Hi,

I've just received a Buffalo WBMR-HP-G300H and would love to get OpenWRT on it, I notice there is some support in trunk, but I can't figure out how to get it on there, the images don't seem flashable.

I've got dd-wrt on there ok, but I'm not a great dd-wrt fan ... I really want to get to OpenWRT.

I'm happy to open it up and solder on a serial console if that's what's needed, and very happy to help test etc (it's purely a test box at this stage.)

Cheers,

Lee.

Actually ... given I have dd-wrt on there, could I simply do this?

mtd -r openwrt-lantiq-ar9-WBMR-jffs2-64k.image linux

Or would that brick the router?   I've just ordered a set of the security torx so I can get into the thing and get a console on it.

Cheers,

Lee.

I got bored, so I decided to drill out the holes a little bit so I could get my torx bits in there, so it's now open and has a serial console all working nicely (didn't need to solder anything, it has a nice header for you) ...

XR9-x chip found
DDR set @ 166.6MHz
Check initial DDR setting...DDR check ok... start booting...



ARCADYAN U-Boot 1.00 (Nov 10 2010 - 17:41:42)

AR9 BOARD
CLOCK CPU 333M RAM 166M
DRAM:  64 MB

 relocate_code start
 relocate_code finish.
Flash: 32 MB
In:    serial
Out:   serial
Err:   serial
Net:   
switch chip id=00001001
AR8316
amazon_s Switch

Copying boot params.....
DONE

Type "run flash_nfs" to mount root filesystem over NFS

Hit any key to stop autoboot:  0 
ARC_BOOT # printenv
bootcmd=run flash_flash
bootdelay=3
baudrate=115200
preboot=echo;echo Type "run flash_nfs" to mount root filesystem over NFS;echo
bootfile=uImage
mem=64M
phym=64M
netdev=eth0
console=ttyS1
baudrate=115200
tftppath=
loadaddr=0x80800000
rootpath=/mnt/full_fs
rootfsmtd=/dev/mtdblock3
nfsargs= setenv bootargs root=/dev/nfs rw nfsroot=$(serverip):$(rootpath)
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):n
mtdparts=ifx_nor0:256k(uboot),128k(ubootconfig),1280k(kernel),30336k(rootfs),256k(firmware),128)
addmisc=setenv bootargs $(bootargs) console=$(console),$(baudrate) ethaddr=$(ethaddr) phym=$(ph 
flash_nfs=run nfsargs addip addmisc;bootm $(kernel_addr)
net_nfs=tftp $(loadaddr) $(tftppath)$(bootfile);run nfsargs addip addmisc;bootm
net_flash=tftp $(loadaddr) $(tftppath)$(bootfile); run flashargs addip addmisc; bootm
net_ram=tftp $(loadaddr) $(tftppath)$(bootfile); run ramargs addip addmisc; bootm
u-boot=u-boot.ifx
rootfs=rootfs.img
firmware=firmware.img
fullimage=fullimage.img
totalimage=totalimage.img
load=tftp $(loadaddr) $(u-boot)
update=protect off 1:0-2;era 1:0-2;cp.b $(loadaddr) B0000000 $(filesize)
flashargs=setenv bootargs root=$(rootfsmtd) ro rootfstype=squashfs
flash_flash=run flashargs addip addmisc; bootm $(kernel_addr)
update_uboot=tftpboot $(loadaddr) $(tftppath)$(u-boot); prot off b0000000 b1fbffff; erase b0000t
update_kernel=tftpboot $(loadaddr) $(tftppath)$(bootfile);upgrade $(loadaddr) $(filesize)
update_rootfs=tftpboot $(loadaddr) $(tftppath)$(rootfs); upgrade $(loadaddr) $(filesize)
update_firmware=tftpboot $(loadaddr) $(tftppath)$(firmware);upgrade $(loadaddr) $(filesize)
update_fullimage=tftpboot $(loadaddr) $(tftppath)$(fullimage);upgrade $(loadaddr) $(filesize)
update_totalimage=tftpboot $(loadaddr) $(tftppath)$(totalimage);upgrade $(loadaddr) $(filesize)
reset_uboot_config=prot off 0xB0040000   0xB005FFFF;  erase 0xB0040000 0xB005FFFF 1
part0_begin=0xB0000000
part1_begin=0xB0040000
part2_begin=0xB0060000
part3_begin=0xB01A0000
part4_begin=0xB1F40000
part5_begin=0xB1F80000
part6_begin=0xB1FA0000
part7_begin=0xB1FC0000
part8_begin=0xB1FE0000
total_part=9
flash_end=0xB1FFFFFF
data_block0=uboot
data_block1=ubootconfig
data_block2=kernel
data_block3=rootfs
data_block4=firmware
data_block5=sysconfig
data_block6=fwdiag
data_block7=boardcfg
data_block8=ddrconfig
data_block9=bparam
data_block10=calibration
total_db=11
f_uboot_addr=0xB0000000
f_uboot_size=0x40000
f_ubootconfig_addr=0xB0040000
f_ubootconfig_size=0x20000
f_ubootconfig_end=0xB005FFFF
f_kernel_end=0xB019FFFF
f_sysconfig_addr=0xB1F80000
f_sysconfig_size=0x20000
f_fwdiag_addr=0xB1FA0000
f_fwdiag_size=0x20000
f_ddrconfig_addr=0xB1FC8000
f_ddrconfig_size=0x8000
f_bparam_addr=0xB1FD0000
f_bparam_size=0x10000
f_calibration_addr=0xB1FE0000
f_calibration_size=0x20000
f_boardcfg_addr=0xB1FC0000
f_boardcfg_size=0x8000
reset_sysconfig=prot off 0xB1F80000   0xB1F9FFFF;  erase 0xB1F80000 0xB1F9FFFF 1
uboot_ethaddr=02:AA:BB:CC:DD:30
fw_eaddr=b0060000 b1fa0000
custom_id=0
tftp_wait=4
melco_id=RD_BB09145
u_fw=erase $(fw_eaddr); cp.b $(fileaddr) b0060000 $(filesize); run bootcmd
bootcmd=bootm b0060000
tmp_ram=82000000
tmp_bottom=83F00000
buf_ver=1.00
build_date=Nov 10 2010 - 17:41:42
ethact=amazon_s Switch
f_rootfs_size=0x007ce000
f_rootfs_addr=0xb01a0000
f_rootfs_end=0xb096e000
f_rootfs_crc=E30C0DBA
f_firmware_size=0x0002a000
f_firmware_addr=0xb1f40000
f_firmware_crc=7EEE9798
filesize=107ebd
fileaddr=80800000
ipaddr=192.168.11.1
serverip=192.168.11.2
f_kernel_size=0x00107ebd
f_kernel_addr=0xb0060000
kernel_addr=0xb0060000
f_kernel_crc=AB4BFA18
ethaddr=00:24:A5:BD:52:50
hw_rev=0
pincode=58117729
region=EU
DEF-p_wireless_ath0_11bg-wpapsk=bhern5iyusyck
DEF-p_wireless_ath0_11bg-crypto=tkip+aes
DEF-p_wireless_ath0_11bg-authmode=psk
DEF-p_wireless_ath0_11bg-authmode_ex=mixed-psk
stdin=serial
stdout=serial
stderr=serial

Environment size: 4125/131068 bytes
ARC_BOOT #

I'm a bit nervous about just flashing the new image given the mismatch in mtd partitions and all that stuff in the uboot settings, but with a serial console, tftp and nfs all being options I should stand a good chance of having some kind of recovery method.

Lee.

Ok, at the risk of just talking to myself, I thought it was worth a quick follow-up.

Using dd-wrt I simply wrote the squashfs version of the image to the "linux" mtd partition...

# mtd -r write <squashfs_image_file> linux

... and it all seems fine.  The basic image is a little bare, but I didn't tweak the config at all.

I'll have a play with the DSL bits over the weekend.

Lee.

(Last edited by essele on 13 Jan 2012, 18:15)

Hi, I also have this box with DD-WRT installed and I don't like it. I was wondering, what is the image you flashed with and did you get internet connection working?

Hi Labbe,

I flashed with a squashfs image that I built from trunk and it works really well, including the DSL support.

The wireless support isn't included by default, but you just need to select the relevant bits during the menuconfig (I think it was the ath9k wireless driver, and cfg80211) also the LED's are all off by default.

I've submitted a couple of patches to improve the handling of DSL and to include DSL visibility in LuCI, so hopefully they'll make their way into trunk fairly soon. I'll also be looking at the LED's and generally try to fix up the config of this device so it is more complete out of the default build.

Lee.

Thanks for your quick answer, Lee. However, I haven't built an image before and am also new to all this stuff.  I was happy with my previous router, which had Tomato firmware flashed by my friend. Unfortunately I spilled beer on it so here we are.

I know some basic linux stuff so I managed to get to the LuCI menuconfig, but I decided to stop there, as I have no idea what options I should choose and thought better to ask for more help.

So, could you give me few basic options i should choose (apart from the previously mentioned wifi drivers) or better yet, provide me with the image you flashed it, if you would be so kind. I don't care about the LEDs.

I'm sure other people could also find your tips helpful if they find this topic.

Thank you.

Labbe

Ok, here's a quick summary to get it working, but you should note that we are dealing with the development branch (trunk) and things change all the time, so things may break.

What I did....

1. Check out the code:   svn co http://svn.openwrt.org/openwrt/trunk trunk
2. cd trunk
3. Update the feeds: ./scripts/feeds update
4. Install the feeds: ./scripts/feeds install
4b. make package/symlinks
5. Configure:  make menuconfig
  - Target System:  Lantiq GPON/XWAY
  - Subtarget:  AR9
  - Target Profile:  WBMR - Buffalo WMBR-HP-G300H
  - Target Images: I use squashfs, I haven't tested jffs2
  - You might want to enable luci (Luci/Collections/Luci)
  - Enable wireless:  Kernel Modules/Wireless Drivers/kmod-ath9k
  - Enable hostapd: Network/hostapd and Network/hostapd-utils
6. Save the config
7. make

Note: when you select packages make sure they go to "*" and not "M", that way they will be built into the image and you won't have to install them separately.

Then in bin/lantiq you will find "openwrt-lantiq-ar9-WBMR-squashfs.image"

Copy this to the router (I usually put it in /tmp), then you can login (assuming you already have dd-wrt on it) and change to /tmp and flash it with: mtd -r write openwrt-lantiq-ar9-WBMR-squashfs.image linux

Please note: it takes a fair amount of time to boot after this as it creates all the filesystem stuff on the remaining flash ... give it 5 - 10 mins before getting worried.

DISCLAIMER: it worked for me, but I cannot be responsible if you brick your router ... I did a couple of times and had to recover by opening it up and attaching a serial console.

Cheers,

Lee.

(Last edited by essele on 25 Jan 2012, 15:34)

Would any of the ready-made images at http://downloads.openwrt.org/snapshots/trunk/lantiq/ work? Looking at the NONE and unbranded images right now, but a bit hesitant to try.

I'm currently running dd-wrt, which works ok, but I'd prefer openwrt. Does openwrt support vlans on the ethernet ports (or better yet, let me separately configure them)?

AFAIK the Buffalo WBMR-HP-G300H is fully supported by OpenWrt by now.

Please work a bit on the wiki-page.

Also, sombody please do the OpenSSL Benchmark. I am curious how the MIPS 34Kc performs.

How you open the case? It looks that is the second hard part...

Hello, I have flashed a image on my router >> mtd -r write openwrt-lantiq-ar9-WBMR-squashfs.image linux
After few minutes all leds going out. i wait 10 minutes, plug off and on the power
Now if i plug on the power, the router power led going on for 15 seconds. But der router is not pingable not on 192.168.(1 or 2 or 11).1

i hope i can debrick the router with the serial console. Can you tell me how i find the right pins?

I have made Pictures from router.

See the wiki entry.

I just recieved my device. Now entered serial info and added pictures to the wiki entry.

(Last edited by crissi on 23 Feb 2012, 10:48)

Thx crissi. Is the Jtag port at the right side from serial Port? The 14 Points?

Hm, I tried to flash on my device but there is no mtd on this device. Version of FW is:

WBMR-HP-G300H Ver.1.74 (R3.02/B2011/02/03 09:21:07 JST)

Any hints?

@crissi you can flash a dd-wrt firmware then you have mtd.
I have flashed this over the Webconsole from router.

After compile the image and the HDR0 header using trx from dd-wrt was added I tried to flash via dd-wrt webif. I down like my image and says 'invalid image'. Any idea whats wrong on this device?

Helo, my router is running. The time between start und pingable ist very long.

@crissi

at first flash dd-wrt then openwrt via mtd.

There is no mtd on this device.

Hi, you can flash the dd-wrt firmware over webif, then openwrt via ssh console with mtd.

There is already dd-wrt on the device, flashing directly the openwrt firmware fails (squashfs image), it tells me its invalid.

Thanks, I was able to get OpenWRT installed on my WBMR-HP-G300H with these instructions! (my first time compiling owrt)

Only thing I'm missing now are the leds, any way to get them light up?

I was wrong, its stock firmware on this device. Sorry for that. As I read [[http://www.dd-wrt.com/site/content/buffalo-highpower-routers-with-dd-wrt-factory-firmware|DD-Wrt on Buffalo routers]] I assumed it was on it.

I know that flashing via tftp should work but it should be possible to get the webflash working. I tried to adapt the correct values for buffalo-enc/buffalo-tag and got a image. This image I could upload but the the connection was reset by peer. The console shows me:

cgi.c(3617) UploadCgi :x:btpd STOP-SUCCESS (0 sec)
cgi.c(3859) UploadCgi :x:MEMORY CHECK...
MidLayer.c(2067) ML_CheckMemory :X:MemFree = 23652
MidLayer.c(2071) ML_CheckMemory :X:Buffers = 4000
MidLayer.c(2075) ML_CheckMemory :X:Cached = 12788
MidLayer.c(2079) ML_CheckMemory :X:Active = 11464
MidLayer.c(2083) ML_CheckMemory :X:Inactive = 7520
cgi.c(4416) UploadCgi :DEBUG:### CFH->mark=WBMR-HP-G300H ###
cgi.c(4460) UploadCgi :DEBUG:### NON-CRYPT ###
cgi.c(4467) UploadCgi :DEBUG:firm_size:2887884  lTotalSize:2887884
cgi.c(4469) UploadCgi :DEBUG:### cyg_posix_crc32 start ###
cgi.c(4471) UploadCgi :DEBUG:### cyg_posix_crc32 end new_CRC32:616818920###
cgi.c(4483) UploadCgi :DEBUG:firm_size:2887884  lCRC32:616818920
cgi.c(4486) UploadCgi :DEBUG:CRC OK !UploadCgi(4486)
cgi.c(4532) UploadCgi :X:ADSL:AnnexB size 1946177280

But thats only partly success.

Also I want to know where I can get a original FW file (sure I backuped the device, mtd e.g.)? I would help to play with different FW.

Second, I contacted buffalo for the sourcecode of the router and they told me that this is in progress but no current release date yet.

I just bought my own copy of this modem. I've been trying to get OpenWRT to work (trunk version), but so far tftp flashing hasn't been a success. Also the modem comes with "stock FV", so updateing FV trough mtd isn't an option.

I'va also tried to install dd wrt trough webUI update, but it keeps throwing "Invalid image". The image has been downloaded from http://www.dd-wrt.com/site/support/router-database.

Any ideas? Ultimately, I'd like to get openwrt working, the process is now important. Also, atm I don't have serial console, so that pretty much leaves webUI and tftp options? I'd appreciate any help I can get.

--
Daeldo

EDIT:

Nevermin, got dd wrt working with another image and then mtd -r write image linux worked perfectly.

Now trying to figure out how to get RFC 1483 Routed on OpenWRT...

(Last edited by Daeldo on 3 Mar 2012, 12:08)