actually wireless is working, i was testing from a ps3 just a room away before and now im using a pci card about 6 inches from the router i see beacons and i've associated.

going mess with some registers

tx power, antenna, etc, etc.

so thats linux, dsl, wifi, ethernet all on 585v7

Hey there, I got one of these in the post from my new ISP yesterday. I'd quite like to put openWRT on it, as the router I normally use (linksys wag325n) isn't supported by any alternative firmware, and I love the idea of a completely linux-based (and configurable) network in my house As a complete newbie, do you package the firmware into an update and then force the router to read it, or do you flash it with a serial, or something? Basically, how do I get it working like you have ^_^

Thanks,
John

not-so-mini tut

first off
we all know you might break your device doing this so take the usual warnings and precautions and dont blame me if something goes wrong
You will need a computer runining linux. Redhat is reccomended but i use debian personally, with the rpm package installed.
a tftp server
a soldering iron
25 pin d sub male connector (thats the printer one)
4 100ohm resistors (brown black brown)
some sort of serial level shifter you could use a max232 or a pl2303 google for them you will need one.  -Tip- i use a pl2303 from an old mobile phone datacable.
tjtag - http://www.tiaowiki.com/download//file.php?id=24
refer to ali1234's pic here, https://forum.openwrt.org/viewtopic.php … 35#p105535

you only need to bridge r91 and r98 for the serial (bottom pic)
its up to you if you want to make some sort of header like ali did (top pic). it is better because you can just unplug it and use it again later.

use the diagram posted by alromh87 here, https://forum.openwrt.org/viewtopic.php … 82#p101182 to build your jtag cable, keep it shorter than about 6 inches
dont worry about the 5th resistor to the serial port.
the parellel port is pictured as if your'e looking into the pc printer port and the jtag one like looking at the chip side of the board with the ethernet connectors at the bottom, like ali's pic.

connect the level shifter between the pc and routers serial port

cd to wherever tjtag lives

plug in your jtag cable.
test it

tjtag -probeonly /fc:85

did it say:
Failed to open /dev/parport0: No such file or directory?

do this:

rmmod lp
modprobe parport
mknod /dev/parport0 c 99 0 -m 666

while your at it, if you have the pl2303

modprobe pl2303
mknod /dev/ttyUSB0 c 188 0 -m 666

test again,
tjtag -probeonly /fc:85

should say,

==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000110001100111000000101111111 (0633817F)
*** Found a Broadcom BCM6338 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done

Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000101111110 (0000017E)
Flash Device ID: 00000000000000000001101000000000 (00001A00)
*** Manually Selected a Spansion S29GL032M BotB    (4MB) Flash Chip ***

    - Flash Chip Window Start .... : 1fc00000
    - Flash Chip Window Length ... : 00400000
    - Selected Area Start ........ : 00000000
    - Selected Area Length ....... : 00000000

*** REQUESTED OPERATION IS COMPLETE ***

crack open your favourite terminal emulator - speed 9600 and have a last look at what you cant do with thomsonware
(you have to reboot your router as the jtag command will have froze it)

get the source -

ftp://ftp.dlink.ru/pub/ADSL/GPL_source_ … ase.tar.gz

untar it in /opt you should get 3 files:

bcm963xx_3.12L.01_consumer.tar.gz
bcm963xx_uclibc_crosstools_3.4.2_0.9.27.tar.gz
consumer_install

if you dont have Redhat linux you might need to change the line in consumer_install that says

rpm -ivh --force uclibc-crosstools*.rpm

to

rpm -ivh --nodeps uclibc-crosstools*.rpm

now run ./consumer_install
do the obvious

you should get in /opt, two directories -
toolchains - this is the cross compiler, tools and libraries, you shouldnt need to touch this
bcm963xx_router - this is the source for the firmware - you can change pretty much everything in here apart from broadcoms proprietary stuff

so,
cd /opt/bcm963xx_router

to build a straight firmware type,
make PROFILE=96338GWS

This might take a while so, in the meantime,

open another terminal
cd to tjtag

you really want to be making a backup of your current firmware

tjtag3 -backup:wholeflash /fc:85 /bypass /st5
the /bypass /st5 are needed on either read or write but im not sure which or if its both so use them anyway

this will take short while

then

you will need this cfe http://rapidshare.com/files/406151637/cfe.bin.zip
extract it into the tjtag folder

and only if you're ready to blow the thomsonware away,

./tjtag3 -flash:cfe /fc:85 /bypass /st5

that wont take long

when its finished reboot the router

watch the terminal - you might need to change your terminal program's settings to 115200 8N1

now you should have a menu,
for the board choose 0
set the amount of mac addresses you want
and the base mac address

and i think the board resets here

when it comes back type,
c
set your ip address
set your pc address
leave gateway
just leave defaults for everything else, im going on memory so i might not have this in the right order.

now the router should be waiting for a firmware

if your firmware has finished building find the firmware image in /opt/bcm963xx_router/images

transfer this to your tftp server and type into the router terminal

flashimage address.of.tftp.server:firmware_image_name

let it flash and reboot

user: admin
password: admin

notice how the eth0 interface downed ive fixed mine by commenting out the brooadcom configuration manager 'cfm' lines from /opt/bcm963xx_router/targets/96338GWS/96338GWS and
creating my own startup in place of /opt/bcm963xx_router/targets/fs.src/etc/profile - be careful of this one you need to keep the 'if' loop or everytime the shell times out the router will think its just booted.

a few other things,

never do a straight make clean on the source, it will break it. use make PROFILE=96338GWS clean

busybox can be configured,
cd /opt/bcm963xx_router/userapps/opensource/busybox
make menuconfig
load an alternate configuration file
brcm.config
remember to save alternate config file to the same file after configuring

take this bit with a pinch of salt -
you can configure the kernel via make menuconfig but that seems to break things,
instead theres a file /opt/bcm963xx_router/hostTools/scripts/defconfig-bcm.template you have to edit this manually, however,
theres another /opt/bcm963xx_router/targets/96338GWS/96338GWS settings in here override the ones in the first file.
also theres a script at/opt/bcm963xx_router/hostTools/scripts/gendefconfig that changes the kernel config.
all these together get mangled up and turned into the kernel .config

i dont think this should go on the wiki yet,
at least until we have a better understanding of the device.

theres gpio definitions in /opt/bcm963xx_router/shared/opensource/boardparms/bcm963xx/boardparms.c - search for 96338W theyre under there

the wlan doesn't seem to be transmitting at a propper level - i havn't got around to checking registers and srom yet though.
id like to  make use of the led on the front button, it is connected directly to the wifi chip.

a few gpios - i might not be entirely right on these
2L ethernet green
2H broadband
4H internet red
5H internet green

wifi is hardwired - green on, red data

Any questions or suggestions? Feel free to pm me.

Thanks

(Last edited by routednbooted on 12 Jul 2010, 06:05)

Thanks a lot for such a detailed tutorial! I actually already have a max232 (my dad uses it for his special weighing kit he has at work).
I bought a "25-Pin D Connector Plus Shell Housing", "100 x 100 Ohm 0.25w Carbon Resistors 1/4w Resistor 100R.", "1 Metre Black Heat Shrink Tubing 1.6 mm tube sleeving.", and "KYNAR WIRE 5M Yellow - XBOX PS3 WII MODS 5 Metre 15Feet" from ebay in order to do this

I have a soldering iron already, I have ubuntu linux on my machine already (I hate windows), which as you probably know is DEB based, but I should be able to install it without using RPM. If I come across any problems, I'll let you know

Again, thanks for such a detailed tut!

You can have a look at ali's and my patches above for the GPIO defs, they're in the patch.
Right now I'm compiling the firmware, let's see

Thanks for you tutorial!

It boots properly, WiFi and ethernet are working, I did not test DSL.

If you issue "ifconfig eth0 up" after running "cfm", ethernet is working!

excellent..

But does it come back up after a reboot?

if it doesn't, when you're not connected via serial that will be a problem.

where im at so far,

CFE version 1.0.37-6.5.17 for BCM96338 (32bit,SP,BE)
Copyright (C) 2000-2005 Broadcom Corporation.

Boot Address 0xbfc00000

Initializing Arena.
Initializing Devices.
Parallel flash device: name AM29LV320MB, id 0x2200, size 4096KB
Auto-negotiation timed-out
10 MB Half-Duplex (assumed)
CPU type 0x29010: 240MHz
Total memory: 16777216 bytes (16MB)

Total memory used by CFE:  0x80401000 - 0x805283F0 (1209328)
Initialized Data:          0x8041D7F0 - 0x8041FA50 (8800)
BSS Area:                  0x8041FA50 - 0x804263F0 (27040)
Local Heap:                0x804263F0 - 0x805263F0 (1048576)
Stack Area:                0x805263F0 - 0x805283F0 (8192)
Text (code) segment:       0x80401000 - 0x8041D7E8 (116712)
Boot area (physical):      0x00529000 - 0x00569000
Relocation Factor:         I:00000000 - D:00000000

Board IP address                  : 192.168.0.1
Host IP address                   : 192.168.0.33
Gateway IP address                :
Run from flash/host (f/h)         : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 3
Board Id Name                     : 96338W
Psi size in KB                    : 24
Number of MAC Addresses (1-32)    : 6
Base MAC Address                  : 00:34:45:56:67:78
Ethernet PHY Type                 : External
Memory size in MB                 : 16
CMT Thread Number                 : 0
Dying Gasp Enable (0:Disable 1:Enable)  : 1

*** Press Enter to stop auto run (3 seconds) ***
Auto run second count down: 0
Code Address: 0x80010000, Entry Address: 0x801b7018
Decompression OK!
Entry at 0x801b7018
Closing network.
Starting program at 0x801b7018
Linux version 2.6.8.1 (person@localhost) (gcc version 3.4.2) #7 Sun Jul 11 13:17:41 0
Parallel flash device: name AM29LV320MB, id 0x2200, size 4096KB
96338W prom init
CPU revision is: 00029010
Determined physical RAM map:
 memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
  DMA zone: 4000 pages, LIFO batch:1
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB 2-way, linesize 16 bytes.
PID hash table entries: 64 (order 6: 512 bytes)
Using 120.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 13884k/16000k available (1463k kernel code, 2096k reserved, 225k data, )
KLOB Pool 1 Initialized: 1048576 bytes <0x80e00000 ... 0x80f00000>
Calibrating delay loop... 239.20 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction...  unavailable.
NET: Registered protocol family 16
Total Flash size: 4096K with 71 sectors
File system address: 0xbfc10100
Blk# BlkOff Blks  MemLen Partition Name
   0   1408    1    1024 NVRAM
  69  40960    1   24576 Config 2
  70  32768    1    8192 Scratch PAD
  70  40960    1   24576 Config 1
Can't analyze prologue code at 8017c564
Initializing Cryptographic API
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v1.0
brcmboard: brcm_board_init entry
SES: Button Interrupt 0x0 is enabled
SES: LED GPIO 0x8005 is enabled
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xfffe0300 (irq = 10) is a BCM63XX
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
Initializing IPsec netlink socket
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
NET: Registered protocol family 8
NET: Registered protocol family 20
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 68k freed
init started:  BusyBox v1.00 (2010.07.10-22:08+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5


BusyBox v1.00 (2010.07.10-22:08+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.


Loading drivers and kernel modules...

atmapi: module license 'Proprietary' taints kernel.
adsl: adsl_init entry
blaadd: blaa_detect entry
Broadcom BCMPROCFS v1.0 initialized
Broadcom BCM6338A2 Ethernet Network Device v0.3 Apr 10 2009 20:28:04
Config Ethernet Switch Through MDIO Pseudo PHY Interface
ethsw: found bcm5325m!
dgasp: kerSysRegisterDyingGaspHandler: eth0 registered
eth0: MAC Address: 00:34:45:56:67:78
SDIOH mode switch from 1 to 2
available commands: sdio sdioh

---SDIO init SUCCEEDED--- sromless

chipid 0x4024318
bcmsdh_attach, sdioh_attach successful, bcmsdh->sdioh 0x80e97310
wl0: wlc_attach: use mac addr from the system pool by id: 0x776c0000
wl0: MAC Address: 00:34:45:56:67:79
wl0: Broadcom BCM4318 802.11 Wireless Controller 3.131.35.6.cpe1.0a.sd-e1
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
Trying to free free IRQ25

# we dont need no stinkin # cfm.
# this is a good place to start networking.
# todo: some way to get these addresses to and from nvram.
# todo: user and password too.

host_name=585v7
host_ip=192.168.0.1
netmask=255.255.255.0
broadcast=192.168.0.255
gateway_ip=

Configuring network...
device eth0 entered promiscuous mode
device wl0 entered promiscuous mode
# i think it would be a good idea to start the firewall here
# just need to set some rules up. do that later.
/sbin/udhcpc # these need
/usr/sbin/udhcpd # configuring.
/usr/sbin/httpd #
# need a sshd
Bring up network...
br0: port 1(eth0) entering learning state
# dont enable wl0 just yet because we have an open network.
# ifconfig wl0 up

# say something informative.
# give more info.
# etc.

#
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state

Good work.

CANT-P is a specific board identifier for Thomson, no other vendor kernel will recognise it, that's why you needed the patch.

Can you trace the wifi module to find SDIO registers so we can make a new driver for it?

im on thomson at the moment but i did notice

in the broadcom binary driver
a0itssit
pa0b0
pa0b1
pa0b2
pa0maxpwr
were all insane looking values but the srom map was very different from a normal 43xx. endieness, size, all different. so i didnt know what to change

the b43 driver can support sdio. i dont know if it has already been included in the realease. http://www.gc-linux.com/wiki/Wii:WLAN
and we'll need a different firmware. i dont know if the wii one is compatible.

I am interested in flashing my thomson with openwrt.

I read that you have aldo managed to set up wifi too.

So, is everything working fine with openwrt on Thomson? What are the problems that need to be fixed?

Haros, please read thoroughly through the whole thread. Currently, there is NO fully working openwrt for the TG585v7. All your questions are answered within the thread.

To sum up:
With OpenWrt, wireless and DSL are not working, because those features rely on binary-only drivers that are only available for Linux 2.6.8.1. AFAIK, ali1234 is working on WiFi.

The other option is what routednbooted is trying to accomplish: boost a D-Link supplied firmware that runs Linux 2.6.8.1 and the binary-drivers with certain features.

Both approaches require you to solder some parts to the PCB, build serial and JTAG cables and re-flash the CFE with a patched version.

Thanks for the feedback. I was just asking to see if any progress was made.

Has anyone got a image fille so i can tftp the image?

Not bothed about the ADSL drivers.

Cheers

(Last edited by francisuk on 11 Aug 2010, 13:15)

Hi i am trying to use gcl wireless dirver on OpenWrt, I have build my kernel with spi and mmc-spi but i dont get any message about mmc iopenwrt so no sdio.
does anyone have any idea on how to enable mmc in orther to get sdio

thnaks

dmesg | egrep "b43|mmc|phy|sdio|wlan|spi"
bcm63xx-spi bcm63xx-spi.0:  at 0xfffe0c00 (irq 9, FIFOs size 63) v0.1.2

Ok after some hacking in the code i am here

dmesg | egrep "b43|mmc|phy|sdio|wlan|spi"
bcm63xx-spi bcm63xx-spi.0:  at 0xfffe0c00 (irq 9, FIFOs size 63) v0.1.2
mmc_spi spi0.0: ASSUMING SPI bus stays unshared!
mmc_spi spi0.0: SD/MMC host mmc0, no DMA, no WP, no poweroff
mmc_spi spi0.0: mmc_spi: power up (21)
mmc_spi spi0.0: mmc_spi: power on (21)
mmc_spi spi0.0: bcm63xx_spi_setup_transfer, unsupported bits_per_word=0

Normally it gets stuck at last message but I edited some kernel files to continue loading now I will try to get sdio and se what happends

(Last edited by alromh87 on 1 Sep 2010, 03:29)

I took out the heat-sink that was over the wireless chip and there are some test point so I will try to see what i cant get from there on the original firmware after fixing the components that I moved during the processes. oops

Interesting TP:
TP_WLAN
TP_TDO
TP_TDI
TP_TCK
TP_TMS
TP_TRS

but I don't see any SDIO TP does anyone have the BCM4318KFBG datasheet?

(Last edited by alromh87 on 9 Sep 2010, 17:06)

here the link : http://pdf1.alldatasheet.com/datasheet- … M4318.html

"""
you will need this cfe http://rapidshare.com/files/406151637/cfe.bin.zip
"""
link is broken

http://rapidshare.com/files/420538739/cfe.bin.zip

re-up it somewhere it wont get deleted if you want

tnx

I am watching this thread with interest.

Does
http://www.psidoc.com/forum/viewthread. … ead_id=158
help at all? The BT Homehub is a Thomson Speedtouch with takes similar firmwares to the Thomson Gateways.

Updated: Discussion also at https://forum.openwrt.org/viewtopic.php?id=26639

(Last edited by tefirrik on 25 Sep 2010, 19:10)

Thats actually something i had a lot to do with. What part do you mean?

As a whole, the TG585v7 has no usb. so you cant do the telnet thing to get a command shell.

You are right, I missed the part that you need to mount the USB stick in order to copy the data. Sorry for the off-topic.

What, exactly, is the problem with running on 2.6.8.1 kernel so the binary drivers work? Is there a particular reason why this is not suitable for some of the other openwrt features? I have a SpeedTouch 585 (I think it's a v6) and am most interested in having a more sane firmware in it than what is provided as standard.

If you want to do that its completely up to you. Personally i wouldn't want to be stuck at one version, sooner or later im going to find somthing that wants a different kernel or compiler version.
I think the V6 is a bcm6348 so anything in this thread would probably kill it.