1 (edited by 01010code 2011-03-14 23:41:18)

Topic: Pirelli 125G

Hello

I have Pirelli DRG 125G, i have managed to flash the firmware, but i am stuck on "Tag Kernel crc"  error:

 

CFE version 1.0.38-8.7 for BCM96348 (32bit,SP,BE)
Build Date: lun gen 21 18:15:12 CET 2008 (dela@buildserver)
Copyright (C) 2000-2005 Broadcom Corporation.

Boot Address 0xbfc00000

Initializing Arena.
Initializing Devices.
Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB
CPU type 0x29107: 240MHz, Bus: 133MHz, Ref: 26MHz
Total memory: 16777216 bytes (16MB)

Total memory used by CFE:  0x80401000 - 0x80525400 (1197056)
Initialized Data:          0x8041CD10 - 0x8041EC40 (7984)
BSS Area:                  0x8041EC40 - 0x80423400 (18368)
Local Heap:                0x80423400 - 0x80523400 (1048576)
Stack Area:                0x80523400 - 0x80525400 (8192)
Text (code) segment:       0x80401000 - 0x8041CD04 (113924)
Boot area (physical):      0x00526000 - 0x00566000
Relocation Factor:         I:00000000 - D:00000000

MDL - getTagFromPartition: tag found, at address bfc10000  
MDL - getTagFromPartition: tag found, at address bfc10000  
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Board Id (0-9)                    : 96348GW  
Number of MAC Addresses (1-32)    : 11  
Base MAC Address                  : 02:10:18:01:00:02  
PSI Size (1-64) KBytes            : 24  
Ethernet PHY Type                 : [1]Internal
Ethernet PHY Type                 : [2]External Switch Using Reverse MII

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
MDL - getTagFromPartition: tag found, at address bfc10000  
MDL - getTagFromPartition: tag found, at address bfc10000  
Trying to boot from previous MAIN image (0x80010000) ...
Code Address: 0x80010000, Entry Address: 0x80010000
SGP - Flash Kernel Address: 0xBFC10100
SGP - ulImgCrc : 0x5114D1DA  
SGP - Tag->kernelLen: 0x000EFF00
SGP - Flash Kernel Address: 0xBFC10100
Linux kernel CRC error.  Corrupted image?
SGP - Tag Kernel crc : 0x5114D1DA - calculated: 0x5875E4BB 
SGP - Decompression Kernel length: 0x000DEB78 pucSrc: 0xBFC1010C
web info: Waiting for connection on socket 0.
CFE>

The good boot of Pirelli firmware lookls like this:

 

CFE version 1.0.38-8.7 for BCM96348 (32bit,SP,BE)
Build Date: lun gen 21 18:15:12 CET 2008 (dela@buildserver)
Copyright (C) 2000-2005 Broadcom Corporation.

Boot Address 0xbfc00000

Initializing Arena.
Initializing Devices.
Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB
CPU type 0x29107: 240MHz, Bus: 133MHz, Ref: 26MHz
Total memory: 16777216 bytes (16MB)

Total memory used by CFE:  0x80401000 - 0x80525400 (1197056)
Initialized Data:          0x8041CD10 - 0x8041EC40 (7984)
BSS Area:                  0x8041EC40 - 0x80423400 (18368)
Local Heap:                0x80423400 - 0x80523400 (1048576)
Stack Area:                0x80523400 - 0x80525400 (8192)
Text (code) segment:       0x80401000 - 0x8041CD04 (113924)
Boot area (physical):      0x00526000 - 0x00566000
Relocation Factor:         I:00000000 - D:00000000

MDL - getTagFromPartition: tag found, at address bfc10000  
MDL - getTagFromPartition: tag found, at address bfc10000  
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Board Id (0-9)                    : 96348GW  
Number of MAC Addresses (1-32)    : 11  
Base MAC Address                  : 02:10:18:01:00:02  
PSI Size (1-64) KBytes            : 24  
Ethernet PHY Type                 : [1]Internal
Ethernet PHY Type                 : [2]External Switch Using Reverse MII

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
MDL - getTagFromPartition: tag found, at address bfc10000  
MDL - getTagFromPartition: tag found, at address bfc10000  
Trying to boot from previous MAIN image (0x80010000) ...
Code Address: 0x80010000, Entry Address: 0x80010000
SGP - Flash Kernel Address: 0xBFC10100
SGP - ulImgCrc : 0x577C44D7  
SGP - Tag->kernelLen: 0x003A5FB0
SGP - Flash Kernel Address: 0xBFC10100
SGP - Tag Kernel crc : 0x577C44D7 - calculated: 0x577C44D7 
SGP - Decompression Kernel length: 0x0000001C pucSrc: 0xBFC1010C
Decompression OK!
Entry at 0x80010000

Distribution: DWR_96348
Version: TEO_4.2.5.003

Closing network.
Starting program at 0x80010000
Uncompressing Linux......................................................................Ok
Booting the kernel
Linux version 2.6.16.14 #10 Wed Jun 4 15:15:34 CEST 2008
PirelliGateW2+ prom init
CPU revision is: 00029107
Determined physical RAM map:
 memory: 00fa0000 @ 00000000 (usable)
Built 1 zonelists
Kernel command line: 
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (21 instructions).
Synthesized TLB load handler fastpath (33 instructions).
Synthesized TLB store handler fastpath (33 instructions).
Synthesized TLB modify handler fastpath (32 instructions).
PID hash table entries: 64 (order: 6, 1024 bytes)
Using 120.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 13480k/16000k available (1681k kernel code, 2520k reserved, 326k data, 160k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered

Random: 0xed64e338
loop: loaded (max 8 devices)
u32 classifier
    OLD policer on 
NET: Registered protocol family 2
IP route cache hash table entries: 256 (order: -2, 1024 bytes)
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 8
NET: Registered protocol family 20

Any help would be great.
Thanks

2 (edited by 01010code 2011-02-22 21:40:15)

Re: Pirelli 125G

It is Alive:) !!!

A little change in code and it works:)

CFE version 1.0.38-8.7 for BCM96348 (32bit,SP,BE)
Build Date: lun gen 21 18:15:12 CET 2008 (dela@buildserver)
Copyright (C) 2000-2005 Broadcom Corporation.

Boot Address 0xbfc00000

Initializing Arena.
Initializing Devices.
Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB
CPU type 0x29107: 240MHz, Bus: 133MHz, Ref: 26MHz
Total memory: 16777216 bytes (16MB)

Total memory used by CFE:  0x80401000 - 0x80525400 (1197056)
Initialized Data:          0x8041CD10 - 0x8041EC40 (7984)
BSS Area:                  0x8041EC40 - 0x80423400 (18368)
Local Heap:                0x80423400 - 0x80523400 (1048576)
Stack Area:                0x80523400 - 0x80525400 (8192)
Text (code) segment:       0x80401000 - 0x8041CD04 (113924)
Boot area (physical):      0x00526000 - 0x00566000
Relocation Factor:         I:00000000 - D:00000000

MDL - getTagFromPartition: tag found, at address bfc10000  
MDL - getTagFromPartition: tag found, at address bfc10000  
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Board Id (0-9)                    : 96348GW  
Number of MAC Addresses (1-32)    : 11  
Base MAC Address                  : 02:10:18:01:00:01  
PSI Size (1-64) KBytes            : 24  
Ethernet PHY Type                 : [1]Internal
Ethernet PHY Type                 : [2]External Switch Using Reverse MII

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
MDL - getTagFromPartition: tag found, at address bfc10000  
MDL - getTagFromPartition: tag found, at address bfc10000  
Trying to boot from previous MAIN image (0x80010000) ...
Code Address: 0x80010000, Entry Address: 0x80010000
SGP - Flash Kernel Address: 0xBFC10100
SGP - ulImgCrc : 0x2268ABA8  
SGP - Tag->kernelLen: 0x000EFF00
SGP - Flash Kernel Address: 0xBFC10100
SGP - Tag Kernel crc : 0x2268ABA8 - calculated: 0x2268ABA8 
SGP - Decompression Kernel length: 0x000DEA8C pucSrc: 0xBFC1010C
Decompression OK!
Entry at 0x80010000

Distribution: 
Version: 

Closing network.
Starting program at 0x80010000
Linux version 2.6.35.9 (01010code@gogo) (gcc version 4.3.3 (GCC) ) #33 Tue Feb 22 11:15:08 EET 2011
Detected Broadcom 0x6348 CPU revision b0
CPU frequency is 240 MHz
16MB of RAM installed
registering 37 GPIOs
board_bcm963xx: CFE version: 1.0.38-8.7
bootconsole [early0] enabled
CPU revision is: 00029107 (Broadcom BCM6348)
board_bcm963xx: board name: 96348GW
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00001000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00001000
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
Kernel command line:  root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
PID hash table entries: 64 (order: -4, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes
Memory: 13280k/16384k available (2179k kernel code, 3104k reserved, 376k data, 160k init, 0k highmem)
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:128
Calibrating delay loop... 238.59 BogoMIPS (lpj=477184)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x30001fff]
pci 0000:00:01.0: BAR 0: set to [mem 0x30000000-0x30001fff] (PCI address [0x30000000-0x30001fff]
Switching to clocksource MIPS
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
audit: initializing netlink socket (disabled)
type=2000 audit(0.356:1): initialized
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 25
io scheduler noop registered
io scheduler deadline registered (default)
gpiodev: gpio device registered with major 254
bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
bcm963xx_flash: 0x00400000 at 0x1fc00000
bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank
 CFI mfr 0x000000c2
 CFI id  0x000022a8
Amd/Fujitsu Extended Query Table at 0x0040
  Amd/Fujitsu Extended Query version 1.1.
number of CFI chips: 1
bcm963xx_flash: Read Signature value of CFE1CFE1
bcm963xx_flash: CFE bootloader detected
bcm963xx_flash: CFE boot tag found with version 8 and board type 96348GW
bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000
bcm963xx_flash: Partition 1 is kernel offset 10100 and length eff00
bcm963xx_flash: Partition 2 is rootfs offset 100000 and length 2f0000
bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000
bcm963xx_flash: Partition 4 is linux offset 10000 and length 3e0000
bcm963xx_flash: Spare partition is 370000 offset and length 80000
Creating 5 MTD partitions on "bcm963xx":
0x000000000000-0x000000010000 : "CFE"
0x000000010100-0x000000100000 : "kernel"
mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
0x000000100000-0x0000003f0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=350000, len=A0000 
0x000000350000-0x0000003f0000 : "rootfs_data"
0x0000003f0000-0x000000400000 : "nvram"
0x000000010000-0x0000003f0000 : "linux"
bcm63xx_enet MII bus: probed
bcm63xx_wdt started, timer margin: 30 sec
TCP westwood registered
NET: Registered protocol family 17
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 160k freed
awk: /proc/cpuinfo: No such file or directory
awk: /proc/cpuinfo: No such file or directory
eth1: link forced UP - 100/full - flow control off/off
roboswitch: Probing device eth0: 
roboswitch: [/home/01010code/trunk/build_dir/linux-brcm63xx/kmod-switch/switch-robo.c:125] SIOCGETCPHYRD failed!
roboswitch: [/home/01010code/trunk/build_dir/linux-brcm63xx/kmod-switch/switch-robo.c:125] SIOCGETCPHYRD failed!
No Robo switch in managed mode found, phy_id = 0xffffffff
roboswitch: Probing device eth1: found a 5325! It's a 5350.
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
switching to jffs2
mini_fo: using base directory: /
mini_fo: using storage directory: /overlay
- init -

Please press Enter to activate this console. bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)]



BusyBox v1.17.3 (2011-02-08 08:56:46 EET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

udhcpc (v1.17.3) started
/sbin/hotplug-call: /etc/hotplug.d/iface/40-rdate: line 1: logger: not found
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r25417) ------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------

3 (edited by PopOpen 2011-03-04 02:48:17)

Re: Pirelli 125G

Great!

(1) Now could you tell us if and how (well) it works?
(2) It is unclear (to me) which build you have been using?
     [What in http://downloads.openwrt.org/ should I download?]
(3) Will you incorporate your changes into the latest "Bleeding Edge" build?

I live in a country with 10,000s of these useless devices and like to put it back to use as the hardware should be good...

Re: Pirelli 125G

Hi

Sorry, i am a little busy at the moment (work, study, work, study work...:).

(1) Yes it works, but the performance is slower compared to original firmware. ~30mbit/s.
(2) I was using trunk to build the bin file.
(3) I hope do it, you are welcome to help.

So what you need to do this.
1. You need a serial cable to access the CFE boot loader. The serial is located near the reset button. You will have to solder 4 pins in and puts two resistors. You will see where:) (i am using 750 oms ~ it should be 1k i think).
Because it is hard to put the resistors, you can short-circuiting and put the persistent on serial cable. 
I also changed the board name to "96348GW" (it's easy done via CFE).
2. The dirty patch is hear, i am not good on this.

Hear is diff of my trunk dir. But i think you will need to change only Makefile and imagetag.c files,

Index: target/linux/brcm63xx/files/arch/mips/include/asm/mach-bcm63xx/bcm_tag.h
===================================================================
--- target/linux/brcm63xx/files/arch/mips/include/asm/mach-bcm63xx/bcm_tag.h    (revision 25417)
+++ target/linux/brcm63xx/files/arch/mips/include/asm/mach-bcm63xx/bcm_tag.h    (working copy)
@@ -24,6 +24,7 @@
 
 #define PIRELLI_BOARDS { \
   "AGPF-S0", \
+  "96348GW", \
   "DWV-S0", \
 }
 
Index: target/linux/brcm63xx/image/Makefile
===================================================================
--- target/linux/brcm63xx/image/Makefile    (revision 25417)
+++ target/linux/brcm63xx/image/Makefile    (working copy)
@@ -36,7 +36,7 @@
     $(STAGING_DIR_HOST)/bin/imagetag -i $(KDIR)/vmlinux.lzma.cfe -f $(KDIR)/root.$(1) \
         --output $(BIN_DIR)/openwrt-$(4)-$(1)-cfe.bin \
         --boardid $(2) --chipid $(3) --entry $(KERNEL_ENTRY) \
-        --load-addr $(LOADADDR) --rsa-signature "$(5)" \
+        --load-addr $(LOADADDR) --tag-version 8  --rsa-signature "$(5)" \
         --info1 "-$(call Image/LimitName16,$(4))" --info2 $(1) \
         $(6) $(7) $(8) $(9)
 endef
@@ -184,10 +184,12 @@
     # Pirelli A226G
     $(call Image/Build/CFEAGPF,$(1),DWV-S0,6358,0x10000,A226G-cfe)
     $(call Image/Build/CFEAGPF,$(1),DWV-S0,6358,0x10000,A226G)
+        # Pirelli 125G
+        $(call Image/Build/CFEAGPF,$(1),96348GW,6348,0x10000,125G-cfe)
+        $(call Image/Build/CFEAGPF,$(1),96348GW,6348,0x10000,125G)
 
-    # RG100A,DB120 etc.
-    $(call Image/Build/RG100A,$(1),96358VW2,6358,0x20000,RG100A_DB120)
 
+
     # Telsey CPVA642-type (e.g. CPA-ZNTE60T)
     $(call Image/Build/CFE,$(1),CPVA642,6358,CPA-ZNTE60T,,--signature "Telsey Tlc",--signature2 "99.99.999",--second-image-flag "0")
 
Index: target/linux/brcm63xx/config-2.6.35
===================================================================
--- target/linux/brcm63xx/config-2.6.35    (revision 25417)
+++ target/linux/brcm63xx/config-2.6.35    (working copy)
@@ -5,15 +5,14 @@
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+# CONFIG_ARCH_PHYS_ADDR_T_64BIT is not set
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_ARCH_REQUIRE_GPIOLIB=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
 CONFIG_ARCH_SUPPORTS_OPROFILE=y
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
-# CONFIG_ATH_COMMON is not set
 CONFIG_AUDIT=y
 CONFIG_AUDIT_GENERIC=y
-# CONFIG_BATMAN_ADV is not set
 # CONFIG_BCM47XX is not set
 CONFIG_BCM63XX=y
 CONFIG_BCM63XX_CPU_6338=y
@@ -70,10 +69,8 @@
 CONFIG_CSRC_R4K=y
 CONFIG_CSRC_R4K_LIB=y
 CONFIG_DECOMPRESS_LZMA=y
-CONFIG_DEFAULT_SECURITY=""
 CONFIG_DEVPORT=y
 # CONFIG_DM9000 is not set
-CONFIG_DMA_NEED_PCI_MAP_STATE=y
 CONFIG_DMA_NONCOHERENT=y
 CONFIG_EARLY_PRINTK=y
 CONFIG_ELF_CORE=y
@@ -86,7 +83,6 @@
 CONFIG_GENERIC_GPIO=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_GPIOLIB=y
-# CONFIG_GPIO_CS5535 is not set
 CONFIG_GPIO_74X164=y
 CONFIG_GPIO_DEVICE=y
 CONFIG_GPIO_SYSFS=y
@@ -106,9 +102,9 @@
 CONFIG_HAVE_OPROFILE=y
 CONFIG_HW_HAS_PCI=y
 CONFIG_HW_RANDOM=y
-CONFIG_HZ=250
+CONFIG_HZ=128
 # CONFIG_HZ_100 is not set
-CONFIG_HZ_250=y
+CONFIG_HZ_128=y
 CONFIG_IMAGE_CMDLINE_HACK=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_INOTIFY=y
@@ -118,8 +114,8 @@
 CONFIG_IRQ_CPU=y
 CONFIG_KEXEC=y
 CONFIG_LEDS_GPIO=y
-# CONFIG_LEDS_LT3593 is not set
 # CONFIG_LEDS_TRIGGER_HEARTBEAT is not set
+# CONFIG_LOONGSON_MC146818 is not set
 CONFIG_LOONGSON_UART_BASE=y
 # CONFIG_MACH_ALCHEMY is not set
 # CONFIG_MACH_DECSTATION is not set
@@ -152,7 +148,7 @@
 CONFIG_MTD_JEDECPROBE=y
 CONFIG_MTD_REDBOOT_PARTS=y
 CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED=y
-# CONFIG_NL80211_TESTMODE is not set
+CONFIG_NEED_DMA_MAP_STATE=y
 # CONFIG_NO_IOPORT is not set
 # CONFIG_NXP_STB220 is not set
 # CONFIG_NXP_STB225 is not set
@@ -167,11 +163,10 @@
 CONFIG_POSIX_MQUEUE=y
 CONFIG_POSIX_MQUEUE_SYSCTL=y
 # CONFIG_POWERTV is not set
-# CONFIG_R8187SE is not set
-# CONFIG_RAMZSWAP is not set
 CONFIG_RELAY=y
 CONFIG_SCHED_OMIT_FRAME_POINTER=y
 # CONFIG_SCSI_DMA is not set
+CONFIG_SCSI_MOD=y
 # CONFIG_SERIAL_8250 is not set
 CONFIG_SERIAL_BCM63XX=y
 CONFIG_SERIAL_BCM63XX_CONSOLE=y
@@ -188,12 +183,15 @@
 # CONFIG_SIBYTE_SENTOSA is not set
 # CONFIG_SIBYTE_SWARM is not set
 CONFIG_SPI=y
+# CONFIG_SPI_BCM63XX is not set
 CONFIG_SPI_BITBANG=y
 CONFIG_SPI_GPIO=y
 CONFIG_SPI_MASTER=y
+# CONFIG_SPI_SPIDEV is not set
 CONFIG_SQUASHFS_EMBEDDED=y
 CONFIG_SSB=y
 CONFIG_SSB_B43_PCI_BRIDGE=y
+CONFIG_SSB_BLOCKIO=y
 # CONFIG_SSB_DRIVER_MIPS is not set
 CONFIG_SSB_DRIVER_PCICORE=y
 CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
@@ -209,7 +207,6 @@
 # CONFIG_TC35815 is not set
 # CONFIG_TINY_RCU is not set
 CONFIG_TRAD_SIGNALS=y
-# CONFIG_TREE_PREEMPT_RCU is not set
 CONFIG_TREE_RCU=y
 CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
 CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
@@ -217,6 +214,4 @@
 CONFIG_USB_SUPPORT=y
 CONFIG_VM_EVENT_COUNTERS=y
 CONFIG_WATCHDOG_NOWAYOUT=y
-CONFIG_WEXT_CORE=y
-CONFIG_WEXT_PROC=y
 CONFIG_ZONE_DMA_FLAG=0
Index: tools/firmware-utils/src/imagetag.c
===================================================================
--- tools/firmware-utils/src/imagetag.c    (revision 25417)
+++ tools/firmware-utils/src/imagetag.c    (working copy)
@@ -240,6 +240,7 @@
       imagecrc = compute_crc32(imagecrc, binfile, kerneloff - fwaddr + cfelen, imagelen);
       /* Compute the crc32 of the kernel and padding between kernel and rootfs) */
       kernelcrc = compute_crc32(kernelcrc, binfile, kerneloff - fwaddr + cfelen, kernellen + rootfsoffpadlen);
+      imagecrc = kernelcrc;
       /* Compute the crc32 of the kernel and padding between kernel and rootfs) */
       kernelfscrc = compute_crc32(kernelfscrc, binfile, kerneloff - fwaddr + cfelen, kernellen + rootfsoffpadlen + rootfslen + sizeof(deadcode));
       /* Compute the crc32 of the flashImageStart to rootLength.

What is it....

5 (edited by PopOpen 2011-03-04 17:39:03)

Re: Pirelli 125G

Hi & thanks for quick response, but it is still not clear to what exactly you have used/done.

Oh, and I hate to solder serial ports! Contrary to what is recommended I just connect via Ethernet via terminal. This should be okay as long as I do not need to see all the details. (But probably not a good idea.) Then for the Lithuanian TEO distribution of the router FW (4.5.3 TEO_4.2.5.0008) we use:

> telnet 192.168.1.254
U: lt_pdpd
P: un7146

DRG A125G> system shell

Hacking around in this shell we can find some of the original compiler flags with the command:

# system print_config

And the boot-up messages with:

# cat /proc/kmsg

And we see that the kernel is indeed compressed by LZMA and that the board is a "PirelliGateW2+" among other things...
Looking in the "trunk" directory [ http://downloads.openwrt.org/snapshots/trunk/brcm63xx/ ] I see the following files.

openwrt-96348GW-10-gen-jffs2-128k-cfe.bin          02-Mar-2011 14:04             3145732
openwrt-96348GW-10-gen-jffs2-64k-cfe.bin           02-Mar-2011 14:04             3145732
openwrt-96348GW-10-gen-squashfs-cfe.bin            02-Mar-2011 14:04             2424836
openwrt-96348GW-11-gen-jffs2-128k-cfe.bin          02-Mar-2011 14:04             3145732
openwrt-96348GW-11-gen-jffs2-64k-cfe.bin           02-Mar-2011 14:04             3145732
openwrt-96348GW-11-gen-squashfs-cfe.bin            02-Mar-2011 14:04             2424836
openwrt-96348GW-bc221-jffs2-128k-cfe.bin           02-Mar-2011 14:04             3145732
openwrt-96348GW-bc221-jffs2-64k-cfe.bin            02-Mar-2011 14:04             3145732
openwrt-96348GW-bc221-squashfs-cfe.bin             02-Mar-2011 14:04             2424836
openwrt-96348GW-generic-jffs2-128k-cfe.bin         02-Mar-2011 14:04             3145732
openwrt-96348GW-generic-jffs2-64k-cfe.bin          02-Mar-2011 14:04             3145732
openwrt-96348GW-generic-squashfs-cfe.bin           02-Mar-2011 14:04             2424836
openwrt-96348GW2-bc221-jffs2-128k-cfe.bin          02-Mar-2011 14:04             3145732
openwrt-96348GW2-bc221-jffs2-64k-cfe.bin           02-Mar-2011 14:04             3145732
openwrt-96348GW2-bc221-squashfs-cfe.bin            02-Mar-2011 14:04             2424836

However, I am new to all this, so I wonder:
(4) Which files did you use?
(5) What exact procedure did you follow? [I looked at this http://wiki.openwrt.org/toh/pirelli/agpf , but it doesn't quite apply to our device.]
(6) Can I just use the Router's web interface to upgrade the firmware to one of the files above? [I.e. what is involved in producing a proper .rmt file?]
(7) Finally, my goal is to use it as a wireless bridge, or, as a last resort, a Wifi modem to an old PC. Do you think this is possible

Re: Pirelli 125G

Hi

Could you send me firmware file of TEO, (to myname eta gmail account).

First of all you will not find the firmware in trunk directory, you have to make it with applied pacth.
Second, i changed the 125G board name from PirelliGateW2+ to  96348GW (via serial), i will make a fix to PirelliGateW2+
And the last, at the moment firmware upgrade is possible only from serial (i am working on it to make it possible via web, it is my first board:)

Coding....

7 (edited by PopOpen 2011-03-05 00:59:59)

Re: Pirelli 125G

You said: "Yes it works, but the performance is slower compared to original firmware. ~30mbit/s."

Actually according to the Broadcom-data of the later chip BCM6358, that also conforms to ADSL2+,
"The ADSL2+ transceiver delivers up to 29 Mbps downstream and 3 Mbps upstream", then your speed is right on the spot!
See: http://www.broadcom.com/products/Broadband-Carrier-Access/xDSL-CPE-Solutions/BCM6358

But if you feel it has worse performance, it may be due to a bunch of functions that are activated by default. Similarly in the original FW, which had pretty much EVERYTHING activated and thus constantly spit out tons of errors for things that were not connected or used...

As for the FW, I have sent you the download links via PM for:
a) openrg-4.5.3.TEO_4.2.5.0008-DWR_96348.img
b) openrg-4.5.3.TEO_4.2.5.0013-DWR_96348.rmt
Also notice that 0008 is of IMG type, while the 0013 is a RMT file.

Re: Pirelli 125G

Hi

The ADSL2+ offer max 24Mbit/s down, and you should be at most 10m from DSL station:). I made this test in Ethernet router configuration (not DSL).

I did not get the link of firmware, could you post agen [myname@gmail.com].

9 (edited by PopOpen 2011-03-07 09:50:48)

Re: Pirelli 125G

01010code wrote:

Hi

The ADSL2+ offer max 24Mbit/s down, and you should be at most 10m from DSL station:). I made this test in Ethernet router configuration (not DSL).

I did not get the link of firmware, could you post agen [myname@gmail.com].

Hi!  Here are the links:

http://d01.megashares.com/dl/865f7c7/openrg-4.5.3.TEO_4.2.5.0008-DWR_96348.img
http://d01.megashares.com/dl/a38f229/openrg-4.5.3.TEO_4.2.5.0013-DWR_96348.rmt

Just follow the instructions after choosing "Regular Download". In worst case search on Google or Bite Plius Forums for "Pirelli A125G".


http://www.biteplius.lt/lt/2forum.showPosts/718566.461..1-=(1621334386

Re: Pirelli 125G

How did it go? Did you get any further with those?

I am wondering if it is possible to use the USB port as a serial interface, like it's done on other types of routers?
That way I would not need to solder/connect another serial inside the box. However, a JTAG cable would always be useful...

Re: Pirelli 125G

Hi

I got the files, but at the moment no luck, i can't get the file via the web.

12 (edited by PopOpen 2011-03-11 12:23:42)

Re: Pirelli 125G

I would really like to help if I could, but like you I don't have much time to spend on this project. However, if you could provide me ("us") with more information with what exactly you have been doing and HOW, then more people may get involved trying things out, seeing that there are at least a few hundred other people interested in this topic. At the moment I still don't have a clear picture about the specifics.

(1) Let's start with your serial cable.
a) How did you make it? Which instructions did you use? Do you have a schematic? Which components?
b) To what pins/solder hole did you attach it?
c) Please provide a detailed PICTURE indicating the solder joints and their function. (GND, Tx, Rx, VCC etc.)
d) What about the host attachment? Do you use a "USB-to-serial" or just an old PC with serial port?

(2) Then there is the Firmware you are patching.
a) Which firmware did you use to start with? (There is a long list of different ones above, which one is it?)
b) How did you compile it? Please try to be specific here.
c) How did you upload it to the router via Serial cable? (I.e. What software, commands and procedure did you use?)

(3) Starting the router
a) Any particular "tricks" involved to get it to work?
b) How did you configure it? Perhaps a configuration file?
c) You mentioned some performance issues. Any more ideas around this?

Looking forward to some answers and to help.
Best regards.
~~~

PS. The Pirelli DRG A226G is also very popular here, so if THIS firmware works, then it may be easy to get it to work on that model as well. in addition it is possible that most of the older Thomson based DRG A225G.v2 firmware is used also in the A125G, although I have no proof of this.

Re: Pirelli 125G

Hi 01010code,

I just added an entry to the main website:  http://wiki.openwrt.org/toh/pirelli/a125g
Please edit and add any new and relevant information you feel appropriate, there.

14 (edited by 01010code 2011-03-14 23:39:54)

Re: Pirelli 125G

Hi

Sorry I was a little away for the weekend smile
So my progress in Monday night, i was able to make a web boot-able image but i get kernel panic, i thing it happens because i changes image tag.

.
CFE version 1.0.38-8.7 for BCM96348 (32bit,SP,BE)
Build Date: lun gen 21 18:15:12 CET 2008 (dela@buildserver)
Copyright (C) 2000-2005 Broadcom Corporation.

Boot Address 0xbfc00000

Initializing Arena.
Initializing Devices.
Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB
CPU type 0x29107: 240MHz, Bus: 133MHz, Ref: 26MHz
Total memory: 16777216 bytes (16MB)

Total memory used by CFE:  0x80401000 - 0x80525400 (1197056)
Initialized Data:          0x8041CD10 - 0x8041EC40 (7984)
BSS Area:                  0x8041EC40 - 0x80423400 (18368)
Local Heap:                0x80423400 - 0x80523400 (1048576)
Stack Area:                0x80523400 - 0x80525400 (8192)
Text (code) segment:       0x80401000 - 0x8041CD04 (113924)
Boot area (physical):      0x00526000 - 0x00566000
Relocation Factor:         I:00000000 - D:00000000

MDL - getTagFromPartition: tag found, at address bfc10000  
MDL - getTagFromPartition: tag found, at address bfc10000  
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Board Id (0-9)                    : 96348GW  
Number of MAC Addresses (1-32)    : 11  
Base MAC Address                  : 02:10:18:01:00:02
PSI Size (1-64) KBytes            : 24  
Ethernet PHY Type                 : [1]Internal
Ethernet PHY Type                 : [2]External Switch Using Reverse MII

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
MDL - getTagFromPartition: tag found, at address bfc10000  
MDL - getTagFromPartition: tag found, at address bfc10000  
Trying to boot from previous MAIN image (0x80010000) ...
Code Address: 0x80010000, Entry Address: 0x80010000
SGP - Flash Kernel Address: 0xBFC10100
SGP - ulImgCrc : 0xD581A8B0  
SGP - Tag->kernelLen: 0x0034FF04
SGP - Flash Kernel Address: 0xBFC10100
SGP - Tag Kernel crc : 0xD581A8B0 - calculated: 0xD581A8B0 
SGP - Decompression Kernel length: 0x000DE04E pucSrc: 0xBFC1010C
Decompression OK!
Entry at 0x80010000

Distribution: 
Version: e

Closing network.
Starting program at 0x80010000
Linux version 2.6.35.9 (code01010@free) (gcc version 4.3.3 (GCC) ) #45 Mon Mar 14 23:30:17 EET 2011
Detected Broadcom 0x6348 CPU revision b0
CPU frequency is 240 MHz
16MB of RAM installed
registering 37 GPIOs
board_bcm963xx: CFE version: 1.0.38-8.7
bootconsole [early0] enabled
CPU revision is: 00029107 (Broadcom BCM6348)
board_bcm963xx: board name: 96348GW
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00001000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00001000
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
Kernel command line:  root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
PID hash table entries: 64 (order: -4, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes
Memory: 13288k/16384k available (2171k kernel code, 3096k reserved, 375k data, 160k init, 0k highmem)
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:128
Calibrating delay loop... 239.45 BogoMIPS (lpj=933888)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x30001fff]
pci 0000:00:01.0: BAR 0: set to [mem 0x30000000-0x30001fff] (PCI address [0x30000000-0x30001fff]
Switching to clocksource MIPS
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
audit: initializing netlink socket (disabled)
type=2000 audit(0.476:1): initialized
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 25
io scheduler noop registered
io scheduler deadline registered (default)
gpiodev: gpio device registered with major 254
bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
bcm963xx_flash: 0x00400000 at 0x1fc00000
bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank
 CFI mfr 0x000000c2
 CFI id  0x000022a8
Amd/Fujitsu Extended Query Table at 0x0040
  Amd/Fujitsu Extended Query version 1.1.
number of CFI chips: 1
bcm963xx_flash: Read Signature value of CFE1CFE1
bcm963xx_flash: CFE bootloader detected
bcm963xx_flash: CFE boot tag found with version 8 and board type 96348GW
bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000
bcm963xx_flash: Partition 1 is kernel offset 10100 and length 34ff04
bcm963xx_flash: Partition 2 is rootfs offset 360004 and length 8fffc
bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000
bcm963xx_flash: Partition 4 is linux offset 10000 and length 3e0000
bcm963xx_flash: Spare partition is 5d0004 offset and length ffe1fffc
Creating 5 MTD partitions on "bcm963xx":
0x000000000000-0x000000010000 : "CFE"
0x000000010100-0x000000360004 : "kernel"
mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
0x000000360004-0x0001003f0000 : "rootfs"
mtd: partition "rootfs" extends beyond the end of device "bcm963xx" -- size truncated to 0x9fffc
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "bcm963xx"
0x0000003f0000-0x000000400000 : "nvram"
0x000000010000-0x0000003f0000 : "linux"
bcm63xx_enet MII bus: probed
bcm63xx_wdt started, timer margin: 30 sec
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
jffs2: Flash size not aligned to erasesize, reducing to 576KiB
VFS: Mounted root (jffs2 filesystem) readonly on device 31:2.
Freeing unused kernel memory: 160k freed
Kernel panic - not syncing: No init found.  Try passing init= option to kernel. See Linux Documentation/init.txt for guidance.

15 (edited by PopOpen 2011-03-15 18:46:08)

Re: Pirelli 125G

Great! smile

After Googling: http://www.mjmwired.net/kernel/Documentation/init.txt
and: http://www.mjmwired.net/kernel/Documentation/initrd.txt

Which lead me to the line:

Kernel command line:  root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200

Please, also check you kernel (image) address space which should be: 0x00010000-0x003D0000 .

But since I generally have no idea of what you are doing, I can't help you.

16 (edited by 01010code 2011-03-18 13:06:36)

Re: Pirelli 125G

Hi


Looks interesting, but i think what is not the problem, it is more related to image tag (i changed it:)
I found a link with patch i will try to make the image, with this patch.

http://permalink.gmane.org/gmane.comp.embedded.openwrt.devel/8850

PS. Do you a nice picture of opened pirelli 125g board (opened), my camera broak:(

17 (edited by PopOpen 2011-04-13 16:56:36)

Re: Pirelli 125G

[
How is it going? Any success? Please share your info! I have updated the OpenWrt page for Pirelli DRG A125G with new pictures.

Re: Pirelli 125G

Hi

It looks i have to change flash map layout (i am not good on it:), i hope will have more time in the  end of this week, i hope i cani handle this problem.

coding:)

19 (edited by PopOpen 2011-04-13 16:56:00)

Re: Pirelli 125G

Great! Excellent! And I'm waiting for my serial cable in the mail, so I hope to be able to help you out very soon.

In the meantime I'd like to understand the factory firmware better. Do you (or anyone else) have a good idea on how to decompress/extract the .img and/or the .rmt files?? I would be very happy for any suggestion about that.

Re: Pirelli 125G

Update:

(1) For those who doesn't already know, forget trying to upload new Pirelli firmware images via web interface, unless it has the appropriate .img format. The .rmt images are hashed in a way that is still unknown. But we're working on it. Please see this thread.

(2) Further information of interest is that Italians and Germans have found a way to extract the default WPA-PSK and WEP keys from several types of Pirelli Routers, including Alice AGPF. This vulnerability may also include ours (a125g)...

Re: Pirelli 125G

Hi

I was able to build image up loadable via web (i can send you for test) but i strongly recommend to get a serial cable. I have to solve flowing problems:

Image (bin) upload works via web, but it was tested on my device.
I have to reset the switch and reboot device to have lan connectivity with device.
I have problems with building bigger images (i get CRC error) it is the result of my bad codding.

Coding...:)

Re: Pirelli 125G

01010code wrote:

I was able to build image up loadable via web (i can send you for test) but i strongly recommend to get a serial cable.

Great, please send me a PM with a link to the Source+Patch. (You can use Megashares as the most easy to use.) I'll try to compile/flash and look at the code/results.

Re: Pirelli 125G

Hi,

Here is a link of image file:
http://d01.megashares.com/dl/0cde960/openwrt-A125G-squashfs-cfe.bin
pasword my username.

The ip is 192.168.1.100, and after flashing you have to reboot the device.

24 (edited by PopOpen 2011-04-24 23:11:24)

Re: Pirelli 125G

01010code wrote:

Here is a link of image file:

This is great, but I wanted the source so that I can compile it by myself in order to see what is going on. Just to "see" the image crash in console is rather useless...  BTW. Did you upload a .bin file or a .img file? (I didn't think the A125G would accept non .img/.rmt files!??)

[EDIT]
Please disregard what I wrote above. I must have been tired.

a) Thanks for file. I haven't tried it yet... No time, been working on JTAG support...
b) Great! Very happy to see web upload with  .bin files works!
c) Have you uploaded/sent your working FW (or changes) to Bleeding Edge OpenWRT for public use? 
d) Can this be of help: http://thread.gmane.org/gmane.comp.embedded.openwrt.devel/9216
e) Have you tried to use a different block size? I.e. 128 instead of 64?

I see that there are A226G images in the trunk: http://downloads.openwrt.org/snapshots/trunk/brcm63xx/
These should also be interesting for us. Have anyone tried them?

In addition, what is our correct Board ID? You changed it to/from: 96348GW  <=> PirelliGateW2+ ??
Doesn't that mean we should use the "96348GW2" versions? (I'm confused!?)
What about the image Tag ID? Are you using "bc-221"?

Re: Pirelli 125G

Hi

I was away for vacation, so the the patch is:

===================================================================
--- /home/code01010/trunk2/target/linux/brcm63xx/image/Makefile    (revision 26604)
+++ /home/code01010/trunk2/target/linux/brcm63xx/image/Makefile    (working copy)
@@ -193,7 +193,14 @@
     # Pirelli A226G
     $(call Image/Build/CFEAGPF,$(1),DWV-S0,6358,0x10000,A226G-cfe)
     $(call Image/Build/CFEAGPF,$(1),DWV-S0,6358,0x10000,A226G)
+     # Pirelli 125G
+        #$(call Image/Build/CFEAGPF,$(1),96348GW,6348,0x10000,125G-cfe)
+        #$(call Image/Build/CFEAGPF,$(1),96348GW,6348,0x10000,125G)
+    $(call Image/Build/CFEAGPF,$(1),PirelliGateW2+,6348,0x10000,A125G-cfe)
+        $(call Image/Build/CFEAGPF,$(1),PirelliGateW2+,6348,0x10000,A125G)
 
+
+
     # RG100A,DB120 etc.
     $(call Image/Build/RG100A,$(1),96358VW2,6358,0x20000,RG100A_DB120)
 
Index: /home/code01010/trunk2/tools/firmware-utils/src/imagetag.c
===================================================================
--- /home/code01010/trunk2/tools/firmware-utils/src/imagetag.c    (revision 26604)
+++ /home/code01010/trunk2/tools/firmware-utils/src/imagetag.c    (working copy)
@@ -240,7 +240,10 @@
       imagecrc = compute_crc32(imagecrc, binfile, kerneloff - fwaddr + cfelen, imagelen);
       /* Compute the crc32 of the kernel and padding between kernel and rootfs) */
       kernelcrc = compute_crc32(kernelcrc, binfile, kerneloff - fwaddr + cfelen, kernellen + rootfsoffpadlen);
-      /* Compute the crc32 of the kernel and padding between kernel and rootfs) */
+      /* testing */
+     imagecrc = kernelcrc; 
+  
+          /* Compute the crc32 of the kernel and padding between kernel and rootfs) */
       kernelfscrc = compute_crc32(kernelfscrc, binfile, kerneloff - fwaddr + cfelen, kernellen + rootfsoffpadlen + rootfslen + sizeof(deadcode));
       /* Compute the crc32 of the flashImageStart to rootLength.
        * The broadcom firmware assumes the rootfs starts the image,
@@ -302,6 +305,11 @@
 
       /* Compute the crc32 of the entire image (deadC0de included) */
       imagecrc = compute_crc32(imagecrc, binfile, sizeof(tag), imagelen);
+        /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */
+          /* testing !!!!!!!!!!!!!!!!!*/
+          imagecrc = kernelcrc;
+
+
       /* Compute the crc32 of the kernel and padding between kernel and rootfs) */
       kernelcrc = compute_crc32(kernelcrc, binfile, kerneloff - fwaddr + cfelen, kernellen + rootfsoffpadlen);
       kernelfscrc = compute_crc32(kernelfscrc, binfile, rootfsoff - fwaddr + cfelen, kernellen + rootfslen);
@@ -334,8 +342,11 @@
     }
 
     sprintf(tag.kernelAddress, "%lu", kerneloff);
-    sprintf(tag.kernelLength, "%lu", kernellen + rootfsoffpadlen);
+/*XXXXXXXXXXXXXXXX change header testing XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX*/
+/*    sprintf(tag.kernelLength, "%lu", kernellen + rootfsoffpadlen);            */
+        sprintf(tag.kernelLength, "%lu", imagelen);                   
 
+
     if (args->root_first_flag) {
       sprintf(tag.flashImageStart, "%lu", rootfsoff);
       sprintf(tag.flashRootLength, "%lu", rootfslen);

plus  i have changed the bcm963xx-flash.c

added static kernellen value, because a change.
kernellen = 982784;
The problem is that we have to change image tag,
the kernelLength filed must be the same as  totalLength - "Total length of image" field.

Still  i don't know to do it in proper way, so this is dirty hack for testing.
Regarding Bord_ID, you can change it with serial cable, the bin i send you  is using original Pirelli bord id (PirelliGateW2+), so you can upload the file via web. No need to change it.