Thomson SpeedTouch 7G

This ADSL modem router wifi was originally made by Inventel (blue7G board).

The router is distributed by some ISPs like the italian ISP Fastweb. The label on this unit says : THOMSON 7G Modem Easy Thomson V1.0

Other routers using the same board:

Supported Versions

Not supported yet. However you can install OpenWrt (no ADSL) using a custom CFE.

Bootloader (CFE), OpenWrt prebuilt firmware, and patches to build your own firmware:
Speedtouch7G-openwrt_12.09_wl-CFE.zip

board Model Model Specific Notes
blue7g4b -

Hardware Highlights

SoC RAM Flash Network USB Serial JTag
BCM6348@256MHz 32MiB 8MiB 4 x 1 Yes Yes Yes

Installation

Flash Layout

Please check out the article Flash Layout. It contains an example and a couple of explanations.

CFE easy installation

This section deals with how you install OpenWrt once the OEM bootloader is replaced by a new CFE.

  • Unplug the power cord
  • Press the button labeled as reset, don't release it yet!
  • Plug the power cord
  • Wait 10 seconds
  • Release the reset button
  • Select .bin file
  • Upgrade the image
  • Wait for it to reboot
  • Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed. or browse to http://192.168.1.1 if LuCI is installed.

OEM installation using the TFTP method

Upgrading OpenWrt

generic.sysupgrade

If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

LuCI Web Upgrade Process

Terminal Upgrade Process

  • Login as root via SSH on 192.168.1.1
  • Use the following commands to upgrade.

cd /tmp/
wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
sysupgrade /tmp/xxx.abc

  • If sysupgrade does not support this router, use the following commands.

cd /tmp/
wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
mtd write /tmp/xxx.abc linux && reboot

Basic configuration

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

Specific Configuration

Interfaces

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi 192.168.1.1/24
eth0 WAN dhcp
eth1 LAN bridged
wlan0 WiFi disabled

Failsafe mode

Buttons

hardware.button on howto use and configure the hardware button(s).

The Speedtouch 7g has only 1 button

BUTTON Event
Reset reset

Hardware

Info

Architecture: MIPS
Vendor: Broadcom
Bootloader: Unknown (custom Thomson Speedtouch)
Can be replaced by CFE
System-On-Chip: BCM6348
CPU/Speed BMIPS3300 V0.7 / 256 MHz
Flash-Chip: Spansion S29GL064A11TFIR4
Flash size: 8 MiB
RAM-Chip: Samsung K4S561632E / SDR-166
RAM size: 32 MiB
Wireless: Broadcom 4318 802.11b/g (onboard)
Ethernet: 1x internal PHY + 1x external PHY
Internet: ADSL2+
USB: Yes
Serial: Yes
JTAG: Yes

Photos

Model Number

Front:

Photo of front of the casing

Back:

Photo of back of the casing

Opening the case

Note: This will void your warranty!

  • To remove the cover do a/b/c

Photo of PCB

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
- Use a TTL serial cable

Photo of PCB with markings

Settings:

  • Baudrate: 112500
  • Data bits: 8
  • Parity: None
  • Stop bits: 1

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

For reading/writing to the flash you can use UrJTAG (latest svn). UrJTAG is able to operate in DMA mode with bcm63xx boards, then it's faster than hairydairymaid.

Backup whole flash

  1. Connect your JTAG cable from your computer to your board
  2. Execute UrJTAG in root mode:
    sudo jtag
  3. Power on the board
  4. Immediately execute these commands:
    cable dlc5 ppdev /dev/parport0
    detect
    endian big
    initbus ejtag_dma
    detectflash 0x1f800000
    readmem 0x1f800000 0x800000 st7g_backup.bin

Restore whole flash

  1. Connect your JTAG cable from your computer to your board
  2. Execute UrJTAG in root mode:
    sudo jtag
  3. Power on the board
  4. Immediately execute these commands:
    cable dlc5 ppdev /dev/parport0
    detect
    endian big
    initbus ejtag_dma
    detectflash 0x1f800000
    flashmem 0x1f800000 st7g_backup.bin

Flashing a bootloader

  1. Connect your JTAG cable from your computer to your board
  2. Execute UrJTAG in root mode:
    sudo jtag
  3. Power on the board
  4. Immediately flash the new bootloader:
    cable dlc5 ppdev /dev/parport0
    detect
    endian big
    initbus ejtag_dma
    detectflash 0x1f800000
    flashmem 0x1fc00000 CFE_speedtouch7g-nvr.bin

Debricking

Bootloader Mods

  1. you could read about bootloader in general

Hardware mods

  1. as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

Bootlogs

OEM bootlog

��ũ�������������������������������� Speedtouch initialization sequence started. BOOTING THE THOMSON RTEMS KERNEL Starting the kernel @ 0x80010000 Speedtouch initialization sequence started. � [OSI2] File "ZZLZ1.000": Format OSI2 compliant (offset=339, prodid="0", varid="0"). [SS] Device mounted (prodid="0", prodname="SpeedTouch 7G", varid="0", varname=""). [ELF] Loading file "ZZLZ1.000" ... call 0x0x80081040(ZZLZ1.000 -t) ----------------------- OSBA ----------------------- version : bcm96348:MOD_BLDBCM96348_OSBA_V1.0.1 active device : /dev/fda1 passive device : /dev/fda2 active path : /active passive path : /dl Mounting /dev/fda1 as /active... success. Mounting /dev/fda2 as /dl... success. passive build index = 3 active build index = 0 remounting... Unmounting /active... success. Unmounting /dl... success. Mounting /dev/fda1 as /dl... success. Mounting /dev/fda2 as /active... success. ---------------- /active/ZZN0AB6.171 START ---------------- [OSI2] File "/active/ZZN0AB6.171": Format OSI2 compliant (offset=339, prodid="0", varid="0"). [SS] Device mounted (prodid="0", prodname="SpeedTouch 7G", varid="0", varname=""). [ELF] Loading file "/active/ZZN0AB6.171" ... c Speedtouch initialization sequence started. For EMAC1 - select for the ST706/ST780. For EMAC2 - select for the ST706/ST780. b6w_init Calibrating delay loop... 253.13 BogoMIPS mpi: No Card is in the PCMCIA slot mpi: device 0x4318 found in PCI slot 1, function 0 wl: srom not detected, using main memory mapped srom info (wombo board) wl0: wlc_attach: using main broad MAC address base in NVRAM (wombo board srom: 3) wl0 MAC Address: 00:14:7F:5D:73:32

OpenWrt bootlog

CFE version 1.0.37-6.4 for BCM96348 (32bit,SP,BE) Build Date: Wed May 22 13:57:32 CEST 2013 (dani@tool) Copyright (C) 2000-2005 Broadcom Corporation. Boot Address 0xbf400000 Initializing Arena. Initializing Devices. Parallel flash device: name S29GL064M, id 0x2210, size 8192KB Auto-negotiation timed-out 10 MB Half-Duplex (assumed) CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz Total memory: 33554432 bytes (32MB) Total memory used by CFE: 0x80401000 - 0x80525740 (1197888) Initialized Data: 0x8041CC20 - 0x8041EE60 (8768) BSS Area: 0x8041EE60 - 0x80423740 (18656) Local Heap: 0x80423740 - 0x80523740 (1048576) Stack Area: 0x80523740 - 0x80525740 (8192) Text (code) segment: 0x80401000 - 0x8041CC14 (113684) Boot area (physical): 0x00526000 - 0x00566000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.1.1 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : st7g Psi size in KB : 24 Number of MAC Addresses (1-32) : 4 Base MAC Address : fa:ba:da:18:12:01 Ethernet PHY Type : Internal Memory size in MB : 32 CMT Thread Number : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 Code Address: 0x80010000, Entry Address: 0x80010000 Decompression OK! Entry at 0x80010000 Closing network. Starting program at 0x80010000 [ 0.000000] Linux version 3.3.8 (dani@tool) (gcc version 4.6.3 20120201 (pre3 [ 0.000000] Detected Broadcom 0x6348 CPU revision b0 [ 0.000000] CPU frequency is 256 MHz [ 0.000000] 32MB of RAM installed [ 0.000000] registering 37 GPIOs [ 0.000000] gpiochip_add: registered GPIOs 0 to 36 on device: bcm63xx-gpio [ 0.000000] board_bcm963xx: Boot address 0xbf400000 [ 0.000000] board_bcm963xx: CFE version: 1.0.37-6.4 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 00029107 (Broadcom BMIPS3300) [ 0.000000] board_bcm963xx: board name: st7g [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 02000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000000 -> 0x00002000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] Early memory PFN ranges [ 0.000000] 0: 0x00000000 -> 0x00002000 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pa8 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jf0 [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes) [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes. [ 0.000000] Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 byts [ 0.000000] Memory: 29504k/32768k available (2090k kernel code, 3264k reserv) [ 0.000000] NR_IRQS:128 [ 0.000000] Calibrating delay loop... 254.46 BogoMIPS (lpj=508928) [ 0.040000] pid_max: default: 32768 minimum: 301 [ 0.044000] Mount-cache hash table entries: 512 [ 0.064000] NET: Registered protocol family 16 [ 0.092000] registering PCI controller with io_map_base unset [ 0.132000] bio: create slab at 0 [ 0.144000] PCI host bridge to bus 0000:00 [ 0.148000] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff] [ 0.152000] pci_bus 0000:00: root bus resource [io 0x8000000-0x800ffff] [ 0.172000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x30001fff] [ 0.180000] Switching to clocksource MIPS [ 0.204000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002) [ 0.232000] ssb: Found chip with id 0x4318, rev 0x02 and package 0x00 [ 0.296000] ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0 [ 0.308000] NET: Registered protocol family 2 [ 0.312000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.320000] TCP established hash table entries: 1024 (order: 1, 8192 bytes) [ 0.328000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.336000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.344000] TCP reno registered [ 0.348000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.352000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.360000] NET: Registered protocol family 1 [ 0.372000] audit: initializing netlink socket (disabled) [ 0.380000] type=2000 audit(0.380:1): initialized [ 0.388000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.392000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT. [ 0.404000] msgmni has been set to 57 [ 0.408000] io scheduler noop registered [ 0.412000] io scheduler deadline registered (default) [ 0.420000] bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xxt [ 0.428000] console [ttyS0] enabled, bootconsole disabled [ 0.428000] console [ttyS0] enabled, bootconsole disabled [ 0.456000] physmap platform flash device: 00c00000 at 1f400000 [ 0.464000] Found: Spansion S29GL064M [ 0.468000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank [ 0.472000] number of JEDEC chips: 1 [ 0.476000] bcm63xxpart: CFE boot tag found with version 6 and board type 96W [ 0.484000] bcm63xxpart: Partition 0 is CFE offset 0 and length 10000 [ 0.492000] bcm63xxpart: Partition 1 is kernel offset 10100 and length dff00 [ 0.500000] bcm63xxpart: Partition 2 is rootfs offset f0000 and length 700000 [ 0.508000] bcm63xxpart: Partition 3 is nvram offset 7f0000 and length 10000 [ 0.516000] bcm63xxpart: Partition 4 is linux offset 10000 and length 7e0000 [ 0.524000] bcm63xxpart: Spare partition is offset 2d0004 and length 51fffc [ 0.528000] 5 bcm63xxpart partitions found on MTD device physmap-flash.0 [ 0.536000] Creating 5 MTD partitions on "physmap-flash.0": [ 0.544000] 0x000000000000-0x000000010000 : "CFE" [ 0.556000] 0x000000010100-0x0000000f0000 : "kernel" [ 0.560000] mtd: partition "kernel" must either start or end on erase block y [ 0.584000] 0x0000000f0000-0x0000007f0000 : "rootfs" [ 0.596000] mtd: partition "rootfs" set to be root filesystem [ 0.604000] mtd: partition "rootfs_data" created automatically, ofs=2D0000, [ 0.612000] 0x0000002d0000-0x0000007f0000 : "rootfs_data" [ 0.624000] 0x0000007f0000-0x000000800000 : "nvram" [ 0.640000] 0x000000010000-0x0000007f0000 : "linux" [ 0.664000] bcm63xx_enet MII bus: probed [ 0.668000] bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom] [ 0.688000] bcm63xx_enet MII bus: probed [ 0.692000] bcm63xx_enet bcm63xx_enet.1: attached PHY at address 31 [Generic] [ 0.712000] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.732000] TCP cubic registered [ 0.732000] NET: Registered protocol family 17 [ 0.740000] 8021q: 802.1Q VLAN Support v1.8 [ 0.752000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.764000] Freeing unused kernel memory: 176k freed awk: /proc/cpuinfo: No such file or directory - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - [ 10.880000] JFFS2 notice: (321) jffs2_build_xattr_subsystem: complete buildi. switching to jffs2 - init - Please press Enter to activate this console. [ 15.400000] usbcore: registereds [ 15.408000] usbcore: registered new interface driver hub [ 15.416000] usbcore: registered new device driver usb [ 17.348000] wl: module license 'unspecified' taints kernel. [ 17.352000] Disabling lock debugging due to kernel taint [ 17.520000] SSB/BCMA glue driver successfully attached [ 17.544000] Got version 2 SPROM from SSB [ 17.560000] wl0: Broadcom BCM4318 802.11 Wireless Controller 5.10.56.27 [ 17.616000] Button Hotplug driver version 0.4.1 [ 17.948000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 18.364000] nf_conntrack version 0.5.0 (463 buckets, 1852 max) [ 18.980000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 19.092000] bcm63xx_ohci bcm63xx_ohci.0: BCM63XX integrated OHCI controller [ 19.096000] bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered, assigned bu1 [ 19.108000] bcm63xx_ohci bcm63xx_ohci.0: irq 20, io mem 0xfffe1b00 [ 19.172000] hub 1-0:1.0: USB hub found [ 19.176000] hub 1-0:1.0: 1 port detected [ 19.232000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled.0/0 [ 24.496000] device eth1 entered promiscuous mode

Notes

Tags

For some Help with the Tags, please have a look here: tags

Back to top

toh/thomson/st7g.txt · Last modified: 2013/05/29 16:32 by danitool