OpenWrt Forum Archive

Topic: Thomson TG585v8

The content of this topic has been archived on 1 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Can i flash this router with openwrt?

I opened the case and found these chips in it :

BCM5325EKQMG

SDRAM: winbond w9825g6eh-75

FLASH: MX25L6445EMI10G

Wireless: ralink rt3070l

Note that this has a completely different hardware than it's predecessor (TG585v7) which was discussed here https://forum.openwrt.org/viewtopic.php … 89&p=3

Ok I was able to get serial output, it says "CFG 04" can this be used to flash bootloader ?

ROM VER: 1.2.0
CFG 04
EEPROM Data OK
.............................

Version BL: 1.0.6
Multicore disable; Booting Linux kernel

BOOTING THE THOMSON LINUX KERNEL

Starting the kernel @ 0x801f5000 
Extra parameters passed to Linux:
        [0]: Thomson bootloader
        [1]: memsize=0x1FDD000
serial initialized
MC_PRIO = 0xc -> 0xcc
Linux version 2.6.20.19 (buildmgm@dslws-build1.beijing.ap.thmulti.com) (gcc version 3.4.6) #1 Fri Aug 27 14:05:58 CST 2010
CPU revision is: 0001906c
Determined physical RAM map:
 memory: 01fdd000 @ 00002000 (usable)
On node 0 totalpages: 8159
  DMA zone: 63 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 8096 pages, LIFO batch:0
  Normal zone: 0 pages used for memmap
Built 1 zonelists.  Total pages: 8096
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs
1 MIPSR2 register sets available
Primary instruction cache 8kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Setting up vectored interrupts
PID hash table entries: 128 (order: 7, 512 bytes)
mips_hpt_frequency:133333333
r4k_offset: 000208d5(133333)
Using 133.333 MHz high precision timer.
[ifx_asc_init_hardware 1372]: ASC ID = 0x101044c4
[ifx_asc_init_hardware 1374]: TxFIFO size = 16, RxFIFO size = 16
[ifx_asc_init_hardware 1376]: TxFIFO CON = 0x1f01, RxFIFO CON = 0x1f01
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 26868k/32628k available (1705k kernel code, 5760k reserved, 288k data, 112k init, 0k highmem)
Calibrating delay loop... 261.63 BogoMIPS (lpj=130816)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 1024 bind 512)
TCP reno registered
Amazon_Se Port Initialization
squashfs: version 3.4 (2008/08/26) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered (default)
ttyS0 at MMIO 0xbe100c00 (irq = 66) is a IFX_ASC
ifx_asc_init: uart init successfully
Infineon Technologies Synchronous Serial Controller (SSC) driver version 1.0.3
ifx_sscAllocConnection: device spi-flash register sucessfully!
Creating 4 MTD partitions on "spi-flash":
0x00040000-0x00100000 : "userfs"
0x00020000-0x00040000 : "mtdss"
0x001d0000-0x00800000 : "rootfs"
0x00100010-0x001d0000 : "kernel"
mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only
Infineon Technologies Synchronous SPI flash driver version 1.0.0 
dwc_otg: version 2.40a 10-APR-2006 (ker:20614)
data_fifo[0]=0xbe120000
data_fifo[1]=0xbe121000
data_fifo[2]=0xbe122000
data_fifo[3]=0xbe123000
data_fifo[4]=0xbe124000
data_fifo[5]=0xbe125000
data_fifo[6]=0xbe126000
data_fifo[7]=0xbe127000
data_fifo[8]=0xbe128000
data_fifo[9]=0xbe129000
data_fifo[10]=0xbe12a000
data_fifo[11]=0xbe12b000
data_fifo[12]=0xbe12c000
data_fifo[13]=0xbe12d000
data_fifo[14]=0xbe12e000
data_fifo[15]=0xbe12f000
USB_WLAN_HOST_SUPPORT
DWC_otg: Using DMA mode 
dwc_otg dwc_otg: DWC OTG Controller
dwc_otg dwc_otg: new USB bus registered, assigned bus number 1
dwc_otg dwc_otg: irq 31, io mem 0x00000000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
NET: Registered protocol family 26
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Time: MIPS clocksource has been installed.
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 112k freed
dwc_otg_hcd_handle_port_intr=======set hfir ea60 
usb 1-1: new high speed USB device using dwc_otg and address 2
dwc_otg_hcd_handle_port_intr=======set hfir 7530 
usb 1-1: configuration #1 chosen from 1 choice
Algorithmics/MIPS FPU Emulator v1.5
init started:  BusyBox v1.00 (2010.08.27-06:07+0000) multi-call binary
init started:  BusyBox v1.00 (2010.08.27-06:07+0000) multi-call binary
Starting pid 99, console /dev/ttyS0: '/etc/init.d/rcS'
Using /nmon/nmon.ko
nmon: module license 'unspecified' taints kernel.
Button: Character device registered successfully.
SWWD: Enable guarding (ticks: 400 threshold: 280)
IPSecControl Character device registered successfully.
NET: Registered protocol family 3
NET: Registered protocol family 9
NET: Registered protocol family 4
NET: Registered protocol family 5
NET: Registered protocol family 18
NET: Registered protocol family 25
modprobe: could not parse modules.dep

modprobe: could not parse modules.dep

Using /lib/modules/rt3070ap.ko
Symbol usb_register_driver is being used by a non-GPL module, which will not be allowed in the future
Please see the file Documentation/feature-removal-schedule.txt in the kernel source tree for more details.
Symbol usb_deregister is being used by a non-GPL module, which will not be allowed in the future
Please see the file Documentation/feature-removal-schedule.txt in the kernel source tree for more details.
usbcore: registered new interface driver rt2870
Device ikanos not present.
Starting pid 257, console /dev/ttyS0: '/bin/sh'
Switching to RUNLEVEL 1 ...
route: SIOC[ADD|DEL]RT: File exists
route: SIOC[ADD|DEL]RT: File exists
linux application start ...
wait for linux_appl to initialize (1)
wait for linux_appl to initialize (2)
wait for linux_appl to initialize (3)
wait for linux_appl to initialize (4)

************* ERROR RECORD *************
000000:00:00.000000
Application NMON started after POWERON.
****************** END *****************

appl_init: BUILD VERIFIED!
dip_init() : button[FACTORY_RESET] has number[1]
End of initialisation
 start storagepl ...
/etc/rc1.d/S45storagepl: 17: /usr/bin/storagepl: not found
 storagepl is started 
checkd start ...
linuxappl: start loading after [  1002ms ]
Could not read ex-RIP, code 0x10003
WARNING: Unknown Parameter Type brgroup
WARNING: Unknown Parameter Type brgroup
wait until configuration load reaches phase 9 (now -1, 1s)
IOCTL: ADSLIOCTL_SET_TMM_SET_DIAG_MODE
wait until configuration load reaches phase 9 (now 3, 2s)
wait until configuration load reaches phase 9 (now 3, 3s)
wait until configuration load reaches phase 9 (now 3, 4s)
wait until configuration load reaches phase 9 (now 3, 5s)
IOCTL: ADSLIOCTL_SET_TMM_SET_DIAG_MODE
IOCTL: ADSLIOCTL_SET_TMM_SET_DIAG_MODE

Username : admin
Password : ***********
------------------------------------------------------------------------

                             ______  Thomson TG585 v8
                         ___/_____/\ 
                        /         /\\  Plusnet 8.2.7.8.DA
                  _____/__       /  \\ 
                _/       /\_____/___ \  Copyright (c) 1999-2010, THOMSON
               //       /  \       /\ \
       _______//_______/    \     / _\/______ 
      /      / \       \    /    / /        /\
   __/      /   \       \  /    / /        / _\__ 
  / /      /     \_______\/    / /        / /   /\
 /_/______/___________________/ /________/ /___/  \ 
 \ \      \    ___________    \ \        \ \   \  /
  \_\      \  /          /\    \ \        \ \___\/
     \      \/          /  \    \ \        \  /
      \_____/          /    \    \ \________\/
           /__________/      \    \  /
           \   _____  \      /_____\/
            \ /    /\  \    /___\/
             /____/  \  \  /
             \    \  /___\/
              \____\/

------------------------------------------------------------------------
{admin}=>help
Following commands are available :

help             : Displays this help information
menu             : Displays menu
?                : Displays this help information
exit             : Exits this shell.
..               : Exits group selection.
saveall          : Saves current configuration.
ping             : Send ICMP ECHO_REQUEST packets.
traceroute       : Send ICMP/UDP packets to trace the ip path.

Following command groups are available :

firewall        service         connection      cwmp            dhcp            
dns             dsd             dyndns          eth             atm             
config          debug           env             expr            grp             
hostmgr         ids             igmp            interface       ip              
ipqos           label           language        mbus            memm            
mlp             nat             ppp             pptp            script          
sntp            software        statecheck      system          systemlog       
tls             tod             tunnel          upgrade         upnp            
user            wireless        xdsl            

{admin}=>

I'm investigating a simalar device: Thomson TG782i. The problem with the Thomson devices is the locking of the bootloader bij the ISP. In your serial output I see no option to stop loading the kernel and get a bootloader prompt.

The box runs Linux but sourcecode is AFAIK not available. And instead of a normal shell you are dropped in a Thomson shell which hasn't got access to the needed commandline tools.

My next step is getting JTAG to work. That is new for me, so it will take a lot of time. But if it works it should be possible to flash a new bootloader and probably a self compiled OpenWRT. Even if xDSL and POTS doesn't work, the hardware can still be used -- it has a USB port -- for other purposes. It is a waste to throw it in the bin smile. Even if I don't get it to work, learning about JTAG is worth the effort...

Success with your investigation.

hvdkamer wrote:

I'm investigating a simalar device: Thomson TG782i. The problem with the Thomson devices is the locking of the bootloader bij the ISP. In your serial output I see no option to stop loading the kernel and get a bootloader prompt.

The box runs Linux but sourcecode is AFAIK not available. And instead of a normal shell you are dropped in a Thomson shell which hasn't got access to the needed commandline tools.

My next step is getting JTAG to work. That is new for me, so it will take a lot of time. But if it works it should be possible to flash a new bootloader and probably a self compiled OpenWRT. Even if xDSL and POTS doesn't work, the hardware can still be used -- it has a USB port -- for other purposes. It is a waste to throw it in the bin smile. Even if I don't get it to work, learning about JTAG is worth the effort...

Success with your investigation.

In this page https://wiki.openwrt.org/doc/hardware/port.serial it is stated that if the serial mode is "CFG 04" you can send a bootloader code to be flashed and as you can see from my serial output, it does enter "CFG 04" mode so maybe i can send a bootloader to the device! unfortunately i don't have that much info about this and although i'm ready to brick and throw the device away i want to give it some more tries before i do so

moham_96 wrote:

if the serial mode is "CFG 04" you can send a bootloader code to be flashed

From the manual you linked:

Sometimes by shortcutting some pins, connecting them to ground or to power you can change the serial mode. Some of them can help you to restore the bootloader since they allow you to write directly to memory or load something to ram through the serial connection, which can be useful for restoring a bootloader. Also if the original bootloader is password protected with this method you can replace it with a custom bootloader and bypass it.

For example in lantiq danube socs the default mode is CFG 01, but changing to CFG 04 which is known as UART mode allows you to upload to ram through the serial connection and automatically execute a bootloader in ascii format through the serial connection.

It is recommended that you don't try blindly to shortcut or connect to anything the pins as it can brick the device. Find documentation before doing anything.

It mentions Lantiq Danube SoC and you have a Broadcom. Also you didn't short things to get the CFG 04 string? I think that this part has a different meaning than what you've found? Your Thomson shows the bootlader and then immediately starts the kernel. No messages to stop loading the latter. I'm working on another router (Sitecom WLR-6000) and that one you can intterupt. See this log. The prompt is:

Please choose the operation:
   1: Load system code to SDRAM via TFTP.

In this router you have one second to type a number. And with that you get the options I mentioned in this thread. In your log I don't see a question what you want. Have you tried to type a number directly after the fist text appears? Does it do something different than normal. If yes you are on to something...

@hvdkamer yes i know it says "Lantiq Danube SoC" but i just thought that this rule 'might' apply to this router.
And no the bootloader doesn't stop no matter what i press, i think that i have to change the bootloader through JTag

moham_96 wrote:

@hvdkamer yes i know it says "Lantiq Danube SoC" but i just thought that this rule 'might' apply to this router.

In my opinion this seems far fetched. But who knows smile.

moham_96 wrote:

And no the bootloader doesn't stop no matter what i press, i think that i have to change the bootloader through JTag

That is the point where I am with my Thomson TG782i. I've tried to do JTAG via a Raspberry Pi, but that didn't work. The ordered FT232RL has arrived and hopefully I can get it to work with OpenOCD. JTAG is new for me, but it looks like the trick for stubborn hardware smile.

hvdkamer wrote:

[
That is the point where I am with my Thomson TG782i. I've tried to do JTAG via a Raspberry Pi, but that didn't work. The ordered FT232RL has arrived and hopefully I can get it to work with OpenOCD. JTAG is new for me, but it looks like the trick for stubborn hardware smile.

wishing you luck, let me know if it worked

hi there
I have an old TG585 v8 and want to use it as a wireless repeater, but has not such a feature. I am interested in having OpenWRT on it.
Since am have no experience in hardware or flashing routers.... I would wait for you :-)

any news on goal?

regards

The discussion might have continued from here.