OpenWrt Forum Archive

Topic: Huawei HG521

The content of this topic has been archived on 11 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Anybody care to comment on this one?

Huawei HG521 http://www.huaweidevice.com/worldwide/p … treeId=663
CPU: RTL8671 (two chip + RTL8271 ADSL2+) 200MHz Mips r3k according to http://www.realtek.com.tw/products/prod … ;ProdID=87 and /proc/cpuinfo
RAM: 16MB
Flash: 4MB SPI
WiFi: RTL8191 b/g/n, via USB according to boot log

definitely runs linux. I have requested a copy of the source cd but had no answer so far.
Console (115200 8n1) and jtag headers with pinouts printed on board.

Console:

Booting
Press 'ESC' to enter BOOT console...
Using Int. PHY
(c)Copyright Realtek, Inc. 2009
Project RTL867X LOADER (LZMA)
Version 00.00.10 (Dec 25 2009 11:27:08)

<RTL867X>help
help
info
reboot
r [addr]
w [addr] [val]
d [addr] <len>
ferase [offset] <len>
xmodem [address]
tftp [ip] [server ip] [file name]
web
<RTL867X>info
(c)Copyright Realtek, Inc. 2009
Project RTL867X LOADER (LZMA)
Version 00.00.10 (Dec 25 2009 11:27:08)

<RTL867X>BootLine: file
MAC Address [0]: 00:23:79:11:22:33
Entry Point: 0x80000000
Load Address: 0x80000000
Application Address: 0xBFC11000
Wrong Flash Setting!
Memory Configuration: ROW:4K COL:512 Bank:4Banks
MII Selection: 0 (0: Int. PHY  1: Ext. PHY)

<RTL867X>reboot


Booting
Press 'ESC' to enter BOOT console...
Using Int. PHY
Listening Multicast upgrade packets....0
Decompress file... ok!
Linux version 2.6.21.5 (root@g40420m) (gcc version 3.4.6-1.3.6) #4 Thu Mar 25 17:44:34 CST 2010
CPU revision is: 0000ff00
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 4064
Kernel command line: console=ttyS0, 115200 mem=16M root=31:2
Primary instruction cache 16kB, linesize 16 bytes.
Primary data cache 8kB, linesize 16 bytes.
Synthesized TLB refill handler (17 instructions).
Synthesized TLB load handler fastpath (31 instructions).
Synthesized TLB store handler fastpath (31 instructions).
Synthesized TLB modify handler fastpath (25 instructions).
PID hash table entries: 64 (order: 6, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 12200k/16384k available (3036k kernel code, 4184k reserved, 364k data, 104k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  disabled.
bhal: bhalInit entry

MXIC matched!!get SPI chip driver!
NET: Registered protocol family 16
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Sangoma WANPIPE Router v1.1 (c) 1995-2000 Sangoma Technologies Inc.
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 128 (order: -3, 512 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered (default)
Serial: 8250/16550 driver $Revision: 1.3 $ 1 ports, IRQ sharing disabled
netlog start
serial8250: ttyS0 at MMIO 0x0 (irq = 12) is a 16550A
PPP generic driver version 2.4.2
NET: Registered protocol family 24
IMQ starting with 3 devices...
IMQ driver loaded successfully.
        Hooking IMQ before NAT on PREROUTING.
        Hooking IMQ after NAT on POSTROUTING.
flash device: 0x400000 at 0xbfc00000

MXIC matched!!get SPI chip driver!
Physically mapped flash: Found an alies 0x400000 for the chip at 0x0, mxic device detect.
Creating 3 MTD partitions on "Physically mapped flash":
0x00000000-0x00010000 : "boot"
0x00010000-0x00011000 : "flag"
mtd: partition "flag" doesn't end on an erase block -- force read-only
0x00011000-0x00400000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
MoniterInit entry

Led_module_init ok<6>REALTEK NIC Ethernet driver v0.1 (Feb 13, 2009)
eth0.5: RTL-8139C+ at 0xb8018000, 00:e0:4d:xx:xx:xx, IRQ 26
RTL8672 NIC100 Probing..
Enable 8671G 1 function
Enable 8671 0 function
Enable 8672 function
initFreeRxSkbList
initFreeRxSkbList free_rx_skb_producer=48
ratm: Realtek SAR v1.02 (Feb 17, 2009)
RTL8192SU(for RTL8672 platform) driver version 0.13.3 (2008-10-08 - 2009-12-24)
usbcore: registered new interface driver RTL8192SU(for RTL8672 platform)
dwc_otg: version 2.60a 22-NOV-2006
----init hcd-----
DWC_otg: Using DMA mode
dwc_otg lm0: DWC OTG Controller
dwc_otg lm0: new USB bus registered, assigned bus number 1
dwc_otg lm0: irq 11, io mem 0xb8030000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
GACT probability on
Mirror/redirect action on
u32 classifier
    input device check on
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (128 buckets, 1024 max)
nf_conntrack_rtsp v0.6.21 loading
nf_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_time loading
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 104k freed
init started: BusyBox vv1.9.1 (2010-03-25 17:45:09 CST)
starting pid 70, tty '': '/etc/init.d/rcS'
rcs
RCS DONE
starting pid 73, tty '': '/bin/sh'


BusyBox vv1.9.1 (2010-03-25 17:45:09 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

usb 1-1: new high speed USB device using dwc_otg and address 2
usb 1-1: configuration #1 chosen from 1 choice
Boot from EFUSE
Autoload OK!!
Chip Version ID: VERSION_8192S_BCUT.
TX_FEW_INT patch --------- pool alloc
Loading drivers and kernel modules...
Start mic now ...
load cfm ok.
start log proc...
ADSL FirmwareVersion : 2.9.0.68
ADSL DRV: version : 2.9.0.68
ifconfig: SIOCSIFNETMASK: Cannot assign requested address

InitAdslMode....

InitAdsl

 RTL: Adsl DOWN.

 RTL: Adsl DOWN.

 RTL: Adsl DOWN.
Use default bin /var/cwmp now ...
ratm(itf 0): open 0.65
create: ch0 (0/65) 7679,0
sar_set_atm_data_mode
initFreeRxSkbList
initFreeRxSkbList free_rx_skb_producer=48
Enable 8671G 1 function
Enable 8671 0 function
Enable 8672 function
create: ch0 (0/65) 7679,0
applying workaround...done
++XTM f(xtmapi.c)-l(139): XTM link monitor process...1->1
device wl0 is not a slave of br0
device wl0.1 is not a slave of br0
device wl0.2 is not a slave of br0
device wl0.3 is not a slave of br0

 begin WlanUpInterfaces...
No 0  block_relay=0
acCmd:iwpriv wl0 set_mib qos_enable=1
chan = 20,chan2=0

 begin WlanStartServices...
WlanInitNvram...
START WPS SETUP!


Writing file /var/wscd.conf...
int data: 3
int data: 10
int data: 10
int data: 2
int data: 2
string data: QRWFJ6UE
ssid: TALKTALK-xxxxxx

WiFi Simple Config v1.5 (2010.03.25-09:44+0000).

device wl0 entered promiscuous mode
RCR is 0x0
A class
MacConfigBeforeFwDownload
firmware_version: 7fff, fw_EMEM_len: 43784, fw_IMEM_len: 35848
Load IMEM
urb_len=24032, txLength=24000 (USB_HWDESC_HEADER_LEN=32)
urb_len=11880, txLength=11848 (USB_HWDESC_HEADER_LEN=32)
Load EMEM
urb_len=24032, txLength=24000 (USB_HWDESC_HEADER_LEN=32)
urb_len=19816, txLength=19784 (USB_HWDESC_HEADER_LEN=32)
Load DMEM
LoadDMEMIMG(3050)
urb_len=80, txLength=48 (USB_HWDESC_HEADER_LEN=32)
LoadDMEMIMG(3052)
RTL8192 Firmware version: 32767
Load firmware successful!
<---MacConfigAfterFwDownload()
finish config MAC
finish config BB
FIXME: init_beacon 4165
phy_SetUsbRFReg(): Set RegAddr(0x1e) = 0x31059 Fail!!!
phy_SetUsbRFReg(): Set RegAddr(0x1e) = 0x3105b Fail!!!
IQK: Cal fail!
[rtl8190_open, 3745]BSSID=xxxxxxxxxxxx
old txpkt_count=0, new_txpkt_count=3
br0: port 1(wl0) entering learning state
br0: topology change detected, propagating
br0: port 1(wl0) entering forwarding state
device wl0.1 is not a slave of br0
device wl0.2 is not a slave of br0
device wl0.3 is not a slave of br0

 begin WlanSetupBridge...

 wlan wps enabled
device eth0.5 entered promiscuous mode
eth0.5: Promiscuous mode enabled.
br0: port 2(eth0.5) entering learning state
br0: topology change detected, propagating
br0: port 2(eth0.5) entering forwarding state
arp uses obsolete (PF_INET,SOCK_PACKET)
atp: cur kernel version:[2.6.21.5]
device nas_0_65 entered promiscuous mode
br0: port 3(nas_0_65) entering learning state
br0: topology change detected, propagating
br0: port 3(nas_0_65) entering forwarding state
killall: ddnsc: no process killed
close atm port mirror!
++XTM f(xtmapi.c)-l(139): XTM link monitor process...1->1
br0: port 2(eth0.5) entering disabled state
++XTM f(xtmapi.c)-l(139): XTM link monitor process...1->1
eth0.5: Promiscuous mode enabled.
br0: port 2(eth0.5) entering learning state
br0: topology change detected, propagating
br0: port 2(eth0.5) entering forwarding state
++XTM f(xtmapi.c)-l(139): XTM link monitor process...1->1
ifconfig: SIOCSIFFLAGS: Cannot assign requested address
bridge br0:9 doesn't exist; can't delete it
Append upnp ssdp listener ok.
Use default bin /var/upnp now ...
printk: 131 messages suppressed.

Use default bin /var/console now ...
-------------------------------
-----Welcome to ATP Cli------
-------------------------------

Login: admin
Password:
ATP>?
cls
debug
help
save
?
exit
ATP>sh


BusyBox vv1.9.1 (2010-03-25 17:45:09 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# cat /proc/cpuinfo
system type             : RTL8672
processor               : 0
cpu model               : R3000 V0.0
BogoMIPS                : 398.95
wait instruction        : no
microsecond timers      : no
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
VCED exceptions         : not available
VCEI exceptions         : not available

Thanks for that. I've been trying to find all the info i can on this thing. Requests for the source to terminal@huawei.com have been 100% ignored but i have found a project here that seems to support this chip http://wive-ng.sourceforge.net but thats in russian and doesn't seem to want to translate properly. Project gitweb http://wive-ng.git.sourceforge.net/git/ … ;a=summary

wive-ng-dsl

http://sourceforge.net/projects/wive-ng/

"Alternative firmware and software with open source for platforms based on some
SoC (Realtek RTL8186 - Wive-NG, Realtek RTL8671B/RTL8671BH/RTL8672 -
Wive-NG-DSL, Ralink RT3050/RT3052 - Wive-NG-RTNL) . "

Source code cd is on the way.

(Last edited by routednbooted on 30 Oct 2010, 13:32)

No source code ever arrived from Huawei?  This is standard practice for Huawei. There's almost no code in the firmware of these devices that Huawei has developed itself. It simply pilfers other people's contributions made under the GPL.  Has someone got the time to pen a formal letter to Huawei HQ, with a cc: to gpl violations?

I give up on this and give the device away. I did eventually after plenty of pestering get an email back from Huawei, they wanted 20 quid to send a cd of the source code. There's no way i'll pay that for a cd.

routednbooted wrote:

I give up on this and give the device away. I did eventually after plenty of pestering get an email back from Huawei, they wanted 20 quid to send a cd of the source code. There's no way i'll pay that for a cd.

What is "quid"? http://en.wikipedia.org/wiki/Quid says that quid can stand either for Euro or for Australian dollar.

We use quid for GBPound. Anyway, i can't remember if it was Euro or GBP, either way im not paying that.

jerrry94087 wrote:
routednbooted wrote:

I give up on this and give the device away. I did eventually after plenty of pestering get an email back from Huawei, they wanted 20 quid to send a cd of the source code. There's no way i'll pay that for a cd.

What is "quid"? http://en.wikipedia.org/wiki/Quid says that quid can stand either for Euro or for Australian dollar.

I've always assumed it to mean the "quid" from "quid pro quo". Since you give this to get that. This = money.

You can download new Beta Firmware at : http://downloads.talktalk-labs.com/tria … -Trial.zip

Source: http://downloads.talktalk-labs.com/trials/

Modifying firmware's web interface process is easier thanks to the magnificent Firmware Mod Kit (FMK) by Craig Heffner, Jeremy Collake, et. al.

http://code.google.com/p/firmware-mod-kit/

Choose the firmware image from which to extract the webidx and webimg files.

And using the new tool extract-ng from the FMK toolkit, extract the squashfs root file system from the firmware image.

In that extracted file system, the two files webidx and webimg will be found under ~/fmk/rootfs/etc/

You can extract files from webimg and rebuild webimg from modified files by using webflate tool by asbokid

The filesystem and the firmware image are reconstructed using the reverse of the above.

Source (read more at): http://huaweihg612hacking.wordpress.com … interface/

Hello,

Please let me know if you get source codes from Huawei, or a new firmware from Huawei or your ISP.

I would like to share them on our website for other owners: http://openwag.sourceforge.net/HG521/

Best wishes,

where can I find source code wive-ng-dsl for rtl8671 ,I jast can find bin files.
please you introduce a source for it

The discussion might have continued from here.