OpenWrt Forum Archive

Topic: New Broadcom BCM63xx codebase with GPL'd Ethernet and USB support

The content of this topic has been archived between 8 Feb 2018 and 7 May 2018. Unfortunately there are posts – most likely complete pages – missing.

t3l3m4k0 wrote:
Isaac702 wrote:
t3l3m4k0 wrote:

@Isaac702

you must patch file:

root/trunk/target/linux/brcm63xx/files/arch/mips/bcm63xx/boards/board_bcm963xx.c

with apropiate values of your board at this points:

I had done this already however just in case I check it again. The boardid is V2110 and the cpu is a 6348.
When I try to update it returns the error "The firmware update is failed. The selected file contains an illegal image."
I have checked other firmwares and cannot see any other firmware with the variables in the positions I stated above. The exception to this is the RTA1025 which is the board the BT Voyager 2110 is based upon.
I will retract the statement saying the problem is with the firmware version as there is a version 1 device supported by OpenWRT.

Editied: To remove quoted code.

can you post "dmesg" command result, from original firmware?

Here is a copy of the output for the "dmesg" command. http://pastebin.com/f1787aec

Isaac702 wrote:

Here is a copy of the output for the "dmesg" command. http://pastebin.com/f1787aec

I try to find inside your dmesg, name of your board, i can't.
Do you have a serial port in your router?
If yes, try to connect at 115200 bps, 8 bits, no parity and capture cfe (broadcom bootloader) boot messages to see name of your board.

thnx

t3l3m4k0 wrote:
Isaac702 wrote:

Here is a copy of the output for the "dmesg" command. http://pastebin.com/f1787aec

I try to find inside your dmesg, name of your board, i can't.
Do you have a serial port in your router?
If yes, try to connect at 115200 bps, 8 bits, no parity and capture cfe (broadcom bootloader) boot messages to see name of your board.

thnx

I presumed that the name of the board was V2110 due to it being listed in the official firmware for the device and in the output of cpuinfo. (http://pastebin.com/f61041c0d).
There appears to be a four pin connector on the board however I have no experience in this area and do not know if it is a serial port.

Here is a image of the board. http://img207.imageshack.us/img207/4452/dscn5211x.jpg
I'm not sure if this would be much help in identifying the port.
I am right in assuming the 4 pin connect in the left center of the image is a serial port. Behind that connector there is the code "J303".

If it is then I can try to get the necessary equipment to access the console.

Isaac702 wrote:

Here is a image of the board. http://img207.imageshack.us/img207/4452/dscn5211x.jpg
I'm not sure if this would be much help in identifying the port.
I am right in assuming the 4 pin connect in the left center of the image is a serial port. Behind that connector there is the code "J303".

If it is then I can try to get the necessary equipment to access the console.

I think yes, J303 is serial console with 3'3v level outputs, you must identify TX,RX, and GND pins. Also you must use a TTL to RS232 conversor. (3'3 -> +/-12V). As you can see there is unpopulated capacitors C306-C307-C308, not indispensable.

I see also connectors:
J201 -> JTAG with unpopulated components RP201 (i think 10 ohms)
and
J301 -> USB Host?
J304 -> USB Slave? with unpopulated capacitors and resistors below.

luck

(Last edited by t3l3m4k0 on 22 May 2009, 15:18)

Ok I managed to find a old phone data cable which worked well. I don't have the necessary components to connect it properly however holding the cables in place allowed me to get the output from cfe. Here is a full copy of the boot log from the serial console : http://pastebin.com/m5002cf7c

Ok I have tried to update the firmware through the web interface while monitoring the serial console.
It accepts the firmware however then fails with the following error. " ***** Not allowed to downgrade to 2.10 or earlier version ******"

Here is the full output for the update process: http://pastebin.com/f5acc9227

From the information presented I would guess this is referring to the FlashLayoutVer which it claims in OpenWRT is 0.
I'm not sure if it is a coincidence or not however the variable at 192 bytes in the latest BT Voyager 2110 and Dynalink RTA1025W firmwares is a 5. This is the same as the "curFlashLayoutVer".

BT doesn't provide an archive of older firmwares however I have tracked this variable back through the Dynalink firmware just in case it is the variable concerned.
2.21   = 3
3.28q = 4
3.29a = 5
3.29u = 5
3.30j  = 5
3.63u = 5

Looking at this I would guess that the router believes it is downgrading due to the variable being bellow 3 and thus bellow the variable set on the 2.10 firmware. (As I cannot find the 2.10 firmware this is an assumption.)

How would I go about setting byte 192 to 5 to see if "FlashLayoutVer" will change when the installer validates the firmware?

Edit: Correct error in 2.21 firmware version.

(Last edited by Isaac702 on 23 May 2009, 12:56)

@Isaac702,

nice to see that serial port runs fine.

from boot from serial console your board name is V2110

i see also your CFE has a serial board  number included.

i don't know any about versions 3, 4, 5, .... but you can try. Also from serial console you can try to stop boot process, type help i see a list of availables commands, try with "flashimage" command, if it exists, try to flash with your specific-boardname-cfe-squashfs.bin firmware

luck


edit:

you can insert tags modifiying ../trunk/tools/firmware-utils/src/imagetag.c

(Last edited by t3l3m4k0 on 23 May 2009, 15:49)

Well I can confirm that if you change the variable at 192 bytes to 5 the firmware is accepted. However after it was installed it did not pass the image integrity check. Here is a copy of the output : http://pastebin.com/f1e099c39

I'm not sure if this is a problem with the way I compiled it or if it was the modification.

Good thing I made that serial cable.

Edit: Actually I didnt need the serial cable. The CFE web interface is a nice touch. Im back up and running on a slightly older version of BT's firmware. (3.62. They never released a update to 3.63).

Edit 2: Also ye the CFE does have the  flashimage command. I will try that when I get a chance.

(Last edited by Isaac702 on 23 May 2009, 18:07)

Ok I just did a full recompile using the latest svn.

The flash is still failing an image integrity check. Here is the log : http://pastebin.com/f3a9f38f0

i think you have a CRC problem,

Check run time iamge integrity in the flash......[0x08166FAD] != [0x00000000] Image Corrupted !!

how did you put the byte 192 to 5?, imagetag.c made some CRC on it.

Well with this latest attempt I didn't set that byte to 5. Instead I just compiled normally and used the flashimage method you suggested.

Here is a diff file containing the changes I made to imagetag.c : http://pastebin.com/f1aa762ea

I have a guess. There is another CRC32 check (at least it looks like one) in the standard firmware for these boards. It is at bytes 196-199 as I said in my original post. It would make sense that this is the CRC32 check as CFE claims it is "[0x00000000]" regardless what I try. Unlike adding 5 to the imagetag I have no idea how I would go about adding this CRC32 to the bytes it is expected in. It also doesn't help that I don't know what this CRC32 is of.

Edit: Well I guess I could always compile a image without the CRC32 check and then recompile a second image with the CRC32 check it gives me when the check fails. That second image should in theory be accepted by the router and run the firmware. Although it doesn't really help in solving the situation permanently

Edit 2: Ok I have confirmed that the variable between 196 and 199 bytes is the value it is looking for when it does the image integrity check. If someone could help figure out what this CRC32 check is actually of it would help.

Edit 3: Ok the value it is looking for is the same as the image crc between 216 and 219 bytes. I had a look at the original firmware and this is not the case for it. If it works im not sure if that matters however it would be worth looking into why the origonal firmware image has a different variable in this position.

(Last edited by Isaac702 on 24 May 2009, 14:17)

Ok after I set the variable at that position to the required variable it accepted the firmware and was running quite happily.
Then I decided to reboot and now the image integrity check has failed. It obviously doesn't like the prospect of a read/write file system.

Edit: CFE is being extremely overzealous with its image integrity check. Regardless what I do the image checksum keeps changing after it is installed. I presume this problem has been experienced on other boards. Is there a solution for it or is it just this board being difficult?

Edit 2: I am going to try recompile with with jffs2 disabled to see if a pure squashfs solution would work. Of course this is not brilliant from a usability point of view.

Edit 3: Ok even when I disabled jffs2 in make menuconfig it still was compiled and used when I installed it. Same effect CFE rejects the flash image.

Edit 4: Here is the output from the serial port as OpenWRT boots up. : http://pastebin.com/f8ba5728

Edit 5:The Broadcom 4318 wireless card appears to be having some trouble initializing. I am getting the following error.

firmware: requesting b43/ucode5.fw                                                                                                                                                                             
firmware: requesting b43/pcm5.fw                                                                                                                                                                               
firmware: requesting b43/b0g0initvals5.fw                                                                                                                                                                      
firmware: requesting b43/b0g0bsinitvals5.fw                                                                                                                                                                    
b43-phy0: Loading firmware version 478.104 (2008-07-01 00:50:23)                                                                                                                                               
ifconfig: SIOCSIFFLAGS: Cannot assign requested address

This occurs with both the standard and experimental firmwares.

(Last edited by Isaac702 on 24 May 2009, 17:40)

Ok am I correct in assuming that the following error is the reason why the CRC of the firmware is being corrupted after the first restart.
"# 0x00010100-0x000f0000 : "kernel"                                                                                                                                                                             
# mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only"

From the information I have seen elsewhere about this error it is responsible for misaligning the image and so invalidating the CRC. I however have not found a way to fix it. Is there anyone that can help with this?

You are so near to do it ...
Sorry, i can`t help you more. It's beyon my knowledge.
Maybe cshore, expert about packing firmwares to adapt to CFE, can help you.
He has done a greath job.


luck

Marc & Florian:  I don't have your email addresses available as the main system which has them is currently hosed.  It froze in middle of a RAID reconstruction (probably due to overheating), which apparently started during a backup.  So I've lost at lesat a few days work, and am currently on my test system for working on the GW6x00 boards.  Obviously I'm going to be trying to riscesitate the system as my first priority, but I'm out of commission for a least a day, possibly three (and hopefully not more). Waah!

I am able to check my email messages, however.

Isaac702: I just noticed your messages.  I'll look through them once I'm operational again and might be able to help (I've been working on imagetag stuff)

Got your message, Dan smile

marc.

Unfortunately I had some bad luck with one of the flashes. So at the moment the unit is bricked.
I should be able to fix it with a JTAG cable however unlike with the serial cable I don't have the necessary parts to put one together.

I also don't have the time to do so at the moment. I will probably give this another try in about 2 weeks.  Any help would still be appreciated however.

Hi all,

My work is using a TP-Link TD-8840 ADSL modem, which is based on the BCM6338 v1.0 board. The firmware it comes inserts iptables rules that can only be gotten rid of manually, so we'd like to put OpenWRT on it. The boss has approved buying a second one and sending it to an OpenWRT developer - who should I contact to organise this?

# cat /proc/cpuinfo
system type             : 96338L-2M-8M
cpu model               : BCM6338 V1.0
Isaac702 wrote:

Ok am I correct in assuming that the following error is the reason why the CRC of the firmware is being corrupted after the first restart.
"# 0x00010100-0x000f0000 : "kernel"                                                                                                                                                                             
# mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only"

From the information I have seen elsewhere about this error it is responsible for misaligning the image and so invalidating the CRC. I however have not found a way to fix it. Is there anyone that can help with this?

Hello guys i would port Openwrt to a new Board (A modem of Fastweb Italian ISP).
Openwrt boot and recognize the board and lot of hardware (wifi,usb ecc..) but at the first reboot the CRC is corrupted.
In the bootlog i've the same error of Isaac702.
There is any news?

@Isaac702 if your board is bricked contact me to test any firmware in my board , if you want smile

Bye ftp21

There is any method to stop boot after mount the mtd to check the memory?

Because i think the mtd is ok but is disaligned and the mount is corrupted

I'm working on the imagetag right now;  you may want to wait until it's in trunk (web flashing from stock firmware is what I'm working on; it only works for a limited set of boards at the moment)

Hi  all,
my router is DG834GT:

I've succeded to install the openwrt firmware from the web interface of the original firmware and then from luci.

These are the steps that I have followed for the dg834gt:

From sources of original firmware Netgear I created a new script that uses the tool makeimage issued by the Netgear

#!/bin/sh

if [ "$1" = "" ] || [ "$2" = "" ] || [ "$3" = "" ]; then
        echo "Usage:" $0 "orignal_image openwrt-96348GW-10-squashfs-cfe.bin new_image"
        exit
fi

echo
echo "Original Image:" $1
echo "bcm963xx_fs_kernel:" $2
echo "New Image:" $3
echo
echo "Press 'y' to continue"

read yn

if [ "$yn" = "y" ]; then
        tools/makeImage $3 $1 $2
        echo $3 "Created!"
else
        echo "EXIT!"
fi


######################

#### Result mkimage.sh

I have sent openwrt_dg834gt_rev_163326.img file through the web interface of the router dg834gt without using the serial console (CFE).



ssh console :

BusyBox v1.13.4 (2009-06-04 21:33:17 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r16326) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------

Other test:
I have sent the firmware openwrt-96348gw-10-squashfs-cfe.bin through the Web Interface (LUCI) and router up and runnig without error.


Thanks all developers.
MisteroX

HI all,

I'd like everyone to tell my their router and the version of the broadcom source code (it appears on the serial console when booting, and is present in the source code) their router uses.  Also if you have source code for your router, please let me know where I can download it.  Here's why:

I am working on the imagetag and from what I have been able to determine there are five different flash formats:

cfe:will flash as long as the header CRC is correct
cfe-new: as cfe except for some newer boards if the formerly reserved space is used, but isn't correct the CRC it is now used for, you can't flash from CFE
original: at least from 3.02 to 3.08 of the broadcom code, needs header CRC and whole image CRC
new: 3.08 to at least 3.12 of the broadcom code, needs header CRC, whole image CRC, kernel CRC, and rootfs CRC
alicegate: modified version of version 3.06 of the broadcom code; instead of whole image CRC uses kernel CRC

I am doing up a README for router->broadcom version because the new imagetag will generate images for each format, and it would be helpful to users to know which applies to their router.  (The reference board is insufficient because some board designs are used for routers with two different versions of the imagetag).

Please email to crazycshore@gmail.com

(Last edited by cshore on 5 Jun 2009, 00:38)

i mod a bcm6348 modem wag54gs's memory to 32m that has 16m originally.
i flash it to openwrt, it works, but memory is recognized as 16m.
there's no nvram to set or i don't know, how can it use whole 32m ram?

do i need a new cfe? how can i find it?