Thomson SpeedTouch 7G
This ADSL modem router wifi was originally made by Inventel (blue7G board).
The router is distributed by some ISPs like the italian ISP Fastweb. The label on this unit says : THOMSON 7G Modem Easy Thomson V1.0
Other routers using the same board:
Supported Versions
Not supported yet. However you can install OpenWrt (no ADSL) using a custom CFE.
Bootloader (CFE), OpenWrt prebuilt firmware, and patches to build your own firmware: Speedtouch7G-openwrt_12.09_wl-CFE.zip |
board Model | Model Specific Notes |
---|---|
blue7g4b | ADSL not supported |
Hardware Highlights
SoC | RAM | Flash | Network | USB | Serial | JTag |
---|---|---|---|---|---|---|
BCM6348@256MHz | 32MiB | 8MiB | 4 x 1 | Yes | Yes | Yes |
Installation
Flash Layout
Please check out the article flash.layout. It contains an example and a couple of explanations.
CFE easy installation
This section deals with how you install OpenWrt once the OEM bootloader is replaced by a new CFE.
- Unplug the power cord
- Press the button labeled as reset, don't release it yet!
- Plug the power cord
- Wait 10 seconds
- Release the reset button
- Browse to http://192.168.1.1
- Select .bin file
- Upgrade the image
- Wait for it to reboot
- Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed. or browse to http://192.168.1.1 if LuCI is installed.
OEM installation using the TFTP method
Upgrading OpenWrt
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
LuCI Web Upgrade Process
- Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
- Upload image file for sysupgrade to LuCI
- Wait for reboot
Terminal Upgrade Process
- Login as root via SSH on 192.168.1.1
- Use the following commands to upgrade.
cd /tmp/ wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc sysupgrade /tmp/xxx.abc
- If sysupgrade does not support this router, use the following commands.
cd /tmp/ wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc mtd write /tmp/xxx.abc linux && reboot
Basic configuration
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
Specific Configuration
Interfaces
The default network configuration is:
Interface Name | Description | Default configuration |
---|---|---|
br-lan | LAN & WiFi | 192.168.1.1/24 |
eth0 | WAN | dhcp |
eth1 | LAN | bridged |
wlan0 | WiFi | disabled |
Failsafe mode
Buttons
→ hardware.button on howto use and configure the hardware button(s).
The Speedtouch 7g has only 1 button
BUTTON | Event |
---|---|
Reset | reset |
Hardware
Info
Instruction set | MIPS |
---|---|
Vendor | Broadcom |
bootloader | Unknown (custom Thomson Speedtouch) Can be replaced by cfe |
System-On-Chip | BCM6348 |
CPU/Speed | BMIPS3300 V0.7 / 256 MHz |
Flash-Chip | Spansion S29GL064A11TFIR4 |
Flash size | 8 MiB |
RAM-Chip | Samsung K4S561632E / SDR-166 |
RAM size | 32 MiB |
Wireless | Broadcom 4318 802.11b/g (onboard) |
Ethernet | 1x internal PHY + 1x external PHY |
Internet | ADSL2+, not supported |
USB | Yes |
Serial | Yes |
JTAG | Yes |
Photos
Model Number
Front:
Photo of front of the casing
Back:
Photo of back of the casing
Opening the case
Serial
→ port.serial general information about the serial port, serial port cable, etc.
How to connect to the Serial Port of this specific device:
- Use a TTL serial cable
Settings:
- Baudrate: 115200
- Data bits: 8
- Parity: None
- Stop bits: 1
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
For reading/writing to the flash you can use UrJTAG (latest svn). UrJTAG is able to operate in DMA mode with bcm63xx boards, then it's faster than hairydairymaid. |
Backup whole flash
- Connect your JTAG cable from your computer to your board
- Execute UrJTAG in root mode:
sudo jtag
- Power on the board
- Immediately execute these commands:
cable dlc5 ppdev /dev/parport0 detect endian big initbus ejtag_dma detectflash 0x1f800000 readmem 0x1f800000 0x800000 st7g_backup.bin
Restore whole flash
- Connect your JTAG cable from your computer to your board
- Execute UrJTAG in root mode:
sudo jtag
- Power on the board
- Immediately execute these commands:
cable dlc5 ppdev /dev/parport0 detect endian big initbus ejtag_dma detectflash 0x1f800000 flashmem 0x1f800000 st7g_backup.bin
Flashing a bootloader
- Connect your JTAG cable from your computer to your board
- Execute UrJTAG in root mode:
sudo jtag
- Power on the board
- Immediately flash the new bootloader:
cable dlc5 ppdev /dev/parport0 detect endian big initbus ejtag_dma detectflash 0x1f800000 flashmem 0x1fc00000 CFE_speedtouch7g-nvr.bin
Debricking
Bootlogs
OEM bootlog
��ũ�������������������������������� Speedtouch initialization sequence started. BOOTING THE THOMSON RTEMS KERNEL Starting the kernel @ 0x80010000 Speedtouch initialization sequence started. � [OSI2] File "ZZLZ1.000": Format OSI2 compliant (offset=339, prodid="0", varid="0"). [SS] Device mounted (prodid="0", prodname="SpeedTouch 7G", varid="0", varname=""). [ELF] Loading file "ZZLZ1.000" ... call 0x0x80081040(ZZLZ1.000 -t) ----------------------- OSBA ----------------------- version : bcm96348:MOD_BLDBCM96348_OSBA_V1.0.1 active device : /dev/fda1 passive device : /dev/fda2 active path : /active passive path : /dl Mounting /dev/fda1 as /active... success. Mounting /dev/fda2 as /dl... success. passive build index = 3 active build index = 0 remounting... Unmounting /active... success. Unmounting /dl... success. Mounting /dev/fda1 as /dl... success. Mounting /dev/fda2 as /active... success. ---------------- /active/ZZN0AB6.171 START ---------------- [OSI2] File "/active/ZZN0AB6.171": Format OSI2 compliant (offset=339, prodid="0", varid="0"). [SS] Device mounted (prodid="0", prodname="SpeedTouch 7G", varid="0", varname=""). [ELF] Loading file "/active/ZZN0AB6.171" ... c Speedtouch initialization sequence started. For EMAC1 - select for the ST706/ST780. For EMAC2 - select for the ST706/ST780. b6w_init Calibrating delay loop... 253.13 BogoMIPS mpi: No Card is in the PCMCIA slot mpi: device 0x4318 found in PCI slot 1, function 0 wl: srom not detected, using main memory mapped srom info (wombo board) wl0: wlc_attach: using main broad MAC address base in NVRAM (wombo board srom: 3) wl0 MAC Address: 00:14:7F:5D:73:32
OpenWrt bootlog
CFE version 1.0.37-6.4 for BCM96348 (32bit,SP,BE) Build Date: Wed May 22 13:57:32 CEST 2013 (dani@tool) Copyright (C) 2000-2005 Broadcom Corporation. Boot Address 0xbf400000 Initializing Arena. Initializing Devices. Parallel flash device: name S29GL064M, id 0x2210, size 8192KB Auto-negotiation timed-out 10 MB Half-Duplex (assumed) CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz Total memory: 33554432 bytes (32MB) Total memory used by CFE: 0x80401000 - 0x80525740 (1197888) Initialized Data: 0x8041CC20 - 0x8041EE60 (8768) BSS Area: 0x8041EE60 - 0x80423740 (18656) Local Heap: 0x80423740 - 0x80523740 (1048576) Stack Area: 0x80523740 - 0x80525740 (8192) Text (code) segment: 0x80401000 - 0x8041CC14 (113684) Boot area (physical): 0x00526000 - 0x00566000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.1.1 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : st7g Psi size in KB : 24 Number of MAC Addresses (1-32) : 4 Base MAC Address : fa:ba:da:18:12:01 Ethernet PHY Type : Internal Memory size in MB : 32 CMT Thread Number : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 Code Address: 0x80010000, Entry Address: 0x80010000 Decompression OK! Entry at 0x80010000 Closing network. Starting program at 0x80010000 [ 0.000000] Linux version 3.3.8 (dani@tool) (gcc version 4.6.3 20120201 (pre3 [ 0.000000] Detected Broadcom 0x6348 CPU revision b0 [ 0.000000] CPU frequency is 256 MHz [ 0.000000] 32MB of RAM installed [ 0.000000] registering 37 GPIOs [ 0.000000] gpiochip_add: registered GPIOs 0 to 36 on device: bcm63xx-gpio [ 0.000000] board_bcm963xx: Boot address 0xbf400000 [ 0.000000] board_bcm963xx: CFE version: 1.0.37-6.4 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 00029107 (Broadcom BMIPS3300) [ 0.000000] board_bcm963xx: board name: st7g [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 02000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000000 -> 0x00002000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] Early memory PFN ranges [ 0.000000] 0: 0x00000000 -> 0x00002000 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pa8 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jf0 [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes) [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes. [ 0.000000] Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 byts [ 0.000000] Memory: 29504k/32768k available (2090k kernel code, 3264k reserv) [ 0.000000] NR_IRQS:128 [ 0.000000] Calibrating delay loop... 254.46 BogoMIPS (lpj=508928) [ 0.040000] pid_max: default: 32768 minimum: 301 [ 0.044000] Mount-cache hash table entries: 512 [ 0.064000] NET: Registered protocol family 16 [ 0.092000] registering PCI controller with io_map_base unset [ 0.132000] bio: create slab <bio-0> at 0 [ 0.144000] PCI host bridge to bus 0000:00 [ 0.148000] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff] [ 0.152000] pci_bus 0000:00: root bus resource [io 0x8000000-0x800ffff] [ 0.172000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x30001fff] [ 0.180000] Switching to clocksource MIPS [ 0.204000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002) [ 0.232000] ssb: Found chip with id 0x4318, rev 0x02 and package 0x00 [ 0.296000] ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0 [ 0.308000] NET: Registered protocol family 2 [ 0.312000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.320000] TCP established hash table entries: 1024 (order: 1, 8192 bytes) [ 0.328000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.336000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.344000] TCP reno registered [ 0.348000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.352000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.360000] NET: Registered protocol family 1 [ 0.372000] audit: initializing netlink socket (disabled) [ 0.380000] type=2000 audit(0.380:1): initialized [ 0.388000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.392000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT. [ 0.404000] msgmni has been set to 57 [ 0.408000] io scheduler noop registered [ 0.412000] io scheduler deadline registered (default) [ 0.420000] bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xxt [ 0.428000] console [ttyS0] enabled, bootconsole disabled [ 0.428000] console [ttyS0] enabled, bootconsole disabled [ 0.456000] physmap platform flash device: 00c00000 at 1f400000 [ 0.464000] Found: Spansion S29GL064M [ 0.468000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank [ 0.472000] number of JEDEC chips: 1 [ 0.476000] bcm63xxpart: CFE boot tag found with version 6 and board type 96W [ 0.484000] bcm63xxpart: Partition 0 is CFE offset 0 and length 10000 [ 0.492000] bcm63xxpart: Partition 1 is kernel offset 10100 and length dff00 [ 0.500000] bcm63xxpart: Partition 2 is rootfs offset f0000 and length 700000 [ 0.508000] bcm63xxpart: Partition 3 is nvram offset 7f0000 and length 10000 [ 0.516000] bcm63xxpart: Partition 4 is linux offset 10000 and length 7e0000 [ 0.524000] bcm63xxpart: Spare partition is offset 2d0004 and length 51fffc [ 0.528000] 5 bcm63xxpart partitions found on MTD device physmap-flash.0 [ 0.536000] Creating 5 MTD partitions on "physmap-flash.0": [ 0.544000] 0x000000000000-0x000000010000 : "CFE" [ 0.556000] 0x000000010100-0x0000000f0000 : "kernel" [ 0.560000] mtd: partition "kernel" must either start or end on erase block y [ 0.584000] 0x0000000f0000-0x0000007f0000 : "rootfs" [ 0.596000] mtd: partition "rootfs" set to be root filesystem [ 0.604000] mtd: partition "rootfs_data" created automatically, ofs=2D0000, [ 0.612000] 0x0000002d0000-0x0000007f0000 : "rootfs_data" [ 0.624000] 0x0000007f0000-0x000000800000 : "nvram" [ 0.640000] 0x000000010000-0x0000007f0000 : "linux" [ 0.664000] bcm63xx_enet MII bus: probed [ 0.668000] bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom] [ 0.688000] bcm63xx_enet MII bus: probed [ 0.692000] bcm63xx_enet bcm63xx_enet.1: attached PHY at address 31 [Generic] [ 0.712000] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.732000] TCP cubic registered [ 0.732000] NET: Registered protocol family 17 [ 0.740000] 8021q: 802.1Q VLAN Support v1.8 [ 0.752000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.764000] Freeing unused kernel memory: 176k freed awk: /proc/cpuinfo: No such file or directory - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - [ 10.880000] JFFS2 notice: (321) jffs2_build_xattr_subsystem: complete buildi. switching to jffs2 - init - Please press Enter to activate this console. [ 15.400000] usbcore: registereds [ 15.408000] usbcore: registered new interface driver hub [ 15.416000] usbcore: registered new device driver usb [ 17.348000] wl: module license 'unspecified' taints kernel. [ 17.352000] Disabling lock debugging due to kernel taint [ 17.520000] SSB/BCMA glue driver successfully attached [ 17.544000] Got version 2 SPROM from SSB [ 17.560000] wl0: Broadcom BCM4318 802.11 Wireless Controller 5.10.56.27 [ 17.616000] Button Hotplug driver version 0.4.1 [ 17.948000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 18.364000] nf_conntrack version 0.5.0 (463 buckets, 1852 max) [ 18.980000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 19.092000] bcm63xx_ohci bcm63xx_ohci.0: BCM63XX integrated OHCI controller [ 19.096000] bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered, assigned bu1 [ 19.108000] bcm63xx_ohci bcm63xx_ohci.0: irq 20, io mem 0xfffe1b00 [ 19.172000] hub 1-0:1.0: USB hub found [ 19.176000] hub 1-0:1.0: 1 port detected [ 19.232000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled.0/0 [ 24.496000] device eth1 entered promiscuous mode