OpenWrt Forum Archive

Topic: Openwrt support for Huawei HG655b

The content of this topic has been archived between 12 Mar 2018 and 5 May 2018. Unfortunately there are posts – most likely complete pages – missing.

Post #1
fratzicu
20 Apr 2014, 14:36

Hi,
In this thread there are some links that point to my wuala drive. Since wuala has ended its support for free storage, I chose so store the files on box.com and here is the link: https://app.box.com/FratzicuPublic-Hg655b-fratzicu

I search a lot on google about any support in openwrt for the Huawei VDSL 2+ router HG655b. I found  it could be similar with hg655d and HG612.

http://voorthuijsen.blogspot.nl/2013/03 … outer.html

I found a closed ticket

https://dev.openwrt.org/ticket/10103

Other useful links

http://forum.softpedia.com/topic/810301 … awei-655b/ - in romanian
[url]http://wiki.openwrt.org/toh/netgear/dgnd3700?s[]=hg612[/url]
http://huaweihg612hacking.wordpress.com/
http://wiki.openwrt.org/toh/huawei/hg655d
http://forums.modem-help.co.uk/viewtopi … p;start=15
http://huaweihg612hacking.wordpress.com … for-hg612/
http://www.forumforpages.com/facebook/r … 60298466/0
http://consumer.huawei.com/en/support/d … m?id=18222

I wonder if openwrt could be compiled for this device.

Best regards

I put here the danitool's instructions to build the firmware image to ease the access to them

The patch for Openwrt support was added to a github repository (thanks to Noltari).
https://github.com/openwrt-es/barrier-b … aker_14.04
To download
git clone git://github.com/openwrt-es/barrier-breaker-openwrt.git -b barrier-breaker_14.04
To build:

./scripts/feeds update
./scripts/feeds install luci
make menuconfig

select the bcm63xx target, HG655x profile, and other packages you need
Exit menu saving changes, and make the world

make V=s

Also, I put here the link to danitool's first .config file

http://pastebin.com/PtaS7d9G
But note you need to install the required packages in the buildroot with

./scripts/feeds install yourpackage

(Last edited by fratzicu on 31 Jan 2015, 13:21)

Post #2
danitool
20 Apr 2014, 18:12

I've built a firmware for the HG655b. I cannot say if it works since I don't own this router.

- It's a good idea to backup whole flash before testing this firmware, or at least have the vendor firmware, otherwise if openwrt fails you won't have any firmware to run on your device. Also there is a risk of destroying the wifi calibration data. Restoring the vendor firmware won't restore this area at the flash chip.

- I defined a cal_data partition at a safe offset 0x580000 (first 5.5MB), to avoid destroying your wifi calibration data. The backup may help to safely locate this offset. Without the cal_data the wifi won't work.

- No leds or buttons defined. If openwrt boots OK you can easily locate the GPIOs for them, then I will add it later to the firmware.

Let me know if it works for you.

openwrt-HG655x-squashfs-cfe.bin

Post #3
fratzicu
28 Apr 2014, 18:01

Wow, thanks for your reply and for your flash image. I will try to test it and give feedback.

I hope others will test it also.

Kind regards.

Post #4
fratzicu
28 Apr 2014, 18:39

Hi again,

What could be the method for flashing? I could try a web interface flash? MAybe I could conect to the serial port? I don't have the tools for jtag.

I have the original firmware.

Could you give me some serial commands to give you the output? Don't know if I will succeed but I'll try..

Post #5
danitool
28 Apr 2014, 18:48

You could try to just pressing the reset button, plug the power cord and then browse to http://192.168.1.1, the CFE web interface for flashing should be enough.

If the reset button doesn't break into CFE, then just press enter or space key when booting CFE, and browse http://192.168.1.1.

Also it can be done installing a tftp server in your computer, putting the firmware in the tftp directory, and from CFE console executing

f 192.168.1.35:firmware.bin

192.168.1.35 should be your IP address at your computer, but it can be any compatible with that network address

Post #6
fratzicu
28 Apr 2014, 20:44

Hi,

I'll give it a try, jus not tonight.



Hi again,

the rx nd tx seemed to be switched. Usually I connected the rx from PCB to tx from USB serial cable and viceversa. But here nothing, and when I switched it worked. the serial settings are:

Speed (baud) - 115200
Data bits        - 8
Stop bits        - 1
Parity             - None
Flow control   - None

(Last edited by fratzicu on 29 Apr 2014, 08:47)

Post #7
fratzicu
28 Apr 2014, 22:03

Actually,

It  was  quite easy. I did what you said and this is the result after the flash.

You can find device pics and whole putty log here:

https://app.box.com/FratzicuPublic-Hg655b-fratzicu

Here is the log:

CFE version 1.0.37-102.6 for BCM96368 (32bit,SP,BE)
Build Date: Wed Mar 23 22:59:09 CST 2011 (lihua@IBM_x3500)
Copyright (C) 2000-2008 Broadcom Corporation.

Parallel flash device: name AM29LV320MB, id 0x2200, size 8192KB
CPU type 0x2A031: 400MHz, Bus: 160MHz, Ref: 64MHz
CPU running TP0
Total memory: 67108864 bytes (64MB)
Boot Address 0xb8000000


Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :
Run from flash/host (f/h)         : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Boot image (0=latest, 1=previous) : 0
Board Id (0-6)                    : HW65x
Number of MAC Addresses (1-32)    : 11
Base MAC Address                  : 02:10:18:01:00:01
PSI Size (1-64) KBytes            : 64
Main Thread Number [0|1]          : 0

*** Press any key to stop auto run (2 seconds) ***
Auto run second count down: 1
web info: Waiting for connection on socket 0.
web info: Waiting for connection on socket 1.
web info: Waiting for connection on socket 0.
web info: Waiting for connection on socket 1.
web info: Waiting for connection on socket 2.
web warning: Unexpected TCP disconnect.
web warning: Unexpected TCP disconnect.
web info: Waiting for connection on socket 0.
web info: Upload 4194560 bytes, Broadcom image format.
CFE> Current boot system is:<ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ> iMode:<2>

------ Going to update Main System.

Flashing root file system and kernel at 0xb8020000, len = 4194560
.................................................................

Current boot system is:<ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ> iMode:<1>
.
*** Image flash done *** !

Resetting board...

CFE version 1.0.37-102.6 for BCM96368 (32bit,SP,BE)
Build Date: Wed Mar 23 22:59:09 CST 2011 (lihua@IBM_x3500)
Copyright (C) 2000-2008 Broadcom Corporation.

Parallel flash device: name AM29LV320MB, id 0x2200, size 8192KB
CPU type 0x2A031: 400MHz, Bus: 160MHz, Ref: 64MHz
CPU running TP0
Total memory: 67108864 bytes (64MB)
Boot Address 0xb8000000


Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :
Run from flash/host (f/h)         : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Boot image (0=latest, 1=previous) : 0
Board Id (0-6)                    : HW65x
Number of MAC Addresses (1-32)    : 11
Base MAC Address                  : 02:10:18:01:00:01
PSI Size (1-64) KBytes            : 64
Main Thread Number [0|1]          : 0

*** Press any key to stop auto run (2 seconds) ***
Auto run second count down: 0
LZMA: Prossible old LZMA format, trying to decompress..
Decompression OK!
Entry at 0x80010000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
143 buffers found.
Closing DMA Channels.
Starting program at 0x80010000
[    0.000000] Linux version 3.10.34 (dani@tool) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.01 r40396) ) #2 SMP Sun Apr 20 18:56:29 CEST 2014
[    0.000000] Detected Broadcom 0x6368 CPU revision b2
[    0.000000] CPU frequency is 400 MHz
[    0.000000] 64MB of RAM installed
[    0.000000] registering 38 GPIOs
[    0.000000] board_bcm963xx: Boot address 0xb8000000
[    0.000000] board_bcm963xx: CFE version: 1.0.37-102.6
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0002a031 (Broadcom BMIPS4350)
[    0.000000] board_bcm963xx: board name: HW65x
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[    0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.000000] PERCPU: Embedded 7 pages/cpu @81083000 s6592 r8192 d13888 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 61268k/65536k available (2455k kernel code, 4268k reserved, 620k data, 248k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:256
[    0.000000] Calibrating delay loop... 397.82 BogoMIPS (lpj=795648)
[    0.032000] pid_max: default: 32768 minimum: 301
[    0.036000] Mount-cache hash table entries: 512
[    0.044000] SMP: Booting CPU1...
[    0.048000] CPU revision is: 0002a031 (Broadcom BMIPS4350)
[    0.048000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[    0.048000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.080000] Synchronize counters for CPU 1: done.
[    0.080000] SMP: CPU1 is running
[    0.084000] Brought up 2 CPUs
[    0.108000] NET: Registered protocol family 16
[    0.116000] registering PCI controller with io_map_base unset
[    0.132000] bio: create slab <bio-0> at 0
[    0.136000] PCI host bridge to bus 0000:00
[    0.140000] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff]
[    0.144000] pci_bus 0000:00: root bus resource [io  0x8000000-0x800ffff]
[    0.148000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.164000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x3000ffff]
[    0.168000] Switching to clocksource MIPS
[    0.176000] NET: Registered protocol family 2
[    0.184000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.188000] TCP bind hash table entries: 512 (order: 0, 4096 bytes)
[    0.196000] TCP: Hash tables configured (established 512 bind 512)
[    0.204000] TCP: reno registered
[    0.204000] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.212000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.220000] NET: Registered protocol family 1
[    0.228000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.232000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.244000] msgmni has been set to 119
[    0.248000] io scheduler noop registered
[    0.252000] io scheduler deadline registered (default)
[    0.260000] bcm63xx_uart.0: ttyS0 at MMIO 0xb0000100 (irq = 10) is a bcm63xx_uart
[    0.268000] console [ttyS0] enabled, bootconsole disabled
[    0.268000] console [ttyS0] enabled, bootconsole disabled
[    0.280000] bcm63xx-rng bcm63xx-rng: registered RNG driver
[    0.288000] physmap platform flash device: 08000000 at 18000000
[    0.296000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x001000
[    0.304000] Amd/Fujitsu Extended Query Table at 0x0040
[    0.312000]   Amd/Fujitsu Extended Query version 1.3.
[    0.316000] number of CFI chips: 1
[    0.320000] bcm63xxpart: CFE boot tag CRC invalid (expected 0212102b, actual 24b1b887)
[    0.328000] bcm63xxpart: Partition 0 is CFE offset 0 and length 10000
[    0.336000] bcm63xxpart: Partition 1 is cal_data offset 580000 and length 10000
[    0.344000] bcm63xxpart: Partition 2 is nvram offset 7f0000 and length 10000
[    0.348000] bcm63xxpart: Partition 3 is linux offset 10000 and length 570000
[    0.356000] bcm63xxpart: Spare partition is offset 10000 and length 570000
[    0.364000] 4 bcm63xxpart partitions found on MTD device physmap-flash.0
[    0.372000] Creating 4 MTD partitions on "physmap-flash.0":
[    0.376000] 0x000000000000-0x000000010000 : "CFE"
[    0.384000] 0x000000580000-0x000000590000 : "cal_data"
[    0.392000] 0x0000007f0000-0x000000800000 : "nvram"
[    0.400000] 0x000000010000-0x000000580000 : "linux"
[    0.408000] bcm63xx-spi bcm63xx-spi: at 0xb0000800 (irq 9, FIFOs size 542)
[    0.456000] b53_common: found switch: BCM63xx, rev 0
[    0.460000] bcm63xx-wdt bcm63xx-wdt:  started, timer margin: 30 sec
[    0.468000] TCP: cubic registered
[    0.472000] NET: Registered protocol family 17
[    0.476000] 8021q: 802.1Q VLAN Support v1.8
[    0.484000] jffs2: Too few erase blocks (1)
[    0.492000] List of all partitions:
[    0.492000] 1f00              64 mtdblock0  (driver?)
[    0.500000] 1f01              64 mtdblock1  (driver?)
[    0.504000] 1f02              64 mtdblock2  (driver?)
[    0.508000] 1f03            5568 mtdblock3  (driver?)
[    0.516000] No filesystem could mount root, tried:  squashfs jffs2
[    0.520000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)

Maybe you can make something of it. I was able to reflash with the original firmware.

Kind regards.

(Last edited by fratzicu on 31 Jan 2015, 13:13)

Post #8
danitool
28 Apr 2014, 22:43

It seems there are some troubles with your flash memory for detecting correctly the Openwrt partitions. Based on your bootlog I assumed the problem is the CFE size, it should be 0x20000, not 0x10000.
In your pics I couldn't see the flash chip, it may help to know the exact model.

BTW I hardcoded the CFE size in the following firmware:
openwrt-HG655x-squashfs-cfe-2.bin
Hope this time it boots mounting rootfs.

Post #9
fratzicu
28 Apr 2014, 22:50

Great,

I'll try it tomorrow.

I kind of taken pictures of every chip I saw. leasepoint out what part of the PCB would you be interested in to see the flash chip code.

Post #10
danitool
28 Apr 2014, 23:05

Probably the flash chip memory is at the bottom of the PCB.

Then did you already made a flash backup?, I need to know the offset of the wifi cal data area, to later define correctly the partition.

It can be done via serial cable with an utitlity
http://wiki.openwrt.org/doc/hardware/so … .the.flash
But sometimes it doesn't work with some boards. If this is your case, might be it can be done if you can boot Openwrt, but I'm afraid the cal_data partiton will virtually shrink if the data isn't detected.

Regards.

Post #11
fratzicu
29 Apr 2014, 07:30

Hi,

I uploaded more photos. You were right.

The  flash chip label reads:

Spansion
S29GL064N90TF104
21388674   B
@ 06 SPANSION

Now I'm flaashing the second image.

Post #12
fratzicu
29 Apr 2014, 08:24

Hi,

I flashed the second image and itooted allright. i could connect to luci web interface. Lan worked but wifi interfaceseemed not to work (my smartphone does not see the ssid). also, couldn't connect as client with my wifi network.

Anyway, I put te second putty log on my wuala space. Also, I put the syslog and kernellog from the luci interface. separately, you'll find the serial startlog for the second image.

Now, I work with putty and windows 8 64 bit. the cfetool does not detect the module 'serial'. I'lltry with ubuntu.

After I reflashed with the original firmware, the wifi works. So I'll try now to backup the flash with the cfe tool in ubuntu, but tell me, is this the right command? Where will I find thedumped fle?

./cfetool.py --read=dump.bin --addr=0xB8000000 --size=0x1000000 --block=0x10000

Here is the startlog:

*** Image flash done *** !

Resetting board...

CFE version 1.0.37-102.6 for BCM96368 (32bit,SP,BE)
Build Date: Wed Mar 23 22:59:09 CST 2011 (lihua@IBM_x3500)
Copyright (C) 2000-2008 Broadcom Corporation.

Parallel flash device: name AM29LV320MB, id 0x2200, size 8192KB
CPU type 0x2A031: 400MHz, Bus: 160MHz, Ref: 64MHz
CPU running TP0
Total memory: 67108864 bytes (64MB)
Boot Address 0xb8000000


Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Boot image (0=latest, 1=previous) : 0  
Board Id (0-6)                    : HW65x  
Number of MAC Addresses (1-32)    : 11  
Base MAC Address                  : 02:10:18:01:00:01  
PSI Size (1-64) KBytes            : 64  
Main Thread Number [0|1]          : 0  

*** Press any key to stop auto run (2 seconds) ***
Auto run second count down: 2210
LZMA: Prossible old LZMA format, trying to decompress..
Decompression OK!
Entry at 0x80010000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
155 buffers found.
Closing DMA Channels.
Starting program at 0x80010000
[    0.000000] Linux version 3.10.34 (dani@tool) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.01 r40396) ) #4 SMP Mon Apr 28 23:38:05 CEST 2014
[    0.000000] Detected Broadcom 0x6368 CPU revision b2
[    0.000000] CPU frequency is 400 MHz
[    0.000000] 64MB of RAM installed
[    0.000000] registering 38 GPIOs
[    0.000000] board_bcm963xx: Boot address 0xb8000000
[    0.000000] board_bcm963xx: CFE version: 1.0.37-102.6
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0002a031 (Broadcom BMIPS4350)
[    0.000000] board_bcm963xx: board name: HW65x
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[    0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.000000] PERCPU: Embedded 7 pages/cpu @81083000 s6592 r8192 d13888 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 61268k/65536k available (2455k kernel code, 4268k reserved, 620k data, 248k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:256
[    0.000000] Calibrating delay loop... 397.82 BogoMIPS (lpj=795648)
[    0.032000] pid_max: default: 32768 minimum: 301
[    0.036000] Mount-cache hash table entries: 512
[    0.044000] SMP: Booting CPU1...
[    0.048000] CPU revision is: 0002a031 (Broadcom BMIPS4350)
[    0.048000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[    0.048000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.080000] Synchronize counters for CPU 1: done.
[    0.080000] SMP: CPU1 is running
[    0.084000] Brought up 2 CPUs
[    0.108000] NET: Registered protocol family 16
[    0.116000] registering PCI controller with io_map_base unset
[    0.132000] bio: create slab <bio-0> at 0
[    0.136000] PCI host bridge to bus 0000:00
[    0.140000] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff]
[    0.144000] pci_bus 0000:00: root bus resource [io  0x8000000-0x800ffff]
[    0.148000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.164000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x3000ffff]
[    0.168000] Switching to clocksource MIPS
[    0.176000] NET: Registered protocol family 2
[    0.184000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.188000] TCP bind hash table entries: 512 (order: 0, 4096 bytes)
[    0.196000] TCP: Hash tables configured (established 512 bind 512)
[    0.204000] TCP: reno registered
[    0.204000] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.212000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.220000] NET: Registered protocol family 1
[    0.228000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.232000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.244000] msgmni has been set to 119
[    0.248000] io scheduler noop registered
[    0.252000] io scheduler deadline registered (default)
[    0.260000] bcm63xx_uart.0: ttyS0 at MMIO 0xb0000100 (irq = 10) is a bcm63xx_uart
[    0.268000] console [ttyS0] enabled, bootconsole disabled
[    0.268000] console [ttyS0] enabled, bootconsole disabled
[    0.280000] bcm63xx-rng bcm63xx-rng: registered RNG driver
[    0.288000] physmap platform flash device: 08000000 at 18000000
[    0.296000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x001000
[    0.304000] Amd/Fujitsu Extended Query Table at 0x0040
[    0.312000]   Amd/Fujitsu Extended Query version 1.3.
[    0.316000] number of CFI chips: 1
[    0.320000] bcm63xxpart: CFE boot tag found with version 7 and board type HW65x
[    0.328000] bcm63xxpart: Partition 0 is CFE offset 0 and length 20000
[    0.332000] bcm63xxpart: Partition 1 is kernel offset 20100 and length 11ff00
[    0.340000] bcm63xxpart: Partition 2 is rootfs offset 140000 and length 440000
[    0.348000] bcm63xxpart: Partition 3 is cal_data offset 580000 and length 10000
[    0.356000] bcm63xxpart: Partition 4 is nvram offset 7f0000 and length 10000
[    0.364000] bcm63xxpart: Partition 5 is linux offset 20000 and length 560000
[    0.372000] bcm63xxpart: Spare partition is offset 3e0004 and length 19fffc
[    0.376000] 6 bcm63xxpart partitions found on MTD device physmap-flash.0
[    0.384000] Creating 6 MTD partitions on "physmap-flash.0":
[    0.392000] 0x000000000000-0x000000020000 : "CFE"
[    0.396000] 0x000000020100-0x000000140000 : "kernel"
[    0.404000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.416000] 0x000000140000-0x000000580000 : "rootfs"
[    0.424000] mtd: device 2 (rootfs) set to be root filesystem
[    0.432000] mtd: partition "rootfs_data" created automatically, ofs=0x3d0000, len=0x1b0000
[    0.440000] 0x0000003d0000-0x000000580000 : "rootfs_data"
[    0.448000] 0x000000580000-0x000000590000 : "cal_data"
[    0.456000] 0x0000007f0000-0x000000800000 : "nvram"
[    0.464000] 0x000000020000-0x000000580000 : "linux"
[    0.472000] bcm63xx-spi bcm63xx-spi: at 0xb0000800 (irq 9, FIFOs size 542)
[    0.516000] b53_common: found switch: BCM63xx, rev 0
[    0.520000] bcm63xx-wdt bcm63xx-wdt:  started, timer margin: 30 sec
[    0.528000] TCP: cubic registered
[    0.532000] NET: Registered protocol family 17
[    0.536000] 8021q: 802.1Q VLAN Support v1.8
[    0.552000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    0.560000] Freeing unused kernel memory: 248K (80312000 - 80350000)
procd: Console is alive
procd: - watchdog -
procd: - preinit -
[    2.792000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    4.152000] usbcore: registered new interface driver usbfs
[    4.156000] usbcore: registered new interface driver hub
[    4.164000] usbcore: registered new device driver usb
[    4.176000] Button Hotplug driver version 0.4.1
[    4.296000] SGI XFS with security attributes, large block/inode numbers, no debug enabled
[    4.312000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    4.320000] ehci-platform: EHCI generic platform driver
[    4.432000] ehci-platform ehci-platform: EHCI Host Controller
[    4.436000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[    4.444000] ehci-platform ehci-platform: irq 15, io mem 0xb0001500
[    4.464000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00, overcurrent ignored
[    4.472000] hub 1-0:1.0: USB hub found
[    4.476000] hub 1-0:1.0: 1 port detected
[    4.484000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    4.492000] ohci-platform ohci-platform: Generic Platform OHCI Controller
[    4.500000] ohci-platform ohci-platform: new USB bus registered, assigned bus number 2
[    4.508000] ohci-platform ohci-platform: irq 13, io mem 0xb0001600
[    4.572000] hub 2-0:1.0: USB hub found
[    4.576000] hub 2-0:1.0: 1 port detected
No jffs2 marker was found
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[    9.292000] NET: Registered protocol family 10
[    9.332000] nf_conntrack version 0.5.0 (961 buckets, 3844 max)
[    9.348000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    9.376000] Loading modules backported from Linux version master-2014-03-31-1-0-g5c109d2
[    9.384000] Backport generated by backports.git backports-20140221-0-g8e94650
[    9.400000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    9.492000] xt_time: kernel timezone is -0000
[    9.520000] cfg80211: Calling CRDA to update world regulatory domain
[    9.528000] cfg80211: World regulatory domain updated:
[    9.536000] cfg80211:  DFS Master region: unset
[    9.540000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[    9.548000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    9.556000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    9.564000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[    9.576000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[    9.584000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[    9.592000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[    9.660000] PPP generic driver version 2.4.2
[    9.668000] NET: Registered protocol family 24
[    9.704000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
[    9.712000] ieee80211 phy0: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'rt2x00.eeprom'.
[    9.852000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 3572, rev 0223 detected
[    9.860000] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 000f detected
[    9.868000] ------------[ cut here ]------------
[    9.872000] WARNING: at /run/media/dani/STM3500320AS/openwrt/hg655b/barrier-breaker-openwrt/build_dir/target-mips_mips32_uClibc-0.9.33.2/linux-brcm63xx_brcm6368/compat-wireless-2014-03-31/drivers/net/wireless/rt2x00/rt2800lib.c:329 rt2800_vco_calibration+0x310/0x388 [rt2800lib]()
[    9.896000] phy0: invalid access of EEPROM word 38
[    9.904000] Modules linked in: rt2800pci(+) rt2800mmio rt2800lib pppoe ppp_async iptable_nat rt2x00pci rt2x00mmio rt2x00lib pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv4 mac80211 ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_CT slhc nf_nat_irc nf_nat_ftp nf_nat nf_defrag_ipv4 nf_conntrack_irc nf_conntrack_ftp iptable_raw iptable_mangle iptable_filter ipt_REJECT ip_tables crc_itu_t crc_ccitt compat ip6t_REJECT ip6t_rt ip6t_hbh ip6t_mh ip6t_ipv6header ip6t_frag ip6t_eui64 ip6t_ah ip6table_raw ip6table_mangle ip6table_filter ip6_tables x_tables nf_conntrack_ipv6 nf_conntrack nf_defrag_ipv6 vfat fat nls_utf8 nls_iso8859_1 nls_cp437 ipv6 eeprom_93cx6 arc4 crypto_blkcipher gpio_keys_polled input_polldev ohci_hcd ehci_platform ehci_hcd xfs libcrc32c ext4 crc16 jbd2 mbcache button_hotplug input_core usbcore nls_base usb_common exportfs crc32c crypto_hash
[    9.988000] CPU: 1 PID: 429 Comm: kmodloader Not tainted 3.10.34 #4
[    9.996000] Stack : 00000000 00000000 8035b832 00000037 833ef608 838bf438 802a49b0 8030027b
      000001ad 00000001 8035afd4 838bf438 00000000 00000015 00000124 8002ba04
      80306dd8 800291c8 00000000 802a94a0 802a6e20 83bcdb5c 83bcdb5c 802a49b0
      00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      00000000 00000000 00000000 00000000 00000000 00000000 00000000 83bcdaf0
      ...
[   10.032000] Call Trace:
[   10.036000] [<8001fa8c>] show_stack+0x48/0x70
[   10.040000] [<800292c4>] warn_slowpath_common+0x78/0xa8
[   10.044000] [<80029320>] warn_slowpath_fmt+0x2c/0x38
[   10.052000] [<833e2620>] rt2800_vco_calibration+0x310/0x388 [rt2800lib]
[   10.056000] [<833e3134>] rt2800_process_rxwi+0xa9c/0xb04 [rt2800lib]
[   10.064000] 
[   10.064000] ---[ end trace 8e74b46fcf4bb4da ]---
[   15.472000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex
[   18.132000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x10000
[   18.140000] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes
[   18.152000] jffs2: empty_blocks 26, bad_blocks 0, c->nr_blocks 27
procd: - init complete -
[   19.500000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex
[   19.508000] device eth0.1 entered promiscuous mode
[   19.516000] device eth0 entered promiscuous mode
[   19.520000] br-lan: port 1(eth0.1) entered forwarding state
[   19.528000] br-lan: port 1(eth0.1) entered forwarding state
[   20.492000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[   21.532000] br-lan: port 1(eth0.1) entered forwarding state



BusyBox v1.19.4 (2014-04-20 18:24:56 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 BARRIER BREAKER (Barrier Breaker, r40396)
 -------------------------------------------------/:…±±¥…¹½        Pour all ingredients into
  * 4 oz cold Coffee        an irish coffee mug filled
  * 1 1/2 oz Dark Rum       with crushed ice. Stir.
  * 2 tsp. Creme de Cacao
 -----------------------------------------------------
root@OpenWrt:/#

Next I'll give you some other serial output from when Iplayed with the wifi in openwrt.

Post #13
fratzicu
29 Apr 2014, 08:30

Here is the serial output from when playing with the wifi. After a while, when restarting wifi, the system hanged and needed power reset

[  374.848000] device eth0.1 left promiscuous mode
[  374.856000] device eth0 left promiscuous mode
[  374.860000] br-lan: port 1(eth0.1) entered disabled state
[  374.972000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex
[  374.996000] device eth0.1 entered promiscuous mode
[  375.000000] device eth0 entered promiscuous mode
[  375.008000] br-lan: port 1(eth0.1) entered forwarding state
[  375.012000] br-lan: port 1(eth0.1) entered forwarding state
[  375.844000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[  377.016000] br-lan: port 1(eth0.1) entered forwarding state
[  521.164000] cfg80211: Calling CRDA for country: RO
[  521.176000] cfg80211: Regulatory domain changed to country: RO
[  521.180000] cfg80211:  DFS Master region: ETSI
[  521.184000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[  521.196000] cfg80211:   (2402000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[  521.204000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[  521.212000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2000 mBm), (0 s)
[  521.220000] cfg80211:   (5490000 KHz - 5710000 KHz @ 80000 KHz), (N/A, 2700 mBm), (0 s)
[  521.228000] cfg80211:   (57240000 KHz - 65880000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
[  522.884000] ieee80211 phy0: rt2x00lib_request_firmware: Info - Loading firmware file 'rt2860.bin'
[  523.044000] ieee80211 phy0: rt2x00lib_request_firmware: Info - Firmware detected - version: 0.34
[  523.232000] rt2x00mmio_regbusy_read() Indirect register access failed: offset=0x00007010, value=0x30007010
[  523.264000] ieee80211 phy0: rt2800pci_mcu_status: Error - MCU request failed, no response from hardware
[  523.276000] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[  523.284000] device wlan0 entered promiscuous mode
[  523.812000] br-lan: port 2(wlan0) entered forwarding state
[  523.816000] br-lan: port 2(wlan0) entered forwarding state
[  523.824000] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  525.820000] br-lan: port 2(wlan0) entered forwarding state
[  581.092000] device wlan0 left promiscuous mode
[  5
Post #14
fratzicu
29 Apr 2014, 09:01

Ok,

I tried cfetool in ubuntu while CFE is running... this is when pressing enter at the beginning, right?

Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Boot image (0=latest, 1=previous) : 0  
Board Id (0-6)                    : HW65x  
Number of MAC Addresses (1-32)    : 11  
Base MAC Address                  : 02:10:18:01:00:01  
PSI Size (1-64) KBytes            : 64  
Main Thread Number [0|1]          : 0  

*** Press any key to stop auto run (2 seconds) ***
Auto run second count down: 1
CFE> web info: Waiting for connection on socket 0.
CFE>  
CFE>  
CFE>  
CFE>   
CFE>

Then I launched the command

./cfetool.py --read=dump.bin --addr=0xB8000000 --size=0x1000000 --block=0x10000

and the output is

iulia@Iulia-PC:~/apps/cfetool-master$ ./cfetool.py --read=dump.bin --addr=0xB8000000 --size=0x1000000 --block=0x10000
Waiting for a prompt...Traceback (most recent call last):
  File "./cfetool.py", line 86, in <module>
    main()
  File "./cfetool.py", line 82, in main
    memread(ser, options.read, int(options.addr, 0), int(options.size, 0), int(options.block, 0))
  File "./cfetool.py", line 54, in memread
    wait_prompt(ser)
  File "./cfetool.py", line 25, in wait_prompt
    if(ser.read(1) == 'C' and ser.read(1) == 'F' and ser.read(1) == 'E' and ser.read(1) == '>'):
  File "/usr/lib/python2.7/dist-packages/serial/serialposix.py", line 456, in read
    raise SerialException('device reports readiness to read but returned no data (device disconnected?)')
serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected?)
Post #15
fratzicu
29 Apr 2014, 10:00

Hi,

tried with ubuntu from CFE, but CFE has all command status -1, no command works, not even help. Maybe it's deactivated or something

I've put the minicom output in my wuala folder. Couldn't backup the flash.

Do you have other method for backing up the flash? But you have to give me the specific procedure. I have a tftp server I can use

Regards

Post #16
danitool
29 Apr 2014, 12:18

The best method for the backup is using a ramdisk firmware, but without working commands in CFE, you cannot load the firmware into RAM.

I've made another firmware, again with the CFE lenght hardcoded to 0x20000, but this time with a block size 0x10000 (erase size of your flash chip) for the rootfs to get rid of the problem

[   18.132000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x10000
[   18.140000] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes

Also I hardcoded a dummy partition, it starts at the end of rootfs_data and ends at the end of your flash memory chip. I'm not sure this partition will be created correctly since the bcm63xx partitioning parsing is a bit complex.

After flashing this firmware check the dummy parttition is there using 

cat /proc/mtd

It should return something like this:

root@OpenWrt:/# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00020000 00010000 "CFE"
mtd1: 000fff00 00010000 "kernel"
mtd2: 006e0000 00010000 "rootfs"
mtd3: 006e0000 00010000 "cal_data"
mtd4: 006e0000 00010000 "dummy"
mtd5: 00010000 00010000 "nvram"
mtd6: 007e0000 00010000 "linux"
root@OpenWrt:/#

as you can see dummy is the partition mtd4, now you can backup it

root@OpenWrt:/# cd tmp/
root@OpenWrt:/tmp# dd if=/dev/mtd4 of=HW65x_dummy.bin

The HW65x_dummy.bin created file should be 2.5 MB size. You can get the file mounting an usb pendrive in openwrt and copying to it, or transfering the file to your computer via scp, netcat or any other method.

this is the firmware
openwrt-HG655x-squashfs-cfe-3.bin

Post #17
fratzicu
29 Apr 2014, 16:21

Hi,

I managed to dump all partitions. The cat /dev/mtd output is:

dev:    size   erasesize  name
mtd0: 00020000 00010000 "CFE"
mtd1: 0010ff00 00010000 "kernel"
mtd2: 00450000 00010000 "rootfs"
mtd3: 001b0000 00010000 "rootfs_data"
mtd4: 00010000 00010000 "cal_data"
mtd5: 00280000 00010000 "dummy"
mtd6: 00010000 00010000 "nvram"
mtd7: 00560000 00010000 "linux"

You can find the dumped files and the logs on my wuala drive
https://app.box.com/FratzicuPublic-Hg655b-fratzicu
in the dedicated folder
http://www.wuala.com/fratzicu/Public/Hu … ions-dump/

My mtd4 is cal_data and my mtd5 is dummy.

Still ther eis a problem with the wireless. SSId not visible ad it hasproblems activating.

also,the fat32 usb memory stick was not recognised and mounted.

(Last edited by fratzicu on 31 Jan 2015, 13:14)

Post #18
danitool
29 Apr 2014, 17:09

Ok, based on your backup I guess the calibration data is located at 0x7c0000 offset. I used this offset in the following firmware:

openwrt-HG655x-squashfs-cfe-4.bin

I expect this time the wifi will work.

About the the usb problem mounting the usb stick I have no idea, but the bootlog looks good to me at the USB part.

Also maybe time to locate GPIOs for leds and buttons. You can use the script from the wiki to locate them:
http://wiki.openwrt.org/doc/hardware/port.gpio#software

Post #19
fratzicu
29 Apr 2014, 17:53

Hi,

Now the wifi works. i managed to configure it in wireless client mode. I've put the files in my wuala drive.

https://app.box.com/s/qbyc41fe55cnwna8qckdhpvnrh10lpy9

I'll work a little later on the gpioleds and buttons

Good work!

(Last edited by fratzicu on 31 Jan 2015, 13:15)

Post #20
fratzicu
29 Apr 2014, 18:01

As for usb, maybe not all the necessary packages are compiled into the image file.

Actually, i would use this  device as a server ftp, samba, media (minidlna), etc.

Another question: can this branch be included into the openwrt git repository? can you share the git branch for everyone to be able to compile the custom flash image?

Kind regards

Post #21
fratzicu
29 Apr 2014, 18:41

Hi,
i copied the script on the router but it gives me some errors when I run it

root@OpenWrt:/tmp# sh gpioscript
: not found line 2:
: not found line 4: {

gpio.sh <gpio pin number> [in|out [<value>]]
: not found line 6: }
: not found line 7:
gpioscript: line 42: syntax error: unexpected end of file (expecting "then")
Post #22
fratzicu
29 Apr 2014, 18:46

In fact, I don't understand the commands for GPIO.

Do you have some manual procedure andcommands?

Post #23
fratzicu
29 Apr 2014, 18:56

Hold on, I think I figured it  out

Post #24
fratzicu
29 Apr 2014, 19:15

Hi,

Post #25
fratzicu
29 Apr 2014, 19:22

Hi,

I followed theinstructions here for GPIO:
http://wiki.openwrt.org/doc/devel/add.new.device
I think power and wifi wor well.

The results (tested until 37) are:

visible led ..... on (0,1)....no
power.............0..............22
DSL..................0...............2
LAN1................0................6
LAN2.................0...............7
LAN3.................0................8
LAN4..................0...............9
WLAN....................................don't know
WPS...................0...............27
VOIP..................0.................25
USB....................0................14

That's it.

I don't know how to test the buttons (wifi, reset, wps).

What now?