目次
- はじめに
- MTE-N100の概要
- UART
- 起動ログからの考察
- 隠されたWebUIにアクセスする
- U-Bootのコンソールに入る
- コンソールに入る
- GPIO
- NANDのダンプを取る
- ファームウェア改造
- おまけMTE-N100とMTE-N101
- 終わりに
はじめに
AR UARTの横についているLTE UARTという端子がついていて、M.2端子に刺さっているWiMAX 2+のモジュール(MTE-N100)からのUARTという認識はしていたんですが、ボーレートが分からず、放置していました。今回ボーレートがわかったので色々やってみようと思います。
URoad-Home関係の記事の一覧と概要はこちら
MTE-N100の概要
MTE-N100本体の分解は、初回の「URoad-Home2+を分解してみた」で行っています。
SoCはGCT GDM7243M、メモリ64MB、NANDフラッシュ128MBです。URoad-Home2+本体との接続端子は接続端子はM.2 Slot Bで、情報のやり取りはUSBで行われていています。SIMはM.2端子を通して直接繋がっています。
UART
ピンアサインはAR UARTのほうと同じでこんな感じです。
ボーレートは460800なようです。M.2 Slot BのGPIO線を使用したものらしく、振幅が1.8Vしかないため、UART変換器によっては正常に読み取りができないかもしれません。一応、自分の環境ではこんな設定で読み取りできました。レベルシフト回路とかがあるといいと思います。
起動ログからの考察
初回の記事で考察したように、NANDは128MBでした。メモリ(RAM)は64MB、CPUはARMv6で400MHz?っぽいです。NANDの構成はこんなです。31個にも分かれていて非常に多いです。同じものが3つ入っているようです。
隠されたWebUIにアクセスする
起動ログを見ているとわかりますが、本体のURoad-Home 2+と同じ様にWebの設定画面が存在するようです。
webs: Listening for HTTP requests at address 192.168.44.254IPアドレスが、192.168.44.254であるので192.168.44.254:80と192.168.100.254:8080をNAPTで結びつけます。前回の改造ファームウェアを導入したURoad-Home2+のコンソールで以下の2つのコマンド実行します。
iptables -t nat -A POSTROUTING -d 192.168.44.254/32 -p tcp -m tcp --dport 80 -j SNAT --to-source 192.168.100.254
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.44.254:80これでブラウザから192.168.100.254:8080にアクセスするとMTE-N100の管理画面に入れます。ユーザ名はblockuser、パスワードはqmffjrdjzkdnsxmです。もしかしたら端末ごとに異なるかもしれません。下で紹介するコンソールに入った状態でnv -p | grep webで確認できると思います。
U-Bootのコンソールに入る
起動時に
Hit ENTER key to stop autoboot: 0
と出るので、エンターキーを連打します。そうするとU-Bootのコンソールに入れました。URoad-Home2+本体の電源を入れてからしばらくラグがあります。
コンソールに入る
とりあえず、U-Bootのbootargsを変更してinitをshにしてシェルを出します。今回の場合はbootargsがsetbootargsによって設定されるので、
setenv setbootargs set bootargs console=ttyS0,${baudrate} mem=64M root=/dev/${dual_rootfs} rootfstype=cramfs ${mtdparts} init=/bin/shを実行してinit=/bin/shを追加します。その後、bootcmdの内容を実行します。
run setbootargs;nand read ${kernel_exec_addr} ${dual_linux};bootm ${kernel_exec_addr}しばらくするとシェルが起動するので、
/etc/init.d/rcSを実行します。ある程度急がないとwatchdogによって再起動がかかります。先程のを実行すると色々マウントされたりします。しばらくするとコンソールが戻ってきます。晴れて色々できるようになります。
GPIO
URoad-Home2+本体の6つのLEDのうち、上の2つのWiMAX関係のLEDはこのMTE-N100が制御しています。UARTと同じようにM.2 slot B中のGPIOピンを利用している感じです。
今回もgpioappがいたのでいじってみました。URoad-Home2+とは異なりportという概念が存在しました。a~gがあるようです。とりあえず、LEDはこんな感じでした。
port・・・d
8・・・WiMAXの緑LEDのON(1)/OFF(0)
9・・・電波強度の赤色LEDのON(1)/OFF(0)
10・・・電波強度の緑LEDのON(1)/OFF(0)
19・・・WiMAXの青LEDのON(1)/OFF(0)
NANDのダンプを取る
URoad-Home 2+の本体では、先程のコンソールに入る方法が使えなかったので、U-BootとJTAGを使用しましたが、今回はコンソールに入れたので話が違います。tftpコマンドがあるようなのでそれを使用したいです。
はじめに、先程の手順を踏んで、MTE-N100でコンソールに入れている状態にします。また、その状態でtftpサーバのPCをWiFiや有線LANで接続してください。
本体側のNAPTをいじって、MTE-N100のUDP69番ポートとURoad-Home2+の69番ポートを接続します。前回記事で、URoad-Home2+にログインできるようになっているので、URoad-Home2+のコンソールに入って
# MTE-N100からのUDP 69番ポートのトラフィックをPCのudp69番ポートに転送
iptables -t nat -A PREROUTING -p udp --dport 69 -j DNAT --to-destination PCのIPアドレス:69
# ソースNATを設定して、応答トラフィックが適切にルーティングされるようにする
iptables -t nat -A POSTROUTING -d PCのIPアドレス -p udp --dport 69 -j MASQUERADEを実行して、設定します。MTE-N100のコンソールに戻って
ip address add 192.168.44.254/24 dev usb0でIPの割りあてをします。その後、cd /tmpで移動して、vi All_Dump.shで、このtxtファイル(長いのでこのページには載せられない)の内容スクリプト(ちなみにこのスクリプトはURoad-Home2+内のもの)を書きます。書き終わったらchmod 755 All_Dump.shで権限を与えます。これが終わったら、
All_Dump.sh 192.168.44.20で吸い出しを行います。自動的にtftpサーバにアップロードされます。
ファームウェア改造
前回の記事と同じように/etc/passwdファイルを変更してrootパスワードを無くします。めんどくさいので割愛します。今回は、すでにリトルエンディアンなためswappcramfsを行う必要はありません。また、passwdファイルが/etc_moda/下に存在します。改造後のファームウェア(1.3.8.1)はこちら(modified-mtd10.img)です。
焼き方ですが、U-Bootに入ります。loadbを使用して改造ファームウェアを転送します。
loadb 0xd05fffc0コマンド実行後にteratermの場合はファイル→転送→Kermit→送信でファイル(modified-mtd10.img)を選択すれば送れます。
NANDのrootfs領域を消します。
nand erase 0x1200000 0x1400000NANDに焼きます。loadbのログにTotal Size = 0x00e12000とあったので、
nand write 0xd05fffc0 0x1200000 0x00e12000あとはresetを実行するだけです。パスワード無しでrootにログインができました。
おまけMTE-N100とMTE-N101
本体にはMTE-N100と書かれていますが、WebUIのタブの名前がMTE-N101になっていたり、起動ログ中にも101という文字列が多く含まれています。検索しても、MTE-N101にヒットするものはこのページだけでした。WiMAX FORUMの認証証明書ですが、これによると、MTE-N100、MTE-N101だけではなく、MTE-N102、MTE-N103、MTE-104も出すつもりだったようです。一体なにが違うとそんなに種類が増えるんでしょうか…
終わりに
今回は一気にログ取得、ファームウェアダンプ、ファームウェア改造までやってしまいました。URoad-Home2+本体のUARTとMTE-N100のUARTを付け替えたり、ボーレートを変えたりと面倒でした。URoad-Home2+とはUSB-gadgetでやり取りしている感じっぽいので、OpenWRTとかを入れたときには、またMTE-N100に触れるかもしれません。
URoad-Home関係の記事の一覧と概要はこちら
下には起動ログとU-Bootのログを載せておきます。
起動ログ
U-Boot 2010.09 (Dec 15 2015 - 17:35:55)GCT GDM7243
U-Boot MODA Version 1.0.0.1
U-Boot GCT Version 0.7
DRAM: 128 MiB (wbd)
DDR: id=8(Winbond) rev=0,0
NAND: ECC 1bit
maf_id : 0x00000098, dev_id : 0x000000f1
Pagesize : 2Kbytes
Address cycle : 4
Ecc : 1bit(size : c, addr : 834)
128 MiB
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
nand_read_bbt: Bad block at 0x000006000000
==== Master 1st Image ====
Board Rev 1.1
Chip ID:GDM72430000 R0D, HW Reset occured.
Hit ENTER key to stop autoboot: 0
NAND read: partsize: 0x400000
device 0 offset 0xa00000, size 0x400000
4194304 bytes read: OK
## Booting kernel from Legacy Image at d05fffc0 ...
Image Name: Linux-3.10.0-uc0
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2056992 Bytes = 2 MiB
Load Address: d0600000
Entry Point: d0600000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Initializing cgroup subsys cpu
Initializing cgroup subsys cpuacct
Linux version 3.10.0-uc0 (root@seonmi-VirtualBox) (gcc version 4.7.3 (Buildroot 2013.08.1) ) #32 Tue Mar 29 14:47:28 KST 2016
CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c538fd
CPU: VIPT aliasing data cache, VIPT aliasing instruction cache
Machine: GCT GDM7243
Memory policy: ECC disabled, Data cache writeback
CPU: GDM7243. R0D [0x72430000]
ARM:
CR: 00c538fd
ACR: 00000005
CPU: xtal 19.200 MHz, pll 480.000 MHz arm 400.000 MHz, clk(1x) 100.000 MHz
CPU: found DTCM0 16k @ 00000000, not enabled
CPU: moved DTCM0 16k to fffe8000, enabled
CPU: found ITCM0 32k @ 00000000, not enabled
CPU: moved ITCM0 32k to fffe0000, enabled
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS0,460800 mem=64M root=/dev/mtdblock10 rootfstype=cramfs mtdparts=gdm7243:512k(u-boot),512k(env),1m(rev0),1m(ltenv),1m(wmnv),1m(cmnnv),1m(cmnnv2),4m(rev1),4m(linux),4m(linux2),20m(rootfs),20m(rootfs2),1m(lteparam),1m(reserve1),1m(lteparam2),1m(eapparam),1m(devparam),1m(combparam),1m(nvparam),1m(nvparam2),1m(eapparam2),1m(devparam2),1m(combparam2),1m(xmlparam),1m(xmlparam2),4m(linux3),20m(rootfs3),1m(reserve2),1m(reserve3),2m(datausages),2m(datausages2)
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 64MB = 64MB total
Memory: 59700k/59700k available, 5836k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
DTCM : 0xfffe8000 - 0xfffec000 ( 16 kB)
ITCM : 0xfffe0000 - 0xfffe8000 ( 32 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
vmalloc : 0xd4800000 - 0xff000000 ( 680 MB)
lowmem : 0xd0000000 - 0xd4000000 ( 64 MB)
modules : 0xcf000000 - 0xd0000000 ( 16 MB)
.text : 0xd0008000 - 0xd037fa34 (3551 kB)
.init : 0xd0380000 - 0xd03a043c ( 130 kB)
.data : 0xd03a2000 - 0xd0433180 ( 581 kB)
.bss : 0xd0437000 - 0xd051900c ( 905 kB)
SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:64
gdm_set_mode
CLOCK_EVT_MODE_SHUTDOWN
gdm_set_mode
CLOCK_EVT_MODE_PERIODIC
sched_clock: 12 bits at 100MHz, resolution 10ns, wraps every 0ms
RTC: secondary(external) 32.768KHz osc
RTC Interrupt Enabled!
PM: uart add rtc=1(30us) wakeup_overhead_rtc=1
console [ttyS0] enabled
Calibrating delay loop... 159.12 BogoMIPS (lpj=795648)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0xd02a14b0 - 0xd02a150c
SYS_STA: 0x0(POR)
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Build Info:
date: 2016/03/29-14:47:24
user: root@seonmi-VirtualBox
svnr: 892
pkgv: 0.52
appv: 0.52
src: /project/MTE-N100
Config Info:
PRODUCT: MTE-N101
PLATFORM_STANDALONE
HZ=100
NET_NATQ2
NET_VLANQ
VLAN_8021Q
RTC_TIMER
PM_IDLE
PM_IDLE_DFRD_TIMER
NO ARM_DMA_MEM_BUFFERABLE
DDR: id=8(Winbond) rev=0,0
GDM HL IF(v0.5) initialized
bio: create slab <bio-0> at 0
Switching to clocksource rtccs
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 512 bind 1024)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
gipc-protocol(d4804010): va=d4804010, pa=d3880010
ipc ch[0]:CTRL, irb_work: va=d4804ae0, pa=d3880ae0
irb nr: tx=16(2080bytes), rx=64(2080bytes)
m-ch_enabled: 0x1
ipc ch[28]:DBG, irb_work: va=d48057d8, pa=d38817d8
irb nr: tx=2(2080bytes), rx=128(2080bytes)
m-ch_enabled: 0x10000001
IPCIF(v0.2) initialized
IPC Ver: 1.2
IPC_IF_RX_LIMIT=100
tk_crash_cnt=0/0
msgmni has been set to 116
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Initialize gdm-i2c
Probe gdm-i2c
i2c bus frequency set to 400 KHz
i2c-0: GDM I2C adapter
platform driver register success
ROHM-BD71801: BD71801_SW1=1.15V
ROHM-BD71801: BD71801_LDO2=OFF
ROHM-BD71801: BD71801_LDO4=OFF
ROHM-BD71801: BD71801_LDO5=OFF
ROHM-BD71801: BD71801_SW2=1.8V
ROHM-BD71801: BD71801_SW4=1.40V
ROHM-BD71801: BD71801_ 7,8,11,12 are controlled by DN_IND
ROHM-BD71801: BD71801_LDO9=2.85V
ROHM-BD71801: TCXO_CNT: 41
ROHM-BD71801: BD71801_LDOPD2_DIS: 00->01
ROHM-BD71801: PMIC ROHM-BD71801(id:4c) probed!
ROHM-BD71801: BD71801_LDO9=2.85V
ROHM-BD71801: BD71801_LDO9=OFF
gdm-uart.0: ttyS0 at I/O 0xfc007500 (irq = 2) is a gdm-uart
leddev: Copyright (C) Modacom, 2013.07 v1.1
gbutton: Copyright (C) Modacom, 2013.07 v1.0
DEBUG: device register - done
DEBUG: [+]gpio_init
gpioman: Copyright (C) Modacom, 2013.5 v1.0
[USIM] : GDM USIM device driver (1.1), RETRY patch
[USIM] : GDM USIM device driver (1.1)
brd: module loaded
GDM7243 NAND Driver, GCT Semiconductor, Ltd.
Ecc : 1bit
pagesize : 2K
ecc_addr : 834 ecc_size : c
address cycle : 4
NAND device: Manufacturer ID: 0x98, Chip ID: 0xf1 (Toshiba NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
nand_read_bbt: bad block at 0x000006000000
31 cmdlinepart partitions found on MTD device gdm7243
31 cmdlinepart partitions found on MTD device gdm7243
Creating 31 MTD partitions on "gdm7243":
0x000000000000-0x000000080000 : "u-boot"
0x000000080000-0x000000100000 : "env"
0x000000100000-0x000000200000 : "rev0"
0x000000200000-0x000000300000 : "ltenv"
0x000000300000-0x000000400000 : "wmnv"
0x000000400000-0x000000500000 : "cmnnv"
0x000000500000-0x000000600000 : "cmnnv2"
0x000000600000-0x000000a00000 : "rev1"
0x000000a00000-0x000000e00000 : "linux"
0x000000e00000-0x000001200000 : "linux2"
0x000001200000-0x000002600000 : "rootfs"
0x000002600000-0x000003a00000 : "rootfs2"
0x000003a00000-0x000003b00000 : "lteparam"
0x000003b00000-0x000003c00000 : "reserve1"
0x000003c00000-0x000003d00000 : "lteparam2"
0x000003d00000-0x000003e00000 : "eapparam"
0x000003e00000-0x000003f00000 : "devparam"
0x000003f00000-0x000004000000 : "combparam"
0x000004000000-0x000004100000 : "nvparam"
0x000004100000-0x000004200000 : "nvparam2"
0x000004200000-0x000004300000 : "eapparam2"
0x000004300000-0x000004400000 : "devparam2"
0x000004400000-0x000004500000 : "combparam2"
0x000004500000-0x000004600000 : "xmlparam"
0x000004600000-0x000004700000 : "xmlparam2"
0x000004700000-0x000004b00000 : "linux3"
0x000004b00000-0x000005f00000 : "rootfs3"
0x000005f00000-0x000006000000 : "reserve2"
0x000006000000-0x000006100000 : "reserve3"
0x000006100000-0x000006300000 : "datausages"
0x000006300000-0x000006500000 : "datausages2"
---------------------
hdr chksum : 0x9e1506d1
magic : 0xcafebabe
timstamp : 0x00000000
data chksum : 0x79ff0613
data size : 0x0001ffdc
---------------------
---------------------
hdr chksum : 0xffffffff
magic : 0xffffffff
timstamp : 0xffffffff
data chksum : 0xffffffff
data size : 0xffffffff
---------------------
---------------------
hdr chksum : 0x92c605eb
magic : 0xcafebabe
timstamp : 0x00000066
data chksum : 0x79198e12
data size : 0x0001ee00
---------------------
---------------------
hdr chksum : 0x92db05ec
magic : 0xcafebabe
timstamp : 0x00000067
data chksum : 0x79198e12
data size : 0x0001ee00
---------------------
ARM0 CLOCK No CHANGE
GCT GDM udc driver: version 1.0.1
+gdm_udc_probe
gdm-udc (ver=9) at 0xfc005200 irq=24 with UTMI level 0 tranceiver
watchdog v2.0 : WDT driver for Acquire single board computer initialising.
Watchdog get Major 125
gdm_wdt_probe
watchdog: modacom Watchdog enabled (30 seconds, nowayout)
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (932 buckets, 3728 max)
ctnetlink v0.93: registering with nfnetlink.
xt_time: kernel timezone is -0000
ipip: IPv4 over IPv4 tunneling driver
gre: GRE over IPv4 demultiplexor driver
ip_gre: GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
register_ip_conntrack_flush_cb
arp_tables: (C) 2002 David S. Miller
TCP: bic registered
TCP: cubic registered
TCP: westwood registered
TCP: htcp registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
sit: IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
8021q: 802.1Q VLAN Support v1.8
VFP support v0.3: implementor 41 architecture 1 part 20 variant b rev 5
aom memcpy(f4000000, d0434000, 6340): d=ea000009 s=f10e01d3
aom memcpy done
pll_delay=2000us wakeup_overhead=4241us
GDM PM Inited: SYS_GLB_CTRL=0020c344(wfds=976us)
moda_pm v3.0
[PM]DEBUG: GDM PM enabled(SYS_GLB_CTRL:0020c344)
MTD Crash partition /dev/mtd7
ipc mux irb nr(0->128) bsize(0->4128)
ipc ch[16]:MUX, irb_work: va=d4806a48, pa=d3882a48
irb nr: tx=2(4128bytes), rx=128(4128bytes)
m-ch_enabled: 0x10010001
uart port[0] fc=0 cr=0000002b
VFS: Mounted root (cramfs filesystem) readonly on device 31:10.
Freeing TCM link memory: 4K (d0436000 - d0437000)
Freeing unused kernel memory: 128K (d0380000 - d03a0000)
starting pid 32, tty '': '/etc_moda/init.d/rcS'
devpts: called with bogus options
Welcome to
______ ______
| \ / |
| \ / |
| \ / |
| \ / |
| \ / |
| \/ |
| |\ /| |
| | \ / | |
| | \ / | |
| | \ / | |
|_____| \__/ |_____|
M O D A C O M M U N I C A T I O N
MODACOM is a leading provider of next-generation
convergence terminal solution based on the technalogy
of Mobile WiMAX,mobile and next-generation internet
Starting modprobe arm1 product_id=0x0000 operator_id=0x0005
modem map info:
[0] pa(d4100000)->va(d5000000)
decompress at 0xd4100000... (3895820bytes)
decompress done(9358260bytes)
TK: knl_init_Imalloc: top d525d414 end d62ffff8 size 17443804
gipc-protocol address: d3880010
ipc config: 00000004
router-device
s-ch_enabled: 0x10010001
s-ch_enabled: 0x10010001
s-ch_enabled: 0x10010001
ipc magic=0x49504312(12)
Timer0: uncleared timer interrupt 000c0000
============================================================================
uT-Kernel R-11090 (branches / moda_n100_uqc-r6318)
----------------------------------------------------------------------------
- jeonjinh@jjhnb-ubuntu
- gcc version 4.5.2 (GCC)
- #15 Tue Mar 29 12:07:46 KST 2016
============================================================================
[MMU] VA:54000000 PA:D4000000 SZ:64MB ATTR:00001412
[MMU] 57FFFFFF PA:D7FFFFFF
[MMU] VA:FFF00000 PA:D4000000 SZ: 1MB ATTR:0000040E
[MMU] FFF00FFF PA:D4000FFF
[MMU] VA:FC000000 PA:FC000000 SZ:63MB ATTR:00000412
[MMU] FFEFFFFF PA:FFEFFFFF
[MMU] VA:D0000000 PA:D0000000 SZ:64MB ATTR:00000412
[MMU] D3FFFFFF PA:D3FFFFFF
[MMU] VA:F4000000 PA:F4000000 SZ: 1MB ATTR:00001412
[MMU] F4007FFF PA:F4007FFF
[MMU] VA:D4000000 PA:80000000 SZ: 1MB ATTR:00001402
[MMU] D4007FFF PA:80007FFF
[MMU] VA:80200000 PA:80200000 SZ: 1MB ATTR:00001412
[MMU] 80203FFF PA:80203FFF
[MMU] VA:D6400000 PA:D6400000 SZ:27MB ATTR:0000040A
[MMU] D7EFFFFF PA:D7EFFFFF
[MMU] VA:D7F00000 PA:D7F00000 SZ: 1MB ATTR:00001412
[MMU] D7FFFFFF PA:D7FFFFFF
[CPU] ARMv6-compatible [4117b365] revision 5 (ARMv6TEJ) cr=00c538fd
[CACHE] I cache: 32768 bytes 4-way 32 byte lines 256 sets
[CACHE] D cache: 32768 bytes 4-way 32 byte lines 256 sets
[CACHE] D cache: write-back cache
[VFP] implementor 41 arch 1 part 20 variant b rev 5
[TCM] ITCM0 32k moved to 80000000 and enabled
[TCM] ITCM code 30580(0x7774)bytes copied from d4105a60 to d4000000
[TCM] DTCM0 16k moved to 80200000 and enabled
[TCM] DTCM code 152(0x98)bytes copied from d410d1d4 to 80200000
[TCM] zero initialized 14148(0x3744)bytes at 80200098
[MEM] WT DRAM zero initialized 202448(197KB)bytes from d7df2720 to d7e23df0
[MEM] NCH DRAM zero initialized 0(0KB)bytes from d7f362a8 to d7f362a8
[CHIP] GDM7243M(Rev.0D)
[CLOCK] arm(400.000MHz) 1x(100.000MHz)
[PM] GDM Power Management
[MEM] total : 0xd4000000 - 0xd8000000 ( 64 MB)
[MEM] .init : 0xd4100000 - 0xd41109e0 ( 67 kB)
[MEM] .text : 0xd4100000 - 0xd49770b0 ( 8669 kB)
[MEM] .data : 0xd4978000 - 0xd49ecbb4 ( 467 kB)
[MEM] .bss : 0xd525d400 - 0xd6300000 (17035 kB)
########################################
#### 7243 Board Configuration ####
########################################
Operator: [0x0005]
Product : [0x0000]
## LTE SYS CONFIG
- LTE power saving : [1]
- LTE cip : [1]
## LTE CONFIG
- Combined attach : [0]
- SMS over SGS : [1]
- SMS over IMS : [0]
- UE CAPABILITY
> UE Category : [4]
> AS Rel Num : [1]
> FGI : FDD [00000000 00000000 00000000]
> : TDD [00000000 00000000 00000000]
> DRX : [1]
> AGAP : [0]
> ROHC : [1]
> eMBMS : [0]
> TM : [00/00/00]
[console] gdm_uart0 enabled
[console] gdm_ipc enabled
[console] netimizer enabled
----------------------------------------------------------------------------
LTE - FW ver: 0.2.63.5
----------------------------------------------------------------------------
----------------------------------------------------------------------------
WiMAX - Build data: 2016/02/11 16:13:22
----------------------------------------------------------------------------
ipc_init_dl_sdu_buffer done
DM> ipc_init_ul_sdu_buffer done
[NVM] nv_checksum_info: 0
[nv_conf:ConfSendRecv][nv]sendto failed rtn[-1] sun_path[/tmp/nv_conf_ipc_interface]
[nvmgr]== begining ===================
nand_block_bad_list
[nand_block_bad_list] ret[1],offset[0x6000000] list_cnt[0]
bad_block_cnt[1]
[nvmgr]Set WiMAX Interface MAC Address : 00:1D:93:54:F7:B4
[nvmgr]== init_system_value
[nv_conf:ConfSendRecv][nv]sendto failed rtn[-1] sun_path[/tmp/nv_conf_ipc_interface]
sysconf check
[nv_conf:ConfSendRecv][nv]sendto failed rtn[-1] sun_path[/tmp/nv_conf_ipc_interface]
mp_mode 0
mp checking: gpio[0] nvflag[0]
[nvmgr]init_mp_mode ==> 0
[nvmgr]== system_config_socket
sysconf check 1
VLANQ register lte0pdn0 tag=100 en=0
VLANQ register lte0pdn1 tag=101 en=0
VLANQ register lte0pdn2 tag=102 en=0
VLANQ register lte0pdn3 tag=103 en=0
ipc ch[1]:LTE-SDU, irb_work: va=d480c010, pa=d3888010
irb nr: tx=1024(1568bytes), rx=1024(1568bytes)
s-ch_enabled: 0x10010003
m-ch_enabled: 0x10010003
modprobe: module gdmtty not found in modules.dep
GCT mobile WiMax driver version 0.5
VLANQ register wimax tag=200 en=0
ipc ch[12]:WM-SDU, irb_work: va=d4805c28, pa=d3881c28
irb nr: tx=32(1568bytes), rx=64(1568bytes)
s-ch_enabled: 0x10011003
m-ch_enabled: 0x10011003
Fri Feb 14 00:00:00 UTC 2014
+[DEV]thread_exit_hibernation()
###[mirage] hb_exit
Trying to free nonexistent resource <000000000000060f-000000000000060f>
PORT[6] Bit[615] USIM_PRESENCE install success
proc_watchdog_mode 1
Watchdog MODE = 1
wan_connect_mode=0
LEDMAN_CTL_SET
Enable DNSMASQ IP=192.168.44.254, DOMAIN=mte.n101
# Run Applications
pszVal is GCT7243M
webs: Listening for HTTP requests at address 192.168.44.254
read current LTE parameter file from NV
mp_mode 0
mp checking: gpio[0] nvflag[0]
LTE Param File Read Succeeded
mp_mode 0
mp checking: gpio[0] nvflag[0]
Loading simple NAT configuration..
==[ Setting Firewall Done]==
Running UCM
/etc/init.d/S92NATQ: line 10: /proc/net/mnatq: No such file or directory
***************************************************************************
UCM : Unified CM Version 0.7.0.0
MODEL : MTE-N100, TARGET : UQC
Copyright (c) 2008-2013 MODA Co., Inc.
***************************************************************************
[UCM Configuration]
core->auto_conn_cfg.auto_connect=[1]
core->auto_conn_cfg.fail_delay_time=[1]
core->auto_conn_cfg.max_fail_cnt=[3]
core->auto_conn_cfg.max_fail_delay_time=[10]
core->auto_conn_cfg.reconn_signal_level=[1]
core->ignore_usim=[0]
core->enable_system_ho=[1]
core->scan_interval=[5000]
core->use_ho_lte_wimax=[0]
core->ooz_init_scan_interval=[100]
core->ooz_inter_rat_scan_interval=[1000]
core->ooz_intra_rat_scan_interval=[500]
core->ooz_scan_cycle_interval=[500]
core->state_handler.scan.pre=[/etc/sysconfig/script/ucm_scan_pre.sh]
core->state_handler.scan.post=[/etc/sysconfig/script/ucm_scan_post.sh]
core->state_handler.connecting.pre=[/etc/sysconfig/script/ucm_connecting_pre.sh]
core->state_handler.connecting.post=[/etc/sysconfig/script/ucm_connecting_post.sh]
core->state_handler.connected.on=[/etc/sysconfig/script/ucm_connected_on.sh]
core->state_handler.disconnect.pre=[/etc/sysconfig/script/ucm_disconnect_pre.sh]
core->state_handler.disconnect.post=[/etc/sysconfig/script/ucm_disconnect_post.sh]
device->wifi.pub.enable=[0]
device->wifi.pub.use_access=[0]
device->wifi.pub.priority=[1]
device->wifi.pub.conn_interval=[0]
device->lte.pub.enable=[1]
device->lte.pub.use_access=[1]
device->lte.pub.priority=[2]
device->lte.plmn_search_type=[1]
device->lte.timer_attach_timeout=[40]
device->lte.plmn_search_fail_count=[5]
device->lte.bg_scan_wimax_freq=[2610000,2600000,2620000]
device->lte.bg_scan_rsrp=[-119]
device->lte.bg_scan_sinr=[1]
device->lte.ho_srv_rsrp=[-140]
device->lte.ho_srv_sinr=[-10]
device->lte.ho_nbr_rssi=[-85]
device->lte.ho_nbr_cinr=[4]
device->lte.act_scan_rsrp=[-122]
device->lte.act_scan_sinr=[-3]
device->lte.act_scan_dur=[0]
device->lte.act_scan_int=[500]
device->lte.ho_trig_dur=[5000]
device->lte.act_scan_tmr=[0]
device->lte.act_scan_rpt_tmr=[0]
device->lte.ho_trig_dur_ooz=[5000]
device->wimax.pub.enable=[1]
device->wimax.pub.use_access=[1]
device->wimax.pub.priority=[3]
device->wimax.bg_scan_lte_earfcn=[41040,40842]
device->wimax.ho_nbr_rsrp=[-120]
device->wimax.ho_nbr_sinr=[2]
device->wimax.ho_trig_dur=[0]
device->wimax.scan_rssi=[10]
device->wimax.scan_cinr=[50]
device->wimax.ho_map_per=[100]
device->wimax.ho_harq_per=[100]
device->wimax.ho_per_dur=[0]
device->cdma.pub.enable=[0]
device->cdma.pub.use_access=[0]
device->cdma.pub.priority=[4]
device->cdma.pub.conn_interval=[0]
-------------------------------------------------------------
wan_connect_mode = 0
starting pid 1227, tty '/dev/ttyS0': '/bin/login'
MTE-N100 login: Fri Feb 14 09:00:20 system_mp_mode 0
Fri Feb 14 09:00:20 mode=2, ttygs0=0, ttygs1=0 ttdm0=0 ttydm1=0
Fri Feb 14 09:00:20 usb_tethering_ready_time 40
config->nai_control_char=[$$&#]
SDK INIT SCRIPT - [cfg pc max_pwr 25 pwr_lim 25;cfg harq mask 8;cfg sbc mod 0x15;cfg idle pag_cyc_req 1024;cfg idle start_TO 3;cfg ho opt |0x1000;cfg scn enable 0x49;]
[WiMAX SDKD Configuration]
name = wimax
driver = /usr/wimax/wimax -D
ctrl_iface = /var/tmp/wimax-ctrl-server
oma_mgmt_tree = /var/lte/param/motree.xml
mru = 0
scan_interval = 2
scan_type = 2
scan_nsp_idx = 0
pkm = ENABLE
eap = EAP-TTLS/CHAP
eap_fragment = 1265
alpha_delim = 0
ca_cert = /var/combined_ca.pem
client_cert = /var/device_cert.pem
private_key = NULL
dev_cert_null = 0
ca_cert_null = 0
use_xml = 1
sdk_dbg_on(PCAP Enable) = 0
-------------------------------------------------------------
[wimax] bentry delayed copy: b336(1)
using block : 1, 0x40000
using block : 1, 0x40000
using block : 0, 0x20000
NV init : GCT libnvm.so v1.2, 2015.09.21
NV init : GCT libnvm.so v1.2, 2015.09.21
NV init : GCT libnvm.so v1.2, 2015.09.21
NV init : GCT libnvm.so v1.2, 2015.09.21
NV init : GCT lnatq event=2 del_unreg_dev(wimax)
ibnvm.so v1.2, 2015.09.21
Magic is different!(0x43525442!=0x00000000)
NV read failed(0x101), size=-1
devl1_setup_wimax_rf(l1_init=0,cnt=0) start
ice cert open fail
NV init : GCT libnvm.so v1.2, 2015.09.21
Ml1_setup_wimax_rf end
agic is different!(0x43525453!=0x00000000)
NV read failed(0x102), size=-1
NV init : GCT libnvm.so v1.2, 2015.09.21
Magic is different!(0x43525453!=0x00000000)
NV read failed(0x103), size=-1
NV init : GCT libnvm.so v1.2, 2015.09.21
Magic is different!(0x43525453!=0x00000000)
NV read failed(0x104), size=-1
NV init : GCT libnvm.so v1.2, 2015.09.21
Magic is different!(0x4352544d!=0x00000000)
NV read failed(0x106), size=-1
NV init : GCT libnvm.so v1.2, 2015.09.21
NV init : GCT libnvm.so v1.2, 2015.09.21
NV init : GCT libnvm.so v1.2, 2015.09.21
NV init : GCT libnvm.so v1.2, 2015.09.21
/var/wimax/tree.xml.gz: No such file or directory
PC configuration:
mode = 1
ofs = 0
ni_ofs = 0
rng_ofs = 0.0
option = 0x121a
tx_hr = 15.5
sc_ofs = 0.0
max_pwr = 25.0
min_pwr = -54.0
pwr_lim = 25.0
scale = 0
margin = 0.0
mdm_ctrl = 4
DM> HARQ configuration:
enable = 3
mask = 8
ack_mask = 0x0
#UL = 9
#DL = 15
#burst = 0x41
chase_buf_cap = 0x565a
option(C,BR) = 0x1e35
DL_Delay = 3
UL_Delay = 5
map_category = 3
map_buf_skip = 31
post_limit = 20480
post_num = 30
drop_th = 48
DM> SBC configuration:
option = 0x0
mac_pdu = 0x1
SSTG = 0x3232
MAP_CAP = 0x6
UL_PWR_CTL = 0x1
DEMOD = 0x42d
MOD = 0x15
UL_CTL_CHAN = 0x6
MIMO_DEMOD = 0x3
MIMO_MOD = 0x140
PARAM_SET = 0x52
CINR_MEAS_CAP = 0x13
PERM_SUP = 0x8
FFT_SIZE = 24
MIN_FR_NR_SWITCH_PC = 1
EXT_CAP = 0x1
HO_TRIG_MTR = 0xb
CSIT_CAP = 0x4b9
HARQ_PDU_SN = 2 2
DM> IDLE configuration:
pag_int_len = 5
pag_cyc_req = 1024
ret_inf = 0x7f
mac_hash_skip_th = 0xff
ignore_to = 0
ignore_bs_chg = 1
ignore_trf = 0
start_TO = 60
wakeup_dur = 5 3 0 0
idle_timeout = 0
lu_mode = 0x1
refresh_ip = 0
option = 0x52d
resync = 3 -80 2
scn_dur = 3
min_pag = 4
mna_wait(sec) = 4
grace_time = 16
DM> IDLE configuration:
pag_int_len = 5
pag_cyc_req = 1024
ret_inf = 0x7f
mac_hash_skip_th = 0xff
ignore_to = 0
ignore_bs_chg = 1
ignore_trf = 0
start_TO = 3
wakeup_dur = 5 3 0 0
idle_timeout = 0
lu_mode = 0x1
refresh_ip = 0
option = 0x52d
resync = 3 -80 2
scn_dur = 3
min_pag = 4
mna_wait(sec) = 4
grace_time = 16
DM> HO configuration:
enable = 1
IC = 1
Th1 = 10
Th2 = 10
BCS_prd = 1
AVG_exp = 3
mode = 0
ZeroBR = 1
ZeroBRType = 1
TrigOpt = 0xf
TrigVal = 10.0
TrigDur = 200
TrigVal2 = -70.00
TrigDur2 = 200
IC_CTL = 0x22c000
HOID_EN = 0
DCD_TrigEN = 1
CINR_margin = 6
scn_dur = 4
Option = 0x571c
TrigInterval = 300
TimeFactor = 8
UC_trig(S,H,H) = -90 -100 3
MAP_PER(RNG,SYNC) = 0.5469 0.8438 0.1250
DM> SCN configuration:
enable = 0x49
CS = 0
interval = 300
srch_dur = 0 6
bcs_th = 2000
cell_time = 6
cell_iter = 3
srch_mtr = 0x0
srch_th = -65
scn_dur = 4
scn_intlv = 32
scn_iter = 0
scn_time_ofs = 0
afc_wait = 16
acx = 0
uc(dur,int) = 15 0
PER = 0.2500
DM> Unkown command ch!
DM> NV init : GCT libnvm.so v1.2, 2015.09.21
get_load_debug mode = 0
get_load_debug_level mode = 0
NV init : GCT libnvm.so v1.2, 2015.09.21
[lted] bentry delayed copy: b336(1)
[LTE Configuration]
conf->plmn_search_type=[1]
conf->psb_scan_req_count=[4]
conf->plmn_search_timeout=[30000]
conf->plmn_search_band_timeout=[5000]
conf->plmn_list_request_timeout=[60000]
conf->attach_optional_info=[1]
conf->attach_apn_name=[povo.jp]
conf->attach_pdn_type=[0]
conf->attach_auth=[1]
conf->attach_username=[povo@com]
conf->attach_password=[povo]
conf->attach_ip_alloc=[0]
conf->attach_username_control_char=[$$&#]
conf->attach_req_apn_type=[0]
conf->rsrp_sig_level1=[-120]
conf->rsrp_sig_level2=[-118]
conf->rsrp_sig_level3=[-115]
conf->rsrp_sig_level4=[-105]
conf->rssnr_sig_level1=[-30]
conf->rssnr_sig_level2=[-10]
conf->rssnr_sig_level3=[10]
conf->rssnr_sig_level4=[45]
conf->lte_asr_disable=[0]
conf->attach_reject_count=[1]
conf->rrc_reject_count=[5]
-------------------------------------------------------------
NV init : GCT libnvm.so v1.2, 2015.09.21
[NV_HCI] NV_CHECKSUM_IS_VALID
gif_to_ipc: delayed req 3335(2044)
gif_to_ipc: delayed req 3335(2044)
[NV_HCI] nv checksum is valid(0x79198e12/0x79198e12)
[NVM] Complete checking / default setting
[V_SIM]ProcNvBcfgData/gstVsimEnData:0
default tdm log level=0
nvUserPlmnSrchMode:0
user_plmn_id:ff ff ff
as_security:0
nas_security:0
READ CNF LPM_NV_FILENAME_SMS_CONFIG
nvRrcInactTimer:0
[IMEI]NV len:9
8 3a 25
[IMEI]gstLpmGlobalDb.imei.len:15
3 5 2 8
[SWVER] NV :0
DM> DM> L1_BandInformation:success(41)
ps_sys_init / UMM_Create
[UMM_InitC]Detect:gCtx.bInsertTmrCalled:0, gREG_UserNum:0
[V_SIM]eVSIM_Enabled:0
debug_map_add: en_cats=00000004
IMC : FGI(use:0) FDD:FE0DD898 00000018 00000000 / TDD:FE0DD880 00000000 00000000
L3_SetTransmissionMode5 0:0
L3_SetTransmissionMode5 0:0:0
L3_SetTransmissionMode7 0:0
L3_SetTransmissionMode7 1:1:11
L3_SetTransmissionMode8 0:0
L3_SetTransmissionMode8 1:1:11
[Agent]LAPI_UICC_ADDUSER_CNF
[G_IAC]Agent_PsInitReqHandler/enabledUiccInserted:0
[USIM DEBUG]COLD RESET failed!!!(2) USIM may have been removed.
[Agent] Rcv GMCM_HOST_UICC_NO_USIM_RE[nicky]>>G_IAC_Agent_Send_PS_Init_Rsp
Q
[UMM_HanldeUICCRemoval]
[NAS_EMMCache] NVM - MRU[num:1, 0x44f015, 41040, 0 ]
[NAS_EMMCache] NVM - T3346 Info [0, 0] Plmn(00:00:00)
LAPI_UICC_REMOVED_IND
[Agent]_UIcc_DeActivatedInd(0)
[UMM_InitC]Detect:gCtx.bInsertTmrCalled:0, gREG_UserNum:2
####[mirage] pm.pm_no_sleep = 1
lted: pm_no_sleepable=1
NV init : GCT libnvm.so v1.2, 2015.09.21
####[mirage] pm.pm_no_sleep = 0
lted: pm_no_sleepable=0
SMSMGR : bSmsFormat(3GPP)
LTE No UICC
LTE Script []
[lte_wimax_bg_scan_ind] type=0
TK: TLV:length:13
[Agent]bSaveNV: 0
e6 d d8 98
[LPM]bSaveNV_Flag:0
e6 d d8 98
FGI Data is saved in RRC DB and NV
Set Attach Retry Count (1), RRC Connection Retry Count (5)
[Agent]_RRC_Capa_Control_CnfHandler/ Type:5
lte_set_info_handler: attach/rrc [1/5]
NV init : GCT libnvm.so v1.2, 2015.09.21
WiMAX API version 1.2
---------[WiMAX Configuration]---------------------------
CONNECT TYPE = BEST
SELECT_POLICY = ALL
DHCP : AUTO_DHCP = 1
DHCP : IP Wait Time = 30 sec
DHCP : dhcp_client = /sbin/udhcpc
DHCP : dhcp options = -i wimax -H MTE-N101 -s /usr/sbin/default.script
WIMAX NETWORK MODE = nat
-------------------------------------------------------------
dm_log_reset in case of ucm state off
GDM_PM_SLEEP_WIBRO_OFF
wmx_irat_modem_up_req
wb_rf_afe_pwdn(0)
GDM_PM_SLEEP_WIBRO_OFF
wmx_irat_modem_up_proc
l1_setup_wimax_rf(l1_init=1,cnt=4) start
GRF7243 Init.... OP Mode = 0
BGR E-FUSE Mode Enable (3)
ADC dcc : main = 0x040064ce, div = 0x0404045e
ADC DC Power-On Cal : ResDCm_I = 0, ResDCm_Q = 3, ResDCd_I = 1, ResDCd_Q = 0
Final Cal Tx pwr = 19681832
Final Cal Tx pwr = 19327402
BW IQCAL1 5M[4][0]= 0xfb00fc
BW IQCAL1 10M[4][1]= 0xff00fd
BW IQCAL1 15M[4][2]= 0x200fd
BW IQCAL1 20M[4][3]= 0xf100fc
Rximb_BW[vport4][bw 5][M] = 0xc6feff3, Rximb_BW[vport4][bw 5][D] = 0xc6fd043
Rximb_BW[vport4][bw10][M] = 0xc6fefd3, Rximb_BW[vport4][bw10][D] = 0xc6fdfb3
Rximb_BW[vport4][bw15][M] = 0xc6fef63, Rximb_BW[vport4][bw15][D] = 0xc6fef63
Rximb_BW[vport4][bw20][M] = 0xc6ffff3, Rximb_BW[vport4][bw20][D] = 0xc6fdfc3
-Power On Cal Report-
vP:0 No NV data
vP:1 No NV data
vP:2 No NV data
vP:3 No NV data
vP:4, pP:4 [L T E] TxCL=0xa8ffe806, TxSSB=0x00f100fc, Rximb_M=0x0c6ffff3, Rximb_D=0x0c6fdfc3
[Wimax] TXCL=0xa8ffd807, TxSSB_p=0x01d2e44, TxSSB_g=0x8, Rximb_M=0x0c6ff003, Rximb_D=0x0c6fd003
vP:5 No NV data
vP:6 No NV data
vP:7 No NV data
l1_setup_wimax_rf end
wbi_grafe_init - called
chip info : GDM7243R1BV1
wmx_irat_mode0(irat_state=0)
wb_rf_afe_pwdn(1)
wmx_irat_cnf0(irat_state=1)
[UCM STATE]Enter UCM_STATE_TOP
[UCM STATE]Enter UCM_STATE_INIT
ucm_dispatch_uci: UCI not handled 0x8014
[Data] len=5
80 14 00 01 01
ucm_dispatch_uci: UCI not handled 0x8017
[Data] len=4
80 17 00 00
DM LOG RESPONSE FAILED(DEV_IDX(1))
mp_mode 0
mp checking: gpio[0] nvflag[0]
USIM Check Error : ucm.usim_status is USIM_DEACTIVATE
[UCM STATE]Enter UCM_STATE_OFF
wb_irat_modem_dn(irat_state=1)
[WIMAX] Radio OFF Done.
Switch Off Detach cnf: Do Polling OFF
[LTE] Radio OFF Done.
GDM_PM_SLEEP_WIBRO_ON
ucm_dispatch_uci: UCI not handled 0x8009
[Data] len=5
80 09 00 01 02
ucm_dispatch_uci: UCI not handled 0x8014
[Data] len=5
80 14 00 01 00
Fri Feb 14 09:00:30 [usb_ether_rndis_enter] cmd = modprobe g_ether mode=rndis ttygs0=0 ttygs1=0 ttydm0=0 ttydm1=0 iSerialNumber=001d93ffff01 host_addr=00:1d:93:ff:ff:01 dev_addr=00:1d:93:ff:ff:02
Fri Feb 14 09:00:30 ether-rndis: modprobe g_ether mode=rndis ttygs0=0 ttygs1=0 ttydm0=0 ttydm1=0 iSerialNumber=001d93ffff01 host_addr=00:1d:93:ff:ff:01 dev_addr=00:1d:93:ff:ff:02
usb0: MAC 00:1d:93:ff:ff:02
usb0: HOST MAC 00:1d:93:ff:ff:01
EOU_RTC_TIMER enabled!
g_ether gadget: mode - rndis
g_ether gadget: Multifunction Composite Gadget, version: Memorial Day 2008
g_ether gadget: USB VID 1076
g_ether gadget: USB PID 9082
g_ether gadget: USB SERIAL 00000003
g_ether gadget: g_ether ready
UDC: gdm_udc_start: g_ether
UDC: gdm_udc_enable
UDC: udc->base: fc005200
UDC: sys_clk_mhz: 200
IPv6: ADDRCONF(NETDEV_UP): usb0: link is not ready
Fri Feb 14 09:00:30 ether-rndis(192776) timer created
Fri Feb 14 09:00:30 ether-rndis: starting
device usb0 entered promiscuous mode
Fri Feb 14 09:00:30 ether-rndis (gadget=g_ether): 'DEFAULT' -> 'ADDRESS'
UDC version 9 at 0xfc005200 irq=24 tranceiver=UTMI level 0
state=ADDRESS address=2 speed=high gadget=g_ether
Fri Feb 14 09:00:30 usb_tethering_mode_change_timeout 5
Fri Feb 14 09:00:30 get_tethering_timeout: 5
Fri Feb 14 09:00:30 usb_tethering_mode_change_timeout 5
Fri Feb 14 09:00:30 ether-rndis: addressed, setting timeout (5)
Fri Feb 14 09:00:30 ether-rndis(192776) timer started : 5 (secs) / 0 (secs)
g_ether gadget: high-speed config #2: RNDIS
br0: port 1(usb0) entered forwarding state
br0: port 1(usb0) entered forwarding state
Fri Feb 14 09:00:30 ether-rndis (gadget=g_ether): 'ADDRESS' -> 'CONFIGURED'
RNDIS multi_pkt_tx_size: host=2048 nv=0 actual=2048
UDC version 9 at 0xfc005200 irq=24 tranceiver=UTMI level 0
state=CONFIGURED address=2 speed=high gadget=g_ether
ep0 : maxpacket=64 type=control(IN) address=00
fifo=0xd3aa6600 (64)
config=00400001 control=00400021 status=00000000
irq=38, transfer=34, bytes=600, err=0
qlen=0 interval=0 (min=0 max=31)
ep1 : maxpacket=512 type=bulk(IN) address=01
fifo=0x00000000 (32768)
config=02008149 control=00000000 status=00000000
irq=0, transfer=0, bytes=0, err=0
qlen=0 interval=0 (min=2147483647 max=0)
ep2 : maxpacket=512 type=bulk(OUT) address=02
fifo=0xd2ee0004 (21216)
config=02000249 control=52e00001 status=00000000
irq=0, transfer=0, bytes=0, err=0
qlen=10 interval=0 (min=2147483647 max=0)
ep3 : maxpacket=8 type=interrupt(IN) address=03
fifo=0x00000000 (32768)
config=00088345 control=00080001 status=00000000
irq=0, transfer=0, bytes=0, err=0
qlen=1 interval=0 (min=2147483647 max=0)
Fri Feb 14 09:00:32 ether-rndis (gadget=g_ether): 'CONFIGURED' -> 'CONFIGURED'
usb0 set host mac: 00:1d:93:ff:ff:01
UDC version 9 at 0xfc005200 irq=24 tranceiver=UTMI level 0
state=CONFIGURED address=2 speed=high gadget=g_ether
ep0 : maxpacket=64 type=control(OUT) address=00
fifo=0xd3aa6600 (64)
config=00400001 control=00400021 status=00000000
irq=42, transfer=38, bytes=656, err=0
qlen=0 interval=0 (min=0 max=31)
ep1 : maxpacket=512 type=bulk(IN) address=01
fifo=0x00000000 (32768)
config=02008149 control=00720020 status=00000421
irq=2, transfer=2, bytes=236, err=0
qlen=0 interval=882418 (min=882418 max=1882571)
ep2 : maxpacket=512 type=bulk(OUT) address=02
fifo=0xd2ee8004 (21216)
config=02000249 control=52e00081 status=00860201
irq=1, transfer=1, bytes=134, err=0
qlen=10 interval=2272487 (min=2272487 max=2272487)
ep3 : maxpacket=8 type=interrupt(IN) address=03
fifo=0x00000000 (32768)
config=00088345 control=00080001 status=00000000
irq=0, transfer=0, bytes=0, err=0
qlen=1 interval=0 (min=2147483647 max=0)
Fri Feb 14 09:00:32 ether-rndis: configured, resetting timeout
Fri Feb 14 09:00:32 ether-rndis(192776) timer stopped
Fri Feb 14 09:00:32 ether-rndis(192776) timer started : 1 (secs) / 1 (secs)
[noti : send_notification] start
[noti : load_nv_data] start
[noti : load_nv_data] serv_addr = 192.168.44.20
[noti : load_nv_data] port = 18808
[noti : load_nv_data] noti_server_avaliable = 0
[noti : load_nv_data] timeout = 3000
[noti : load_nv_data] retry_cnt = 3
[noti : load_nv_data] end
Fri Feb 14 09:00:33 usb_tethering_mode_change_timeout 5
Fri Feb 14 09:00:33 get_tethering_timeout: 5
Fri Feb 14 09:00:33 usb_tethering_mode_change_timeout 5
Fri Feb 14 09:00:33 check_gadget_udc_status_error
Fri Feb 14 09:00:34 all status of ep [0]
brctl: bridge br0: Device or resource busy
Fri Feb 14 09:00:34 ether-rndis(192776) timer stopped
Fri Feb 14 09:00:34 ether-rndis: usb_mode.sh mbim off
Working MBIM off
kill siralupdater
No processes
kill mibim
No processes
Fri Feb 14 09:00:34 ether-rndis: usb_mode.sh rndis on
start rndis on
netifq_enabled=0
/usr/lte/lteatcm -d
Fri Feb 14 09:00:34 ether-rndis: carrier on (flags=0x1043)
[noti: send_recv][app: goahead] recvfrom failed 11,msg Resource temporarily unavailable
[noti: send_recv][app: goahead] Oops recverror
[noti : send_notification] server available 0,recv result noti fail
[noti: noti_close_socket][app: goahead] close socket start
[noti: noti_close_socket][app: goahead] close socket success
[noti : send_notification] end ret 0
[noti : send_notification] start
[noti : load_nv_data] start
[noti : load_nv_data] serv_addr = 192.168.44.20
[noti : load_nv_data] port = 18808
[noti : load_nv_data] noti_server_avaliable = 0
[noti : load_nv_data] timeout = 3000
[noti : load_nv_data] retry_cnt = 3
[noti : load_nv_data] end
[noti: send_recv][app: goahead] recvfrom failed 11,msg Resource temporarily unavailable
[noti: send_recv][app: goahead] Oops recverror
[noti : send_notification] server available 0,recv result noti fail
[noti: noti_close_socket][app: goahead] close socket start
[noti: noti_close_socket][app: goahead] close socket success
[noti : send_notification] end ret 0
Attach Params Read Succeeded
br0: port 1(usb0) entered forwarding stateU-Boot
U-Boot 2010.09 (Dec 15 2015 - 17:35:55)GCT GDM7243
U-Boot MODA Version 1.0.0.1
U-Boot GCT Version 0.7
DRAM: 128 MiB (wbd)
DDR: id=8(Winbond) rev=0,0
NAND: ECC 1bit
maf_id : 0x00000098, dev_id : 0x000000f1
Pagesize : 2Kbytes
Address cycle : 4
Ecc : 1bit(size : c, addr : 834)
128 MiB
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
nand_read_bbt: Bad block at 0x000006000000
==== Master 1st Image ====
Board Rev 1.1
Chip ID:GDM72430000 R0D, HW Reset occured.
Hit ENTER key to stop autoboot: 0
N100> help
? - alias for 'help'
askenv - get environment variables from stdin
base - print or set address offset
bootm - boot application image from memory
chpart - change active partition
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
ddri - Print DDR information
dualboot- [MODA]Selection First or Second image booting
fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
go - start application at address 'addr'
help - print command description/usage
image - GDM7243 Toggle Image selection
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
ls - list files in a directory (default /)
md - memory display
mm - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtest - simple RAM read/write test
mw - memory write (fill)
mwx - memory write (incremental fill)
nand - NAND sub-system
nand_test- GDM7243 NAND Verify Test
nboot - boot from NAND device
nm - memory modify (constant address)
printenv- print environment variables
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
suspend - CPU suspend
version - print monitor version
N100> printenv
bootdelay=0
baudrate=460800
nand0=gdm7243
mtdparts=mtdparts=gdm7243:512k(u-boot),512k(env),1m(rev0),1m(ltenv),1m(wmnv),1m(cmnnv),1m(cmnnv2),4m(rev1),4m(linux),4m(linux2),20m(rootfs),20m(rootfs2),1m(lteparam),1m(reserve1),1m(lteparam2),1m(eapparam),1m(devparam),1m(combparam),1m(nvparam),1m(nvparam2),1m(eapparam2),1m(devparam2),1m(combparam2),1m(xmlparam),1m(xmlparam2),4m(linux3),20m(rootfs3),1m(reserve2),1m(reserve3),2m(datausages),2m(datausages2)
kernel_exec_addr=0xd05fffc0
kernel_load_addr=0xd0600000
file_load_addr=0xd0008000
cleanenv=nand erase.part env
linuxdn=loady ${kernel_load_addr}
imagedn=loady ${file_load_addr}
linuxsave=nand erase.part linux;nand write ${kernel_load_addr} linux ${filesize}
rootfssave=nand erase.part rootfs;nand write ${file_load_addr} rootfs ${filesize}
linux2save=nand erase.part linux2;nand write ${kernel_load_addr} linux2 ${filesize}
rootfs2save=nand erase.part rootfs2;nand write ${file_load_addr} rootfs2 ${filesize}
linux3save=nand erase.part linux3;nand write ${kernel_load_addr} linux3 ${filesize}
rootfs3save=nand erase.part rootfs3;nand write ${file_load_addr} rootfs3 ${filesize}
bootsave=nand erase.part u-boot;nand write ${file_load_addr} u-boot ${filesize}
bswoecc=nand erase.part u-boot;nand write.woecc ${file_load_addr} u-boot ${filesize}
setbootargs=set bootargs console=ttyS0,${baudrate} mem=64M root=/dev/${dual_rootfs} rootfstype=cramfs ${mtdparts}
bootcmd=run setbootargs;nand read ${kernel_exec_addr} ${dual_linux};bootm ${kernel_exec_addr}
dual_linux=linux
dual_rootfs=mtdblock10
dualimage_num=1
master_img_ver=1.3.8.1
slave_img_ver=1.3.8.1
emergency_img_ver=0.0.0.1
emergency_linux=linux3
emergency_rootfs=mtdblock26
emergency_num=0
ebt_threshold=1
uboot_ver=1.0.0.1
Hardware_ver=1.0.D.0
stdin=serial
stdout=serial
stderr=serial
Environment size: 1792/131068 bytes