ZTE ZXHN H367A

From WikiDevi.Wi-Cat.RU
Jump to navigation Jump to search

ZTE ZXHN H367A (V1.0)
Availability: now

Country of manuf.: China
Series: AC1600

Type: wireless router, dsl modem, analog phone gateway

Power: 12 VDC, 2 A
Connector type: barrel

CPU1: EcoNet EN7513G (900 MHz)
FLA1: 128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (Winbond W25N01GVZE1G)
RAM1: 256 MiB268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br /> (SK hynix H5TQ2G63GFR)

Expansion IFs: USB 2.0
USB ports: 1
Serial: yes, 4-pin header, internal

WI1 chip1: Atheros AR9381
WI1 802dot11 protocols: bgn
WI1 MIMO config: 2x2:2
WI1 antenna connector: none
WI2 chip1: Qualcomm Atheros QCA9880
WI2 802dot11 protocols: an+ac
WI2 MIMO config: 3x3:3
WI2 antenna connector: none

ETH chip1: EcoNet EN7513G
Switch: EcoNet EN7513G
LAN speed: 1GbE
LAN ports: 4
WAN speed: 1GbE
WAN ports: 1

abgn+ac

Flags: ADSL2+, VDSL, VoIP

Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1304 additional devices
of which 10 are ZTE devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1326 additional devices
of which 8 are ZTE devices

802dot11 OUI: 8C:DC:02
Ethernet OUI: 8C:DC:02

For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.
For a list of all currently documented EcoNet (MediaTek) SoC's with specifications, see EcoNet (MediaTek).
For a list of all currently documented Qualcomm Atheros (QCA) chipsets with specifications, see Qualcomm Atheros.

Wireless Router - Home Gateway

Support page

Specifications

  • Wi-Fi: AC1600, 2.4GHz (300Mbps), 5GHz (1300Mbps)

Models

ZTE • Vodafone
MasMovil • 2016 (14:60:80, 70:9F:2D, 74:B5:7E)
FCC ID: Q78-ZXHNH267N (2017-05-11)
MasMovil • 2016 (00:4A:77, 64:13:6C, 8C:68:C8)
FCC ID: Q78-ZXHNH268A (2016-06-30) (AC1600)
Digi (DIGIFIBRA) • 2018 (44:FF:BA, 2C:95:7F) (AC1200)
Broadcom BCM63168, 128MB, 2x 16MB, Realtek RTL8367RB
MasMovil • 2018 (00:4A:77, 44:FF:BA, 8C:E1:17)
FCC ID: Q78-ZXHNF680V6 (2019-11-04) - GPON ONT
FCC ID: Q78-ZXHNF680V5 (2019-11-01) - GPON ONT

Images

External

  • Case front

  • Case side

  • Case back

Internal

  • Board top

  • Wi-Fi 2.4GHz

  • Wi-Fi 5GHz

  • Wi-Fi Amp

  • Board bottom

  • Flash chip

  • Power chip

  • Serial port

Serial

Flash layout

Offset size Description
0x0000000 0x7000000 Wholeflash
0x0000000 0x0040000 Bootloader
0x0040000 0x0020000 wifi
0x0060000 0x0040000 tag
0x00a0000 0x0160000 config
0x0200000 0x0400000 kernel1
0x0600000 0x1400000 rootfs1
0x1a00000 0x0400000 kernel2
0x1e00000 0x1400000 rootfs2

Flash backup: h367a-flash-backup.tar.gz

Bootloader Recovery mode

We can enter into the bootloader recovery mode:

  1. Set a static IP on your computer, use 192.168.1.35 (or any compatible),
    and connect the ethernet cable to the router.
  2. Power off the device (unplug the PSU)
  3. Push down Reset and WPS buttons at the same time
  4. Power on the device
  5. Wait 5 seconds or more
  6. Release the buttons
  7. Browse to http://192.168.1.254, you should see this screen:

H367A-bootloader-web.png

Telnet

The router has its own CLI accesible via telnet. The credentials are admin

and the serial number found on the sticker at the back of the casing. E.g:
  • user: admin
  • password: ZTEEG8UL5K09012 (sticker at the back of the router)
$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.

          ************************************************************
                          Welcome to the world of CLI !
          ************************************************************
Username:admin
Password:
CLI>enable
Password:

The password for entering into a semi-privileged mode is zte

 • CLI 
CLI#?
Exec commands:
  configure       Enter configuration mode.
  disable         Exit from privilege mode.
  exit            Quit from telnet.
  ping            Ping the destination.
  reboot          Reboot device.
  restoredefault  Reset to factory configuration.
  save            Save function.
CLI#configure ?
  terminal  Enter configuration mode.
CLI#configure terminal
Enter configuration commands, one per line.  End with 'Exit'.
CLI(config)#?
Configure commands:
  exit  Exit from configure mode.
  set   Set configuration.
  show  Show configuration.
  wlan  Wlan configuration.
CLI(config)#set ?
  igmp   Set IGMP configuration.
  log    Set log redirect configuration
  route  Set route configuration.
  tr069  Set tr-069 configuration.
  wi-fi  Set wi-fi configuration.
CLI(config)#show ?
  arp       Show arp information.
  cpu       Show CPU usage rates.
  ifconfig  Show ifconfig information.
  iptables  Show iptables information.
  memory    Show memory information.
  nattable  nat
  route     Show route information.
  sysinfo   Show system information.
  tr069     Show tr069 configuration.
  wan       Show WAN information.
  wi-fi     Show wi-fi information.
CLI(config)#

Command injection

There is a possibility to inject commands via web interface using

the URL Filter field at Internet -> Security section
H367a-com injection.png

Note that here we use a custom script located at the var directory because apparently the scripts

at the usb flash drives under the /mnt directory can't be executed. We can write files to /var using a popular samba server bug.

Serial port

The stock firmware requires unknown credentials for entering into the serial port console.

This is is the /etc/shadow file content:
 • console 
Root:nN7ALIDilSRE6:12086::99999::::
bin:*:12084:0:99999:7:::
daemon:*:12084:0:99999:7:::
adm:*:12084:0:99999:7:::
lp:*:12084:0:99999:7:::
sync:*:12084:0:99999:7:::
shutdown:*:12084:0:99999:7:::
halt:*:12084:0:99999:7:::
uucp:*:12084:0:99999:7:::
ftp:*:12084:0:99999:7:::
nobody:*:12084:0:99999:7:::
ntp:!!:12084:0:99999:7:::
sshd:!!:12084:0:99999:7:::
named:!!:12084:0:99999:7:::
gdm:!!:12084:0:99999:7:::
sathesh:TJ06VabosxcTg:12086::99999::::
trainee:$1$mtjRWsdG$JOSdnKQhULmqnVajxi7LQ0:12364:0:99999:7:::

Therefore these are the credentials:

  • user: Root
  • password: nN7ALIDilSRE6 (encrypted, DES)

The password needs to be cracked using brute force. But if we delete the password from

the shadow file, we can enter into the serial console CLI only entering the user:
 • login 
H367AV1.0 
login: Root
Jan  2 20:32:49 login[1368]: root login on 'ttyS0'

BusyBox v1.17.2 (2018-01-02 18:50:09 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# help
Built-in commands:
------------------
        . : [ [[ alias break cd chdir continue echo eval exec exit export
        false hash help local printf pwd read readonly return set shift
        source test times trap true type ulimit umask unalias unset wait

The busybox commands are quite limited. However there are more commands available,

but for some reason they don't return anything visible.

We can workaround this issue using the echo command, e.g:

 • cpu info 
# cat /proc/cpuinfo
                                                                                                         
# echo "$(cat /proc/cpuinfo)"
system type             : EcoNet EN751221 SOC
processor               : 0
cpu model               : MIPS 34Kc V5.8
BogoMIPS                : 598.01
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 1
cpu model               : (null) V5.8
BogoMIPS                : 448.92
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 2
cpu model               : (null) V5.8
BogoMIPS                : 448.92
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 3
cpu model               : (null) V5.8
BogoMIPS                : 448.92
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

# mount
# echo "$(mount)"
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
none on /sys type sysfs (rw,relatime)
tmpfs on /var type tmpfs (rw,relatime,size=20480k)
tmpfs on /tmp type tmpfs (rw,relatime,size=12288k)
tmpfs on /mnt type tmpfs (rw,relatime,size=16k)
none on /proc/bus/usb type usbfs (rw,relatime)
/dev/sda on /mnt/usb1_1 type fuseblk (rw,relatime,user_id=0,
 group_id=0,default_permissions,allow_other,blksize=4096)
tmpfs on /etc type tmpfs (rw,relatime,size=20480k)
tmpfs on /dev type tmpfs (rw,relatime,size=20480k)

Bootloader

We can break into the Bootloader command line by pressing

the key 1 while starting up the device.

There are some commands available for unbricking the device:

 • bootloader 
H367AV1.0 
login: BGA IC
Xtal:1
DDR3 init.
DRAMC init done. 
Calculate size.
DRAM size=256MB
Set new TRFC.
ddr-1066

7512DRAMC V1.2.2 (0)
Set SPI Flash Clock to 25 Mhz
Memory size 256MB
Set SPI Flash Clock to 25 Mhz
spi_nand_probe: mfr_id=0xef, dev_id=0xaa
Dected SPI NAND Flash : _SPI_NAND_DEVICE_ID_W25N01G, Flash Size=0x8000000
bmt pool size: 81 
BMT & BBT Init Success 

board ip address:192.168.1.254
no_pci_found error case

*** Press 1 means entering boot mode***
*** Press 2 means entering testing mode***
*** Press 3 means entering norm mode***

Entering boot mode ...

******start httpd******

PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
PBUF_POOL_BUFSIZE = 256
memtop = 80020000
zteboot_cmdline_init
bldr> ?
                                                                              
?                                   Print out help messages.                  
help                                Print out help messages.                  
go                                  Booting the linux kernel.                 
decomp                              Decompress kernel image to ram.           
memrl <addr>                        Read a word from addr.                    
memrls <addr_start> <addr_end>      Read some regs addr.                      
memwl <addr> <value>                Write a word to addr.                     
dump <addr> <len>                   Dump memory content.                      
jump <addr>                         Jump to addr.                             
flash <dst> <src> <len> <oob>       Write to flash from src to dst(oob: write nand oob if 1).
erase <addr> <len>                  Erase flash from addr.                    
readflash <raddr> <faddr> <len>     read flash from flashaddr to ramaddr.     
imginfo                             Show images info.                         
bdstore <flash dst> <bin src>       Do backdoor config store                  
bdshow                              Show backdoor config                      
bdswitch[1|0]                       Enable or disable backdoor function       
ddrcalswitch[1|0]                   Enable or disable ddr calibration funciton 
drambistswitch[0|1|2]               disable or enable, and quick or normal test 
xmdm <addr> <len>                   Xmodem receive to addr.                   
miir <phyaddr> <reg>                Read ethernet phy reg.                    
miiw <phyaddr> <reg> <value>        Write ethernet phy reg.                   
cpufreq <freq num> / <m> <n>        Set CPU Freq <156~450>(freq has to be multiple of 6)
ipaddr <ip addr>                    Change modem's IP.                        
httpd                               Start Web Server                          
ddrdrv <..>                         Change DDR driving length                 
reset                               reset the system                          
upgrade <ip addr> <filename>        upgrade version                           
runemt                              run emt mode                              
bldr>

Boot log

 • boot log 
BGA IC
Xtal:1
DDR3 init.
DRAMC init done. 
Calculate size.
DRAM size=256MB
Set new TRFC.
ddr-1066

7512DRAMC V1.2.2 (0)
Set SPI Flash Clock to 25 Mhz
Memory size 256MB
Set SPI Flash Clock to 25 Mhz
spi_nand_probe: mfr_id=0xef, dev_id=0xaa
Dected SPI NAND Flash : _SPI_NAND_DEVICE_ID_W25N01G, Flash Size=0x8000000
bmt pool size: 81 
BMT & BBT Init Success 

board ip address:192.168.1.254
no_pci_found error case

*** Press 1 means entering boot mode***
*** Press 2 means entering testing mode***
*** Press 3 means entering norm mode***
.......................................
Found image at 0x00200000
Found image at 0x01a00000
****Try the first image...
decompress_addr 200100 decompress_addr_end 373e04 
Decompress to 80002000 free_mem_ptr=80600000 free_mem_ptr_end=80780000
75xx: 0x0
Uncompressing [LZMA] ...  done.
Linux version 2.6.36 (xialei@localhost.localdomain) (gcc version 4.3.6 
 (Buildroot 2012.05) ) #1 SMP Tue Jan 2 18:49:54 CST 2018
ISPRAM0: PA=00340000,Size=00010000,enabled
Check boot para cksum...
aca acaboot para cksum OK!
Boot 1'th image
bootPara.runmode=3
pdt_verinfo_init: tcVerInfo->RunMode[3]
bootPara.bootWhichImg=1
bootPara.img_info_tbl[0].flashOffset=0x  200000
hw_ver=00
sHardVersion=V1.0.00
memsize:256MB
EcoNet EN751221 SOC prom init
bootconsole [early0] enabled
CPU revision is: 00019558 (MIPS 34Kc)
Determined physical RAM map:
 memory: 0ffe0000 @ 00020000 (usable)
Wasting 1024 bytes for tracking 32 unused pages
Zone PFN ranges:
  Normal   0x00000020 -> 0x00010000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000020 -> 0x00010000
3 available secondary CPU TC(s)
PERCPU: Embedded 7 pages/cpu @81203000 s7232 r8192 d13248 u65536
pcpu-alloc: s7232 r8192 d13248 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 64992
Kernel command line:  es=1
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00037732
Readback ErrCtl register=00037732
nmi base is 81274200
Memory: 253624k/262016k available (3384k kernel code, 8392k reserved, 937k data, 232k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:64
CPU frequency 900.00 MHz
 Using 199.996 MHz high precision timer.
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Calibrating delay loop... 598.01 BogoMIPS (lpj=2990080)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
34K sync es set to 1.
Config7: 0x80080500
Limit of 4 TCs set
TLB of 64 entry pairs shared by 2 VPEs
VPE 0: TC 0 1 2, VPE 1: TC 3
IPI buffer pool of 16 buffers
CPU revision is: 00019558 ((null))
TC 1 going on-line as CPU 1
CPU revision is: 00019558 ((null))
TC 2 going on-line as CPU 2
CPU revision is: 00019558 ((null))
TC 3 going on-line as CPU 3
Brought up 4 CPUs
NET: Registered protocol family 16
11930:22:53 [KMONITOR][Notice] [monitor.c(938)MonitorInit]  cspmonitor init... !  
MT7512_pcie_init
check pcie link up status: 
isRC0_LINKUP=1 
isRC1_LINKUP=1 
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
pci 0000:00:01.0: BAR 8: assigned [mem 0x20100000-0x203fffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x2001ffff 64bit]
pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x2001ffff 64bit] (PCI address [0x20000000-0x2001ffff]
pci 0000:01:00.0: BAR 6: assigned [mem 0x20020000-0x2002ffff pref]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0:   bridge window [io  disabled]
pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
pci 0000:00:00.0:   bridge window [mem pref disabled]
pci 0000:02:00.0: BAR 0: assigned [mem 0x20200000-0x203fffff 64bit]
pci 0000:02:00.0: BAR 0: set to [mem 0x20200000-0x203fffff 64bit] (PCI address [0x20200000-0x203fffff]
pci 0000:02:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
pci 0000:00:01.0: PCI bridge to [bus 02-02]
pci 0000:00:01.0:   bridge window [io  disabled]
pci 0000:00:01.0:   bridge window [mem 0x20100000-0x203fffff]
pci 0000:00:01.0:   bridge window [mem pref disabled]
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
NET: Registered protocol family 8
NET: Registered protocol family 20
11930:22:54 [KQOS][Info] [qos.c(4999)CSPKernel_QoS_I] Qos module init
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP: reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1

 mt7512_pcie_fixup: 0x1438 = 20000014 
 mt7512_pcie_fixup: 0x3438 = 20100016 
 mt7512_pcie_rc1_retrain: 70 = 00036c11 80 = 01608c12
TC3162 hardware watchdog module loaded.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 495
cryptomgr_test used greatest stack depth: 15632 bytes left
cryptomgr_test used greatest stack depth: 15496 bytes left
cryptomgr_test used greatest stack depth: 15472 bytes left
io scheduler noop registered (default)
##WF watchdog inited!
ttyS0 at I/O 0xbfbf0003 (irq = 1) is a TC3162
ttyS20 at I/O 0xbfbf0303 (irq = 17) is a TC3162
brd: module loaded
IS_SPIFLASH=0x0, IS_NANDFLASH=0x2, (0xBFA10114)=0x6)
SPI_NAND_Flash_init: before init, mtx_mode_tog=0xl9, manaul_en=0x1
spi_nand_probe: mfr_id=0xef, dev_id=0xaa
Dected SPI NAND Flash : _SPI_NAND_DEVICE_ID_W25N01G, Flash Size=0x8000000
spi nand flash
tc3162: flash device 0x01000000 at 0x1c000000
EN7512 mtd init: spi nand probe enter
[spi_nand_setup] : Enter 
NAND device: Manufacturer ID: 0xef, Chip ID: 0xaa (Unknown _SPI_NAND_DEVICE_ID_W25N01G)
nand_scan_ident ok
[spi_nand_setup]: chip size =  0x8000000, erase_shift=0x11
calc_bmt_pool_size : need_valid_block_num=0x51, total_block=0x400
bmt pool size: 81 
BMT & BBT Init Success 
Creating 9 MTD partitions on "EN7512-SPI_NAND":
0x000000000000-0x000007000000 : "Wholeflash"
0x000000000000-0x000000040000 : "Bootloader"
0x000000040000-0x000000060000 : "wifi"
0x000000060000-0x0000000a0000 : "tag"
0x0000000a0000-0x000000200000 : "config"
0x000000200000-0x000000600000 : "kernel1"
0x000000600000-0x000001a00000 : "rootfs1"
0x000001a00000-0x000001e00000 : "kernel2"
0x000001e00000-0x000003200000 : "rootfs2"
!!!! led bink!!!
RT3xxx EHCI/OHCI init.
nf_conntrack version 0.5.0 (3962 buckets, 15848 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
Bridge firewalling registered
Ebtables v2.0 registered
PPP generic driver version 2.4.2
NET: Registered protocol family 24
11930:22:55 [KSWETH][Notice] [sweth_core.c(2818)sweth_init] SW&ETH HAL driver initing!
11930:22:55 [KSWETH][Notice] [sweth_core.c(144)CreateSwEthObjs] Create SW & ETH objects
11930:22:55 [KSWETH][Notice] [sweth_core.c(160)CreateSwEthObjs] Failed to get SWITCH attr, iRet=-2
11930:22:55 [KSWETH][Info] [sweth_core.c(167)CreateSwEthObjs] nEmac = 1, nSw = 0, nEth=5.
11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:55 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj0: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 0
11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:55 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj1: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 1
11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:55 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj2: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 2
11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:56 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj3: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 3
11930:22:56 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:56 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj4: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 4
11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms
11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms
11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms
11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms
11930:22:56 [TAGPARAM][Info] [tagparam_mod.c(1348)TagaramodInit] Tagaram module Driver Version 0.0.1.
11930:22:56 [TAGPARAM][Info] [tagparam_mod.c(1381)TagaramodInit] parse tag param success
Jiffies_test Driver Init Successfully 
logger: created 1024K log 'logger_main' major '99'
: success register character device for /dev/monitor
11930:22:56 [MIRROR][Notice] [cspmirror.c(1262)mirror_init] ***********mirror_init************
systools version:v0.7.0
errorEPC = f9d31b1c
11930:22:56 [KIGMPSNP][Info] [br_multicast_se(7334)br_mcparam_init] info init!
11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(stb)
11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(srtc)
11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(trtc)
11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(hard)
11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(null)
11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(drop)
11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_mark)
11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(vlan_prio_mark)
11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_vlan_prio_mark)
child_dev_init start
child_dev_ioctl_set set[8032a2c8]
11930:22:56 [Kernm255][Info] [ver_info.c(406)ver_info_init] ver_info_init
11930:22:56 [Kernm255][Info] [ver_info.c(195)ReadInfoFromVer] ver_info_init
11930:22:56 [Kernm255][Info] [ver_info.c(202)ReadInfoFromVer] ver_info_init
11930:22:56 [Kernm255][Info] [ver_info.c(218)ReadInfoFromVer] wFirmwareForm is:0x1 
11930:22:56 [KSWETH][Notice] [csp_ifinfo.c(221)csp_ifinfo_init] Initializing CSP IFinfo...
khelper used greatest stack depth: 15224 bytes left
khelper used greatest stack depth: 14824 bytes left
kworker/u:1 used greatest stack depth: 14784 bytes left
register AF_INET filter failed
#######begin FDB_Notify Reg
#######after FDB_Notify Reg
#######begin FDB_Notify Reg
Shouldn't be in WHILE
#######after FDB_Notify Reg
11930:22:56 [LEDKEYDRV][Error] [ledkey_callback(26)keycallback_ini] Install WPS KEY Callback Failed!
VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
Freeing unused kernel memory: 232k freed
busybox init and set aff
sched_setaffinity cpu all success
mount used greatest stack depth: 14144 bytes left
init normal mode!!!

Loading drivers and kernel modules... 

TC3162 LED Manager 0.1 init
tcledctrl version: tcledctrl V1.1.0.0 (Jan  2 2018-18:50:15).
tccicmd V1.1.0.0 (Jan  2 2018-18:50:19)
fe_core: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
macType = 0
qdma_lan: physical_size is 0x00200000
insmod used greatest stack depth: 14120 bytes left
ether.c:v1.00-NAPI 29.Mar.2015
rasw: FE MAC Ethernet address: 00:00:AA:BB:CC:FF
11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth0.
11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth1.
11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth2.
11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth3.
11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth4.
11930:22:58 [KSWETH][Notice] [econet_mac_adap(579)Register_econet] Register econet EMAC driver
11930:22:58 [KSWETH][Notice] [sweth_core.c(604)RegisterEmacDrv] Register EMAC driver
11930:22:58 [KSWETH][Notice] [sweth_core.c(433)InitSwEthObjs] Initialise SW & ETH objects
User External switch ,type 10
EN7512 TRGMII V1.0external port 6 reg=2604,value=16712704
queue0:
queue1:
queue2:
queue3:
insmod used greatest stack depth: 13808 bytes left
 7530 Ge, 0x1 
MCM MT7530 
 7530 Ge, 0x1 
MCM MT7530 
 7530 Ge, 0x1 
MCM MT7530 
 7530 Ge, 0x1 
MCM MT7530 
 7530 Ge, 0x1 
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
 7512 Ge, MCM MT7530 
[adslTimer (1508)18:50:20]  ADSL_MODEM_STATE_DOWN
 GE Tx amp AnaCal Done! (pair-0)(0x12)(0x1c20)
 GE Tx amp AnaCal Done! (pair-1)(0x17)(0xc20)
 GE Tx amp AnaCal Done! (pair-2)(0x19)(0xd20)
 GE Tx amp AnaCal Done! (pair-3)(0x21)(0xb20)
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
macType = 0
qdma_wan: qdma_bmgr.c [2581]: HW_FWD physical size is not illegal, force setting to 4MB
qdma_wan: physical_size is 0x00400000
Dying Gasp 0.31 init
oenmap 0 oenmap2 0
PCM V2.4 (Aug 12 2016 17:56:04) 
Major Num:255, device: spi
init mod-slic3,interface:,devNum:1,gpio:2000
spi &pcm 

Silabs SLIC type selected by SW makefile compile option


SPI_Reset
pcm1 ch num:3 pcm2 ch num:0
Init fxsNum(3) + fxoNum(0) = slic_ch_num(:3) , deviceNum(1)
init mod-ksocket
task init
init mod-acodec
init mod-foip3
task init
task init
task init

===============================
|| MTK DSP init successfully ||
===============================

dbgTool_init init v2.0 
pid 94's current affinity mask: (null)
pid 94's new affinity mask: 8
pid 91's current affinity mask: (null)
pid 91's new affinity mask: 8
pid 101's current affinity mask: (null)
pid 101's new affinity mask: 8
pid 99's current affinity mask: (null)
pid 99's new affinity mask: 8
pid 100's current affinity mask: (null)
pid 100's new affinity mask: 8
taskset: invalid number '0x8'

H367AV1.0 
login: 11930:23:03 [User][Info] [cspd_main.c(791)main] CALL SetSystemTimeInit main[791]
11930:23:03 [User][Info] [cspd_main.c(727)SetSystemTimeIn] SetSystemTimeInit[727]
11930:23:03 [User][Info] [cspd_main.c(747)SetSystemTimeIn] SetSystemTimeInit dateStr[20180102190105]
11930:23:03 [User][Info] [db_shm_mgr.c(121)DBShmSrvInit] iShmId:65538
11930:23:03 [User][Info] [db_shm_mgr.c(136)DBShmSrvInit] pShmBuf:60000000
11930:23:04 [dhcp4c][Warn] [dhcp4c_inst.c(4548)_dhcp4cRegSendO] Send code[60]fun[0x5b57ec] is replaced by fun[0x5be25c]
11930:23:04 [dhcps][Info] [dhcps.c(160)DHCPSInit] module init success!dhcp server
11930:23:04 [ipif_mgr][Info] [ipv4_addr_mgr.c(1402)ipv4AddrInit] [ipv4AddrInit] success
11930:23:04 [ipif_mgr][Info] [ifs_ipif.c(2110)ifsIPIFInit] [ifsIPIFInit] success
11930:23:04 [ipif_mgr][Error] [oss_subscribe.c(526)SubScribPublish] SubScribPublish server 10002 already exist!
11930:23:04 [ipif_mgr][Error] [oss_subscribe.c(526)SubScribPublish] SubScribPublish server 10008 already exist!
11930:23:04 [qos_mgr][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[] WanLan[3] Handle[0x4eedc8]
[log_file.c(1978)ProcLogConf] Set LOG_FILE_CONF_SET_PDTCONF.
[log_file.c(2042)ProcLogConf] Set cAutoSave = 1
11930:23:04 [DB][Notice] [dbc_core.c(364)_dbInit] Check whether the proc file started successfully
11930:23:04 [DB][Notice] [dbc_core.c(370)_dbInit] the proc file started successfully
11930:23:04 [DB][Error] [dbc_mgr_tbl.c(504)dbCreateDomainN] create table fail (ParentControlUser) domain(FilterMode) error default value
11930:23:04 [qos_mgr][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[], WanLan[3], pHandle[0x4eedc8], Event[6]
11930:23:04 [route_mgr][Info] [policy_route.c(1596)policyRtTableIn] policyRtTableInit ok
11930:23:04 [route_mgr][Info] [policy_route.c(1511)defPolicyRtChai] defPolicyRtChainInit ok
11930:23:04 [route_mgr][Info] [route_mgr.c(488)routeInit] SubScribPublish DefGW Service OK
11930:23:04 [bridge][Warn] [bridge.c(2267)bridgeInit] SubScribPublish Bridge Service OK
11930:23:04 [bridge][Info] [bridge.c(2275)bridgeInit] module init success!(bridge_mgr)
11930:23:04 [eth_mgr][Info] [eth_mgr.c(1350)ethInit] module init success!ethernet mgr
11930:23:04 [prefix_mgr][Info] [prefix_mgr.c(2686)prefixInit] Prefix Init Success!
11930:23:04 [sntp_mgr][Info] [time_policy.c(102)TpInit] module init success!2
11930:23:04 [sntp_mgr][Info] [sntp_mgr.c(1519)sntpInit] module init success!SNTP mgr
11930:23:04 [binding_mgr][Info] [binding_mgr.c(1493)bindingInit] [bindingInit] end
11930:23:04 [dhcp6c][Info] [dhcp6c_inst.c(2221)_DHCP6CInit] SubScribPublish DHCP6C OPT Service OK
11930:23:04 [slaac_mgr][Info] [slaac_mgr.c(2098)slaacInit] SubScribPublish SLAAC OPT Service OK
11930:23:04 [kernelmonitor][Info] [cspd_monitor.c(436)MonitorMain] monitor init success
11930:23:04 [PingTracert_mgr][Info] [tracert_mgr.c(1281)tracertInit] module init success!tracert mgr
11930:23:04 [ppp_mgr][Info] [ppp_mgr.c(7821)PPPInit] module init success!
11930:23:04 [dsl_mgr][Info] [dsl_mgr.c(3575)dsl_init] dsl init ok
11930:23:04 [xtm_mgr][Info] [xtm_mgr.c(4487)xtmInit] [xtmInit] start
11930:23:04 [xtm_mgr][Info] [xtm_mgr.c(4513)xtmInit] xtm init ok
11930:23:04 [xtm_mgr][Info] [xtm_mgr.c(4515)xtmInit] xtm support dynamic add/del interface
11930:23:04 [ptry_mgr][Info] [ptry_mgr.c(478)ptryMgrInit] module init success!(PTry mgr)
11930:23:04 [ddns_mgr][Info] [ddns_mgr.c(1419)ddnsInit] module init success!ddns_mgr
11930:23:04 [dns_mgr][Info] [dns_mgr.c(459)dnsInit] SubScribPublish NetIF Service OK
11930:23:04 [dns_mgr][Info] [comp_dns_mgr.c(75)CompDnsInit] Init Comp_Dns_Mgr Success!
11930:23:04 [fm_mgr][Info] [fm_mgr.c(2494)fmServerInit] module init success!Enter FmServer Init!
11930:23:04 [fm_mgr][Info] [fm_mgr.c(4139)fmMgrInit] module init success!fm mgr
11930:23:04 [tr143_mgr][Info] [tr143_mgr.c(548)tr143Init] module init success!tr143 mgr
11930:23:04 [ipif_mgr][Info] [ifs_netif.c(2530)interfaceNotify] [interfaceNotifyHook] start, to pid[cspd.cspd.qos_mgr]
open file failed
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(WANDCfg)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(DHCPSHostCfg)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(DHCPSPool)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(DHCPSBind)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(BrVlan)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(BrVlanport)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(BrFilter)
11930:23:04 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_user_cfg.xml
11930:23:04 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_user_cfg.xml
11930:23:04 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_user_cfg.xml
11930:23:04 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_user_cfg.xml
11930:23:04 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_user_cfg.xml
11930:23:04 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_user_cfg.xml
11930:23:04 [DB][Info] [dbc_mgr_file.c(1295)dbFileLoadCfg] find file /var/tmp/db_Decry_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [DB][Info] [dbc_mgr_file.c(2289)dbInitSignVal] szCfgSignVal= ZXHN H367A V1.0,iRet:0
11930:23:05 [DB][Warn] [env_api.c(225)GetEnvPara_proc] GetEnvPara: ParaName=SIPLineUserCfg, ParaSize = 1024, RealLen = 0
11930:23:05 [DB][Info] [dbc_core.c(1084)dbEndTm] (ALL) end, use 121 tick
11930:23:06 [dnsurl_policy][Info] [route_api.c(579)RegisterDefGWNo] RegisterDefGWNotify sucessed, ipType[3] event[3] Handle[0x485214]
11930:23:06 [dhcp6s][Info] [ipif_api.c(2330)RegAddr6Notify] RegAddr6Notify start, event[3] IF_ID[] WanLan[2] Handle[0x4724ec]
11930:23:06 [dhcp6s][Info] [dhcp6c_api.c(55)RegDHCP6COptNot] szModuleName:DHCP6S
11930:23:06 [dhcp6s][Info] [dhcp6c_api.c(68)RegDHCP6COptNot] Reg DHCP6C Notify ok, IF_ID[(null)], wOptCode[0], pHandle[0x46b624], Event[1], Module[DHCP6S]
11930:23:06 [dhcp6s][Info] [slaac_api.c(15)RegSLAACOptNoti] RegSLAACOptNotify start, event[1] IF_ID[(null)] wOptCode[0] Handle[0x46b530]
11930:23:06 [dhcp6s][Info] [slaac_api.c(39)RegSLAACOptNoti] szModuleName:DHCP6S
[log_file.c(1714)ProcLogConf] Set SaveEnable=0
11930:23:06 [dhcp6s][Info] [slaac_api.c(52)RegSLAACOptNoti] Reg SLAAC Notify ok, IF_ID[(null)], wOptCode[0], pHandle[0x46b530], Event[1]
11930:23:06 [log_mgr][Notice] [log_file.c(1704)ProcLogConf] [Log File] disable.
11930:23:06 [dhcps][Info] [ipif_api.c(2174)RegisterV4AddrN] RegisterV4AddrNotify start, event[1] IF_ID[DEV.IP.IF1] WanLan[2] Handle[0x5a5e58]
11930:23:06 [dhcps][Warn] [interface_api.c(682)GetIFBaseInfo] call dbAPIQryView failed!IF_ID[DEV.IP.IF1], count[0]
11930:23:06 [dhcps][Warn] [dhcpsinst.c(462)getIFInfoAndCre] Call function failed!GetWANLANBaseInfo, IF_ID[DEV.IP.IF1]
11930:23:06 [dhcps][Info] [dhcpsinst.c(548)dhcp4sIFRegiste] dhcps start inst,dhcp4sIFRegister fail
11930:23:06 [dhcps][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[] WanLan[2] Handle[0x5a5f40]
11930:23:06 [dhcps][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[], WanLan[2], pHandle[0x5a5f40], Event[6]
11930:23:06 [dhcp4c][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.IP.IF3] WanLan[3] Handle[0x5bce0c]
11930:23:06 [dhcp4c][Info] [interface_api.c(1508)RegisterNetIFNo] IF_ID Not Null[DEV.IP.IF3]
11930:23:06 [dhcp4c][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.IP.IF3], WanLan[3], pHandle[0x5bce0c], Event[6]
11930:23:06 [dhcp4c][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.IP.IF5] WanLan[3] Handle[0x5bce0c]
11930:23:06 [dhcp4c][Info] [interface_api.c(1508)RegisterNetIFNo] IF_ID Not Null[DEV.IP.IF5]
11930:23:06 [dhcp4c][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.IP.IF5], WanLan[3], pHandle[0x5bce0c], Event[6]
11930:23:06 [adev_mgr][Info] [access_dev_mgr.(285)adevStart] module start success!(Adev mgr)
11930:23:06 [srm_mgr][Info] [srm_mgr.c(230)SrmInit] module init success!use SRM_DBVIEW data
11930:23:06 [wwan_mgr][Info] [wwan_mgr.c(1091)WwanMgrInit] module init success!wwan mgr
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1182)AllocNetIF] AllocNetIF start,IF_ID DEV.POTS1
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1182)AllocNetIF] AllocNetIF start,IF_ID DEV.DT1
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(957)lowlayerIFChang] oldcount 0, newcount 1
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1182)AllocNetIF] AllocNetIF start,IF_ID DEV.DT2
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(957)lowlayerIFChang] oldcount 0, newcount 1
11930:23:06 [OSS][Warn] [oss_event_handl(149)OssEventListCal]  OssEventListCallChain id = 0x1103!!
11930:23:06 [log_mgr][Info] [log_mgr.c(1276)logSetSerialEna] logGetVerDate str = 20180102.
[log_file.c(3540)logFileProcMsg] operation result --- Success
[log_file.c(3395)logRegisterToLogcat] RegisterToLogcat success.

H367AV1.0 
login:


Retrieved from "https://wikidevi.wi-cat.ru/index.php?title=ZTE_ZXHN_H367A&oldid=375524"