OpenWrt Forum Archive

Topic: New Broadcom BCM63xx codebase with GPL'd Ethernet and USB support

The content of this topic has been archived between 8 Feb 2018 and 7 May 2018. Unfortunately there are posts – most likely complete pages – missing.

as lamaatje sayed:
after changed

static int bcm963xx_detect_cfe(struct mtd_info *master)
{
       int idoffset = 0x4e0;
       static char idstring[8] = "CFE1CFE1";
       char buf[8];
       int ret;
       size_t retlen;

       ret = master->read(master, idoffset, 8, &retlen, (void *)buf);
       printk("bcm963xx: Read Signature value of %s\n", buf);
       return strncmp(idstring,buf,8);
}

it  boots

but as lamaatje also has sayed no lan working

thanks to all people

(Last edited by t3l3m4k0 on 7 Nov 2008, 00:05)

just a trace

CFE version 1.0.37-0.8 for BCM96348 (32bit,SP,BE)
Build Date: ¤@  2¤ë 20 18:37:34 CST 2006 (root@localhost.localdomain)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.
CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz

Total memory used by CFE:  0x80401000 - 0x805246F0 (1193712)
Initialized Data:          0x8041C680 - 0x8041E080 (6656)
BSS Area:                  0x8041E080 - 0x804226F0 (18032)
Local Heap:                0x804226F0 - 0x805226F0 (1048576)
Stack Area:                0x805226F0 - 0x805246F0 (8192)
Text (code) segment:       0x80401000 - 0x8041C67C (112252)
Boot area (physical):      0x00525000 - 0x00565000
Relocation Factor:         I:00000000 - D:00000000

Board IP address                : 192.168.1.19:ffffff00
Host IP address                 : 192.168.1.21
Gateway IP address              :
Run from flash/host (f/h)       : f
Default host run file name      : vmlinux
Default host flash file name    : bcm963xx_fs_kernel
Boot delay (0-9 seconds)        : 2
Board Id Name                   : 96348GW-11
Psi size in KB                  : 24
Number of MAC Addresses (1-32)  : 11
Base MAC Address                : 11:22:33:44:55:66
Ethernet PHY Type               : Internal
Memory size in MB               : 16

*** Press any key to stop auto run (2 seconds) ***
Auto run second count down: 2
web info: Waiting for connection on socket 0.
CFE>  r 192.168.1.21:vmlinux.elf
TFTP Client.
0x80010000/2351238 0x8024e086/140394 Entry at 0x80014450
Closing network.
Starting program at 0x80014450
Linux version 2.6.27.4 (od1sea@1t4k4) (gcc version 4.1.2) #1 Thu Nov 6 23:39:11 CET 2008
Detected Broadcom 0x6348 CPU revision a2
CPU frequency is 256000000 MHz
16MB of RAM installed
board_bcm963xx: CFE version: 1.0.37-0.8
console [early0] enabled
CPU revision is: 00029107 (Broadcom BCM6348)
board_bcm963xx: board name: 96348GW-11
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00001000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00001000
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200
Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes
PID hash table entries: 64 (order: 6, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13736k/16384k available (1860k kernel code, 2648k reserved, 317k data, 120k init, 0k highmem)
Calibrating delay loop... 255.48 BogoMIPS (lpj=510976)
Mount-cache hash table entries: 512
net_namespace: 592 bytes
NET: Registered protocol family 16
registering PCI controller with io_map_base unset
bus: 00 index 0 io port: [8000000, 800ffff]
bus: 00 index 1 mmio: [30000000, 37ffffff]
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
NET: Registered protocol family 1
audit: initializing netlink socket (disabled)
type=2000 audit(0.265:1): initialized
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
msgmni has been set to 26
io scheduler noop registered
io scheduler cfq registered (default)
bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart
console handover: boot [early0] -> real [ttyS0]
bcm63xx_enet MII bus: probed
bcm963xx: 0x00400000 at 0x1fc00000
bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
bcm963xx: Read Signature value of CFE1CFE1 X$à ¼$Î
bcm963xx: CFE bootloader detected
bcm963xx: CFE boot tag found with version 6 and board type 96348GW.
bcm963xx: Partition 0 is CFE offset 0 and length 10000
bcm963xx: Partition 1 is kernel offset 10100 and length baff4
bcm963xx: Partition 2 is rootfs offset d0000 and length 320000
bcm963xx: Partition 3 is nvram offset 3f0000 and length 10000
Creating 4 MTD partitions on "bcm963xx":
0x00000000-0x00010000 : "CFE"
0x00010100-0x000cb0f4 : "kernel"
mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only
0x000d0000-0x003f0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "bcm963xx"
0x003f0000-0x00400000 : "nvram"
TCP bic registered
NET: Registered protocol family 17
VFS: Mounted root (jffs2 filesystem) readonly.
Freeing unused kernel memory: 120k freed
Please be patient, while OpenWrt loads ...
Algorithmics/MIPS FPU Emulator v1.5
- preinit -
Press CTRL-C for failsafe
- init -

Please press Enter to activate this console. br-lan: Dropping NETIF_F_UFO since no NETIF_F_HW_CSUM feature.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
ip_tables: (C) 2000-2006 Netfilter Core Team
Driver 'sd' needs updating - please use bus_type methods
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use
nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
wlan: trunk
ath_hal: module license 'Proprietary' taints kernel.
ath_hal: 2008-10-02 (AR5210, AR5211, AR5212, AR5416, RF5111, RF5112, RF2413, RF5413, RF2133, RF2425, REGOPS_FUNC, DFS, XR)
ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (trunk)
ath_rate_minstrel: look around rate set to 10%
ath_rate_minstrel: EWMA rolloff level set to 75%
ath_rate_minstrel: max segment size in the mrr set to 6000 us
wlan: mac acl policy registered
ath_pci: trunk
usbcore: registered new interface driver usblp
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.



BusyBox v1.11.2 (2008-11-06 00:24:13 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r13129) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/#

@ t3l3m4k0 congratulations, note that buf is still not terminated, you might consider dropping the kprint.

Any ideas how to analyse the networking problems?  I expect it to be in the initialisation since mounting an NFS rootfs is possible.

You may want to try this ...

static int bcm963xx_detect_cfe(struct mtd_info *master)
{
       int idoffset = 0x4e0;
       static char idstring[8] = "CFE1CFE1";
       char buf[9];
       int ret;
       size_t retlen;

       ret = master->read(master, idoffset, 8, &retlen, (void *)buf);
       buf[retlen] = 0;
       printk("bcm963xx: Read Signature value of %s\n", buf);
       return strncmp(idstring,buf,8);
}
t3l3m4k0 wrote:

hi to all,

I did to compile openwrt for a bcm6348gw board  (Comtrend536) with cfe bootloader.
Compilation was rigth but result was for bcm96348.bin and bcm96345.bin.

I tried to send firmware to router, via:
1.- web page from comtrend firmware
2.- web page from cfe
3.- via tftp server from cfe

results, as spected, was file not valid, i think, because firmware header was for other model than bcm6348gw.

Is there a way from make menu_config, config, .... etc where i can set target to bcm6348gw?
In config  menus,  only i have found bcm963xx generic board setting.

regards.

excuse my poor english.

I know what the cause is. The image build process is:
create compressed lzma.cfe kernel
create rootfs
merge kernel+rootfs and tag image
add zero's until image is 64k fold
add 0xdeadc0de
add zero's until image is 64k fold
add 0xdeadc0de

In the tagging process 3 CRC are calculated: kernel, rootfs and total
since the image is manipulated afterwards with dd, crc of total is not correct and image is no considered valid!

lamaatje,
Thnks for your info. This wil be much usefull to make an image than can be loaded from router's web page.

I tried to build firmware from diferents choices, with switch, like 6358 boards, etc and i can't get lan up.
I see in neufbox forums, with 6358 borads, getting lan working.
Also USB host port are not working .

Have you news about getting up lan?

thnks.

spirit,
your option is more elegant.

(Last edited by t3l3m4k0 on 9 Nov 2008, 18:46)

@lamaatge,
lan interace is working on 96348GW-11 board, later i will post how.

[t3l3m4k0@1t4k4 ~]$ ping 192.168.1.19
PING 192.168.1.19 (192.168.1.19) 56(84) bytes of data.
64 bytes from 192.168.1.19: icmp_seq=1 ttl=64 time=0.745 ms
64 bytes from 192.168.1.19: icmp_seq=2 ttl=64 time=0.595 ms
64 bytes from 192.168.1.19: icmp_seq=3 ttl=64 time=0.599 ms
64 bytes from 192.168.1.19: icmp_seq=4 ttl=64 time=0.585 ms
64 bytes from 192.168.1.19: icmp_seq=5 ttl=64 time=0.659 ms
64 bytes from 192.168.1.19: icmp_seq=6 ttl=64 time=0.685 ms
64 bytes from 192.168.1.19: icmp_seq=7 ttl=64 time=0.720 ms
64 bytes from 192.168.1.19: icmp_seq=8 ttl=64 time=0.582 ms
64 bytes from 192.168.1.19: icmp_seq=9 ttl=64 time=0.613 ms

--- 192.168.1.19 ping statistics ---
9 packets transmitted, 9 received, 0% packet loss, time 7999ms
rtt min/avg/max/mdev = 0.582/0.642/0.745/0.064 ms
[t3l3m4k0@1t4k4 ~]$ telnet 192.168.1.19
Trying 192.168.1.19...
Connected to SAM1.SOL (192.168.1.19).
Escape character is '^]'.
 === IMPORTANT ============================
  Use 'passwd' to set your login password
  this will disable telnet and enable SSH
 ------------------------------------------


BusyBox v1.11.2 (2008-11-09 17:29:24 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r13144) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------

(Last edited by t3l3m4k0 on 10 Nov 2008, 15:15)

Searching at broadcom docs about CPUs 96348 and 96358, i found differences , bassicaly, only in USB 1.1 (6348) USB 2.0 (6358).
The two CPUs have 2 ethernet ports, so tried similar settings to the cpu 96358.


patch file:

    011-add_preliminary_board_support.patch

must be updated to patch file:

    .../arch/mips/bcm63xx/boards/board_bcm963xx.c

and add to apropiate location YOURBOARDNAME=your board name:

#ifdef CONFIG_BCM63XX_CPU_6348

/* code to add */ 

         static struct board_info __initdata board_YOURBOARDNAME = { 
                 .name                           = "YOURBOARDNAME", 
                 .expected_cpu_id                = 0x6348, 
          
                 .has_enet0                      = 1, 
                 .has_enet1                      = 1, 
                 .has_pci                        = 1, 
          
                 .enet0 = { 
                         .has_phy                = 1, 
                         .use_internal_phy       = 1, 
                 }, 
          
                 .enet1 = { 
                         .force_speed_100        = 1, 
                         .force_duplex_full      = 1, 
                 }, 
          
          
                 .has_ohci0 = 1, 
                 .has_pccard = 1,  
         }; 


/* code to modify */

#ifdef CONFIG_BCM63XX_CPU_6348 
                 &board_96348r, 
                 &board_96348gw,
                        &board_YOURBOARDNAME,
#endif

After compiled and device firmware updated, i must changed uci setting

uci set network.lan.ifname=eth1
uci commit
reboot

and lan works

warnig:
you must have acces trough serial console

t3l3m4k0 wrote:

@lamaatge,
lan interace is working on 96348GW-11 board, later i will post how.

@t3l3m4k0 very good work, I really appreciate it!

I have managed to get OpenWRT working with your great help in a Sagem Fast 2404 delivered by Orange here in Spain.

It belongs to 6348 platform. I guess I missed something as wireless is not working (Broadcom 4318 chipset). Is there any chance to get working the Broadcom 6301 modem in it? This platform is spread all around the globe, usually in DSL modem/router.

Great work!!!

I just had to modify from the trunk what it was pointed by t3l3m4k0 for my board support (its name is rather stupid F@ST2404 because the @ in the name, I used that name for the board identity but not for the variable) and add the hack from lamaatje to get working partition mentioned at the top of this page by t3l3m4k0.

Also had to make the network trick from t3l3m4k0 after booting OpenWRT.

Bye!

(Last edited by sblanco on 11 Nov 2008, 15:47)

lamaatje wrote:
t3l3m4k0 wrote:

hi to all,

I did to compile openwrt for a bcm6348gw board  (Comtrend536) with cfe bootloader.
Compilation was rigth but result was for bcm96348.bin and bcm96345.bin.

I tried to send firmware to router, via:
1.- web page from comtrend firmware
2.- web page from cfe
3.- via tftp server from cfe

results, as spected, was file not valid, i think, because firmware header was for other model than bcm6348gw.

Is there a way from make menu_config, config, .... etc where i can set target to bcm6348gw?
In config  menus,  only i have found bcm963xx generic board setting.

regards.

excuse my poor english.

I know what the cause is. The image build process is:
create compressed lzma.cfe kernel
create rootfs
merge kernel+rootfs and tag image
add zero's until image is 64k fold
add 0xdeadc0de
add zero's until image is 64k fold
add 0xdeadc0de

In the tagging process 3 CRC are calculated: kernel, rootfs and total
since the image is manipulated afterwards with dd, crc of total is not correct and image is no considered valid!

Did some more investigations on updating via CFE web interface. Conclusion is that CFE assumes an images with rootfs that is followed by kernel. I did some tests with images that have kernel first but they fail, althougn CRC's in  imageValidationToken of the tag are correct. Changing the order of the CRC's from total,rootfs, kernel -> total, kernel, rootfs did not work.

lamaatje wrote:

Did some more investigations on updating via CFE web interface. Conclusion is that CFE assumes an images with rootfs that is followed by kernel. I did some tests with images that have kernel first but they fail, althougn CRC's in  imageValidationToken of the tag are correct. Changing the order of the CRC's from total,rootfs, kernel -> total, kernel, rootfs did not work.

There is an additional CRC32 tagValidationToken over the entire TAG.

Can you please post the CFE output log on the serial line when trying to upload an image.

spirit wrote:

There is an additional CRC32 tagValidationToken over the entire TAG.

correct

spirit wrote:

Can you please post the CFE output log on the serial line when trying to upload an image.

Sorry, I don't have the image anymore, but I am very sure that the problem arises in my version of CFE from the assumption that the rootfs is in front of the kernel. Note I have a davolink special, after image download, it verifies kernel CRC and rootfs CRC, if ok it compares with the existing backup image in the higher half of the flash, if different it flashes also a backup.

Looks like this:

web info: Upload 2097156 bytes, Broadcom image format.
CFE>
Flashing root file system and kernel: .................................

.
*** Image flash done *** !
Successful.
Resetting board...

CFE version 1.0.37-0.6 for BCM96348 (32bit,SP,BE)
Build Date: 2005-03-31 17:08:34 (root@ylinux)
DV-201AMR Boot ROM version: 1.6
H/W version: 00

Initializing Arena.
Initializing Devices.
Flash ID - 0x1(0), 0x227e(1), 0x2210(e), 0x2200(f)
flash - size:8388608, nsect:135, base:0xbf800000
Checking running image.....
Running image good. Comparing running image to backup.....
Backup image is different from running image. Copying running to backup(2097156).....
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Image copied to running.(2097156)

Note that this order is hampering creation of a proper rootfs_data partition.
Sure would like to get rid of this CFE version, but some efforts resulted in reprogramming flash by JTAG which is very cumbersome.

lamaatje wrote:

Sorry, I don't have the image anymore, but I am very sure that the problem arises in my version of CFE from the assumption that the rootfs is in front of the kernel. Note I have a davolink special, after image download, it verifies kernel CRC and rootfs CRC, if ok it compares with the existing backup image in the higher half of the flash, if different it flashes also a backup.

Well, I don't think that rootfs in front of the kernel is a special format. The speciality is the running and backup flash mechanism.
AFAIK this is the standard broadcom flash image format:
- TAG
- CFE
- ROOT_FS
- KERNEL

The CFE, ROOT_FS or KERNEL can be left empty in order to just flash a new portion of the image.

lamaatje wrote:

Note that this order is hampering creation of a proper rootfs_data partition.
Sure would like to get rid of this CFE version, but some efforts resulted in reprogramming flash by JTAG which is very cumbersome.

Hmm, I didn't get your point ...

spirit wrote:

Well, I don't think that rootfs in front of the kernel is a special format.

I agree, it is the standard format, but I would like to have kernel first and rootfs last.

spirit wrote:

The CFE, ROOT_FS or KERNEL can be left empty in order to just flash a new portion of the image.

Haven't tried it but it might work.

spirit wrote:

Hmm, I didn't get your point ...

After detecting the rootfs partition the system tries to generate "rootfs_data" where some kind of writable unionfs of the rootfs will be mounted.
from one of the logs in this thread:

0x000d0000-0x003f0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=260000, len=190000
0x00260000-0x003f0000 : "rootfs_data"

This process somehow fails if the kernel partition is physically located after the rootfs in flash, as you state correct this is the case with standard broadcom flash image format.
My CFE supports no 'flashimage' command, so the images in the OpenWrt build process are useless.

lamaatje wrote:

I agree, it is the standard format, but I would like to have kernel first and rootfs last.

Got it ... so this is your workaround to the problem below!?

lamaatje wrote:

After detecting the rootfs partition the system tries to generate "rootfs_data" where some kind of writable unionfs of the rootfs will be mounted.
from one of the logs in this thread:

0x000d0000-0x003f0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=260000, len=190000
0x00260000-0x003f0000 : "rootfs_data"

This process somehow fails if the kernel partition is physically located after the rootfs in flash, as you state correct this is the case with standard broadcom flash image format.

Hmm, rootfstype=squashfs,jffs2 from the boot line ...
But I guess this is a kernel issues/bug, right?

lamaatje wrote:

My CFE supports no 'flashimage' command, so the images in the OpenWrt build process are useless.

Have you tried a CFE from another router? If you have a JTAG re-flash of the original one shouldn't be a problem.

spirit wrote:

Got it ... so this is your workaround to the problem below!?

yep, but did not get it working.

spirit wrote:

Hmm, rootfstype=squashfs,jffs2 from the boot line ...
But I guess this is a kernel issues/bug, right?

A bug, or design problem in mtdpart.c by disabling CONFIG_MTD_ROOTFS_SPLIT, and 'manually' generating rootfs_data in  bcm963xx-flash.c I was able to workaround.


spirit wrote:
lamaatje wrote:

My CFE supports no 'flashimage' command, so the images in the OpenWrt build process are useless.

Have you tried a CFE from another router? If you have a JTAG re-flash of the original one shouldn't be a problem.

Tried this but these crash, debricking takes ages :-(

Hi!
Is it done on purpose that wireless bcm43xx drivers don't compile although selecting them in the configuration?

During the compilation, I get a warning saying that kmod-net-bcm43xx doesn't compile because it's not found in kernel config, as well the package it depends on, kmod-ieee80211-softmac


WARNING: kmod-ieee80211-softmac is not available in the kernel config
WARNING: kmod-net-bcm43xx is not available in the kernel config

Bye!

(Last edited by sblanco on 12 Nov 2008, 23:02)

sblanco wrote:

Hi!
Is it done on purpose that wireless bcm43xx drivers don't compile although selecting them in the configuration?

During the compilation, I get a warning saying that kmod-net-bcm43xx doesn't compile because it's not found in kernel config, as well the package it depends on, kmod-ieee80211-softmac


WARNING: kmod-ieee80211-softmac is not available in the kernel config
WARNING: kmod-net-bcm43xx is not available in the kernel config

Bye!

Strange, they are indeed not available in the kernel  .config.   They are available in .config.old

lamaatje wrote:
sblanco wrote:

Hi!
Is it done on purpose that wireless bcm43xx drivers don't compile although selecting them in the configuration?

During the compilation, I get a warning saying that kmod-net-bcm43xx doesn't compile because it's not found in kernel config, as well the package it depends on, kmod-ieee80211-softmac


WARNING: kmod-ieee80211-softmac is not available in the kernel config
WARNING: kmod-net-bcm43xx is not available in the kernel config

Bye!

Strange, they are indeed not available in the kernel  .config.   They are available in .config.old

Have you tried to compile with that .config.old? Does it work?

Hi all,
I have a netgear dg834gt with chipset broadcom 6348.
After I compiled the firmware, I flashed with cfe using this firmware: openwrt-96348GW-10-squashfs-cfe.bin  (trunk version 13186):

boot log:

CFE version 1.0.37-5.11 for BCM96348 (32bit,SP,BE)
Build Date: Fri Sep 17 15:59:48 CST 2004 (root@Run-P4)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Devices.                                                                       
            internal_open                                                                               
            bcm6348enet: init_emac                                                                       
            CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz                                           
                                                                                                         
            Total memory used by CFE:  0x80401000 - 0x8051C910 (1161488)                                 
            Initialized Data:          0x80418630 - 0x804192D0 (3232)                                   
            BSS Area:                  0x804192D0 - 0x8041A910 (5696)                                   
            Local Heap:                0x8041A910 - 0x8051A910 (1048576)                                 
            Stack Area:                0x8051A910 - 0x8051C910 (8192)                                   
            Text (code) segment:       0x80401000 - 0x80418624 (95780)                                   
            Boot area (physical):      0x0051D000 - 0x0055D000                                           
            Relocation Factor:         I:00000000 - D:00000000                                           
                                                                                                         
            Board IP address                : 192.168.1.1:ffffff00                                       
            Host IP address                 : 192.168.1.100                                             
            Gateway IP address              :                                                           
            Run from flash/host (f/h)       : f                                                         
            Default host run file name      : vmlinux                                                   
            Default host flash file name    : bcm963xx_fs_kernel                                         
            Boot delay (0-9 seconds)        : 1                                                         
            Board Id Name                   : 96348GW-10                                                 
            Psi size in KB                  : 16                                                         
            Number of MAC Addresses (1-32)  : 2                                                         
            Base MAC Address                : my mac address .....                                         
            Ethernet PHY Type               : Internal                                                   
            Memory size in MB               : 16                                                         
                                                                                                         
            *** Press any key to stop auto run (1 seconds) ***                                           
            Auto run second count down: 0                                                               
            Code Address: 0x80010000, Entry Address: 0x80010000                                         
            Decompression OK!                                                                           
            Entry at 0x80010000                                                                         
            Closing network.                                                                             
            Starting program at 0x80010000                                                               
            Linux version 2.6.27.4 (misteroX@ubuntu8041) (gcc version 4.1.2) #4 Tue Nov 11 17:46:43 EST 2008
            Detected Broadcom 0x6348 CPU revision b0                                                     
            CPU frequency is 256000000 MHz                                                               
            16MB of RAM installed                                                                       
            board_bcm963xx: CFE version: unknown                                                         
            board_bcm963xx: unknown bcm963xx board: 96348GW-10                                           
            console [early0] enabled                                                                     
            CPU revision is: 00029107 (Broadcom BCM6348)                                         
            Kernel panic - not syncing: unable to detect bcm963xx board

at boot time it recognize cpu 6348 revision B0 but doesn't recognize:

          board_bcm963xx: CFE version: unknown                                                         
          board_bcm963xx: unknown bcm963xx board: 96348GW-10                                                   
         


I modified makefile this way, is it right?

/13186/target/linux/brcm63xx/image/Makefile

define Image/Build
        $(STAGING_DIR_HOST)/bin/trx -o $(BIN_DIR)/openwrt-$(BOARD)-$(1).trx -f $(KDIR)/loader.gz -f $(KDIR)/vmlinux.lzma $(call trxalign/$(1)) -f $(KDIR)/root.$(1)
        $(call Image/Build/CFE,$(1),96345GW2,6345)
        # Neufbox4
        $(call Image/Build/CFE,$(1),96358VW,6358)
# added targets to Makefile
       # DG834GT
       $(call Image/Build/CFE,$(1),96348GW-10,6348)
endef

below there is boot log of original netgear firmware:

CFE version 1.0.37-5.11 for BCM96348 (32bit,SP,BE)
Build Date: Fri Sep 17 15:59:48 CST 2004 (root@Run-P4)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.
internal_open
bcm6348enet: init_emac
CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz

Total memory used by CFE:  0x80401000 - 0x8051C910 (1161488)
Initialized Data:          0x80418630 - 0x804192D0 (3232)
BSS Area:                  0x804192D0 - 0x8041A910 (5696)
Local Heap:                0x8041A910 - 0x8051A910 (1048576)
Stack Area:                0x8051A910 - 0x8051C910 (8192)
Text (code) segment:       0x80401000 - 0x80418624 (95780)
Boot area (physical):      0x0051D000 - 0x0055D000
Relocation Factor:         I:00000000 - D:00000000

Board IP address                : 192.168.1.1:ffffff00
Host IP address                 : 192.168.1.100
Gateway IP address              :
Run from flash/host (f/h)       : f
Default host run file name      : vmlinux
Default host flash file name    : bcm963xx_fs_kernel
Boot delay (0-9 seconds)        : 1
Board Id Name                   : 96348GW-10
Psi size in KB                  : 16
Number of MAC Addresses (1-32)  : 2
Base MAC Address                : my macaddres............
Ethernet PHY Type               : Internal
Memory size in MB               : 16

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Code Address: 0x80010000, Entry Address: 0x80227018
Decompression OK!
Entry at 0x80227018
Closing network.
Starting program at 0x80227018
Linux version 2.6.8.1 (root@Build_Server) (gcc version 3.4.2) #12 Mon Aug 6 14:09:51 CST 2007
Total Flash size: 4096K with 71 sectors
Scratch pad is not used for this flash part.
96348GW-10 prom init
CPU revision is: 00029107
mpi: No Card is in the PCMCIA slot
Determined physical RAM map:
memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
  DMA zone: 4000 pages, LIFO batch:1
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists

What do I have to modify to let firmware recognize cfe and board at boot time ?


Thank.
MisteroX

(Last edited by misteroX on 15 Nov 2008, 00:31)

misteroX wrote:

What do I have to modify to let firmware recognize cfe and board at boot time ?

Take a look at post #58 ...

You have to modify .../arch/mips/bcm63xx/boards/board_bcm963xx.c and add an entry for your board.

spirit wrote:
misteroX wrote:

What do I have to modify to let firmware recognize cfe and board at boot time ?

Take a look at post #58 ...

You have to modify .../arch/mips/bcm63xx/boards/board_bcm963xx.c and add an entry for your board.

Hi spirit,

I made a mistake, and now my router is bricked.

Recovery utility does not replace firmware into router.
CFE don't start at boot and serial console do nothing; I see only led of switch active where cable is inserted.


I saw on openwrt site ( http://wiki.openwrt.org/OpenWrtDocs/Cus … TAG_Cable)
there ar two possible jtag configuration.

For semplicity I want to make this jtag : Unbuffered Cable, Xilinx DLC5 Cable III

Do you know if I can use "HairyDairyMaid_WRT54G_Debrick_Utility_v48.zip (wrt54.exe)" to send CFE.bin into my router ?

If so which is the correct memory address to send CFE.BIN into DG834GT ?


Many thanks in advice.
MisteroX

To recover the router is recommended to send , by the slow process, only the CFE through JTAG, and then send the firmware via webpage.

For this I used the modification of the program HairyDaili ... Telsey adapted to the router (chip BCM96348), telsey_debrick-0.91beta1 (use google)
to send the firmware I used the only option / nodma.

The recovery software for JTAG presents the following feature as a file with the bytes in the following order:
ABCD .....
sent by JTAG
BADC .....
and read by JTAG
DCBA .....

So to send a file by JTAG must first amend the original.
An option to prepare the file from linux will be:
dd if = CFE.BIN.ori of = CFE.BIN.byteswapped conv = swab

Once the file envoy, light power maybe is not activated, but the router is ready to receive the firmware from a mini website to which we access via IP is the default router.

Good luck.

Unpowered/unbuffered JTAG used:
[url=http://img82.imageshack.us/my.php?image=convjtaggp7.jpg]

(Last edited by t3l3m4k0 on 17 Nov 2008, 15:20)