ZTE ZXHN H367A

From TechInfoDepot
Jump to navigationJump to search
abgn+ac (AC1200)
Wireless Router - Home Gateway
Support
WikiDevi.wi-cat.ru
3rd Party Firmware
dd-wrt
Status Unknown
OpenWrt
Status Unknown
Tomato any flavor
Incompatible
Platform
BrandModelRev
ZTE ZXHN H367A V1.0
FCC ID
none specified
Type
wireless router, dsl modem, analog phone gateway
CPU1
EcoNet EN7513G
CPU1 Type
MIPS 34Kc
CPU1 Speed
900 MHz
Flash1 Chip
Winbond W25N01GVZE1G
Flash1 Size
128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br />
RAM1 Size
256 MiB268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br />
RAM1 Chip
SK hynix H5TQ2G63GFR
ETH chip1
EcoNet EN7513G
Switch
EcoNet EN7513G
Ethernet Port Count
1-1GbE-WAN
4-1GbE-LAN
Wired Standard
IEEE 802.3i/3u/3ab

802dot11 OUI: 8C:DC:02

Expansion IF types
USB 2.0
USB ports
1
USB Hub Compatible
Untested
Power
12 VDC, 2 A
Connector type
barrel
Serial Port (UART)
yes, 4-pin header, internal
Flags:
ADSL2+, VDSL, VoIP
Other

Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1311 additional devices
of which 11 are ZTE devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1332 additional devices
of which 8 are ZTE devices

Manuf/OEM/ODM
Retail
Country of manuf China
Radio 1
Chip1
Atheros AR9381
Wireless interface OUI
8C:DC:02
Antenna Connector Type
none specified
MIMO status
2x2:2
Wireless Standard
IEEE 802.11b/g/n
802.11n
up to 300 Mbps
802.11g
up to 54 Mbps
802.11b
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz
Radio 2
Chip1
Qualcomm QCA9880
Wireless interface OUI
8C:DC:02
Antenna Connector Type
none specified
MIMO status
2x2:2
Wireless Standard
IEEE 802.11a/n/ac
802.11ac
up to 867 Mbps
802.11n
up to 300 Mbps
802.11a
up to 54 Mbps
WiFi Operating Frequency
5 GHz

For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.
For a list of all currently documented EcoNet (MediaTek) SoC's with specifications, see EcoNet (MediaTek).
For a list of all currently documented Qualcomm chipsets with specifications, see Qualcomm.

For a list of all currently documented ZTE device with specifications, see ZTE.

867 Mbps - 2SS 5GHz 802.11ac (80MHz chan.),
300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = AC1200 class

Overview

Specifications

  • Wi-Fi: AC1200, 2.4GHz (300Mbps), 5GHz (867Mbps)

JTAG-Serial Info

Serial

Flash layout

Offset size Description
0x0000000 0x7000000 Wholeflash
0x0000000 0x0040000 Bootloader
0x0040000 0x0020000 wifi
0x0060000 0x0040000 tag
0x00a0000 0x0160000 config
0x0200000 0x0400000 kernel1
0x0600000 0x1400000 rootfs1
0x1a00000 0x0400000 kernel2
0x1e00000 0x1400000 rootfs2

Flash backup: h367n-flash-backup.tar.gz

Bootloader Recovery mode

We can enter into the bootloader recovery mode:

  1. Set a static IP on your computer, use 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.
  2. Power off the device (unplug the PSU)
  3. Puss down Reset and WPS button at the same time
  4. Power on the device
  5. Wait 5 seconds
  6. Release the buttons
  7. Browse to http://192.168.1.254, you should see this screen:

H367A-bootloader-web.png

Bootloader

We can break into the Bootloader command line by pressing

the key 1 while starting up the device.

There are some commands available for unbricking the device:

H367AV1.0 
login: BGA IC
Xtal:1
DDR3 init.
DRAMC init done. 
Calculate size.
DRAM size=256MB
Set new TRFC.
ddr-1066

7512DRAMC V1.2.2 (0)
Set SPI Flash Clock to 25 Mhz
Memory size 256MB
Set SPI Flash Clock to 25 Mhz
spi_nand_probe: mfr_id=0xef, dev_id=0xaa
Dected SPI NAND Flash : _SPI_NAND_DEVICE_ID_W25N01G, Flash Size=0x8000000
bmt pool size: 81 
BMT & BBT Init Success 

board ip address:192.168.1.254
no_pci_found error case

*** Press 1 means entering boot mode***
*** Press 2 means entering testing mode***
*** Press 3 means entering norm mode***

Entering boot mode ...

******start httpd******

PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
PBUF_POOL_BUFSIZE = 256
memtop = 80020000
zteboot_cmdline_init
bldr> ?
                                                                              
?                                   Print out help messages.                  
help                                Print out help messages.                  
go                                  Booting the linux kernel.                 
decomp                              Decompress kernel image to ram.           
memrl <addr>                        Read a word from addr.                    
memrls <addr_start> <addr_end>      Read some regs addr.                      
memwl <addr> <value>                Write a word to addr.                     
dump <addr> <len>                   Dump memory content.                      
jump <addr>                         Jump to addr.                             
flash <dst> <src> <len> <oob>       Write to flash from src to dst(oob: write nand oob if 1).
erase <addr> <len>                  Erase flash from addr.                    
readflash <raddr> <faddr> <len>     read flash from flashaddr to ramaddr.     
imginfo                             Show images info.                         
bdstore <flash dst> <bin src>       Do backdoor config store                  
bdshow                              Show backdoor config                      
bdswitch[1|0]                       Enable or disable backdoor function       
ddrcalswitch[1|0]                   Enable or disable ddr calibration funciton 
drambistswitch[0|1|2]               disable or enable, and quick or normal test 
xmdm <addr> <len>                   Xmodem receive to addr.                   
miir <phyaddr> <reg>                Read ethernet phy reg.                    
miiw <phyaddr> <reg> <value>        Write ethernet phy reg.                   
cpufreq <freq num> / <m> <n>        Set CPU Freq <156~450>(freq has to be multiple of 6)
ipaddr <ip addr>                    Change modem's IP.                        
httpd                               Start Web Server                          
ddrdrv <..>                         Change DDR driving length                 
reset                               reset the system                          
upgrade <ip addr> <filename>        upgrade version                           
runemt                              run emt mode                              
bldr>


Command injection

There is a possibility to inject commands via web interface using the URL Filter field at Internet->Security section

H367a-com injection.png

Note that here we use a custom script located at the var directory because apparently the scripts at the usb flash drives under the /mnt directory can't be executed. We can write files to /var using a popular samba server bug.

Boot log

boot log
BGA IC
Xtal:1
DDR3 init.
DRAMC init done. 
Calculate size.
DRAM size=256MB
Set new TRFC.
ddr-1066

7512DRAMC V1.2.2 (0)
Set SPI Flash Clock to 25 Mhz
Memory size 256MB
Set SPI Flash Clock to 25 Mhz
spi_nand_probe: mfr_id=0xef, dev_id=0xaa
Dected SPI NAND Flash : _SPI_NAND_DEVICE_ID_W25N01G, Flash Size=0x8000000
bmt pool size: 81 
BMT & BBT Init Success 

board ip address:192.168.1.254
no_pci_found error case

*** Press 1 means entering boot mode***
*** Press 2 means entering testing mode***
*** Press 3 means entering norm mode***
............................................................


Found image at 0x00200000

Found image at 0x01a00000
****Try the first image...
decompress_addr 200100 decompress_addr_end 373e04 
Decompress to 80002000 free_mem_ptr=80600000 free_mem_ptr_end=80780000
75xx: 0x0
Uncompressing [LZMA] ...  done.
Linux version 2.6.36 (xialei@localhost.localdomain) (gcc version 4.3.6 (Buildroot 2012.05) ) #1 SMP Tue Jan 2 18:49:54 CST 2018
ISPRAM0: PA=00340000,Size=00010000,enabled
Check boot para cksum...
aca acaboot para cksum OK!
Boot 1'th image
bootPara.runmode=3
pdt_verinfo_init: tcVerInfo->RunMode[3]
bootPara.bootWhichImg=1
bootPara.img_info_tbl[0].flashOffset=0x  200000
hw_ver=00
sHardVersion=V1.0.00
memsize:256MB
EcoNet EN751221 SOC prom init
bootconsole [early0] enabled
CPU revision is: 00019558 (MIPS 34Kc)
Determined physical RAM map:
 memory: 0ffe0000 @ 00020000 (usable)
Wasting 1024 bytes for tracking 32 unused pages
Zone PFN ranges:
  Normal   0x00000020 -> 0x00010000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000020 -> 0x00010000
3 available secondary CPU TC(s)
PERCPU: Embedded 7 pages/cpu @81203000 s7232 r8192 d13248 u65536
pcpu-alloc: s7232 r8192 d13248 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 64992
Kernel command line:  es=1
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00037732
Readback ErrCtl register=00037732
nmi base is 81274200
Memory: 253624k/262016k available (3384k kernel code, 8392k reserved, 937k data, 232k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:64
CPU frequency 900.00 MHz
 Using 199.996 MHz high precision timer.
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Calibrating delay loop... 598.01 BogoMIPS (lpj=2990080)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
34K sync es set to 1.
Config7: 0x80080500
Limit of 4 TCs set
TLB of 64 entry pairs shared by 2 VPEs
VPE 0: TC 0 1 2, VPE 1: TC 3
IPI buffer pool of 16 buffers
CPU revision is: 00019558 ((null))
TC 1 going on-line as CPU 1
CPU revision is: 00019558 ((null))
TC 2 going on-line as CPU 2
CPU revision is: 00019558 ((null))
TC 3 going on-line as CPU 3
Brought up 4 CPUs
NET: Registered protocol family 16
11930:22:53 [KMONITOR][Notice] [monitor.c(938)MonitorInit]  cspmonitor init... !  
MT7512_pcie_init
check pcie link up status: 
isRC0_LINKUP=1 
isRC1_LINKUP=1 
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
pci 0000:00:01.0: BAR 8: assigned [mem 0x20100000-0x203fffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x2001ffff 64bit]
pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x2001ffff 64bit] (PCI address [0x20000000-0x2001ffff]
pci 0000:01:00.0: BAR 6: assigned [mem 0x20020000-0x2002ffff pref]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0:   bridge window [io  disabled]
pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
pci 0000:00:00.0:   bridge window [mem pref disabled]
pci 0000:02:00.0: BAR 0: assigned [mem 0x20200000-0x203fffff 64bit]
pci 0000:02:00.0: BAR 0: set to [mem 0x20200000-0x203fffff 64bit] (PCI address [0x20200000-0x203fffff]
pci 0000:02:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
pci 0000:00:01.0: PCI bridge to [bus 02-02]
pci 0000:00:01.0:   bridge window [io  disabled]
pci 0000:00:01.0:   bridge window [mem 0x20100000-0x203fffff]
pci 0000:00:01.0:   bridge window [mem pref disabled]
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
NET: Registered protocol family 8
NET: Registered protocol family 20
11930:22:54 [KQOS][Info] [qos.c(4999)CSPKernel_QoS_I] Qos module init
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP: reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1

 mt7512_pcie_fixup: 0x1438 = 20000014 
 mt7512_pcie_fixup: 0x3438 = 20100016 
 mt7512_pcie_rc1_retrain: 70 = 00036c11 80 = 01608c12
TC3162 hardware watchdog module loaded.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 495
cryptomgr_test used greatest stack depth: 15632 bytes left
cryptomgr_test used greatest stack depth: 15496 bytes left
cryptomgr_test used greatest stack depth: 15472 bytes left
io scheduler noop registered (default)
##WF watchdog inited!
ttyS0 at I/O 0xbfbf0003 (irq = 1) is a TC3162
ttyS20 at I/O 0xbfbf0303 (irq = 17) is a TC3162
brd: module loaded
IS_SPIFLASH=0x0, IS_NANDFLASH=0x2, (0xBFA10114)=0x6)
SPI_NAND_Flash_init: before init, mtx_mode_tog=0xl9, manaul_en=0x1
spi_nand_probe: mfr_id=0xef, dev_id=0xaa
Dected SPI NAND Flash : _SPI_NAND_DEVICE_ID_W25N01G, Flash Size=0x8000000
spi nand flash
tc3162: flash device 0x01000000 at 0x1c000000
EN7512 mtd init: spi nand probe enter
[spi_nand_setup] : Enter 
NAND device: Manufacturer ID: 0xef, Chip ID: 0xaa (Unknown _SPI_NAND_DEVICE_ID_W25N01G)
nand_scan_ident ok
[spi_nand_setup]: chip size =  0x8000000, erase_shift=0x11
calc_bmt_pool_size : need_valid_block_num=0x51, total_block=0x400
bmt pool size: 81 
BMT & BBT Init Success 
Creating 9 MTD partitions on "EN7512-SPI_NAND":
0x000000000000-0x000007000000 : "Wholeflash"
0x000000000000-0x000000040000 : "Bootloader"
0x000000040000-0x000000060000 : "wifi"
0x000000060000-0x0000000a0000 : "tag"
0x0000000a0000-0x000000200000 : "config"
0x000000200000-0x000000600000 : "kernel1"
0x000000600000-0x000001a00000 : "rootfs1"
0x000001a00000-0x000001e00000 : "kernel2"
0x000001e00000-0x000003200000 : "rootfs2"
!!!! led bink!!!
RT3xxx EHCI/OHCI init.
nf_conntrack version 0.5.0 (3962 buckets, 15848 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
Bridge firewalling registered
Ebtables v2.0 registered
PPP generic driver version 2.4.2
NET: Registered protocol family 24
11930:22:55 [KSWETH][Notice] [sweth_core.c(2818)sweth_init] SW&ETH HAL driver initing!
11930:22:55 [KSWETH][Notice] [sweth_core.c(144)CreateSwEthObjs] Create SW & ETH objects
11930:22:55 [KSWETH][Notice] [sweth_core.c(160)CreateSwEthObjs] Failed to get SWITCH attr, iRet=-2
11930:22:55 [KSWETH][Info] [sweth_core.c(167)CreateSwEthObjs] nEmac = 1, nSw = 0, nEth=5.
11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:55 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj0: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 0
11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:55 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj1: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 1
11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:55 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj2: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 2
11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:56 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj3: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 3
11930:22:56 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:56 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj4: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 4
11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms
11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms
11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms
11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms
11930:22:56 [TAGPARAM][Info] [tagparam_mod.c(1348)TagaramodInit] Tagaram module Driver Version 0.0.1.
11930:22:56 [TAGPARAM][Info] [tagparam_mod.c(1381)TagaramodInit] parse tag param success
Jiffies_test Driver Init Successfully 
logger: created 1024K log 'logger_main' major '99'
: success register character device for /dev/monitor
11930:22:56 [MIRROR][Notice] [cspmirror.c(1262)mirror_init] ***********mirror_init************
systools version:v0.7.0
errorEPC = f9d31b1c
11930:22:56 [KIGMPSNP][Info] [br_multicast_se(7334)br_mcparam_init] info init!
11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(stb)
11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(srtc)
11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(trtc)
11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(hard)
11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(null)
11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(drop)
11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_mark)
11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(vlan_prio_mark)
11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_vlan_prio_mark)
child_dev_init start
child_dev_ioctl_set set[8032a2c8]
11930:22:56 [Kernm255][Info] [ver_info.c(406)ver_info_init] ver_info_init
11930:22:56 [Kernm255][Info] [ver_info.c(195)ReadInfoFromVer] ver_info_init
11930:22:56 [Kernm255][Info] [ver_info.c(202)ReadInfoFromVer] ver_info_init
11930:22:56 [Kernm255][Info] [ver_info.c(218)ReadInfoFromVer] wFirmwareForm is:0x1 
11930:22:56 [KSWETH][Notice] [csp_ifinfo.c(221)csp_ifinfo_init] Initializing CSP IFinfo...
khelper used greatest stack depth: 15224 bytes left
khelper used greatest stack depth: 14824 bytes left
kworker/u:1 used greatest stack depth: 14784 bytes left
register AF_INET filter failed
#######begin FDB_Notify Reg
#######after FDB_Notify Reg
#######begin FDB_Notify Reg
Shouldn't be in WHILE
#######after FDB_Notify Reg
11930:22:56 [LEDKEYDRV][Error] [ledkey_callback(26)keycallback_ini] Install WPS KEY Callback Failed!
VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
Freeing unused kernel memory: 232k freed
busybox init and set aff
sched_setaffinity cpu all success
mount used greatest stack depth: 14144 bytes left
init normal mode!!!

Loading drivers and kernel modules... 

TC3162 LED Manager 0.1 init
tcledctrl version: tcledctrl V1.1.0.0 (Jan  2 2018-18:50:15).
tccicmd V1.1.0.0 (Jan  2 2018-18:50:19)
fe_core: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
macType = 0
qdma_lan: physical_size is 0x00200000
insmod used greatest stack depth: 14120 bytes left
ether.c:v1.00-NAPI 29.Mar.2015
rasw: FE MAC Ethernet address: 00:00:AA:BB:CC:FF
11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth0.
11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth1.
11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth2.
11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth3.
11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth4.
11930:22:58 [KSWETH][Notice] [econet_mac_adap(579)Register_econet] Register econet EMAC driver
11930:22:58 [KSWETH][Notice] [sweth_core.c(604)RegisterEmacDrv] Register EMAC driver
11930:22:58 [KSWETH][Notice] [sweth_core.c(433)InitSwEthObjs] Initialise SW & ETH objects
User External switch ,type 10
EN7512 TRGMII V1.0external port 6 reg=2604,value=16712704
queue0:
queue1:
queue2:
queue3:
insmod used greatest stack depth: 13808 bytes left
 7530 Ge, 0x1 
MCM MT7530 
 7530 Ge, 0x1 
MCM MT7530 
 7530 Ge, 0x1 
MCM MT7530 
 7530 Ge, 0x1 
MCM MT7530 
 7530 Ge, 0x1 
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
 7512 Ge, MCM MT7530 
[adslTimer (1508)18:50:20]  ADSL_MODEM_STATE_DOWN
 GE Tx amp AnaCal Done! (pair-0)(0x12)(0x1c20)
 GE Tx amp AnaCal Done! (pair-1)(0x17)(0xc20)
 GE Tx amp AnaCal Done! (pair-2)(0x19)(0xd20)
 GE Tx amp AnaCal Done! (pair-3)(0x21)(0xb20)
MCM MT7530 
MCM MT7530 
MCM MT7530 
MCM MT7530 
macType = 0
qdma_wan: qdma_bmgr.c [2581]: HW_FWD physical size is not illegal, force setting to 4MB
qdma_wan: physical_size is 0x00400000
Dying Gasp 0.31 init
oenmap 0 oenmap2 0
PCM V2.4 (Aug 12 2016 17:56:04) 
Major Num:255, device: spi
init mod-slic3,interface:,devNum:1,gpio:2000
spi &pcm 

Silabs SLIC type selected by SW makefile compile option


SPI_Reset
pcm1 ch num:3 pcm2 ch num:0
Init fxsNum(3) + fxoNum(0) = slic_ch_num(:3) , deviceNum(1)
init mod-ksocket
task init
init mod-acodec
init mod-foip3
task init
task init
task init

===============================
|| MTK DSP init successfully ||
===============================

dbgTool_init init v2.0 
pid 94's current affinity mask: (null)
pid 94's new affinity mask: 8
pid 91's current affinity mask: (null)
pid 91's new affinity mask: 8
pid 101's current affinity mask: (null)
pid 101's new affinity mask: 8
pid 99's current affinity mask: (null)
pid 99's new affinity mask: 8
pid 100's current affinity mask: (null)
pid 100's new affinity mask: 8
taskset: invalid number '0x8'

H367AV1.0 
login: 11930:23:03 [User][Info] [cspd_main.c(791)main] CALL SetSystemTimeInit main[791]
11930:23:03 [User][Info] [cspd_main.c(727)SetSystemTimeIn] SetSystemTimeInit[727]
11930:23:03 [User][Info] [cspd_main.c(747)SetSystemTimeIn] SetSystemTimeInit dateStr[20180102190105]
11930:23:03 [User][Info] [db_shm_mgr.c(121)DBShmSrvInit] iShmId:65538
11930:23:03 [User][Info] [db_shm_mgr.c(136)DBShmSrvInit] pShmBuf:60000000
11930:23:04 [dhcp4c][Warn] [dhcp4c_inst.c(4548)_dhcp4cRegSendO] Send code[60]fun[0x5b57ec] is replaced by fun[0x5be25c]
11930:23:04 [dhcps][Info] [dhcps.c(160)DHCPSInit] module init success!dhcp server
11930:23:04 [ipif_mgr][Info] [ipv4_addr_mgr.c(1402)ipv4AddrInit] [ipv4AddrInit] success
11930:23:04 [ipif_mgr][Info] [ifs_ipif.c(2110)ifsIPIFInit] [ifsIPIFInit] success
11930:23:04 [ipif_mgr][Error] [oss_subscribe.c(526)SubScribPublish] SubScribPublish server 10002 already exist!
11930:23:04 [ipif_mgr][Error] [oss_subscribe.c(526)SubScribPublish] SubScribPublish server 10008 already exist!
11930:23:04 [qos_mgr][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[] WanLan[3] Handle[0x4eedc8]
[log_file.c(1978)ProcLogConf] Set LOG_FILE_CONF_SET_PDTCONF.
[log_file.c(2042)ProcLogConf] Set cAutoSave = 1
11930:23:04 [DB][Notice] [dbc_core.c(364)_dbInit] Check whether the proc file started successfully
11930:23:04 [DB][Notice] [dbc_core.c(370)_dbInit] the proc file started successfully
11930:23:04 [DB][Error] [dbc_mgr_tbl.c(504)dbCreateDomainN] create table fail (ParentControlUser) domain(FilterMode) error default value
11930:23:04 [qos_mgr][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[], WanLan[3], pHandle[0x4eedc8], Event[6]
11930:23:04 [route_mgr][Info] [policy_route.c(1596)policyRtTableIn] policyRtTableInit ok
11930:23:04 [route_mgr][Info] [policy_route.c(1511)defPolicyRtChai] defPolicyRtChainInit ok
11930:23:04 [route_mgr][Info] [route_mgr.c(488)routeInit] SubScribPublish DefGW Service OK
11930:23:04 [bridge][Warn] [bridge.c(2267)bridgeInit] SubScribPublish Bridge Service OK
11930:23:04 [bridge][Info] [bridge.c(2275)bridgeInit] module init success!(bridge_mgr)
11930:23:04 [eth_mgr][Info] [eth_mgr.c(1350)ethInit] module init success!ethernet mgr
11930:23:04 [prefix_mgr][Info] [prefix_mgr.c(2686)prefixInit] Prefix Init Success!
11930:23:04 [sntp_mgr][Info] [time_policy.c(102)TpInit] module init success!2
11930:23:04 [sntp_mgr][Info] [sntp_mgr.c(1519)sntpInit] module init success!SNTP mgr
11930:23:04 [binding_mgr][Info] [binding_mgr.c(1493)bindingInit] [bindingInit] end
11930:23:04 [dhcp6c][Info] [dhcp6c_inst.c(2221)_DHCP6CInit] SubScribPublish DHCP6C OPT Service OK
11930:23:04 [slaac_mgr][Info] [slaac_mgr.c(2098)slaacInit] SubScribPublish SLAAC OPT Service OK
11930:23:04 [kernelmonitor][Info] [cspd_monitor.c(436)MonitorMain] monitor init success
11930:23:04 [PingTracert_mgr][Info] [tracert_mgr.c(1281)tracertInit] module init success!tracert mgr
11930:23:04 [ppp_mgr][Info] [ppp_mgr.c(7821)PPPInit] module init success!
11930:23:04 [dsl_mgr][Info] [dsl_mgr.c(3575)dsl_init] dsl init ok
11930:23:04 [xtm_mgr][Info] [xtm_mgr.c(4487)xtmInit] [xtmInit] start
11930:23:04 [xtm_mgr][Info] [xtm_mgr.c(4513)xtmInit] xtm init ok
11930:23:04 [xtm_mgr][Info] [xtm_mgr.c(4515)xtmInit] xtm support dynamic add/del interface
11930:23:04 [ptry_mgr][Info] [ptry_mgr.c(478)ptryMgrInit] module init success!(PTry mgr)
11930:23:04 [ddns_mgr][Info] [ddns_mgr.c(1419)ddnsInit] module init success!ddns_mgr
11930:23:04 [dns_mgr][Info] [dns_mgr.c(459)dnsInit] SubScribPublish NetIF Service OK
11930:23:04 [dns_mgr][Info] [comp_dns_mgr.c(75)CompDnsInit] Init Comp_Dns_Mgr Success!
11930:23:04 [fm_mgr][Info] [fm_mgr.c(2494)fmServerInit] module init success!Enter FmServer Init!
11930:23:04 [fm_mgr][Info] [fm_mgr.c(4139)fmMgrInit] module init success!fm mgr
11930:23:04 [tr143_mgr][Info] [tr143_mgr.c(548)tr143Init] module init success!tr143 mgr
11930:23:04 [ipif_mgr][Info] [ifs_netif.c(2530)interfaceNotify] [interfaceNotifyHook] start, to pid[cspd.cspd.qos_mgr]
open file failed
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(WANDCfg)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(DHCPSHostCfg)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(DHCPSPool)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(DHCPSBind)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(BrVlan)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(BrVlanport)
11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(BrFilter)
11930:23:04 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_user_cfg.xml
11930:23:04 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_user_cfg.xml
11930:23:04 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_user_cfg.xml
11930:23:04 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_user_cfg.xml
11930:23:04 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_user_cfg.xml
11930:23:04 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_user_cfg.xml
11930:23:04 [DB][Info] [dbc_mgr_file.c(1295)dbFileLoadCfg] find file /var/tmp/db_Decry_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [DB][Info] [dbc_mgr_file.c(2289)dbInitSignVal] szCfgSignVal= ZXHN H367A V1.0,iRet:0
11930:23:05 [DB][Warn] [env_api.c(225)GetEnvPara_proc] GetEnvPara: ParaName=SIPLineUserCfg, ParaSize = 1 GiB, RealLen = 0
11930:23:05 [DB][Info] [dbc_core.c(1084)dbEndTm] (ALL) end, use 121 tick
11930:23:06 [dnsurl_policy][Info] [route_api.c(579)RegisterDefGWNo] RegisterDefGWNotify sucessed, ipType[3] event[3] Handle[0x485214]
11930:23:06 [dhcp6s][Info] [ipif_api.c(2330)RegAddr6Notify] RegAddr6Notify start, event[3] IF_ID[] WanLan[2] Handle[0x4724ec]
11930:23:06 [dhcp6s][Info] [dhcp6c_api.c(55)RegDHCP6COptNot] szModuleName:DHCP6S
11930:23:06 [dhcp6s][Info] [dhcp6c_api.c(68)RegDHCP6COptNot] Reg DHCP6C Notify ok, IF_ID[(null)], wOptCode[0], pHandle[0x46b624], Event[1], Module[DHCP6S]
11930:23:06 [dhcp6s][Info] [slaac_api.c(15)RegSLAACOptNoti] RegSLAACOptNotify start, event[1] IF_ID[(null)] wOptCode[0] Handle[0x46b530]
11930:23:06 [dhcp6s][Info] [slaac_api.c(39)RegSLAACOptNoti] szModuleName:DHCP6S
[log_file.c(1714)ProcLogConf] Set SaveEnable=0
11930:23:06 [dhcp6s][Info] [slaac_api.c(52)RegSLAACOptNoti] Reg SLAAC Notify ok, IF_ID[(null)], wOptCode[0], pHandle[0x46b530], Event[1]
11930:23:06 [log_mgr][Notice] [log_file.c(1704)ProcLogConf] [Log File] disable.
11930:23:06 [dhcps][Info] [ipif_api.c(2174)RegisterV4AddrN] RegisterV4AddrNotify start, event[1] IF_ID[DEV.IP.IF1] WanLan[2] Handle[0x5a5e58]
11930:23:06 [dhcps][Warn] [interface_api.c(682)GetIFBaseInfo] call dbAPIQryView failed!IF_ID[DEV.IP.IF1], count[0]
11930:23:06 [dhcps][Warn] [dhcpsinst.c(462)getIFInfoAndCre] Call function failed!GetWANLANBaseInfo, IF_ID[DEV.IP.IF1]
11930:23:06 [dhcps][Info] [dhcpsinst.c(548)dhcp4sIFRegiste] dhcps start inst,dhcp4sIFRegister fail
11930:23:06 [dhcps][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[] WanLan[2] Handle[0x5a5f40]
11930:23:06 [dhcps][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[], WanLan[2], pHandle[0x5a5f40], Event[6]
11930:23:06 [dhcp4c][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.IP.IF3] WanLan[3] Handle[0x5bce0c]
11930:23:06 [dhcp4c][Info] [interface_api.c(1508)RegisterNetIFNo] IF_ID Not Null[DEV.IP.IF3]
11930:23:06 [dhcp4c][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.IP.IF3], WanLan[3], pHandle[0x5bce0c], Event[6]
11930:23:06 [dhcp4c][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.IP.IF5] WanLan[3] Handle[0x5bce0c]
11930:23:06 [dhcp4c][Info] [interface_api.c(1508)RegisterNetIFNo] IF_ID Not Null[DEV.IP.IF5]
11930:23:06 [dhcp4c][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.IP.IF5], WanLan[3], pHandle[0x5bce0c], Event[6]
11930:23:06 [adev_mgr][Info] [access_dev_mgr.(285)adevStart] module start success!(Adev mgr)
11930:23:06 [srm_mgr][Info] [srm_mgr.c(230)SrmInit] module init success!use SRM_DBVIEW data
11930:23:06 [wwan_mgr][Info] [wwan_mgr.c(1091)WwanMgrInit] module init success!wwan mgr
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1182)AllocNetIF] AllocNetIF start,IF_ID DEV.POTS1
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1182)AllocNetIF] AllocNetIF start,IF_ID DEV.DT1
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(957)lowlayerIFChang] oldcount 0, newcount 1
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1182)AllocNetIF] AllocNetIF start,IF_ID DEV.DT2
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(957)lowlayerIFChang] oldcount 0, newcount 1
11930:23:06 [OSS][Warn] [oss_event_handl(149)OssEventListCal]  OssEventListCallChain id = 0x1103!!
11930:23:06 [log_mgr][Info] [log_mgr.c(1276)logSetSerialEna] logGetVerDate str = 20180102.
[log_file.c(3540)logFileProcMsg] operation result --- Success
[log_file.c(3395)logRegisterToLogcat] RegisterToLogcat success.

H367AV1.0 
login: 

Pictures

User Images

See also

Models

ZTEVodafone
MasMovil • 2016 (14:60:80,70:9F:2D,74:B5:7E)
FCC ID: Q78-ZXHNH267N (2017-05-11)
MasMovil • 2016 (00:4A:77,64:13:6C,8C:68:C8)
FCC ID: Q78-ZXHNH268A (2016-06-30)
Digi (DIGIFIBRA) • 2018 (44:FF:BA, 2C:95:7F)
MasMovil • 2018 (00:4A:77,44:FF:BA,8C:E1:17)