2000-2006 Netfilter Core Team
br_netlink_mcpd.c: Setting registration type 0 pid to 528
ip6_tables: (C) 2000-2006 Netfilter Core Team
nf_conntrack version 0.5.0 (1924 buckets, 7696 max)
app: echo > /var/temp_route
app: route -n > /var/temp_route
app: rm -fr /var/temp_route
can't get Addr: No such device
ssk:error:37.704:rut_restartRadvd:358:failed to start or restart radvd on br0
ADDRCONF(NETDEV_UP): eth0: link is not ready
netdev path : eth0.0 -> eth0
BCMVLAN : eth0 mode was set to RG
Created new Tag Rule: dev=eth0, dir=1, tags=0, id=0

Created new Tag Rule: dev=eth0, dir=1, tags=1, id=0

Created new Tag Rule: dev=eth0, dir=1, tags=2, id=0

Created new Tag Rule: dev=eth0, dir=0, tags=0, id=0

Created new Tag Rule: dev=eth0, dir=0, tags=1, id=0

Created new Tag Rule: dev=eth0, dir=0, tags=2, id=0

device eth0.0 entered promiscuous mode
device eth0 entered promiscuous mode
br0: port 1(eth0.0) entered forwarding state
br0: port 1(eth0.0) entered forwarding state
ssk:error:37.837:rut_restartRadvd:358:failed to start or restart radvd on br0
ADDRCONF(NETDEV_UP): eth1: link is not ready
netdev path : eth1.0 -> eth1
BCMVLAN : eth1 mode was set to RG
Created new Tag Rule: dev=eth1, dir=1, tags=0, id=0

Created new Tag Rule: dev=eth1, dir=1, tags=1, id=0

Created new Tag Rule: dev=eth1, dir=1, tags=2, id=0

Created new Tag Rule: dev=eth1, dir=0, tags=0, id=0

Created new Tag Rule: dev=eth1, dir=0, tags=1, id=0

Created new Tag Rule: dev=eth1, dir=0, tags=2, id=0

device eth1.0 entered promiscuous mode
device eth1 entered promiscuous mode
br0: port 2(eth1.0) entered forwarding state
br0: port 2(eth1.0) entered forwarding state
ssk:error:38.317:rut_restartRado_signal 15
dvd:358:failed to start or restart radvd on br0
ADDRCONF(NETDEV_UP): eth2: link is not ready
netdev path : eth2.0 -> eth2
BCMVLAN : eth2 mode was set to RG
Created new Tag Rule: dev=eth2, dir=1, tags=0, id=0

Created new Tag Rule: dev=eth2, dir=1, tags=1, id=0

Created new Tag Rule: dev=eth2, dir=1, tags=2, id=0

Created new Tag Rule: dev=eth2, dir=0, tags=0, id=0

Created new Tag Rule: dev=eth2, dir=0, tags=1, id=0

Created new Tag Rule: dev=eth2, dir=0, tags=2, id=0

jimbot · February 13, 2024, 3:25pm

Boot log (part 2 of 3)

device eth2.0 entered promiscuous mode
device eth2 entered promiscuous mode
br0: port 3(eth2.0) entered forwarding state
br0: port 3(eth2.0) entered forwarding state
ssk:error:38.667:rut_restartRado_signal 15
dvd:358:failed to start or restart radvd on br0
ADDRCONF(NETDEV_UP): eth3: link is not ready
netdev path : eth3.0 -> eth3
BCMVLAN : eth3 mode was set to RG
Created new Tag Rule: dev=eth3, dir=1, tags=0, id=0

Created new Tag Rule: dev=eth3, dir=1, tags=1, id=0

Created new Tag Rule: dev=eth3, dir=1, tags=2, id=0

Created new Tag Rule: dev=eth3, dir=0, tags=0, id=0

Created new Tag Rule: dev=eth3, dir=0, tags=1, id=0

Created new Tag Rule: dev=eth3, dir=0, tags=2, id=0

device eth3.0 entered promiscuous mode
device eth3 entered promiscuous mode
br0: port 4(eth3.0) entered forwarding state
br0: port 4(eth3.0) entered forwarding state
ssk:error:39.020:rut_restartRadvd:358:failed to start or restart radvd on br0
do_signal 15
*** dslThread dslPid=950
BcmAdsl_Initialize=0xC02F0050, g_pFnNotifyCallback=0xC032D4A0
lmemhdr[2]=0x100CE000, pAdslLMem[2]=0x100CE000
AdslCoreSetSdramImageAddr: lmem2(0xce000) vs ADSL_PHY_SDRAM_BIAS(0xce000); origAddr=0xA7ECE000 newAddr=0xA7ECE000
pSdramPHY=0xA7FFFFF8, 0x6B47861E 0x2E88AB6D
*** XfaceOffset: 0x5FF90 => 0x5FF90 ***
*** PhySdramSize got adjusted: 0xF7844 => 0x12BD20 ***
AdslCoreSharedMemInit: shareMemSize=25280(25280)
AdslCoreHwReset:  pLocSbSta=82fd8000 bkupThreshold=3072
AdslCoreHwReset:  AdslOemDataAddr = 0xA7FB6278, time=16 ms
VersionInfo: A2pv6F039v.d26r
***BcmDiagsMgrRegisterClient: 0 ***
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered 
bcmxtmcfg: DS xDSL G.inp Mode = DISABLED 
bcmxtmcfg: xDSL G.Fast Mode = DISABLED 
fapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22be0 bytes remaining 584
XTM Init: Ch:0 - 200 rx BDs at 0xb0a22be0
fapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a23220 bytes remaining 456
XTM Init: Ch:1 - 16 rx BDs at 0xb0a23220
bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system
bcmxtmcfg: Out of sequence call to XTM_ASM_HANDLER::Uninitialize().  Recovering.
bcmxtmcfg: ATM Bonding configured in system. Fallback mode = Enabled 
bcmxtmcfg: Bonding State is DATA_IDLE 
bcmxtmcfg: SID MODE SET to 12 BIT MODE 
bcmxtmcfg: ATM Bonding Mgmt Log Area = 82fcb514 
ADDRCONF(NETDEV_UP): eth4: link is not ready
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
###reset_nf_conntrack_net_ops;973;###
monitor task is initialized pid= 472 
ssk:error:53.538:cmsLck_acquireLockWithTimeoutTraced:90:already have lock! callerFuncName getVoipServiceBoundIfName
ssk:error:53.540:initVodslBoundIpIfWanSideUpLocked:1214:Failed to get WAN Connection object
starting pid 1692, tty '': '-/bin/sh -l -c consoled'
killall: SpeedTestClient: no process killed
killall: SpeedTestServer: no process killed
killall: flashpolicyserv: no process killed
sh: SpeedTestClient: not found
sh: SpeedTestServer: not found
sh: flashpolicyserv: not found
NF18ACV
ssk:error:53.980:ssk_main:1062:cannot handle msg type 0x10000809 from 20 (flags=0x20000008)
ssk:error:53.980:ssk_main:1062:cannot handle msg type 0x10000809 from 20 (flags=0x20000008)
ssk:error:53.980:ssk_main:1062:cannot handle msg type 0x10000809 from 20 (flags=0x20000008)
ssk:error:53.981:ssk_main:1062:cannot handle msg type 0x10000809 from 20 (flags=0x20000008)
ssk:error:53.981:ssk_main:1062:cannot handle msg type 0x10000809 from 20 (flags=0x20000008)
ssk:error:54.278:cmsLck_acquireLockWithTimeoutTraced:90:already have lock! callerFuncName getVoipServiceBoundIfName
ssk:error:54.279:initVodslBoundIpIfWanSideUpLocked:1214:Failed to get WAN Connection object
vodsl:debug:54.979:sip_start:1008:We entered sip_start function

vodsl:error:54.979:sip_start:1011:sip_start:CfmAgent_Init

vodsl:error:54.986:sip_start:1013:Init status: 1

Agent: SUCCESS to start recieve data thread.
vodsl:debug:54.989:oalMsg_initWithFlags:122:commFd=8 connected to smd
vodsl:debug:54.989:oalMsg_initWithFlags:144:sent LAUNCHED message to smd
vodsl:notice:54.990:cmsMdm_initWithAcc:677:entered, eid=150 acc=0x0 shmid=0
vodsl:notice:54.990:oalShm_init:137:attaching to existing shmId=0
vodsl:notice:54.990:oalLck_init:118:attach existing done, semid=0
vodsl:notice:54.993:cmsMem_initSharedMemPointer:137:shm pool: 0x58822a6c-0x588a8000
vodsl:debug:54.993:cmsMdm_initWithAcc:725:attach existing done, ret=0
vodsl:debug:54.994:cmsLck_acquireLockTraced:73:acquired lock. callerFuncName provisSetVodslLogLevel
vodsl:debug:54.996:cmsLck_releaseLockTraced:144:lock hold time=1ms, acquiring lock callerFuncName provisSetVodslLogLevel; releasing lock callerFuncName provisSetVodslLogLevel;
vodsl:error:55.012:cmsLck_acquireLockTraced:64:already have lock! callerFuncName bcmSetVoiceStackType
vodsl:error:55.018:cmsLck_acquireLockTraced:64:already have lock! callerFuncName bcmGetVoiceStackType
[CfmAgent_Voip_SetCfg]Can't Match the key:SIGNALING_PROTOCOL
Set agentlog = 1!
vodsl:error:55.360:mdm_validateParamNodeString:4756:param name=TestSelector, error=9007
vodsl:error:55.367:cmsObj_setFlags:473:set of InternetGatewayDevice.Services.VoiceService.{i}.PhyInterface.{i}.Tests. {1,1} failed
vodsl:error:55.367:dalVoice_SetTests:2840:Can't set Simulate Tests ret = 9007

pc_msg_handle 1247 msg->msg_type:9
Start: name = voice_start_sip, pid = voiceapp-pid
===closed fd_index:6
===unused fd_index:7
fork
 pid is 1710
 pid is 0
exec /etc/voice_start_sip  (1710)
pc_msg_handle 1247 msg->msg_type:9
Start: name = iptables, pid = iptables_cmd_pid
===unused fd_index:6
fork
 pid is 1711
pc_msg_handle 1247 msg->msg_type:9
Start: name = iptables, pid = iptables_cmd_pid
pc_msg_handle 1247 msg->msg_type:9
Start: name = iptables, pid = iptables_cmd_pid
 pid is 0
exec iptables  -t nat -N VOIP (1711)
pc_msg_handle 1247 msg->msg_type:9
Start: name = iptables, pid = iptables_cmd_pid
WLmngr Daemon is running
Process iptables(1711) exited with code 0
Deleting process iptables!
===unused fd_index:6
fork
 pid is 1727
 pid is 0
exec iptables  -t nat -A APPPRE -j VOIP (1727)
Process iptables(1727) exited with code 0
Deleting process iptables!
Loading /lib/modules/3.4.11-rt19/extra/endpointdd.ko
===unused fd_index:6
fork
 pid is 1740
 pid is 0
exec iptables  -t filter -N VOIP (1740)
Broadcom Websocket Server Stack v0.1 (Dec 18 2020, 14:20:37) is based in part on the work of the libwebsockets project (http://libwebsockets.org)
Process iptables(1740) exited with code 0
Deleting process iptables!
wlevt is ready for new msg...
===unused fd_index:6
fork
 pid is 1744
 pid is 0
exec iptables  -t filter -A APPIN -j VOIP (1744)
Process iptables(1744) exited with code 0
Deleting process iptables!
[CfmAgent_Voip_SetCfg]Can't Match the key:PREF_FAX_CODEC
[CfmAgent_Voip_SetCfg]Can't Match the key:PREF_MODEM_CODEC
error: unkown port -1
[CfmAgent_Voip_SetCfg]Can't Match the key:X_BROADCOM_COM_RingNoSdp
[CfmAgent_Voip_SetCfg]Can't Match the key:X_BROADCOM_COM_Certificate
[CfmAgent_Voip_SetCfg]Can't Match the key:X_TW_COM_StartDelayTime
[CfmAgent_Voip_SetCfg]Can't Match the key:X_BROADCOM_COM_HookFlashMethod
[CfmAgent_Voip_SetCfg]Can't Match the key:X_BROADCOM_COM_maxInviteRetransmissions
[CfmAgent_Voip_SetCfg]Can't Match the key:X_BROADCOM_COM_maxGeneralRetransmissions
[CfmAgent_Voip_SetCfg]Can't Match the key:URI_Star
vpInst:1 
[CfmAgent_Voip_SetCfg]Can't Match the key:SntpZoneOffset
[vtp_syslogd]:enter isValidIpAddress
[vtp_syslogd]:enter isValidIpAddress
There is no Predefined DevicePin in CFE
There is no Predefined DevicePin in CFE
[provision_apply(6700)] content 1  ,voice_en 1, iad_state None 
[provision_apply:6746]voice_state:0
insmod: can't insert '/lib/modules/3.4.11-rt19/extra/endpointdd.ko': File exists
module loaded /lib/modules/3.4.11-rt19/extra/endpointdd.ko
module loaded /lib/modules/3.4.11-rt19/extra/endpointdd.ko
Loading /modules/mxpmod.ko
There is no Predefined DevicePin in CFE
MXP module loading
MXP_TMR: notice linux timer base tick 1000.
MXP: ======= line = 1607 =============
MXP: ======= line = 1625 =============
MXP: ======= line = 1667 =============
MXP module loaded
module loaded /modules/mxpmod.ko
module loaded /modules/mxpmod.ko
Loading /modules/mxpmem.ko
MXP memory module loaded
module loaded /modules/mxpmem.ko
module loaded /modules/mxpmem.ko
Loading /modules/tiuhal_26.ko
wlmngr:error:57.987:oal_getPidByName:587:could not open /proc/1787/stat
wlmngr:error:58.033:oal_getPidByName:587:could not open /proc/1789/stat
module loaded /modules/tiuhal_26.ko
module loaded /modules/tiuhal_26.ko
Loading /modules/tiuhw_mod_26.ko
[bcm_spi_init] Nothing to do!!!
tiuhw_mod module loaded
wlctl: Unsupported
module loaded /modules/tiuhw_mod_26.ko
module loaded /modules/tiuhw_mod_26.ko
Loading /modules/tiuhw_an_26.ko
TIUHW module start loading
Get companding from product config
tiu_if_init : num_tids = 1
raw=0x82396000(inst=82396000) page=4096 n=2
tids=1, TELE_ID=LE9642
tid_str_table[0].string=FXOY__tmp_str=LE9642
tid_str_table[1].string=LE9642__tmp_str=LE9642
[tiuhw_get_spi_cs]name=tcid0:3
[tiuhw_get_spi_cs]name=tcid1:3
[tiuhw_get_spi_cs]name=(null)
SPI registe 0: BUS_ID 1; cs 3
Initializing device 0
exit 2251 BcmSpiReserveSlave 0
SPI registe 1: BUS_ID 1; cs 3
BcmSpiReserveSlave - slaveId 3, already registerd
exit 2251 BcmSpiReserveSlave 1
[tiuhw_an_init_module]Transform the slic type, doesn't neen check! 
tiu_linux_tmrinit: Enter!
init_tiu_poll_work, enter!
 create workqueue tq_4294725868 success.
module loaded /modules/tiuhw_an_26.ko
module loaded /modules/tiuhw_an_26.ko
module return value 0
current modules loaded
tiuhw_an_26 184198 0 - Live 0xc29bb000 (O)
tiuhw_mod_26 1529 0 - Live 0xc2976000 (PO)
tiuhal_26 5172 2 tiuhw_an_26,tiuhw_mod_26, Live 0xc296e000 (PO)
mxpmem 4475 0 - Live 0xc2965000 (PO)
mxpmod 362825 2 tiuhw_an_26,mxpmem, Live 0xc2903000 (O)
nf_nat_rtsp 3508 0 - Live 0xc1aae000
nf_conntrack_rtsp 7344 1 nf_nat_rtsp, Live 0xc1aa6000
nf_nat_pptp 1754 0 - Live 0xc1a9d000
nf_conntrack_pptp 3964 1 nf_nat_pptp, Live 0xc1a96000
nf_nat_irc 1102 0 - Live 0xc1a8e000
nf_conntrack_irc 3323 1 nf_nat_irc, Live 0xc1a87000
nf_nat_h323 6015 0 - Live 0xc1a7e000
nf_conntrack_h323 37964 1 nf_nat_h323, Live 0xc1a6a000
nf_nat_tftp 582 0 - Live 0xc1a57000
nf_conntrack_tftp 2785 1 nf_nat_tftp, Live 0xc1a51000
nf_nat_sip 4198 0 - Live 0xc1a49000
nf_conntrack_sip 11170 1 nf_nat_sip, Live 0xc1a3f000
nf_nat_ftp 1284 0 - Live 0xc1a35000
nf_conntrack_ftp 5868 1 nf_nat_ftp, Live 0xc1a2d000
xt_iprange 1144 0 - Live 0xc1727000
nf_nat_proto_esp 674 0 - Live 0xc1721000
nf_conntrack_proto_esp 3145 0 - Live 0xc171b000
nf_nat_ipsec 910 0 - Live 0xc1714000
nf_conntrack_ipsec 2620 1 nf_nat_ipsec, Live 0xc170e000
nf_nat_proto_gre 1173 1 nf_nat_pptp, Live 0xc1707000
nf_conntrack_proto_gre 3766 1 nf_conntrack_pptp, Live 0xc1700000
ip6t_REJECT 3148 0 - Live 0xc16f8000
ip6table_filter 803 1 - Live 0xc16eb000
xt_LOG 11214 0 - Live 0xc16e2000
xt_limit 1703 0 - Live 0xc16d8000
xt_state 951 1 - Live 0xc16d1000
xt_conntrack 2316 0 - Live 0xc16cb000
ipt_REJECT 2489 0 - Live 0xc16c4000
ipt_REDIRECT 943 0 - Live 0xc16bd000
ipt_MASQUERADE 2734 0 - Live 0xc16b7000
iptable_nat 3483 1 - Live 0xc16aa000
nf_nat 13362 12 nf_nat_rtsp,nf_nat_pptp,nf_nat_irc,nf_nat_h323,nf_nat_tftp,nf_nat_sip,nf_nat_ftp,nf_nat_proto_esp,nf_nat_proto_gre,ipt_REDIRECT,ipt_MASQUERADE,iptable_nat, Live 0xc169e000
nf_conntrack_ipv4 10565 4 iptable_nat,nf_nat, Live 0xc1690000
nf_defrag_ipv4 971 1 nf_conntrack_ipv4, Live 0xc1685000
nf_conntrack 58257 23 nf_nat_rtsp,nf_conntrack_rtsp,nf_nat_pptp,nf_conntrack_pptp,nf_nat_irc,nf_conntrack_irc,nf_nat_h323,nf_conntrack_h323,nf_nat_tftp,nf_conntrack_tftp,nf_nat_sip,nf_conntrack_sip,nf_nat_ftp,nf_conntrack_ftp,nf_conntrack_proto_esp,nf_conntrack_ipsec,nf_conntrack_proto_gre,xt_state,xt_conntrack,ipt_MASQUERADE,iptable_nat,nf_nat,nf_conntrack_ipv4, Live 0xc166c000
xt_flag 677 0 - Live 0xc164e000
ip6table_mangle 1203 0 - Live 0xc1642000
ip6_tables 12401 2 ip6table_filter,ip6table_mangle, Live 0xc1638000
iptable_mangle 1168 0 - Live 0xc1627000
iptable_filter 848 1 - Live 0xc161a000
ip_tables 11528 3 iptable_nat,iptable_mangle,iptable_filter, Live 0xc1611000
xt_multiport 1446 0 - Live 0xc1607000
xt_mark 877 0 - Live 0xc1600000
xt_mac 739 0 - Live 0xc15fa000
xt_DSCP 1819 0 - Live 0xc15f4000
xt_dscp 1203 0 - Live 0xc15ed000
nfnetlink_queue 7498 0 - Live 0xc15e6000
nfnetlink 2751 1 nfnetlink_queue, Live 0xc15dd000
xt_SKIPLOG 635 0 - Live 0xc15d5000
xt_TCPMSS 3375 0 - Live 0xc15cf000
pwrmngtd 5790 0 - Live 0xc15c7000 (P)
bcmvlan 92334 0 - Live 0xc15a4000 (P)
usb_storage 41237 0 - Live 0xc156c000
endpointdd 2703633 0 - Live 0xc129b000 (P)
pcmshim 1354 0 - Live 0xc10c1000
wl 4759085 0 - Live 0xc0bd4000 (P)
dhd 471896 0 - Live 0xc05ac000
wlemf 80962 2 wl,dhd, Live 0xc04f3000 (P)
wfd 11083 2 wl,dhd, Live 0xc04c2000
bcmarl 6371 0 - Live 0xc04b6000 (P)
nciTMSkmod 307016 0 - Live 0xc045f000 (P)
bcm_enet 242613 1 wl, Live 0xc03b6000
adsldd 369156 0 - Live 0xc02f0000 (P)
bcmxtmcfg 90993 1 adsldd, Live 0xc026a000 (P)
bcmfap 205226 3 wfd,bcmarl,bcm_enet, Live 0xc01c3000 (P)
pktflow 127547 2 bcm_enet,bcmfap, Live 0xc0110000 (P)
bcm_bpm 10147 0 [permanent], Live 0xc00e1000 (P)
bcm_ingqos 9932 0 - Live 0xc00d5000 (P)
bcmxtmrtdrv 37241 2 bcmxtmcfg,pktflow, Live 0xc00c1000
chipinfo 1325 0 - Live 0xc00ad000 (P)
wlcsm 6797 5 wl,dhd,wlemf, Live 0xc00a6000 (P)
dhd_wmf_igs_broadcast: WMF: send failure
IGMP Query send failed
There is no Predefined DevicePin in CFE
Setting SSID: "NetComm 5026"
wlctl: Unsupported
wlctl: Unsupported
wlctl: Unsupported
chmod: /usr/sbin/ggsip: Read-only file system
wl0: cmd=3: Invalid argument
=====socket fd :5
Successfully locked range: start=0x004e5000, end=0x004e6000, len=0x00001000
mxp_initHandle, mxpFd 3.
XgetTicksRate: 1000
Thread 1 = mxproot, priority -1
mxp_ mmap_kmem page_addr 00002396.
tcb_init, Dec 18 2020 14:14:19, stack size 32768
user level MXP memory module loaded
APP_tiuhw_an_init_module, 808: hit!
Hardware configuration: num_of_tcids = 2
no_of_tids = 1
companding = 2
poll_mode 1
_common_tiuo_get_hw_inst, 1035, sizeof(Tiu_hw_inst_data) 1148, tcids 2.
Memory mapped for 2 TCIDS
mlxDbgInit: MXDebug_segm_storage = 7f7d9c, MXDebug_segm_id = 0.
mxp_tcb_init, Dec 18 2020 14:14:19, stack size 32768
>>>> rootInit <<<<<
Creating Golden Gateway application...
Thread 3 = ROOT, priority 0
mxp_tcb_init, Dec 18 2020 14:14:19, stack size 32768
Escaping to MXP command shell. Use 'exit' to exit.
4294729517 - GG_PERM_STORAGE=875200 mem_params.perm_size=875204, mem_params.perm_addr=0x0x77266008
4294729610 - gg_alloc_storage=0x3f14c mem_params.dynam_size=0x3f150, mem_params.dynam_addr=0x0x9b51c0
4294729631 - ROOT: PERM    224 bytes requested by ROOT ,Now Alloc 0, Free 875204, from line   205 of ggmem.c
4294729631 - [GGMEM] Memory Init: 28 bytes * gg_mem_num_partitions (8) = 224 bytes.
4294729631 - gg_mem_init partition GGMA : partition 0x00010000 block_size 74, total_blocks 300

4294729642 - gg_mem_init partition GGMB : partition 0x00010001 block_size 138, total_blocks 160

4294729642 - gg_mem_init partition GGMC : partition 0x00010002 block_size 304, total_blocks 90

4294729642 - gg_mem_init partition GGMD : partition 0x00010003 block_size 408, total_blocks 25

4294729642 - gg_mem_init partition GGME : partition 0x00010004 block_size 704, total_blocks 25

4294729642 - gg_mem_init partition GGMF : partition 0x00010005 block_size 1624, total_blocks 15

4294729642 - gg_mem_init partition GGMG : partition 0x00010006 block_size 2524, total_blocks 13

4294729642 - gg_mem_init partition GGMH : partition 0x00010007 block_size 7024, total_blocks 12

4294729642 - NWIF: nw_create_ccbs(): creating 16 ccbs.
4294729642 - ROOT: PERM   2240 bytes requested by NWIF ,Now Alloc 224, Free 874980, from line   783 of /home/xuchao/NF18MESH_release/bcm963xx/voice_terminal_platform/VTP_proj/VTP_base/build.BRCOM416_ON_VTP_MIPS/src/voice/pform/linux/src/network.c
4294729642 - Network: nw_create_sock_map(): creating a map of 80 sockets.
4294729642 - ROOT: PERM    320 bytes requested by NWIF ,Now Alloc 2464, Free 872740, from line   833 of /home/xuchao/NF18MESH_release/bcm963xx/voice_terminal_platform/VTP_proj/VTP_base/build.BRCOM416_ON_VTP_MIPS/src/voice/pform/linux/src/network.c
Thread 4 = NWIF01, priority 1
mxp_tcb_init, Dec 18 2020 14:14:19, stack size 32768
4294729642 - [DSP_BCM] BCM dsp initializing!
4294729642 - [DSP_BCM] vrgEndptDriverOpen: Endpoint driver open success!
4294729652 - [DSP_BCM] get env VTP_COUNTRY=AUSTRALIA
4294729652 - [DSP_BCM] current country id 0
tpUpdateLocaleProfile: Openning file /etc/telephonyProfiles.d/AUS_profile.xml ...
tpUpdateLocaleProfile: the size of file /etc/telephonyProfiles.d/AUS_profile.xml is 25156
tpFile_copyToBuffer: line 82, filename /etc/telephonyProfiles.d/AUS_profile.xml
Got config file from /etc/telephonyProfiles.d/AUS_profile.xml (len=25156), validating....
set endpoint provItem toneProfile (202), value = 0x00000000 0x00000001 0x00000000set endpoint provItem toneProfile (214), value = 0x00001388 0x00000001 0x00000000set endpoint provItem toneProfile (203), value = 0x00001388 0x00000001 0x00000000set endpoint provItem toneProfile (201), value = 0x00000000 0x00000001 0x00000000set endpoint provItem toneProfile (205), value = 0x00001388 0x00000002 0x00000000set endpoint provItem toneProfile (200), value = 0x00001388 0x00000001 0x00000000set endpoint provItem toneProfile (206), value = 0x00001388 0x00000002 0x00000000set endpoint provItem toneProfile (204), value = 0x00001388 0x00000001 0x00000000set endpoint provItem toneProfile (219), value = 0x00000009 0x00000001 0x00000000set endpoint provItem toneProfile (217), value = 0x00001388 0x00000001 0x00000000set endpoint provItem toneProfile (218), value = 0x00001388 0x00000001 0x00000000set endpoint provItem toneProfile (223), value = 0x00001388 0x00000001 0x00000000set endpoint provItem toneProfile (224), value = 0x00001388 0x00000001 0x00000000set endpoint provItem toneProfile (225), value = 0x00000000 0x00000002 0x00000001set endpoint provItem toneProfile (208), value = 0x00000000 0x00000002 0x00000001set endpoint provItem toneProfile (209), value = 0x00000000 0x00000002 0x00000001set endpoint provItem toneProfile (210), value = 0x00000000 0x00000002 0x00000001set endpoint provItem toneProfile (211), value = 0x00000000 0x00000002 0x00000001set endpoint provItem toneProfile (212), value = 0x00000000 0x00000001 0x00000001set endpoint provItem ringProfile (8), value = 0x00000001 0x00000003 0xCF000000set endpoint provItem ringProfile (9), value = 0x00000001 0x00000000 0x000001F0set endpoint provItem ringProfile (0), value = 0x00000001 0x00000003 0xC33C0000set endpoint provItem ringProfile (1), value = 0x00000001 0x00000003 0xC33C0000set endpoint provItem ringProfile (2), value = 0x00000001 0x00000003 0xC3000000set endpoint provItem ringProfile (3), value = 0x00000001 0x00000003 0x3C000000set endpoint provItem ringProfile (4), value = 0x00000001 0x00000003 0xC0000000set endpoint provItem ringProfile (5), value = 0x00000001 0x00000003 0xC30C0000set endpoint provItem ringProfile (6), value = 0x00000001 0x00000003 0x0CF00000set endpoint provItem ringProfile (7), value = 0x00000001 0x00000003 0x0C300000set endpoint provItem MinHookFlash (400), value = 280set endpoint provItem MaxHookFlash (401), value = 1100set endpoint provItem PlsDlInterdigitTime (402), value = 350set endpoint provItem PlsDlMinMakeTime (403), value = 28set endpoint provItem PlsDlMaxMakeTime (404), value = 46set endpoint provItem PlsDlMinBreakTime (405), value = 50set endpoint provItem PlsDlMaxBreakTime (406), value = 76set endpoint provItem MinConnect (423), value = 150set endpoint provItem MinDisconnect (424), value = 1200set endpoint provItem CIDMode (407), value = 0set endpoint provItem CIDFskAfterRing (408), value = 750set endpoint provItem CIDFskAfterDTAS (409), value = 100set endpoint provItem CIDFskAfterRPAS (410), value = 100set endpoint provItem CIDRingAfterFSK (411), value = 100set endpoint provItem CIDDTASAfterLR (412), value = 100set endpoint provItem CIDSigProtocol (413), value = 1set endpoint provItem CallWtgDelay (11), value = 4400set endpoint provItem VMWIMode (414), value = 6set endpoint provItem VMWIFskAfterDTAS (416), value = 100set endpoint provItem VMWIFskAfterRPAS (417), value = 100set endpoint provItem VMWIDTASAfterLR (418), value = 100set endpoint provItem VMWISigProtocol (415), value = 3set endpoint provItem VMWIMsgFormat (427), value = 1set endpoint provItem DtmfDbLevel (2202), value = 4set endpoint provItem DtmfPulseTime (2203), value = 100set endpoint provItem PowerRingFrequency (2601), value = 25set endpoint provItem RingWaveform (2602), value = 0set endpoint provItem HighVoltageRingSupport (2600), value = 1set endpoint provItem RingVoltagBOS: Enter bosInit 
BOS: Exit bosInit 
e (2603), value = 50set endpoint provItem RingDCOffset (2604), value = 0set endpoint provItem PteDetectAdmin (428), value = 4set endpoint provItem PteMinDetectPower (429), value = 40set endpoint provItem PveEgressVolume (430), value = 0set endpoint provItem CIDFskParmsProfile (425), value = 0x008704B0 0x0898012C 0x00B40000set endpoint provItem CIDDtmfParmsProfile (426), value = 0x00050046 0x0C0E0D00 0x010E7F00tpUpdateLocaleProfile: config file from /etc/telephonyProfiles.d/AUS_profile.xml is OK for country 04294729908 - [DSP_BCM] Initializing Endpt Driver!
wlctl: Unsupported
wlctl: Unsupported
******* DSP: Found BCM63268 *******
******* DSP: In PCM Mode *******
******* DSP: PCM running in 16 bit mode *******
gInterruptCounter     = 0xC151AF64 
gInterruptErrors      = 0xC151AF60 
gNextRxDesc           = 0xC151B098 
gNextTxDesc           = 0xC151B09C 
gDectTestMode         = 0xc151b0d0 
dectBuffStart         = 0xc151b0a0 
gDectRxOutOfSyncCounter = 0xc151b0e4 
gDectTxOutOfSyncCounter = 0xc151b0e8 
32 ms ECAN tail-length
*** gStartRxDesc[0] = 0xA229F000 
*** gBufferSizeBytes = 640 
*** gStartTxDesc[0] = 0xA229F7D0 
halPcmInit 389 nextTxDesc = 0xA229F7D0 
halPcmInit 389 nextTxDesc = 0xA229F7D8 
halPcmInit 393 Ownership for TX desc not set. Use this buffer. 
Binding 0x832fb228
boardHalInit completed
[ERROR ept] endptProvInitDefaults,642: (ts: 3 s 218ms):ERROR provision item is not configured
0    | 207   | EPPROV_ToneStutterdial       | 292 
[ERROR ept] endptProvInitDefaults,642: (ts: 3 s 237ms):ERROR provision item is not configured
1    | 207   | EPPROV_ToneStutterdial       | 292 
DSP: Interrupt Ids
---------------
InterruptId/Location      = 42/HIGH 

DSP: Interrupt Masks
---------------
IrqMask                   = 0x0000B100 
IrqMaskLow                = 0x83806680 
IrqMask1                  = 0x00device wl0 000400 
is not a slavIrqMaskLow1               = 0x00000020 
e of br0

DSP: Interrupt Status
-----------------
IrqStatus                 = 0x00100000 
IrqStatusLow              = 0x00038100 
IrqStatus1                = 0x00100000 
IrqStatusLow1             = 0x00038100 
device wl0 entered promiscuous mode
wlmngr:error:63.587:rut_restardo_signal 15
tRadvd:358:failed to start or restart radvd on br0
br0: port 5(wl0) entered forwarding state
br0: port 5(wl0) entered forwarding state
EndpointInit completed
dgasp: kerSysRegisterDyingGaspHandler: endpoint registered 
Thread 5 = eptEvnt, priority 99
mxp_tcb_init, Dec 18 2020 14:14:19, stack size 32768
Thread 6 = eptPkt, priority 99
mxp_tcb_init, Dec 18 2020 14:14:19, stack size 32768
4294731221 - ROOT: Creating Golden Gateway Application
4294731221 - ROOT:Number of tcids in the system  2: 4
4294731221 - gg_evtmgr_module_init
4294731221 - ISU: Creating...
4294731221 - ROOT: PERM   1552 bytes requested by ISU ,Now Alloc 2784, Free 872420, from line   187 of isush.c
4294731221 - [ISU] TCID Control Blocks: 388 bytes * voice_tcids (4) = 1552 bytes.
4294731221 - gg_evtmgr_register_event module ISU, base 0x1, num_eventmgrs 0x1
4294731221 - current_base 0x0, mask 1
4294731221 - gg_evtmgr_register_event 0x504098 0x50375c
4294731221 - ISU: isu_module_init isu_event_base 0x0, task 0x0

4294731221 - ROOT: ISU created
4294731221 - CCU: Creating...
4294731221 - ROOT: PERM  13408 bytes requested by CCU ,Now Alloc 4336, Free 870868, from line   360 of ccush.c
4294731221 - [CCU] Call Control Block: 3352 bytes * (voice_tcids + data_tcids + conf_tcids) (4) = 13408 bytes.
4294731221 - gg_evtmgr_register_event module CCU, base 0x4, num_eventmgrs 0x2
4294731221 - current_base 0x1, mask e
4294731221 - gg_evtmgr_register_event 0x4f98e0 0x4faf6c
4294731221 - CCU: ccu_module_init ccu_event_base 0x1, task 0x0
4294731221 - ROOT: CCU created
4294731231 - AMU: Creating...
4294731231 - ROOT: PERM    640 bytes requested by AMU ,Now Alloc 17744, Free 857460, from line   276 of amush.c
4294731231 - ROOT: PERM  75528 bytes requested by AMU ,Now Alloc 18384, Free 856820, from line   277 of amush.c
4294731231 - gg_evtmgr_register_event module AMU, base 0x5, num_eventmgrs 0x3
4294731231 - current_base 0x4, mask 10
4294731231 - gg_evtmgr_register_event 0x46733c 0x467180
4294731231 - AMU: amu_module_init amu_event_base 0x4, task 0x0

4294731231 - ROOT: PERM 134528 bytes requested by SPU ,Now Alloc 93912, Free 781292, from line   212 of spush.c
4294731231 - ROOT: PERM  33600 bytes requested by SPU ,Now Alloc 228440, Free 646764, from line   219 of spush.c
4294731231 - SPU: *, SM create
4294731231 - ROOT: PERM   1184 bytes requestNo device nameed by SPU ,No wl0 found in Ethernet driver
w Alloc 262040, Free 613164, from line   159 of spupsu.c
4294731231 - gg_evtmgr_register_event module SPU, base 0x6, num_eventmgrs 0x4
4294731231 - current_base 0x5, mask 20
4294731231 - gg_evtmgr_register_event 0x484a80 0x484238
4294731231 - SPU: spu_module_init spu_event_base 0x5, task 0x0

4294731241 - ROOT: PERM   5232 bytes requested by SFU ,Now Alloc 263224, Free 611980, from line   153 of sfush.c
4294731241 - ROOT: PERM   1752 bytes requested by SFU ,Now Alloc 268456, Free 606748, from line   166 of sfush.c
4294731241 - gg_evtmgr_register_event module SFU, base 0x7, num_eventmgrs 0x5
4294731241 - current_base 0x6, mask 40
4294731241 - gg_evtmgr_register_event 0x4985e4 0x497d34
4294731241 - SFU: sfu_module_init sfu_event_base 0x6, task 0x0

4294731241 - ROOT: TSGM created
4294731241 - ATPM: Creating...
4294731241 - ROOT: PERM   1296 bytes requested by ATPM ,Now Alloc 270208, Free 604996, from line   300 of atpmsh.c
4294731241 - ROOT: PERM     16 bytes requested by ATPM ,Now Alloc 271504, Free 603700, from line   355 of atpmsh.c
4294731241 - ROOT: PERM    144 bytes requested by ATPM ,Now Alloc 271520, Free 603684, from line   367 of atpmsh.c
4294731241 - ROOT: PERM  38408 bytes requested by ATPM ,Now Alloc 271664, Free 603540, from line   428 of atpmsh.c
4294731241 - ROOT: PERM 232260 bytes requested by DCMM ,Now Alloc 310072, Free 565132, from line   239 of dcmsh.c
4294731251 - DCM: Creating DCM DB...
4294731251 - DCM: DB Created.
4294731251 - gg_evtmgr_register_event module ATPM, base 0x3, num_eventmgrs 0x1
4294731251 - current_base 0x0, mask 7
4294731251 - gg_evtmgr_register_event 0x45b150 0x45a3dc
4294731251 - ROOT: ATPM module initialization
mxp_tcb_init, Dec 18 2020 14:14:19, stack size 32768
4294731251 - gg_evtmgr_main 0 current_base 0x7 nevtmgr 5 
4294731251 - gg_evtmgr_main 0x504098 0x50375c
4294731251 - gg_evtmgr_create 0 7
mxp_tcb_init, Dec 18 2020 14:14:19, stack size 32768
4294731251 - [RM]not use resource manager uint.
4294731251 - [DSP_BCM] DSP(BRCM): Can't find interface(10)!
4294731251 - gg_evtmgr_create 1 8
4294731251 - [DSP_BCM] DSP(BRCM): Can't find interface(12)!
4294731251 - gg_evtmgr_get_taskid 7
4294731251 - [DSP_BCM] DSP(BRCM): Can't find interface(13)!
4294731251 - CCU: ccu_create 7 queue 2 4
4294731261 - gg_evtmgr_get_taskid 7
4294731261 - SPU: spup_init

4294731261 - ISU: isu_create 7 queue 1

4294731251 - gg_evtmgr_main 1 current_base 0x3 nevtmgr 1 
4294731261 - gg_evtmgr_get_taskid 7
4294731261 - gg_evtmgr_main 0x45b150 0x45a3dc
4294731261 - AMU: Created.
4294731261 - DCM: Queue Created.
4294731611 - DCM: Creating Timers....
4294731611 - gg_evtmgr_get_taskid 7
4294731611 - SPU: spu_create 7 queue 20

wlmngr:error:64.244:wl_getCurrentChSpec:106:wlCurrentChannel = 36
4294731611 - ROOT: PERM  26400 bytes requested by DCMM ,Now Alloc 542332, Free 332872, from line   503 of dcmutl.c
4294731611 - gg_evtmgr_get_taskid 7
4294731611 - SFU: sfu_create 7 queue 40

4294731611 - SSMU: max_call_control_blocks = 7 

4294731611 - initFreeCbs: freeCBs = 7 

4294731611 - ROOT: PERM  69608 bytes requested by SSMU ,Now Alloc 542332, Free 332872, from line   188 of ssmush.c
4294731611 - SSMU: Creating...

mxp_tcb_init, Dec 18 2020 14:14:19, stack size 262144
4294731611 - SSMU: Internal message queue created.

4294731611 - SSMU: Registered with XUEvt. ID = 2
4294731611 - SSMU: Task Created.

4294731611 - ROOT: SSMU created
4294731611 - ROOT: PERM   2176 bytes requested by PSU ,Now Alloc 611940, Free 263264, from line   146 of psuinit.c
4294731611 - gg_evtmgr_register_event module PSU, base 0x8, num_eventmgrs 0x6
4294731621 - current_base 0x7, mask 80
4294731621 - gg_evtmgr_register_event 0x45e870 0x45e868
4294731621 - ROOT: PSU created
4294731621 - gg_evtmgr_get_taskid 7
4294731621 - gg_evtmgr_get_taskid 8
4294731621 - ATPM: Created.
4294731621 - DEX: Creating...
Thread 10 = DEX, priority 1
mxp_tcb_init, Dec 18 2020 14:14:19, stack size 32768
4294731621 - TIU: Creating...
4294731621 - TIU: Requesting Perm Memory 2 blocks of 1364 bytes
4294731621 - ROOT: PERM   2728 bytes requested by TIU ,Now Alloc 614116, Free 261088, from line   553 of tiush.c
4294731621 - TIU: 0, init
There is no Predefined DevicePin in CFE

jimbot · February 13, 2024, 3:27pm

Boot log (part 3 of 3)

initialize VpInitDevice successed 
do_signal 15

Line 0:initialize VpInitLine successed 
4294732911 - TIU: 1, init

Line 1:initialize VpInitLine successed 
4294733601 - TIU: Registered with XUEvt. ID = 3
4294733601 - DEX: Created_
4294733601 - ROOT: DIM PLATFORM created
4294733601 - CMGR: Created.
4294733601 - ROOT: Call Mgr created
4294733601 - ROOT: PERM   1408 bytes requested by NMM ,Now Alloc 616844, Free 258360, from line   174 of nmmsh.c
4294733601 - NMM: Build contains Only TIU.
4294733611 - nmmp_restore_config end
mxp_tcb_init, Dec 18 2020 14:14:19, stack size 32768
mxp_tcb_init, Dec 18 2020 14:14:19, stack size 32768
4294733611 - NMM: Starting Periodic Timer. rate=200 msec
4294733611 - ROOT: NMM created
4294733621 - ROOT: All units and modules created
4294733621 - ***** CONFIG_VTP_VOICE_MAX_TCIDS=2, MAX_NET_CCBS=4, GG_CCB_SIZE=128. *****
4294733621 - NUM_NET_CCBS=4, CONFIG_VTP_VOICE_MAX_TCIDS=2. *****
4294733621 -       GGBSP_PERM_STORAGE allocated  = 0.
4294733621 -       NWIF_PERM_STORAGE allocated = 2560.
4294733621 -       UDP_PERM_STORAGE allocated  = 0.
4294733621 -       NWX_PERM_STORAGE allocated  = 0.
4294733621 -       ATMU_PERM_STORAGE allocated = 0.
4294733621 -       JSBU_PERM_STORAGE allocated = 0.
4294733621 -       ARP_PERM_STORAGE allocated  = 0.
4294733621 -       BCTM_PERM_STORAGE allocated = 0.
4294733621 -       SVCA_PERM_STORAGE allocated = 0.
4294733621 -       HSMU_PERM_STORAGE allocated = 0.
4294733621 -       FTMU_PERM_STORAGE allocated = 0.
4294733621 -       ISDM_PERM_STORAGE allocated = 0.
4294733621 -       XGCM_PERM_STORAGE allocated = 0.
4294733621 -       TIU_PERM_STORAGE allocated  = 2728.
4294733621 -       UIU_PERM_STORAGE allocated  = 0.
4294733621 -       DIM_PERM_STORAGE allocated  = 0.
4294733621 -       ISU_PERM_STORAGE allocated  = 1728.
4294733621 -       VIM_PERM_STORAGE allocated  = 0.
4294733621 -       CCU_PERM_STORAGE allocated  = 13408.
4294733621 -       RTCP_PERM_STORAGE allocated = 0.
4294733621 -       PSMU_PERM_STORAGE allocated = 0.
4294733621 -       TSMU_PERM_STORAGE allocated = 0.
4294733621 -       QSMU_PERM_STORAGE allocated = 0.
4294733621 -       SSMU_PERM_STORAGE allocated = 139216.
4294733621 -       AMU_PERM_STORAGE   allocated  = 76168.
4294733631 -       SPU_PERM_STORAGE   allocated  = 169312.
4294733631 -       SFU_PERM_STORAGE   allocated  = 6984.
4294733631 -       PSU_PERM_STORAGE allocated  = 1088.
4294733631 -       ATPM_PERM_STORAGE allocated = 39880.
4294733631 -       DCM_PERM_STORAGE allocated  = 415280.
4294733631 -       DLM_PERM_STORAGE allocated  = 0.
4294733631 -       DSMC_PERM_STORAGE allocated = 0.
4294733631 -       DSPA_PERM_STORAGE allocated = 300.
4294733631 -       NMM_PERM_STORAGE allocated  = 1408.
4294733631 -       APM_PERM_STORAGE allocated  = 0.
4294733631 -       DMMU_PERM_STORAGE allocated = 0.
4294733631 -       MEGM_PERM_STORAGE allocated = 0.
4294733631 -       DSP_IMAGE_HANDLER_STORAGE allocated = 20.
4294733631 -       MCC_PERM_STORAGE allocated  = 0.
4294733631 -       OOB_PERM_STORAGE allocated  = 0.
4294733631 -       DH_PERM_STORAGE allocated   = 0.
4294733631 -       XDP_PERM_STORAGE allocated  = 0.
4294733631 -       XDPHW_PERM_STORAGE allocated  = 0.
4294733631 -       MSU_PERM_STORAGE allocated  = 0.
4294733631 -       PMA_PERM_STORAGE allocated  = 0.
4294733631 -       PVA_PERM_STORAGE allocated  = 0.
4294733631 -       PSA_PERM_STORAGE allocated  = 0.
4294733631 -       CMM_PERM_STORAGE allocated  = 0.
4294733631 -       RVCM_PERM_STORAGE allocated = 0.
4294733631 -       TUIU_PERM_STORAGE allocated = 0.
4294733631 -       UIUHW_PERM_STORAGE allocated = 0.
4294733631 -       SC_PERM_STORAGE allocated   = 0.
4294733631 - ***** OVHD_STORAGE allocated      = 5120. *****
4294733641 - ***** TOTAL_PERM_STORAGE allocated  = 875200. *****
4294733641 - sfu: init_feature_state on port=0, cw_feature_state = 0 , per_call_state = 0
4294733641 - [DCM] Digital Map: DCM_PERM_MEMORY_SIZE = 26400 bytes.
4294733641 - sfu: init_feature_state on port=1, cw_feature_state = 0 , per_call_state = 0
4294733641 - SFU: Registered with XUEvt. ID = 5
4294733641 - ROOT: PERM  26400 bytes requested by DCMM ,Now Alloc 644652, Free 230552, from line   503 of dcmutl.c
4294733641 - [DCM] Digital Map: DCM_PERM_MEMORY_SIZE = 26400 bytes.
4294733641 - ROOT: PERM  26400 bytes requested by DCMM ,Now Alloc 671052, Free 204152, from line   503 of dcmutl.c
4294733641 - [DCM] Digital Map: DCM_PERM_MEMORY_SIZE = 26400 bytes.
4294733641 - DCM: Timer Created.
4294733811 - !! NMM Server Started !!
4294733811 - SIP_FORCEUPDATE_CIDDATE already exists!

4294733811 - IC_CARD_TIMER_A already exists!

4294733811 - RTCP_AUTO_MANAGE already exists!

4294733821 - the queue NMMQ post the event : msg_id is 5, eventId is 29
4294733821 - the queue NMMQ wait the event: msg_id is 5, eventId is 29
voice_app_ready:1263 Send Wan UP
4294733821 - VNIU: Recieved system event id=10010, type=0, size=0
[provision_event:8185]voice_state:0, temp 0xc0f0b0
4294733981 - VNIU: Recieved system event id=10059, type=3, size=21
4294733981 - the queue NMMQ post the event : msg_id is 5, eventId is 145
4294733981 - the queue NMMQ wait the event: msg_id is 5, eventId is 145
4294733981 - nmm_process_voice_event event SYSTEM_NMMPROV recv, param=/var/tmp/voice_config
OK
OK
OK
[provision_event:8208]voice_state:3
4294734611 - NMM: 0, Switched CAS, FXS Loop Start
4294734611 - SSMU: med_gw= med_dev=
4294734611 - SSMU:* Local Media IP Set to 0.0.0.0
4294734611 - SSMU:* Local Media IP Set to 0.0.0.0, Media Dev Set to 
4294734611 - NMM: open FLASH_CONFIG_TYPE_NSP_VERSION failed!

4294735351 - ============================================================
4294735351 - SSMU Inited RV SIP Stack Version 5.0.0.29 successfully!!
4294735351 - ============================================================
4294735361 - NMM: 1, Switched CAS, FXS Loop GW_TIUO_FXS_LOOP_HW_INIT tcid=0, companding is=2
Start
tiup_pdr_config tcid=0
GW_TIUO_FXS_LOOP_HW_INIT tcid=1, companding is=2
tiup_pdr_config tcid=1
There is no Predefined DevicePin in CFE
Setting SSID: "NetComm 5734"
device wl1 is not a slave of br0
device wl1 entered promiscuous mode
wlmngr:error:70.881:rut_restartRadvd:358:fado_signal 15
iled to start or restart radvd on br0
br0: port 6(wl1) entered forwarding state
br0: port 6(wl1) entered forwarding state
No device name wl1 found in Ethernet driver
acsd: selected channel spec: 0xe02a
acsd: Adjusted channel spec: 0xe02a
acsd: selected channel spec: 0xe02a
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: selected channel spec: 0x1001
acsd: Adjusted channel spec: 0x1001
acsd: selected channel spec: 0x1001
Line 0: ADSL G.992 started
Line 0: xDSL link down
acsd: selected channel spec: 0xe02a
acsd: Adjusted channel spec: 0xe02a
acsd: selected channel spec: 0xe02a

frollic · February 13, 2024, 4:33pm

Broadcom is dead, for the wifi and the VDSL part.

jimbot · February 13, 2024, 4:36pm

is that including the BCM43602 chip as well?

frollic · February 13, 2024, 4:38pm

Same wifi chip - https://openwrt.org/toh/netgear/r8000

jimbot · February 13, 2024, 4:42pm

oh great, so the brcmfmac driver should allow me to get the 5G Wi-Fi working?

frollic · February 13, 2024, 4:43pm

you'll get some wifi, yes ...

jimbot · February 19, 2024, 12:17am

A few updates...
Running from RAM
Using the initramfs target from v23.05.2, I built and loaded the bcm63xx sercomm_h-500s-vfes elf file into ram. I used the run command in CFE to download it via tftp, and it 'worked'. By that, I mean that it didn't crash, and I had an interactive console. The LAN port I was plugged into was working, I could ping, etc. The LEDs weren't quite right and the reset function was mapped to the WPS button.

Firmware Format
I have two versions of the vendor-supplied firmware. Both of them are *.w files. I couldn't see how these related to the broadcom imagetag format. I tried the Image Analyzer, but it was spitting out gibberish. It turns out the w file format is different (broadcom calls this a 'whole flash ".w" image'). I used binwalk to extract the jffs2 filesystem, but couldn't work out the validation protocol.

The w file has a large empty section and then right at the end, a string with the product id (NF18ACV), and the last 20 bytes are described in the bcmTag.h file in the vendor's GPL source code (which I now have).

The CRC used is non-standard, so I can't yet generate an alternative w file. However, if I need to, I expect I can use CRC RevEng to determine the inputs required. In the meantime, I'm leaving the firmware as-is and experimenting loading from RAM.

I also confirmed that the CFE provides the standard firmware update web server interface, which may be another option if needed.

Other Devices
Based on the board id (963167GWV_004R), there's several other devices with the same basic platform. This includes:

SmartRG SR516ac
(Vodaphone) Netcomm NL1902
Vodaphone Wi-Fi Hub 2.0
Motorola MD1600
Pictures of these devices, including internal images (from FCC etc), confirm the same layout and external ports, with differences such as no VoIP, or the addition of an internal 4G/LTE modem (probably via USB)

Hardware Layout
I couldn't find a pinout or datasheet for the BCM63167VKPEBG, but I'm assuming it's the same (or very similar to) the pinout for the BCM63167VKPEBG. This is consistent with a visual trace of the signal paths.

I have the datasheet for the BCM53134SKFBG switch, and to make things easier, I made this pinout diagram, trying to follow the conventions used in the other pinouts I saw.

jimbot · February 19, 2024, 2:50pm

I requested the GPL source code from the vendor and they obliged. I've uploaded it here: nf18acv-openwrt (github)

OpenWRT_Newb · March 26, 2024, 5:45pm

Hey... Saw your post and wanted to encourage you to keep going. I've got a SmartRG SR519ac, and would love to see it repurposed as a router with OpenWRT, even if the xDSL capability doesn't work.

I didn't understand one of the earlier replies about Broadcom being 'dead'... Can you enlighten me?

Thx.

slh · March 27, 2024, 12:49pm

There are very few developers or other contributors for Broadcom based devices, as there are no drivers for:

xDSL modem
cable modem
phone features (FXS, DECT, ...)
hardware offloading (packet engines)
WLAN

...and Broadcom being openly hostile towards opensource.

With the prospects of there never going to be drivers for the primary features (wifi), it makes little sense to waste time on that steaming pile of proprietary garbage - and few even try (why would you, if Mediatek and QCA offer equivalent hardware that can be fully supported, vote with your wallet).

OpenWRT_Newb · March 27, 2024, 1:03pm

Ah. I didn't realize the situation was so problematic. The post I replied to had a link to some open source software -- I'm presuming that's just the things they were forced to release, and not the drivers you're talking about?

I ask because I'm trying to keep routers out of the trash by 'upcycling' them -- and it sucks that they'd rather let them go to landfill than release some code.