SBV5220 Fatso voip modem survey

[cc17926]

Its not every day i see "Honey i shrunk the kids" but .. jeez "Honey i blew up the modem!".. This thing is atleast 2 times the overall size of the 5100 and bigger than the sbg900.. it has gained a few pounds.. this modem sports 2 telephone lines and 2 slots for batteries! (which are 10.8v lithium) This unit also has the power supply built-in, not external. its built in two vertical halves which are then sandwiched toghether by a divider. one side comprises of the power supply, other half the mainboard. The board is date stamped from march 2006. the processor on this board is a Texas Instrument TNETC4401PYP, its memory is a Hynix HY57V281620ETP-H. Flash memory is an Intel TE28F320. It contains a 14-pin JTag port, and (what appers to be) a 4-pin TTL serial port, whose pinout can suggest to be Vcc-Gnd-Tx-Rx. This board is missing circuity for the diagnostic port itself.. Had the design been implemented, it would have been a round phono jack (round hole in backplate covered by a big sticker on the outside). The firmware (written on a sticker on the box) is SBV5220-2.16.1.3-SC<09-SHPC. The modem's webpage is greeted with a username/password box (in the page). I've attempted to enable factory mode with bit files, and it does not work. No other exploritory research has been done on this modem yet. SHPC on the firmware assumes theres a shell somewhere, but this is uncertain. I would like to dump the flash, but do not know the range. If anybody would like pictures of the inside, i can do that.

[cc17926]

ive taken the liberty to jtag the modem using following the following commands:
-detect
IDCODE 100F
TI TNETC4401
IMPCODE 21404000
DMA not supoorted
Found Address= 90000000 Intel 28F320C3
-getram 90000000 200000
-save 90000000 200000

analyzing the firmware in a hex editior leads me to believe everything is compressed.. i am uncertain 100% about this though. i tried searching in the dump for something that i know, such like the mac address and part of the serial, returning no results. if anybody would like to analyze, i can send the dump.

[cc17926]

using TTL serial adapter, at baud 9600 yeilds some stuff like this:

Code: Select all

US Boot Loader, version 08.02.00 - 04-Dec-03 (c).
Sdram Size =  0x01000000 (c).
Heap starts at 0xB4F70000
HW revision is 0.0.0.2

Flash autodetection returned: 0x00000000
VendorID: 0x0089	DeviceID: 0x88C4

-\
Trying to run default image
	Prefix address - B0210000	Found image CRC OK; Decompressing
...........................
Well, looks OK; Let's go

Run it from 0x94001000

Boot messages at 0xA0000800
Target Name: vxTarget 
Attached TCP/IP interface to brgEnd unit 32
NFS client support not included.
CPU is Puma-S.
Board is SBV5220.
HW Revision is 0.0.0.2

SW Version is 16.1.2.13 (Build 14_Jul_06:1)
Creation Date/Time:  Jul 14 2006 / 17:47:19

SBV5220: MIPS Core speed is 125.00 MHz (200 Ticks per second)
Installed MIPS exception handler

Initialized BBIF









                  ***********************************
                  **   DOCSIS based Cable Modem    **
                  ***********************************


  PacketCable Version 16.1.3.12 (CableLabs) DOCSIS Version 16.1.2.13 (Build 14_Jul_06:1) - Creation Date/Time:  Jul 14 2006 / 17:47:19

   TurboDox Include 

usrNetInit2 entry
Bridge Initialization Successful.
Init BSP CB
USB_Init
0x94fffdf0 (tRootTask): DEBUG: ETHERNET END LOAD: emacLoad
0x94fffdf0 (tRootTask): After USB_Init

 New procedure for VLYNQ clock init 
 PGA type : TEMIC 1530
0x94e7a600 (CMRT): Used default US calibration table.
Cable Modem not in Standby Mode
HAL: Chip ID is `Puma_S`
InitCB
init RNDIS CB
Attaching network interface lo0... done.
0x94e7a600 (CMRT): Loading MTA End Driver...
0x94e7a600 (CMRT): Memory setup complete
0x94e7a600 (CMRT): Done loading MTA END.

 flash index = 0

 RAM index = 0

********        open tyCo/1 succeeds
Mot_UARTInit fd != ERROR,fd=b

 ***** Core - motfgm Ver 1.61

***********Init complete


>>>
Cable Modem Console
Type 'help' for list of commands

MAIN> Include TurboDox Version 1.3.1
HAL: Installing WDT protection...
HAL: Watchdog Timer installed.
Vendor Cold Start
Trying to synchronize ... 
Scanning frequency 501000000Hz
Scanning frequency 501000000Hz
Scanning frequency 507000000Hz
sScanning frequency 513000000Hz
caScanning frequency 519000000Hz
n Scanning frequency 525000000Hz
Scanning frequency 531000000Hz
0
Scan mode - OFF
MAIN> Scanning frequency 537000000Hz
help
Console Commands for this level:
 logout                        - Logout Telnet session.
 timeout                       - Telnet session timeout in secs (0=disable).
 config                        - Display configuration file.
 hwcounters                    - Shows HW counters.
 swcounters                    - Shows Vendor SW counters.
 ipcable                       - Print the cable modem IP address.
 macaddr                       - Display Cable MAC address.
 ping                          - Sends ping to <Dest> of <length> by <of>.
 phystatus                     - Display status of PHY.
 monitorphy                    - Start PHY monitoring.
 reboot                        - 'reboot 0' will reboot the cable modem.
 replevel                      - Update Report level (en/dis): repl <level_id>.
 scanmode                      - Set Scan Mode <en> (1-enable, 0-disable).
 status                        - Display current CM state.
 tuner                         - Program the tuner to <freq>(Mhz).
 goto                          - Tune to DS <freq>(Mhz) & US channel <ID>.
 ucd                           - Display current UCDs.
 upstatus                      - Upstream Status for SID <index>.
 dmesg                         - Display console msgs from restart.
 cleart4cnt                    - Clear T4 reset sw counter.
<<Press>>
 clearpingcnt                  - Clear ping watchdog reset sw counter.
 dir                           - Dir of Flashed Software Image Files.
 version                       - Software Version.
 vbShowStats                   - Display voice bridge statistics.
 vbResetStats                  - Clear voice bridge statistics.
 !                             - Execute the last command.
 help                          - Display this message.
 exit                          - Quit the console.
 FRP_dbg>                      - Frame Processor Debugger.
 atp>                          - Modem initiated tests.
 qos>                          - Quality of Service parameters.
 setup>                        - Configure modem parameters.
 debug>                        - General debug options.
 show>                         - Show modem parameters.
 vxshell>                      - VxWorks Shell commands.
 bpi>                          - Show BPI messages.
 battery>                      - Show Battery messages.
 certificates>                 - Certificate options.
 TurboDox>                     - TurboDox commands.
 appbypass                     - Bypass PacketCable Application.
<<Press>>
 mta_console>                  - MTA options.
MAIN> setup
Configuration parameters submenu
setup> help
Console Commands for this level:
 addcpe                        - Add new cpe to the learned cpe's.
 classification                - Set Classification (1=On or 0=Off).
 concat                        - Set Concatenation (1=On or 0=Off).
 default                       - Change CM mode to 'default'.
 igmpstart                     - Start IGMP task manually.
 scanreset                     - Reset scanning frequency cache.
 setopmode                     - Set Operational mode <index>.
 standby                       - Set Standby mode (1=On or 0=Off).
 rgenable                      - Sets RG on/off status (0 or 1).
 precharge                     - Set the PRECHARGE_ALWAYS flag (1=On or 0=Off).
 timestamp                     - Set the Console print timestamp flag (1=On or 0=Off).
 wdtdisable                    - Disable WDT.
 !                             - Execute the last command.
 help                          - Display this message.
 exit                          - Quit this sub-menu.
setup> exit
MAIN> debug
General debug submenu
debug> help
Console Commands for this level:
 collectmap                    - Collect Map Packets (0-stop, 1-collect for CMs
UC-id
2-collect all the mapp
other num-print).
 equadump                      - Dump equalization coeff.
 macread                       - Read from MAC register <reg>.
 macwrite                      - Write to MAC register <reg> the value <data>.
 mapdata                       - Transfer MAP msgs also to the software (0 or 1).
 read                          - Read from PHY register <reg>.
 write                         - Write <data> to PHY register <reg>.
 dump                          - Dump PHY registers.
 sread                         - Read from SRAM <addr> through MAC (in non-DMA mode).
 swrite                        - Write <data> to SRAM <addr> through MAC (in non-DMA mode).
 cerreset                      - Reset CER counter.
 sequthresh                    - Set the equ threshold <NUM> times 10 to the power of -<NUM>.
 gequthresh                    - Read the equalizer threshold.
 ustables                      - Read the equalizer threshold.
 set20                         - Set the CM to be DOCSIS 2.0.
 sethighDA                     - Add a Mac address to the DS High priority.
 setlowDA                      - Remove a Mac address to the DS High priority.
 addFilter                     - Add a Mac address to the DS filter table[indx,mac].
 remFilter                     - Remove a Mac address to the DS filter table.
 shFilter                      - Show the DS filter table.
<<Press>>
 printdscal                    - prints the DS cal table.
 cpuPerform                    - Show periodically <sec> CPU usage that performed <num> times.
 dml                           - DML <addr> [count].
 mml                           - Modify memory: mml <Addr> <long>.
 adcdump                       - Print out ADC dump.
 !                             - Execute the last command.
 help                          - Display this message.
 exit                          - Quit this sub-menu.
debug> exit
MAIN> version
Version Information:
Software - SBV5220-2.16.1.3-SCM09-SHPC
Hardware - 2.0.0
Boot LDR - Ver: 8.2.0, Date: 04-Dec-2003
CHIP_ID  - PUMAS
MAIN> 

[bbb]

Please provide a link to the bios dump.

I'll take a look at it.


BBB

[intArray]

Directory of Flash (Checking CRC, Please wait ...)
-> Sec#1 SBV5220-2.17.1.1-SCM09-SHNP.NN 1575776 CRC OK
Sec#2 SBV5220-2.16.1.1-SCM23-SHNP.NN 1533856 CRC OK


A full flash is address getram 90000000 400000

USBBDM Can you add support for this modem?

[tester5]

u can try to add in the def file the ranges......u might have to make your own DLL file do to anything more then that for example change mac etc.....


make your own test voip modem
code range
cfg range etc ......

[XinaPower]

using TTL serial adapter, at baud 9600 yeilds some [/code]

What software did you use? etherboot?

thks.

[XinaPower]

Directory of Flash (Checking CRC, Please wait ...)
-> Sec#1 SBV5220-2.17.1.1-SCM09-SHNP.NN 1575776 CRC OK
Sec#2 SBV5220-2.16.1.1-SCM23-SHNP.NN 1533856 CRC OK


A full flash is address getram 90000000 400000

USBBDM Can you add support for this modem?

I have a universal JTAG, but I don?t have the software to make the flash dump. Can someone please tell me were to find the JTAG software?
My JTAG is a parallel port interface.

Please help.
thks.