Some package repositories are configured point to directories below:
http://delos.devolo.net/5.10.3/palma/
and
http://delos.devolo.net/5.10.3/ipq/
Not all of them exist however and some packages installed on the device do not seem to be in the directories that are there.
The command ghn_console provides insight in the G.hn powerline network. The ver command outputs a version number that seems to fit in the numbering scheme used by the Magic 2 LAN firmware (the device without WiFi that doesn't seem to use OpenWRT). Possibly the G.hn device runs fully independently and this is the entry point into it.
I do not see a distinct ethernet device for the G.hn interface. The one listed is using the MAC address of the LAN interface and is according to brctl only bridge with the wireless interfaces. I suspect that there is another independent switch and the G.hn interface and UTP wired ethernet interface are hooked up together to that. This independent separate environment might resemble a Magic 2 LAN, but running a lighter version of its firmware.
The ghn_console tool thus gives entry into that separate device. It also has its own filesystem. Here some commands:
#delos@/>help
Console Help
-------------
h/help -> Show this help
q/quit -> Quit the console
exit -> Exit Console Session
uid -> Return Console User Id
.. -> Go up one menu
/ -> Go to root menu
ls [-a] -> List commands in current menu (-a: extended)
lsall [-a]-> List ALL commands and menus in the console (-a: extended)
his -> Command history
run <file>-> Executes commands present in <file> located in FFS
OK
#delos@/>ls
Name Alias Description
---- ----- -----------
activatesocket as Activate the socket console task.
afe/ afe/ Analog Front End Commands
agc/ a/ Automatic Gain Control Commands
apiver av Information about the API version
assert/ asrt/ Assert Commands
bpcdriver/ bpcdr/ Bpcdriver commands
bridge_tables/ bft/ Commands for the bridge forwarding table
bridgedriver/ b/ Bridgedriver commands
channelestimator/ chest/ Channel Estimator commands
cldriver/ cld/ Cl Driver commands
clock/ clock/ Clock commands
configlayer/ cfl/ Configuration Layer related commands
consoleexit ce Change Console exit mode, set timeout time or get num of timeouts. Usage: ce e [0|1]|ce t <seconds>|ce tg
crypto/ cr/ Crypto commands
didm/ didm/ DIDMng commands
dns/ dns/ DNS commands
dro/ dro/ DRO Driver commands
ethifdriver/ ethd/ Ethernet interface driver commands
ethphyconf/ ethp/ EthPhyConf commands
factoryreset/ frst/ Factory Reset-related commands
filesystem/ fs/ File System related commands
flash/ flash/ HDL Flash commands
flowmanager/ flm/ Flow Manager commands
flup/ flup/ Flash Upgrade commands
hw/ hw/ Hardware-related commands
info i General information about the modem
lcdu/ lcdu/ LCDU commands
lcmp/ lcmp/ Lcmp commands
linkadaptation/ la/ Link_adaptation commands
linktable/ lt/ Link Table commands
macdriver/ md/ Macdriver commands
machal/ msh/ MacHAL commands
macsynch/ ms/ MAC commands
malloc/ malloc/ Malloc commands
mapmanager/ map/ MAP manager commands
masterselection/ msel/ Master Selection commands
mcast/ mcast/ Mcast commands
measuremanager/ measm/ Measure Manager commands
memoryController/ mc/ Memory Controller Debug commands
mnmtmsgmng/ m3/ MnmtMsgMng commands
mode mode Change Console mode. Usage: mode [user|admin <password>]
nap/ nap/ Nap commands
ndim/ ndim/ Ndim commands
net/ n/ NET Commands
networkclock/ nc/ Network Clock Driver commands
node/ node/ L2 Database commands
osinfo/ os/ Display information about OS Execution
packetdet/ pckd/ PacketDetector commands
pairing/ pair/ Pairing commands
password passwd Change Local Console Password
phydriver/ phy/ Phydriver commands
plcmng/ pm/ PLC Manager commands
posix/ posix/ POSIX layer management
powersaving/ powsav/ POWER SAVING console commands
qadriver/ qadriver/ QA Driver debug commands.
qossynch/ qs/ QoS commands
queueconfig/ qconf/ QueueConfig commands
rfa/ rfa/ Rfa commands
rtm/ rtm/ RTM commands
sync/ s/ Sync console commands
syslog/ log/ System log configuration
system_manager/ sys/ System Manager Commands
tcpip/ tcpip/ TCPIP stack manipulation
topologymanager/ topo/ Topology Manager commands
txmodes/ tm/ Transmission Modes console commands
version ver Information about the firmware
watchdog/ w/ Watchdog Commands
OK
#delos@/>fs
OK
#delos@/filesystem/>ls
Name Alias Description
---- ----- -----------
aginginfo aginfo Show flash erase statistics
blockinfo blinfo Show internal ffs block structure
cat c Shows the content of a file directly in console. Usage cat <file>
cd cd Changes directory. Usage cd <new firectory>
chdrv cdr Changes the current drive. Usage chdrv <drive number (0, 1...)>
crcval crc Check CRC (for image files only!). Usage crcval <file>
delete del Removes a file. Usage delete <file>
dir dir Shows the content of the current directory
flashfilesysmount ffsm Mount Flash File system and start ConfigLayer. Usage flashfilesysmount
flashfilesysunmount ffsu Unmount Flash File system and stop Configlayer. Usage flashfilesysunmount
hexdump hd Shows the content of a file in HEX/ASCII format. Usage hexdump <file> [offset [size]]
mkdir md Creates a new directory. Usage mkdir <new directory>
move mv Renames a file. Usage move <old name> <new name>
new n Creates a new file. Usage new <file> <length> [content]
permits pmt Set/Get permits to file or directory. Usage: permits <path> [+RO|-RO]
pwd pwd Prints current working directory
ramdiskmount rdm Mount RAM Disk. Usage ramdiskmount
ramdiskunmount rdu Unmount RAM Disk. Usage ramdiskunmount
read r Reads a byte from a file. Usage read <file> <position>
rmdir rd Removes an empty directory. Usage rmdir <directory>
write w Writes a byte to a file. Usage write <file> <position> <value>
OK
#delos@/filesystem/>dir
Current directory is: B:\
01/01/1970 0:00:00 RW 22332 configuration_settings.bin
31/08/2092 9:39:26 <DIR> RW diagnostics
08/15/2028 16:32:24 RW 22332 factory_settings.bin
08/15/2028 16:32:24 RW 8736 factory_settings_profile_1.bin
08/15/2028 16:32:24 RW 8736 factory_settings_profile_2.bin
08/15/2028 16:32:24 RW 8736 factory_settings_profile_3.bin
08/15/2028 16:32:24 RW 8736 factory_settings_profile_32.bin
08/15/2028 16:32:24 RW 8736 factory_settings_profile_33.bin
08/15/2028 16:32:24 RW 8736 factory_settings_profile_34.bin
08/15/2028 16:32:24 RW 8736 factory_settings_profile_35.bin
08/15/2028 16:32:24 RW 8736 factory_settings_profile_6.bin
08/15/2028 16:32:24 RW 88 fw
08/15/2028 16:32:24 RW 580 mbr.bin
**************************************************
Total: 969216 bytes
Free : 835584 bytes
Used : 133632 bytes
Bad : 0 bytes
OK
#delos@/filesystem/>pwd
Current directory is: B:\
OK
#delos@/filesystem/>
Some information on the CPUs:
OpenWRT environment:
root@devolo-435:~# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 5 (v7l)
BogoMIPS : 96.00
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 5
processor : 1
model name : ARMv7 Processor rev 5 (v7l)
BogoMIPS : 96.00
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 5
processor : 2
model name : ARMv7 Processor rev 5 (v7l)
BogoMIPS : 96.00
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 5
processor : 3
model name : ARMv7 Processor rev 5 (v7l)
BogoMIPS : 96.00
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 5
Hardware : Qualcomm (Flattened Device Tree)
Revision : 0000
Serial : 0000000000000000
G.hn environment:
#delos@/system_manager/cpu/>info
The CPU of this modem is an Xtensa 8 from Tensilica.
OK
#delos@/system_manager/cpu/>extra
Xtensa core ID: "xtensa8_z2001".
OK
So it seems these devices have two environments running in tandem. To use the regular OpenWRT without losing G.hn, it needs to be figured out what is necessary to initialize the extra G.hn part. I am afraid it would be difficult to replace the proprietary G.hn firmware, it could only be used as-is.
Edit: I got the G.hn to work, important is to switch first to 100 MBit/s as this is needed to allow the device to start:
ethtool -s ghn speed 100
Then it should work:
root@OpenWrt:/tmp/ghn# LD_LIBRARY_PATH=lib2:lib /lib/ld-musl-armhf.so.1 ./ghn_host -i eth0 -b /tmp/ghn/base/ --name "Magic 2 WiFi next" --serial 1234567890123456 --mac 01:23:45:67:89:AB
--mt MT3056 --profile 0 --script /tmp/ghn/script --verbose
Firmware CRC: 0x0bb58890 OK
Successfully validated firmware image
Device MBR/sector0 configuration:
Factory Profile = 0
MAC Address = 01:23:45:67:89:AB
Serial Number = 1234567890123456
MT = MT3056
Name = Magic 2 WiFi next
Option user_notches_enable not found in uci config, using default '1'
Option user_notches not found in uci config
Option dhcp_ipv4_enabled not found in uci config
Option rtm_general_unknown_suppression not found in uci config, using default '0'
Option ghn_threshold not found in uci config, using default '20'
Option dm_selection_node_type not found in uci config, using default '0'
Option dslcoex_initial_reduction not found in uci config, using default '-40'
Option dslcoex_lnpe_offset not found in uci config, using default '0'
Option dslcoex_threshold_upper not found in uci config, using default '5'
Option dslcoex_probeframe_duration not found in uci config, using default '5'
Option dslcoex_measurement_interval not found in uci config, using default '15'
Option dslcoex_max_reduction not found in uci config, using default '-60'
Option dslcoex_minimum_plc_rate not found in uci config, using default '625'
Option dslcoex_psd_decrement not found in uci config, using default '4'
Option dslcoex_force_enable not found in uci config, using default '1'
Option dslcoex_detection_mode not found in uci config, using default '1'
Option dslcoex_snr_deembedding not found in uci config, using default '1'
Option dslcoex_auto_threshold not found in uci config, using default '1'
Option dslcoex_psd_increment not found in uci config, using default '4'
Option dslcoex_mode not found in uci config, using default '2'
Option dslcoex_threshold_lower not found in uci config, using default '3'
Option dslcoex_monitoring_int not found in uci config, using default '3600'
Option dslcoex_overwrite_shapedef not found in uci config, using default '1'
Option dslcoex_minimum_plc_rate_percent not found in uci config, using default '0'
Option dslcoex_notch_distance not found in uci config, using default '5000'
Option dslcoex_notch_width not found in uci config, using default '400'
Option dslcoex_low_traffic_threshold not found in uci config, using default '1'
Option dslcoex_low_traffic_duration not found in uci config, using default '5'
Option dslcoex_measurement_timeout not found in uci config, using default '0'
Option diagnostics_ghnmonitor_mintime not found in uci config, using default '120'
Option dmselection_general_nodetype not found in uci config, using default '4'
Option dmselection_general_config not found in uci config
Rebuilt image filesystem
Found recovery device 00:13:9D:00:05:00
Successfully downloaded ethloader and firmware
Untracked write to 37.0.7
Untracked write to 19.0.7
Untracked write to 35.0.0
Untracked write to 36.9.0
Untracked write to 36.9.1
Untracked write to 36.9.5
Device boot finished in 17.18 seconds
Flash is already disabled, skipping migration
Initialized ubus api
Listening on port 40000 locally for console access
Untracked write to 61.0.3
Device is now connected to network, device_state=1
