[SOLVED] FritzBox4040 installation problems

Installing and Using OpenWrt
1

Instructions from commit are as following:

Install Procedure:
0. It's highly recommended to connect to the serial port.
The serial settings are listed above.

  1. install a u-boot image for AVM Fritz!Box 4040
    (see https://github.com/chunkeey/FritzBox-4040-UBOOT/releases and
    https://github.com/chunkeey/FritzBox-4040-UBOOT/blob/master/upload-to-f4040.sh)
  2. upload the initramfs.itb image via tftp (u-boot listens to
    192.168.1.1 - use binary transfer mode!)
  3. connect to the FB4040 and use sysupgrade sysupgrade.bin
    to install the image.

I found the modified U-Boot and the script to install it...
next step would be uploading initramfs.itb with tftp

where can I find the correct initramfs.itb?
snapshot download directory just contains:

lede-ipq806x-FRITZ4040-squashfs-sysupgrade.bin
and
lede-ipq806x-FRITZ4040-ubifs-sysupgrade.bin

Thanks in advance!

Stormy667

2

the commit came from my repository over at github:

If you compile It, it will create the initramfs image. This is because I set the "ramdisk" feature for all ipq806x targets there. If you want to do it this way, you'll have to download LEDE Source (see: https://lede-project.org/docs/guide-developer/the-source-code ). select the FB4040 and built it with initramfs (CONFIG_TARGET_ROOTFS_INITRAMFS,
CONFIG_TARGET_INITRAMFS_COMPRESSION_LZMA).

Another option is to write the lede-ipq806x-FRITZ4040-squashfs-sysupgrade.bin into the flash via u-boot.

(FRITZ4040) # sf probe
SF: Detected MX25L25635E with page size 4 KiB, total 32 MiB

(FRITZ4040) # tftpboot 0x85000000 192.168.1.70:lede-ipq806x-FRITZ4040-squashfs-sysupgrade.bin
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 up Speed :1000 Full duplex
Using eth0 device
TFTP from server 192.168.1.70; our IP address is 192.168.1.1
Filename 'lede-ipq806x-FRITZ4040-squashfs-sysupgrade.bin'.
Load address: 0x85000000
Loading: Got ARP REPLY, set eth addr (d4:3d:7e:bd:e9:6e)
#################################################################
     #################################################################
done
Bytes transferred = 4828028 (49ab7c hex)
NetBootFileXferSize= 0049ab7c

(FRITZ4040) # sf prog 0x85000000 0x002a0000 0x0049ab7c
   .................................................................................................
(FRITZ4040) # run nandboot

Loading from nand0, offset 0x2a0000
Fit image detected...
FIT description: ARM OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel@1)
    Description:  ARM OpenWrt Linux-4.9.17
    Type:         Kernel Image
    Compression:  lzma compressed
    Data Start:   0x850000e4
    Data Size:    4793801 Bytes = 4.6 MiB
    Architecture: ARM
    OS:           Linux
    ...

Note: The last parameter of the sf prog command is the image size. In this case tftp downloaded 4828028 Bytes which means that the last parameter is: 0x0049ab7c.

One thing to watch out: The USB support for the IPQ40XX was disabled by this commit:

So, sadly all the snapshot images don't have USB until the IPQ806x DWC3/USB3 issue gets fixed.

3

Hi chunkeey!
I compiled LEDE myself with LZMA-compressed initramfs selected
in builder.

Used atftp to put file on router, then copied sysupgrade file to /tmp
with scp , then sysupgrade.

Worked like a charm :slight_smile:

Now the testrun begins :wink:

Thanks for your help!

Stormy667

4

Hi chunkeey,
Can you explain this command sf prog 0x85000000 0x002a0000 0x0049ab7c.
Why we use 0x002a0000 here
Thank you very much

5

That's the absolute position of the fit+kernel+dtb partition. See:
https://github.com/lede-project/source/blob/master/target/linux/ipq806x/files-4.9/arch/arm/boot/dts/qcom-ipq4019-fritz4040.dts#L274

6

Hi chunkeey, sorry for my stupid question, but Why we choose this partition, Could I choose another rw partition like partition12?

7

Partition12 is too small to contain a The fit-image (kernel + dtb) + rootfs.
It's only 1MiB (it's located at the 31 MiB of the 32 MiB FlashNOR).

So no, partition12 is not really an option.

Note: the EVA/ADAM2 bootloader will under certain conditions recreate partition12 if it's deleted (i.e reformated). So don't extend partition 11.

8

Hi chunkeey,
I am very sorry for bother you. However, I have one more question.
If the partition 12 is big enough, Could I write to firmware to it. And how can I choice the partition for the best solution?

Thank you very much

9

@chunkeey,
I have recently compiled LEDE trunk for Fritzbox4040,
However the boot up very slow.
do you have any idea to accelerate the boot up, not sure may be with EVA commands or setting ?
Thank you !
Br
aty02

10

Hello,

I am trying to follow the rather sparse instructions here:

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=1cb406d019dc84497a8405c470f0b0394d5ff64a

I have managed to get uboot on the system, and when I rebooted into uboot, it waited for tftp upload. I tried to upload like this:

cd bin/targets/ipq40xx/generic/
tftp 192.168.1.1
put openwrt-ipq40xx-avm_fritzbox-4040-initramfs-fit-uImage.itb

uboot showed this:

Load address: 0x85000000
Loading: T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T)
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
####################################################
done
Bytes transferred = 4591049 (460dc9 hex)
NetBootFileXferSize= 00460dc9

What do I do after this to use the file I just uploaded?

Thanks,
Ben

11
  1. upload the initramfs.itb image via tftp (u-boot listens to
    192.168.1.1 - use binary transfer mode!)

i.e.:

  tftp 192.168.1.1
  binary
  put openwrt-ipq40xx-avm_fritzbox-4040-initramfs-fit-uImage.itb
12

I had managed to get the itb to be in use by doing tftpboot from uboot via serial console, my problem now is that sysupgrade does not work and/or uboot is mis-configured on my system.

My current boot process looks like this:

root@OpenWrt:/# reboot
root@OpenWrt:/# [60224.746919] br-lan: port 1(eth0) entered disabled state
[60224.752498] device eth0 left promiscuous mode
[60224.752633] br-lan: port 1(eth0) entered disabled state
[60224.760911] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[6
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00085
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1338 - bootable_media_detect_entry, Start
B -      1678 - bootable_media_detect_success, Start
B -      1692 - elf_loader_entry, Start
B -      5068 - auth_hash_seg_entry, Start
B -      7209 - auth_hash_seg_exit, Start
B -    570971 - elf_segs_hash_verify_entry, Start
B -    685453 - PBL, End
B -    685477 - SBL1, Start
B -    773947 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    775391 - boot_flash_init, Start
D -     54262 - boot_flash_init, Delta
B -    833829 - boot_config_data_table_init, Start
D -      3812 - boot_config_data_table_init, Delta - (419 Bytes)
B -    841033 - clock_init, Start
D -      7578 - clock_init, Delta
B -    853136 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:0
B -    856631 - sbl1_ddr_set_params, Start
B -    861625 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    866013 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13161 - sbl1_ddr_set_params, Delta
B -    879854 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    950291 - sbl1_wait_for_ddr_training, Start
D -        29 - sbl1_wait_for_ddr_training, Delta
B -    966075 - Image Load, Start
D -    135425 - QSEE Image Loaded, Delta - (262104 Bytes)
B -   1102003 - Image Load, Start
D -      1452 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1112156 - Image Load, Start
D -     48681 - APPSBL Image Loaded, Delta - (90484 Bytes)
B -   1161257 - QSEE Execution, Start
D -        66 - QSEE Execution, Delta
B -   1167399 - SBL1, End
D -    483925 - SBL1, Delta
S - Flash Throughput, 1940 KB/s  (355055 Bytes,  182981 us)
S - DDR Frequency, 533 MHz

(AVM) EVA Revision: 1.3139
(C) Copyright 2005 AVM Date: Jul 21 2016 Time: 11:00:55 (0) 3 0x0-0x240D

[FLASH:] MACRONIX Uniform-Flash 32MB 256 Bytes WriteBuffer
[FLASH:](Eraseregion [0] 512 sectors a 64kB) 
[SYSTEM:] CortexA9 

Eva_AVM >go
.......Device Tree Blob for SubRevision 3 not found.
Using Device Tree Blob of SubRevision 2 
prop->data 0x880B4DA8
prop->len 0x8
Removing props


U-Boot 2012.07 [local,local] (Jan 26 2017 - 23:53:55)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
machid : 0x8010000
Maximum malloc length: 512 KBytes
mem_malloc_start/brk/end: 0x84140000/84140000/84200000
Relocation offset: 0
NAND:  SF: Detected MX25L25635E with page size 4 KiB, total 32 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x2000000
32 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
name         : offset   size    
0:SBL1       : 00000000 00040000
0:MIBIB      : 00040000 00020000
0:QSEE       : 00060000 00060000
0:CDT        : 000c0000 00010000
0:DDRPARAMS  : 000d0000 00010000
0:APPSBLENV  : 000e0000 00010000
0:APPSBL     : 000f0000 00080000
0:ART        : 00170000 00010000
0:HLOS       : 00180000 00400000
rootfs       : 00580000 01600000
machid: 8010000
Net:   Configure GPIOSMAC0 addr:e0:28:6d:85:20:dc
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot:  0 
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 up Speed :1000 Full duplex
eth0 PHY4 Down Speed :10 Half duplex
Using eth0 device
Listening for TFTP transfer on 192.168.1.1
Load address: 0x85000000
Loading: T T T T T T T T T T T T T 
Abort

### I hit ctrl-C here. --Ben

(FRITZ4040) # bootm
## Booting kernel from FIT Image at 85000000 ...
   Using 'config@1' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM OpenWrt Linux-4.14.34
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x850000e4
     Data Size:    4876467 Bytes = 4.7 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x80208000
     Entry Point:  0x80208000
     Hash algo:    crc32
     Hash value:   3b91ccd5
     Hash algo:    sha1
     Hash value:   2cd75f19a6b30915bc27b5002ce76c4c12245ab4
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 85000000
   Using 'config@1' configuration
   Trying 'fdt@1' FDT blob subimage
     Description:  ARM OpenWrt avm_fritzbox-4040 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x854a6ad4
     Data Size:    34767 Bytes = 34 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   6b1c991d
     Hash algo:    sha1
     Hash value:   93a596a7cdf40c4865f50f1ab12e51cba4f1b39f
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x854a6ad4
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 84124000, end 8412f7ce ... OK
Using machid 0x8010000 from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.14.34 (greearb@ben-dt3) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r6672+129-b28e9958
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt: Machine model: AVM FRITZ!Box 4040
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] random: get_random_bytes called from start_kernel+0x88/0x3c4 with crng_init=0
[    0.000000] percpu: Embedded 15 pages/cpu @cfda0000 s29324 r8192 d23924 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64512
[    0.000000] Kernel command line:
13

The Fritz4040-Uboot automatic boot process does not flash the router by itself:

It tries to boot from the internal mtd-nor first (nandboot)... But if no viable firmware image was installed (either nboot firmware or bootm fails), it goes into a tftpserver that waits for a initramfs image.

If you want you follow the install procedure in this thread and manually flash the sysupgrade.bin without the initramfs detour, you have to stop the autoboot process when it says "Hit any key to stop autoboot" and follow post #2 on this thread.

14

Hi, I see that now there is avm_fritzbox-4040-squashfs-eva.bin firmware on shapshots. Can I use this for switch from stock to OpenWrt?
Wifi is working fine?
Thanks

15

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.