This cable VoIP router is nearly identical to the Thomson THG520 and Scientific Atlanta DXP2213 Webstar

WIP

Note: This will void your warranty!

• There are four torx screws holding the bottom and top halves of the case together.

       |---|
front  | o | 3.3V  (pin 1)
 of      o | GND
 the     o | Tx
board  | o | Rx
       |---|

BCM3349A0 100000010346890 MemSize:16M Flash detected @0xbe000000 Signature:e003 Scientific Atlanta BootLoader Version: V2.1.6r Build Date: Feb 25 2005 Build Time: 11:07:51 IMG1 Program Header: Signature:e003 Control:0005 Major Rev:0002 Minor Rev:0000 Build Time:2005/4/22 07:19:51 Z File Len:1662730 bytes Load Addr:80010000 Filename:epx2203-v202r1152-050419c-eu-5.bin HCS:610a CRC:3f359461 IMG2 Program Header: Signature:e003 Control:0005 Major Rev:0002 Minor Rev:0000 Build Time:2005/4/22 07:19:51 Z File Len:1662730 bytes Load Addr:80010000 Filename:epx2203-v202r1152-050419c-eu-5.bin HCS:610a CRC:3f359461 Enter '1','2', or 'p' within 2 seconds or take default.. . . Performing CRC on IMG2.. Decompress LZMA IMG.. Target Addr:0x80010000 .......................... Decompressed length:6815995 Executing IMG2.. eCos - hal_diag_init Init device '/dev/BrcmTelnetIoDriver' Init device '/dev/ttydiag' Init tty channel: 80656c20 Init device '/dev/tty0' Init tty channel: 80656c40 Init device '/dev/haldiag' HAL/diag SERIAL init Init device '/dev/ser0' BCM 33XX SERIAL init - dev: 0.0 Set output buffer - buf: 8075c1d8 len: 2048 Set input buffer - buf: 8075c9d8 len: 2048 BCM 33XX SERIAL config 0x0000000a [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver... 0x00000014 [tStartup] FlashDeviceDriver::PlaceRegions: (Flash Driver C API) WARNING - Permanent NonVol would fit in the boot block of this flash device, but I found existing NonVol at the end of Image 1; using this location instead... 0x0000001e [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver... 0x0000001e [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver... 0x00000028 [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver... 0x00000028 [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully. 0x00000032 [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices... Detecting the next image number that we will store to by default... 0x3c Computing CRC32 over image2 to ensure that it is valid... 0x136 Done computing CRC32! By default, we will dload to image number 1! By default, we will dload to block number 0! 0x00000136 [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully. HW BOARD VERSION detected from GPIO[0~4] is 0x1e Attention:skip_GPIO_manualMode Function: SetHardcodeVendorProfile Got Attached ProfileRawData ok Reading Permanent settings from non-vol... Checksum for permanent settings: 0x935d467a Settings were read and verified. Reading Dynamic settings from non-vol... Checksum for dynamic settings: 0x498f4aa0 Settings were read and verified. Creating SNMP agent cablemodem agent Creating BcmEmtaCommandTable Creating DOCSIS Control Thread... vvv Interface creation and driver startup beginning vvv -> Begin DOCSIS CM WAN interface Creating HAL object for the DOCSIS CableModem interface Registering DOCSIS CableModem driver INTC->RevID = 334900A0, MAX_US_QUEUES = 16, numUsQueuesConfigured = 16 0x000001ae [Telnet Thread] BcmTelnetThread::ThreadMain: (Telnet Thread) Telnet server thread running... BcmMacInit: advMapRunAheadTimeMin = 2048 (0x00000800) 10.24 MHz ticks, 200 usec 0x00000582 [tStartup] BcmDocsisCmHalIf::Register: (DOCSIS CableModem HalIf) CM HAL reports h/w support for PHS, bitmask=0x3 0x00000582 [tStartup] BcmDocsisCmHalIf::Register: (DOCSIS CableModem HalIf) CM HAL reports h/w support for PHS, size=64 bytes. -> End DOCSIS CM WAN interface -> Begin Ethernet LAN interfaces Creating HAL object for the Ethernet interface Registering Ethernet driver -> End Ethernet LAN interfaces -> Begin USB LAN interface Creating HAL object for the USB interface Registering USB driver -> End USB LAN interface -> Begin IP Stack interfaces -> Starting V2 DHCP Client subsystem... Creating HAL object for IP Stack1 (MAC Addr=00:14:f8:xx:xx:xx) DHCPc: Created default DHCP lease for IP Stack1 using client id htype=1, value=00:14:f8:3b:5d:1a; auto-config enabled (IP, subnet, router). Registering IP Stack1 driver Tcpip NI: Init - RegisteredStackCount = 1 Creating HAL object for IP Stack2 (MAC Addr=00:14:f8:xx:xx:xx) DHCPc: Created default DHCP lease for IP Stack2 using client id htype=1, value=00:14:f8:3b:5d:1c; auto-config enabled (IP, subnet, router). Registering IP Stack2 driver Tcpip NI: Init - RegisteredStackCount = 2 Creating HAL object for IP Stack3 (MAC Addr=00:14:f8:xx:xx:xx) DHCPc: Created default DHCP lease for IP Stack3 using client id htype=1, value=00:14:f8:3b:5d:1d; auto-config enabled (IP, subnet, router). Registering IP Stack3 driver Tcpip NI: Init - RegisteredStackCount = 3 IP Stack4 not enabled or failed to create and start interface; no other stacks will be loaded. -> End IP Stack interfaces ^^^ Interface creation and driver startup complete ^^^ Creating the PacketCable Forwarder... Adding IP Stack2 HalIf to the PacketCable Forwarder Calling BcmCmDocsisSystem::PostDriverInitialization()... Creating the DOCSIS Forwarder... Adding DOCSIS CableModem HalIf as the default interface to the DOCSIS Forwarder Adding Ethernet HalIf to the DOCSIS Forwarder Adding USB HalIf to the DOCSIS Forwarder Adding IP Stack1 HalIf to the DOCSIS Forwarder Adding IP Stack3 HalIf to the DOCSIS Forwarder Linking Docsis and PacketCable packet switches... Adding DOCSIS Embedded Interface HalIf as the default interface to the PacketCable Forwarder Adding PacketCable Embedded Interface HalIf to the DOCSIS Forwarder Current IP address is default 0.0.0.0. 0x000005f0 [tStartup] BcmEcosIpHalIf::ConfigureLeaseImpl: (IP Stack3 HalIf) Configuring IP stack 3: IP Address = 192.168.100.1 (primary IP address) Subnet Mask = 255.255.255.0 Router = 192.168.100.254 IsPrimaryInterface = 0 Creating Propane Control Thread... Propane version: 2.0.1 (28 Oct 2002) Instantiating CmSnmpAgent object. T-LinuxAgent:AgentInitSnmp Starting SNMP subsystem Registering STP Filter Snoop with all interfaces. Registering DOCSIS MIB Filter Snoop with CPE and WAN interfaces. LX- Now in AgentStartSnmp() LX-AgentStartSnmp: DON'T think we need to go here - so don't:::: init_mib !!!! WARNING: netsnmp_brcm_create_tstring called with no address! NOT Calling VacmTest for debug users NOT STARTING THE LOCAL snmp thread!! - must be using the v2 LX- Now in AgentStartSnmp() - finished ===> WARNING: Can't add httpMgmtGroup @ 0x80da41c8 to iso, group already exists. 0x0000091a [tStartup] BcmDocsisCmHalIf::RegisterSnmpObjects: (DOCSIS CableModem HalIf) Interface 10 additional registration w/ SNMP agent OK. 0x00000992 [tStartup] BcmPacketSwitchBridgingHalIf::RegisterSnmpObjects: (PacketCable Embedded Interface HalIf) Interface 28 additional registration w/ SNMP agent OK. CmSnmpAgent installing views... Vendor CM Agent w/ BRCM Factory Support setting V1/V2 view to unrestricted Vendor CM Agent w/ BRCM Factory Support installing engine ID... Vendor CM Agent w/ BRCM Factory Support installing context... Creating SNMP agent CPE diag agent CPE diag agent disabling management. CPE diag agent defering traps. LX- Now in AgentStartSnmp() LX- Now in AgentStartSnmp() - finished Vendor CPE Agent w/ BRCM Factory Support setting V1/V2 view to unrestricted Vendor CPE Agent w/ BRCM Factory Support installing engine ID... Vendor CPE Agent w/ BRCM Factory Support installing context... Vendor CPE Agent w/ BRCM Factory Support setting V1/V2 view to docsisCpeView Vendor CPE Agent w/ BRCM Factory Support ConfigIp: Ip=192.168.100.1, Subnet=255.255.255.0, Gateway=0.0.0.0 Vendor CPE Agent w/ BRCM Factory Support enabling management. Vendor CPE Agent w/ BRCM Factory Support sending deferred traps... Done w/ deferred traps. BcmSnmpThread starting thread operation. SNMP startup complete. kConsoleIsReadWrite fpBridge is Not Null !!! 0x00000d34 [tStartup] BcmVendorCmApplication::CreateDhcpServer: Configuring the DHCP server with 50 leases from 192.168.100.10 -> 192.168.100.60; lease time is 30 seconds. 0x00000d48 [tStartup] BcmVendorCmApplication::StartDhcpServer: Starting DHCP Server! Reseting the 3341BOS: Enter bosInit BOS: Exit bosInit INFO: mtaInit() - CM Client is calling MTA. Creating SNMP agent EMTA agent mtaAddBannerInfo is NULL! EMTA agent entering RFC-2576 Coexistence security mode. EMTA agent setting V1/V2 view to coexistenceView EMTA agent entering Basic/Hybrid flow provisioning mode. INFO: mtaInit() - Registering MTA Interface in the CM client. INFO: mtaInit() - Initializing MTA NVRAM Area. initBlindData: nvramSize=700 mtaNvCalcChecksum: checksum=0x36adbec8 MTA : Init MTA Configuration from NonVol..O.K. MTA : Register for CM VSIFs 00x00000e42 [aoRT] AppResetRootTask: (cxc-BOS) bosAppRootTask() - Is it morning already? Spawning app task (epoch #0)... 0x00000e56 [aoRT] bosTaskCreateMain: (cxc-BOS) TaskCreate - spawn new task aoAP 0x00000e56 [IpsecTimer] IpsecTimer::ThreadMain: Entering... x00000e60 [DHCP Server Thread] BcmDhcpServerThread::ThreadMain: (DHCP Server Thread) DHCP Server starting...waiting for events... CC: Initialization starting... ccInit: Initialization starting... INFO: cmInit() - CM-MTA Interface Proxy init... INFO: activate CM-MTA interfaces for SNMP Communication... INFO: cmInit() - MTA is waiting until CM is Ready (Ranged, DHCP-ed, TFTP-ed, TOD-ed)... Vendor CM Event Log initializing with stored events. LX- Now in AgentStartSnmp() LX- Now in AgentStartSnmp() - finished BatteryMissing Event log initialization complete. 0x00000fdc [tStartup] BcmPacketSwitchBridgingHalIf::RegisterSnmpObjects: (DOCSIS Embedded Interface HalIf) Interface 29 additional registration w/ SNMP agent OK. ===> WARNING: Failed to register TabularMibBridge 1.3.6.1.4.1.4491.2.1.14.1.1.1 to agent Vendor CM Agent w/ BRCM Factory Support ===> Object not found on agent. ===> WARNING: Failed to register TabularMibBridge 1.3.6.1.4.1.4491.2.1.14.1.1.2 to agent Vendor CM Agent w/ BRCM Factory Support ===> Object not found on agent. emta factory agent installing engine ID... emta factory agent installing context... emta factory agent setting V1/V2 view to emta factory agent setting V1/V2 view to docsisNmAccessView Checking board manufacturing state... Board appears to be manufactured OK. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@# @@@@@@@@@@@@@@@@@@@@@@@@@@##@###@@@@@@@@@@@@@@@@@@@@@@@@# @@@@@@@@@@@@@@@@@@@@@@@###@@@@# ####.@#@@@@@@@@@@@@@@@@@# @@@@@@@@@@@@@#####@@@@###@@@@@# ,#@@@ -#####@@@@@@@@@@@# @@@@###, : #@@@# #@## #@@@@@@@@@# @-------------------------- ## :@@@# ##@@@@@@@# ------------------------------- #@@#, ##@@@@@@# ------------------------------ --- .@# #@@@@@@# ----------------------------- ----- #@@@@@# ---------------------------- ------ /#@@@@# -------------------------- ------ --- ##@@# ------------------------- ------- ----- @## ----------------------- ------- ----- ---------------------- -------- ----- -------------------- -------- ----- - ------------------ -------- ------ -- ---------------- --------- ------ --- ------------- --------- ------- ---- ----------- --------- ------- ---- -------- ---------- -------- ---- ------ ----------- ------- ----- --- ----------- -------- ----- ----------- -------- ----- ------------ --------- ----- ------------ --------- ------ ------------- --------- ------ Scientific-Atlanta WebSTAR EMTA +-------------------------------------------------------------------+ | | | ********** * | | ********** *** | | ** ** ** ** | | ** ** ** ** | | **** ** ** | | **** ** ** | | ** ** ** | | ** ** ** | | **** ********** | | **** ********** | | ** ** ** ** | | ** ** ** ** | | ********** ** ** | | ********** ** ** | | | | Copyright (c) 2000 - 2004 Scientific Atlanta, Inc | | Portions are Copyright (c) 1999 - 2004 Broadcom Corporation | | CxC 3.5.8 | | CM 3.5.10 | | | | Revision: v2.0.2r1152-050419 | +-------------------------------------------------------------------+ Running the system... Beginning Cable Modem operation... Beginning MTA operation... 0x00001194 [Scan Downstream Thread] BcmVendorCmDownstreamScanThread::ThreadMain: (Scan Downstream Thread) Scanning for a Downstream Channel... Scanning DS Channel at Starting Frequency : 578000000 Hz... Type 'help' or '?' for a list of commands... CM> Scanning DS Channel at Vendor NonVolSetting : 578000000 Hz... Scanning DS Channel at Vendor NonVolSetting : 570000000 Hz... Scanning DS Channel at Vendor NonVolSetting : 586000000 Hz... Scanning DS Channel at Vendor NonVolSetting : 562000000 Hz... Scanning DS Channel at Vendor NonVolSetting : 554000000 Hz... Scanning DS Channel at Vendor NonVolSetting : 842000000 Hz... Scanning DS Channel at Vendor NonVolSetting : 321000000 Hz... Scanning DS Channel at Power-Up List: 130750000 Hz... Scanning DS Channel at Power-Up List: 236000000 Hz... Scanning DS Channel at Power-Up List: 514750000 Hz... Scanning DS Channel at Power-Up List: 122500000 Hz... Scanning DS Channel at Power-Up List: 162000000 Hz... Scanning DS Channel at Power-Up List: 307750000 Hz... Scanning DS Channel at Power-Up List: 313750000 Hz... Scanning DS Channel at Power-Up List: 319750000 Hz... Scanning DS Channel at Power-Up List: 325750000 Hz... Scanning DS Channel at Power-Up List: 465000000 Hz... Scanning DS Channel at 858000000 Hz... Scanning DS Channel at 850000000 Hz... Scanning DS Channel at 842000000 Hz... Scanning DS Channel at 834000000 Hz... Scanning DS Channel at 826000000 Hz...

How to connect to JTAG interface, and how to reflash the device with JTAG tools

See port.jtag for more JTAG details.

WIP

WIP

WIP

WIP

WIP

2Buttons : PCB reset and modem Reset