OsmocomDECT » Misc DECT hacks

{{>toc}}

h1. Gigaset Elements Base

This is a DECT [[ULE]] base station for a variety of _IoT_ style devices such as burgler alarm, switchable power sockets, etc.

FIXME: External Pictures

h2. Hardware

* Dialog SC14452 CR16C based DECT SoC

* Dialog LMX4181 RF frontend

* Winbond W9825G6KH-6 RAM

* SMSC 8720A Ethernet PHY

* MX25??? QSPI flash

{{thumbnail(20221211_104138.jpg)}}

{{thumbnail(20221211_104127.jpg)}}

{{thumbnail(20221211_104300.jpg)}}

{{thumbnail(20221211_104108.jpg)}}

{{thumbnail(20221211_104324.jpg)}}

{{thumbnail(20221211_104059.jpg)}}

h3. Connectors / Test Pads

h4. 3-pin UART header

There is an unpopulated 3-pin 2.54mm header on the board.  It has the following pin-out, in left-toright direction when looking at the component side of the PCBA with the ethernet jack facing downwards:

|_.Pin|_.Signal|

|left|P0 [1] / URX|

|center|GND|

|right|P0 [0] / UTX|

The voltage of the UART is about 3.2V; the data sheet states up to 3.45V should be fine, so a normal 3.3V UART should work.

h4. 2-pin jumper

There is an unpopulated 2-pin 2.54mm header on the board. It has the following pin-out, in left-toright direction when looking at the component side of the PCBA with the ethernet jack facing downwards:

|_.Pin|_.Signal|

|left|GND|

|right|P2 [5] / ADC1|

h4. Row of large test pads

There is a row of large (3mm?) test pads close to the unpopulated 3pin header / 2pin jumper. It has the following pin-out, in left-toright direction when looking at the component side of the PCBA with the ethernet jack facing downwards:

|_.Pin|_.Signal|

|1 (left)|P2 [5] / ADC1|

|2|6.5V voltage input|

|3|GND|

|4|P0 [1] / URX|

|5 (right)|P0 [0] / UTX|

h4. test pads on the back side

FIXME: Picture with annotations.  So far we know the single-wire JTAG pin.

h2. Open Source Tarball

In remarkably good compliance with the GNU GPLv2, Gigaset has published a tarball containing the _complete and corresponding_ soure code for the open source parts of the firmware.

h2. building

It can be built on a current (Debian 11) system, if you install the following dependencies:

<pre>

apt install genromfs build-essential default-jdk gcc-multilib lib32z1

dpkg --add-architecture i386

apt update

apt install liblzo2-2:i386

</pre>

After that, you shoul be able to compile it using the instructions from the README_BUILDING file that's in the source code.

h2. flashing

h3. entering the ROM boot-from-UART mode

The flashing process utilizes the SC14452 mask ROM _boot from UART_ feature.  In order to enable this, the UTX pin must be pulled to GND at startup.  So the sequence should be:

# place jumper between GND and UTX

# plug in the power supply

# remove the jumper

# plug in your UART cable

You will notice that in this mode (unlike the normal boot) all 3 LEDs will stay dark.

h3. Flashing via @uniprog.sh@

the @uniprog.sh@ script

* creates a combined flash image using the bootloader, recovery image, kernel image and file system image.

* performs the actual flashing using the @uartfp@ program.

While the flashing is in progress, you will note different LEDs blinking during the writing and the CRC check / verification phase.  It will take quite some time 7.5 minutes here), so be patient.

Note: Don't try to strace the @uartfp@ program, it will break the flashing process.

<pre>

HomeConnector_001.000.026/uniprog $ ./uniprog.sh

Creating empty file:

   size         0 kB

   file:       'reef_boot_rec_sys_fs.bin'

Inserting image file:

   file        'image452.bin'

   at offset    0

   size         131072

Inserting image file:

   file        '../reef_vmlinuz-recovery'

   at offset    131072

   size         819200

Inserting image file:

   file        '../reef_vmlinuz'

   at offset    950272

   size         2560000

Not creating new filesystem image.

Using old one: ../reef_fs.bin

Inserting image file:

   file        '../reef_fs.bin'

   at offset    3510272

   size         1138688

/tmp/HomeConnector_001.000.026 /tmp/HomeConnector_001.000.026/uniprog

/tmp/HomeConnector_001.000.026/uniprog

----------------------------------------------------------

 Image: / (size 4648960) created.

----------------------------------------------------------

To skip this question, you can assign serial port to environment variable PROGRAM_PORT or PORT

Please choose serial port:

1) ttyS0      3) ttyS2     5) ttyUSB0   7) ttyUSB2   9) ttyUSB4

2) ttyS1      4) ttyS3     6) ttyUSB1   8) ttyUSB3  10) ttyUSB5

#? 10

Programming HW via /dev/ttyUSB5

Please do following things:

1. Push "Program" button,

2. Push "Reset" button,

3. Pop "Reset" button,

4. Pop "Program" button.

Be patient

Programmer File Size 3464

Programmer File CRC 0x6E

Image File Size 4648960

Image File CRC 0x62

--- IDLE ---

Uart RX[1]=0xFE,...

state IDLE rec: 0xFE

--- IDLE ---

Uart RX[1]=0x02,...

state IDLE rec: 0x02

Uart TX[3]=0x01,...

Downloading programmer & image...

--- WAIT_ACK ---

Uart RX[1]=0x06,...

state WAIT_ACK rec: 0x06

ACK received, flashing loader (size 3464)...

Uart TX[3464]=0x04,...

--- WAIT_CRC ---

Uart RX[1]=0x6E,...

CRC expected 6E, received 6E CRC OK

Uart TX[1]=0x06,...

--- CHANGE_UART_BPS ---

--- PROG_IDLE ---

Uart RX[1]=0x05,...

Writing image header...

Uart TX[5]=0x03,...

--- PROG_WAIT_ACK ---

Uart RX[1]=0x07,...

Writing image (size 4648960)...

Uart TX[4648960]=0x70,...

--- PROG_WAIT_CRC ---

Uart RX[1]=0x07,...

Writing image (size 4648960)...

Uart TX[4648960]=0x70,...

--- PROG_WAIT_CRC ---

Uart RX[1]=0x62,...

PROG CRC expected 62, received 62 CRC OK

Uart TX[1]=0x07,...

Programming image ...

--- PROG_WAIT_COMP ---

Uart RX[1]=0x17,...

Flash programmed successfully

real    7m32.798s

user    0m0.008s

sys     0m0.460s

Done.

</pre>

h2. Unlocking the serial port

In the default firmware, the UART is locked (disabled) by the boot loader.  You can use it for the ROM boot loader (which executes before the cr16boot), but once you enter cr16boot, it is switched off.

In order to unlock it, there is a special build called @image452_service.bin@ which gets built in parallel to the normal production @image452.bin@ by the build process.

In order to install it, use @./uartfp 452fp.bin image452_service.bin /dev/ttyUSBx@ from the UART ROM boot mode.  It will overwrite the first 128kByte partition (boot loader) with the unlocked version.

<pre>

./uartfp 452fp.bin image452_service.bin /dev/ttyUSB5

Programmer File Size 3464

Programmer File CRC 0x6E

Image File Size 87804

Image File CRC 0x4A

--- IDLE ---

Uart RX[1]=0x00,...

state IDLE rec: 0x00

--- IDLE ---

Uart RX[1]=0xF0,...

state IDLE rec: 0xF0

--- IDLE ---

Uart RX[1]=0x00,...

state IDLE rec: 0x00

--- IDLE ---

Uart RX[1]=0x00,...

state IDLE rec: 0x00

--- IDLE ---

Uart RX[1]=0x00,...

state IDLE rec: 0x00

--- IDLE ---

Uart RX[1]=0x00,...

state IDLE rec: 0x00

--- IDLE ---

Uart RX[1]=0x02,...

state IDLE rec: 0x02

Uart TX[3]=0x01,...

Downloading programmer & image...

--- WAIT_ACK ---

Uart RX[1]=0x06,...

state WAIT_ACK rec: 0x06

ACK received, flashing loader (size 3464)...

Uart TX[3464]=0x04,...

--- WAIT_CRC ---

Uart RX[1]=0x6E,...

CRC expected 6E, received 6E CRC OK

Uart TX[1]=0x06,...

--- CHANGE_UART_BPS ---

--- PROG_IDLE ---

Uart RX[1]=0x05,...

Writing image header...

Uart TX[5]=0x03,...

--- PROG_WAIT_ACK ---

Uart RX[1]=0x07,...

Writing image (size 87804)...

Uart TX[87804]=0x70,...

--- PROG_WAIT_CRC ---

Uart RX[1]=0x4A,...

PROG CRC expected 4A, received 4A CRC OK

Uart TX[1]=0x07,...

Programming image ...

--- PROG_WAIT_COMP ---

Uart RX[1]=0x17,...

Flash programmed successfully

</pre>

When you now reboot the unit, you get serial console for bootloader and linux:

<pre>

    ,;:.                                        

  ;;;;;;;                                   :,

 ;;:    .                                   ;;

 ;;        ,   `;;;.  `:;;,   .;;:   `;;:  :;;:,

,;`       `;  :;;:;;, :;,:;: ,;:.;  .;;,;; ;;;;

:;        `;  ;:   ;,     :; ;;     ;:   ;. ;;

:;    ;;;.`; ,;    ;,  .:;;; ,;;.  `;....;: ;;

,;`   ..;.`; :;    ;, ;;,.:;  .;;; `;;;;;;: ;;

 ;;     ;.`; ,;`   ;,.;   :;    `;; ;`      ;;

 :;;   `;.`;  ;;  ,;,`;`  :; `   ;; ;;   .  ;;

  ,;;;;;;``;  `;;;;;, ;;;;:; ;;;;;   ;;;;;  ,;;;

    `..            :,  ``      .`     `.`     .

                  `:.                           

              ::.,::                            

              `::::

Sitelboot 1.0.3 (Dec 11 2022 - 19:29:16)

Runing on SC14452 SoC 

SiTelboot 

                code: 00f00000 -> 00f0fddc

                data: 00f139ec -> 00f15a28

DRAM Configuration:

Bank #0: 00020000 15 MB

Bank #1: 01080000 15 MB

MXIC: MX25L6405D (64-megabit)

FLASH Configuration:

Bank #0: 00000000 8 MB

Factory device ID=CFE8D287ED60B4B8393398706788C121

Factory MAC=7C:2F:80:EE:3D:A7

This is SERVICE U-Boot!

Hit any key to stop autoboot:  0 

....AutoBoot for SiTel 450 DK....

Booting from flash memory...

Booting from 'E8000'

## Booting image at 000e8000 ...

## Copy image from flash 000e8000 to ram 00a00000 ...

   Image Name:   

   Image Type:   CR16C+ 16 Bit Linux Kernel Image (gzip compressed)

   Data Size:    2335367 Bytes = 2280 kB = 2 MB

   Load Address: 000f4000

   Entry Point:  000f4000

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

commandline arguments position = 000f0000

commandline = 'ethaddr=7C:2F:80:EE:3D:A7 board_rev=RevB Giga94=false system_locked=false deviceid=CFE8D287ED60B4B8393398706788C121 booted_from=1'

Starting kernel ...

Linux version 2.6.19-uc1reef-g28ca9fc4-dirty (laforge@sunbeam.de.gnumonks.org) (gcc version 4.1.2) #5 Sun Dec 11 19:29:29 CET 2022

SC14450_VoIP version: v_1.0.29.1291 Tagged at: 

Version Status: NOT REPOSITORY VERSION  

Local compilation

Reef BS version 'bas-001.000.026' tagged at: 'unknown' version status: 'NOT REPOSITORY VERSION'

Reef BS hash 'bd35bcc4d561e2d4e268c01eb21aa615bb45dff8'

based on build version 'build-483' tagged at: '2013-10-01 11:19:13 +0200' version status: 'NOT REPOSITORY VERSION'

Repository compilation, .git found

RAM size: 0x1f10000, memory_end = 0x2000000

IRQ stack size 0x2000 at 00feeff8

freed bootmem 5b9000 1a47000

reserve bootmem 5b9000 3e4

IRQ stack + mem hole: reserved memory range 00fed000-0107ffff

Setting up paging 

commandline = 'root=/dev/mtdblock0 rootfstype=romfs ro earlyprintk=serial console=ttyS0 ip=dhcp panic=10 ethaddr=7C:2F:80:EE:3D:A7 board_rev=RevB Giga94=false system_locked=false deviceid=CFE8D287ED60B4B8393398706788C121 booted_from=1'

Built 1 zonelists.  Total pages: 11716

Kernel command line: root=/dev/mtdblock0 rootfstype=romfs ro earlyprintk=serial console=ttyS0 ip=dhcp panic=10 ethaddr=7C:2F:80:EE:3D:A7 board_rev=RevB Giga94=false system_locked=false deviceid=CFE8D287ED60B4B8393398706788C121 booted_from=1

PID hash table entries: 256 (order: 8, 1024 bytes)

platform_timer_setup () timer_int = 0x0007af31

disabling early console

Lnux version 2.6.19-uc1reef-g28ca9fc4-dirty (laforge@sunbeam.de.gnumonks.org) (gcc version 4.1.2) #5 Sun Dec 11 19:29:29 CET 2022

SC14450_VoIP version: v_1.0.29.1291 Tagged at: 

Version Status: NOT REPOSITORY VERSION  

Local compilation

Reef BS version 'bas-001.000.026' tagged at: 'unknown' version status: 'NOT REPOSITORY VERSION'

Reef BS hash 'bd35bcc4d561e2d4e268c01eb21aa615bb45dff8'

based on build version 'build-483' tagged at: '2013-10-01 11:19:13 +0200' version status: 'NOT REPOSITORY VERSION'

Repository compilation, .git found

RAM size: 0x1f10000, memory_end = 0x2000000

IRQ stack size 0x2000 at 00feeff8

freed bootmem 5b9000 1a47000

reserve bootmem 5b9000 3e4

IRQ stack + mem hole: reserved memory range 00fed000-0107ffff

Setting up paging 

commandline = 'root=/dev/mtdblock0 rootfstype=romfs ro earlyprintk=serial console=ttyS0 ip=dhcp panic=10 ethaddr=7C:2F:80:EE:3D:A7 board_rev=RevB Giga94=false system_locked=false deviceid=CFE8D287ED60B4B8393398706788C121 booted_from=1'

Built 1 zonelists.  Total pages: 11716

Kernel command line: root=/dev/mtdblock0 rootfstype=romfs ro earlyprintk=serial console=ttyS0 ip=dhcp panic=10 ethaddr=7C:2F:80:EE:3D:A7 board_rev=RevB Giga94=false system_locked=false deviceid=CFE8D287ED60B4B8393398706788C121 booted_from=1

PID hash table entries: 256 (order: 8, 1024 bytes)

platform_timer_setup () timer_int = 0x0007af31

disabling early console

Console: SC1445x on-chip UART channel 0

Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)

Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)

Memory: 25880k/31808k available (1095k kernel code, 5928k reserved, 243k data, 48k init)

Mount-cache hash table entries: 512

NET: Registered protocol family 16

NET: Registered protocol family 2

IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

TCP established hash table entries: 2048 (order: 3, 32768 bytes)

TCP bind hash table entries: 1024 (order: 2, 20480 bytes)

TCP: Hash tables configured (established 2048 bind 1024)

TCP reno registered

JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.

ROMFS MTD (C) 2007 Red Hat, Inc.

cryptodev : SC14452 HW Crypto engine  des(ecb/cbc) 3des(ecb/cbc) aes(ecb/cbc/ctr)

io scheduler noop registered

io scheduler deadline registered (default)

Initializing watchdog driver for SC14452 ...

Watchdog initialized, but not started.

SC1445x on-chip UART

ttyS0 at MMIO 0xd (irq = 5) is a sc1445x_uart

eth0: SC14452_EMAC found at ff2000, 

 EMAC DEVICE ADDRESS:  7c 2f 80 ee 3d a7

register 0x1F=[40] cnt=500 tmp1=[1] 

Eth speed: Still auto negotiating 

SC14452 EMAC dev_irq: 2

Probe for eth0

init_mtdram: __xip_romfs_start=00252000, __xip_romfs_end=0058e000

m25p80 spi0.0: MX25L6405D/MX25L6445E (8192 Kbytes)

Creating 13 MTD partitions on "m25p80":

0x00000000-0x00001000 : "Loader"

0x00001000-0x00020000 : "Bootloader"

0x00020000-0x000e8000 : "Recovery"

0x000e8000-0x00359000 : "Linux1"

0x00359000-0x0046f000 : "FS1"

0x0046f000-0x006e0000 : "Linux2"

0x006e0000-0x007f6000 : "FS2"

0x007f6000-0x007fe000 : "Factory"

0x007fe000-0x00800000 : "Env"

will reboot on crash

0x00000000-0x00800000 : "All Flash Contents"

0x000e8000-0x0046f000 : "Firmware1"

0x0046f000-0x007f6000 : "Firmware2"

0x007fe000-0x007ff000 : "Crashdump"

sc1445x-spi sc1445x-spi.0: SC1445x SPI Controller Driver, Version 1.0

sc1445x-spi sc1445x-spi.1: SC1445x SPI Controller Driver, Version 1.0

input: paging as /class/input/input0

gpio-key gpio-key.0: Registered new button: paging

Registered led device: power

Registered led device: network

Registered led device: cloud

TCP bic registered

TCP cubic registered

TCP westwood registered

TCP htcp registered

TCP scalable registered

NET: Registered protocol family 1

NET: Registered protocol family 17

VFS: Mounted root (romfs filesystem) readonly.

Freeing unused kernel memory: 48k freed

init started: BusyBox v1.20.2 (2022-12-11 19:29:09 CET)

doing rcS

Starting /etc/init.d/S10mountall.sh

Looking for MTD device 'FS1' ... /dev/mtdblock5 found!

Starting /etc/init.d/S11factory.sh

Starting /etc/init.d/S11logging.sh

Starting local logging: OK

Starting /etc/init.d/S12leds.sh

Starting /etc/init.d/S13check_sha256.sh

Starting /etc/init.d/S15features.sh

Starting /etc/init.d/S30hostname.sh

Starting /etc/init.d/S31loopback.sh

Starting /etc/init.d/S33iplugd.sh

Starting /etc/init.d/S34dectdata.sh

[mac_open]

EMAC: Link NOT detected

Starting /etc/init.d/S34sysctl.sh

Starting /etc/init.d/S36inetd.sh

System unlocked - starting inetd

Starting /etc/init.d/S39date.sh

BNFMT_FLAT: bad header magic

BINFMT_FLAT: bad header magic

S39date.sh: applet not found

Starting /etc/init.d/S40reef.sh

Key file /mnt/data/cert/cert.key already exists. Skipping generation.

CSR file /mnt/data/cert/cert.csr already exists. Skipping generation.

(LOG) CoIn: DB 'cloud' is OK

(LOG) CoIn: DB 'heartbeat' is OK

(LOG) CoIn: DB 'settings' is OK

REEF basestation with id CFE8D287ED60B4B8393398706788C121 is being started ...

(LOG) JBusServer: JBus server is running ...

Wtchdog is working and will generate NMI.

(LOG) JBusWatchdog: Watchdog is enabled

Running /usr/bin/coco in normal mode

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

sh: can't execute '/usr/bin/sens': No such file or directory

(LOG) TransactionManager: TRAM is up

(LOG) JBusServer: Thread 141 was created for new client with file descriptor 7.

(LOG) JBusServer: Thread 138 was created for new client with file descriptor 4.

sh: can't execute '/usr/bin/pyta': No such file or directory

Done.

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 149 was created for new client with file descriptor 8.

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 150 was created for new client with file descriptor 9.

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 151 was created for new client with file descriptor 10.

json_object_from_file: error reading file /mnt/data/endnodes: No such file or directory

(WRN) JBusServer: Client with fd 4 is down

(WRN) JBusServer: File: server.c, line: 120, func: ReceiverThread

(LOG) JBusServer: Thread 138 for client 4 will be terminated, because client is down

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 153 was created for new client with file descriptor 11.

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 155 was created for new client with file descriptor 4.

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 156 was created for new client with file descriptor 13.

Starting /etc/init.d/S50ubootscript.sh

arg.verbose = 1, arg.logMask = 0x07

(LOG) coco: ready!

rxdect452: module license 'Proprietary' taints kernel.

rtxdectstack: Loading SC14452 DECT Stack

rtxdectstack: Version: NATALIEV3_FPCVM_V1018, Build date: 2013/09/17, 13:15

Starting /etc/init.d/S60private.sh

Opened '/dev/dect' (3)

Opened '/dev/dectdbg' (4)

sixLowpanBorderRouterInit(2001:5254:5800:0000::1)

Our IPv6 address = 2001:5254:5800:0000:7e2f:80ff:feee:3da7

Ckipping IPv6 DAD, setting 2001:5254:5800:0000:7e2f:80ff:feee:3da7 as preferreDdE

 TS kMiApCp iinngt eIrPrvu6p tDhADa,n dsleetrt iinngs tfael8l0e:d0!0 0

0:0000:0000:?*???2??????"??

???5????jR??iU?            ????????5(?QA?????????????????????Sb?????????????????zj?????????????5R?eE"??????????M??????b??????Q??????5????????b??????Q??????5???????b??????

               ?&$*??%???I???????J????????????????????????2???????????????????????????????????????????&&HL??LN??0 28 01 ff ff ff 20 00 2c 00 ff ff ff ff ff ff ff ff ff ff ff ff 01 00 00 03 3a 80 00 5e 03 80 0f 40 00 53 03 80 0a 20 00 48 03 80 2a 10 00 46 03 80 2a 10 00 43 03 80 44 10 00 41 03 80 22 .G.$.l8%u............................ (.... .,.................:..^...@.S... .H..*..F..*..C..D..A.."

dectUleJbusConnect()

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 172 was created for new client with file descriptor 12.

DECT config file '/mnt/data/uleapp.conf' not found

API-SEND 4FFE ProdTestReq ( 6) fe 4f 00 03 00 00 .O....

API-SEND 4FFE ProdTestReq ( 6) fe 4f 06 02 00 00 .O....

API-SEND 4FFE ProdTestReq ( 6) fe 4f 1c 00 00 00 .O....

dectUleLoop(apifd = 3, dbgfd = 4, listensd = 0, rawrecvsd = 6)

API-RECV 4702 FpLinuxInitCfm (34) 02 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .G................................

uleStackStart()

API-SEND 410D FpMmStartProtocolReq ( 2) 0d 41 .A

API-SEND 4188 FpUleInitReq ( 4) 88 41 30 00 .A0.

API-SEND 5500 LasStartSessionReq ( 5) 00 55 08 00 00 .U...

API-SEND 418C FpUleGetRegistrationCountReq ( 2) 8c 41 .A

API-SEND 4002 FpGetFwVersionReq ( 2) 02 40 .@

API-RECV 00CE V24TxCmd ( 9) ce 00 03 00 02 1f 84 82 00 .........

API-RECV 4FFF ProdTestCfm ( 7) ff 4f 00 03 01 00 07 .O.....

  Opcode = 0x300, ParameterLength = 1

API-RECV 00CE V24TxCmd ( 9) ce 00 03 00 02 35 75 00 bb .....5u..

API-RECV 4FFF ProdTestCfm ( 8) ff 4f 06 02 02 00 75 00 .O....u.

  Opcode = 0x206, ParameterLength = 2

API-RECV 00CE V24TxCmd (12) ce 00 06 00 02 75 03 24 c8 6c 38 03 .....u.$.l8.

API-RECV 4FFF ProdTestCfm (11) ff 4f 1c 00 05 00 03 24 c8 6c 38 .O.....$.l8

  Opcode = 0x1c, ParameterLength = 5

DECT params from NVS:

  bandgap   = 0x07

  clockfreq = 0x0075

  rfpi      = 0x0324C86C38

API-RECV 4189 FpUleInitCfm ( 7) 89 41 00 30 00 5f 00 .A.0._.

  Status = 0 (OK), MaxUlpDevices = 48, UpLinkBuffers = 95

API-RECV 418D FpUleGetRegistrationCountCfm (14) 8d 41 00 06 30 01 07 02 00 00 00 00 00 00 .A..0.........

API-SEND 418E FpUleGetDeviceIpuiReq ( 3) 8e 41 07 .A.

  Status = 0, NoDevices = 1, MaxNoDevices = 48, MaxNoHs = 6, Length = 7, devices = { 7 }

uleStackReady(1)

API-RECV 4003 FpGetFwVersionCfm (27) 03 40 00 18 10 00 00 13 09 17 13 15 00 0c 00 0e 00 04 1a 65 00 00 0c 00 02 03 04 .@.................e.......

  Status = 0, VersionHex = 0x00001018, date = 2013-09-17 13:15

API-RECV 5501 LasStartSessionCfm (19) 01 55 08 01 00 00 00 00 00 00 ff 06 00 01 10 03 02 0c 10 .U.................

  sessionId = 1, ListIdentifier = 8, NoOfEntries = 0, RejectReason = 255, p->IeLength = 6

API-SEND 5502 LasEndSessionReq ( 4) 02 55 01 00 .U..

API-RECV 418F FpUleGetDeviceIpuiCfm ( 9) 8f 41 00 07 03 24 c3 f4 1f .A...$...

  Status = 0 (OK), PpId = 7, IPUI = 03:24:C3:F4:1F

uleStackReady(2)

API-RECV 5503 LasEndSessionCfm ( 4) 03 55 01 00 .U..

  sessionId = 1

reefbs login: (LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 183 was created for new client with file descriptor 14.

(LOG) coco: Waiting for message ...

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 184 was created for new client with file descriptor 16.

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 187 was created for new client with file descriptor 15.

(LOG) coco: Waiting for message ...

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 188 was created for new client with file descriptor 17.

(LOG) coco: Waiting for message ...

[mac_open]

EMAC: Link NOT detected

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 208 was created for new client with file descriptor 18.

(LOG) coco: Link down!

(WRN) JBusServer: Client with fd 18 is down

(WRN) JBusServer: File: server.c, line: 120, func: ReceiverThread

(LOG) JBusServer: Thread 208 for client 18 will be terminated, because client is down

(LOG) JBusServer: Ready

(LOG) JBus-Client: Connection with server was closed

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 219 was created for new client with file descriptor 18.

(LOG) coco: New logger cfgmask=9801

(WRN) JBusServer: Client with fd 18 is down

(WRN) JBusServer: File: server.c, line: 120, func: ReceiverThread

(LOG) JBusServer: Thread 219 for client 18 will be terminated, because client is down

(LOG) JBusWatchdog: Added new client to JBus Monitor (ClientId=132; name:coco)

(LOG) JBusWatchdog: Added new client to JBus Monitor (ClientId=146; name:uleapp)

(LOG) JBusWatchdog: Added new client to JBus Monitor (ClientId=145; name:qpa)

(LOG) JBusWatchdog: Added new client to JBus Monitor (ClientId=137; name:TransactionManager)

(LOG) JBusWatchdog: Added new client to JBus Monitor (ClientId=133; name:Heartbeat)

(LOG) JBusWatchdog: Added new client to JBus Monitor (ClientId=130; name:COMA-Server)

json_object_from_file: error reading file /mnt/data/cfg/firmware_cfg: No such file or directory

json_object_from_file: error reading file /mnt/data/cfg/firmware_inprogress: No such file or directory

(LOG) JBusServer: New client from IP 127.0.0.1 was added.

(LOG) JBusServer: Thread 232 was created for new client with file descriptor 19.

(LOG) coco: Link down!

(WRN) JBusServer: Client with fd 19 is down

(WRN) JBusServer: File: server.c, line: 120, func: ReceiverThread

(LOG) JBusServer: Thread 232 for client 19 will be terminated, because client is down

reefbs login: 

</pre>