1 (edited by bluegeek 2009-01-15 19:55:24)

Topic: Inventel Livebox

Hello,

It seems there's preliminary support for the inventel livebox router. I've build the SVN Kamikaze and I get a Linux Kernel image but not a complete firmware image.

Does somebody with serial console acces to this router tried to boot this kernel from RedBoot?

Some links:

The kernel image I've build:
http://bogomips.net/openwrt/openwrt-livebox-vmlinux.gz

https://dev.openwrt.org/browser/trunk/target/linux/brcm63xx/Makefile
https://svn.openwrt.org/openwrt/trunk/target/linux/brcm63xx/image/Makefile

Propposed patch:
https://dev.openwrt.org/ticket/4433

New Broadcom BCM63xx codebase with GPL'd Ethernet and USB support:
http://forum.openwrt.org/viewtopic.php?id=17370&p=8

How to build firmware images for the livebox with dwbtool:
http://www.dbzoo.com/wiki/livebox/livebox

This is how I compiled

svn co https://svn.openwrt.org/openwrt/trunk/

cd /openwrt/trunk/target/linux/brcm63xx/files/drivers/mtd/maps/

wget http://nbd.name/brcm63xx-mtd.2.patch

patch -b bcm963xx-flash.c brcm63xx-mtd.2.patch

cd /openwrt/trunk/

make menuconfig

    [*] Advanced configuration options (for developers)  ---> 
        [*]   Show broken platforms / packages
        Target System (Broadcom BCM63xx [2.6])  ---> 
         (X) Broadcom BCM63xx [2.6] 
    [*]image configuration
        ---Imageconfiguration
        (192.168.1.1) LAN DNS server
        (static) LAN Protoco (NEW)
        (192.168.1.1) LAN Gateway
        (255.255.255.0) LAN Network Mask (NEW)
        (192.168.1.19) LAN IP Address (NEW)

make V=99

blue@pandora:~/src/openwrt/trunk$ ls -l bin/*livebox*
-rwxr-xr-x 1 blue blue 2372784 2009-01-10 14:26 bin/openwrt-livebox-vmlinux.elf
-rw-r--r-- 1 blue blue 1048576 2009-01-10 14:26 bin/openwrt-livebox-vmlinux.gz
-rw-r--r-- 1 blue blue  786432 2009-01-10 14:26 bin/openwrt-livebox-vmlinux.lzma

2 (edited by pepejose 2009-01-17 21:16:19)

Re: Inventel Livebox

First of all, it's my first time with openwrt so ... may be I'm wrong
I've tested it, but it doen't work (See output)

Note that I've used EXEC & GO for running the image. First exec and after a fail i tried with go.

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2009.01.17 20:34:46 =~=~=~=~=~=~=~=~=~=~=~=

+ESA: deleted
WEP KEY : deleted
Ethernet eth0: MAC address deleted
IP: 192.168.1.1/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2
Hardware version 0x10 BLUE5G.4_mod1
Factory Switch OFF

RedBoot(tm) bootstrap and debug environment [ROM]
Non-certified release, version UNKNOWN - built 22:49:54, Jul 19 2004

Platform: Blue_5g (MIPS32 4Kc)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x80000000-0x81000000, [0x8041de80-0x80fe1000] available
FLASH: 0xbe400000 - 0xbec00000, 128 blocks of 0x00010000 bytes each.
== Executing boot script in 0.400 seconds - enter ^C twice to abort


(configuration)

RedBoot> fconfig -l
Run script at boot: true
Boot script:

Boot script timeout (10ms resolution): 40
Use BOOTP for network configuration: false
Local IP address: 192.168.1.1
Default server IP address: 192.168.1.2
bt_pin: true
bt_pin_data: 0000
Set eth0 network hardware address [MAC]: true
eth0 network hardware address [MAC]: deleted
GDB connection port: 9000
Set H235 KEY: true
H235 KEY: deleted
Force console for special debug messages: false
INVENTEL WIRELESS MAGIC: -2
Network debug at boot time: false
Set SERIAL NUMBER: true
SERIAL NUMBER: deleted
Set WEP KEY: true
WEP KEY: deleted

(load uncompressed image)

RedBoot> load -r -b %{FREEMEMLO} vmlinux
Using default protocol (TFTP)
Raw file loaded 0x8041e000-0x8065f084, assumed entry at 0x8041e000

RedBoot> exec
Now booting linux kernel:
Base address 0x8000fc00 Entry 0x8041e000
Cmdline : root=1F01 panic=2
** command abort - illegal memory access?

RedBoot> go
$T0425:80014450;1d:80ffffd0;#c8$T0425:80014450;1d:80ffffd0;#c8$T0425:80014450;1d:80ffffd0;#c8$T0425:80014450;1d:80ffffd0;#c8$T0425:80014450;1d:80ffffd0;#c8$T0425:80014450;1d:80ffffd0;#c8
(It sems to hangs)

+ESA: deleted
WEP KEY : deleted
Ethernet eth0: MAC address deleted
IP: 192.168.1.1/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2
Hardware version 0x10 BLUE5G.4_mod1
Factory Switch OFF

RedBoot(tm) bootstrap and debug environment [ROM]
Non-certified release, version UNKNOWN - built 22:49:54, Jul 19 2004

Platform: Blue_5g (MIPS32 4Kc)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x80000000-0x81000000, [0x8041de80-0x80fe1000] available
FLASH: 0xbe400000 - 0xbec00000, 128 blocks of 0x00010000 bytes each.
== Executing boot script in 0.400 seconds - enter ^C twice to abort

(Load gz image)

RedBoot> load -r -b %{FFREEMEMLO} openwrt-livebox-vmlinux.gz
Using default protocol (TFTP)
Raw file loaded 0x8041e000-0x8051dfff, assumed entry at 0x8041e000

RedBoot> exec
Now booting linux kernel:
Base address 0x8000fc00 Entry 0x8041e00
Cmdline : root=1F01 panic=2
** command abort - illegal memory access?

RedBoot> go
$T0425:8041e000;1d:80ffffd0;#f4$T0425:8041e000;1d:80ffffd0;#f4$T0425:8041e000;1d:80ffffd0;#f4$T0425:8041e000;1d:80ffffd0;#f4$T0425:8041e000;1d:80ffffd0;#f4$T0425:8041e000;1d:80ffffd0;#f4

Re: Inventel Livebox

more clues
http://www.andyp.uwclub.net/livebox.html

Re: Inventel Livebox

@pepejose: Thanks for trying, I hope it didn't brick your router yikes)

@danitool: I've been in contact with Andy, he's doing a great job trying to hack this router.

Re: Inventel Livebox

bluegeek wrote:

@pepejose: Thanks for trying, I hope it didn't brick your router yikes)

No, It isn't bricked, don't worry. But I need to reflash it again after a lot of (failed) tests with openwrt. I don't know why redboot doesn't allow me to modify the boot script (It's strange!!)

And  => http://www.dbzoo.com/wiki/livebox/livebox

Re: Inventel Livebox

Hi,

I have managed to get my Inventel Livebox to 'boot' an OpenWRT kernel up to a point, then it all goes south with a Oops.

To get my kernel ( config file at http://www.andyp.dyndns.info/.config ) to boot I used the vmlinux kernel from the trunk/build_dir/linux-brcm63xx/ directory, not any of the other kernels.

The RedBoot command line is ignored during the boot and the kernel uses the command line that is in the kernel .config file as CONFIG_CMDLINE.

My bootlog is as follows,

RedBoot(tm) bootstrap and debug environment [ROM]
Non-certified release, version UNKNOWN - built 22:49:54, Jul 19 2004

Platform: Blue_5g (MIPS32 4Kc)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x80000000-0x81000000, [0x8041de80-0x80fe1000] available
FLASH: 0xbe400000 - 0xbec00000, 128 blocks of 0x00010000 bytes each.
== Executing boot script in 0.200 seconds - enter ^C twice to abort
RedBoot> load -r -v -h 10.7.58.114 -m tftp -b 0x80010000 Image
Raw file loaded 0x80010000-0x80253085, assumed entry at 0x80010000
RedBoot> exec -c "boot_loader=RedBoot root=1F01 mem=16M" 0x80010000
Now booting linux kernel:
Base address 0x8000fc00 Entry 0x80010000
Cmdline : boot_loader=RedBoot root=1F01 mem=16M
Linux version 2.6.27.19 (root@acernote) (gcc version 4.1.2) #38 Wed Mar 4 20:20:28 GMT 2009
Detected Broadcom 0x6348 CPU revision b0
CPU frequency is 256000000 Hz
16MB of RAM installed
console [early0] enabled
CPU revision is: 00029107 (Broadcom BCM6348)
board_livebox: board name: Livebox
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00001000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00001000
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
Kernel command line: root=/dev/mtdblock1 rootfstype=squashfs init=/etc/preinit noinitrd console=ttyS0,115200
Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes
PID hash table entries: 64 (order: 6, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13716k/16384k available (1874k kernel code, 2668k reserved, 322k data, 120k init, 0k highmem)
Calibrating delay loop... 252.92 BogoMIPS (lpj=505856)
Mount-cache hash table entries: 512
net_namespace: 592 bytes
NET: Registered protocol family 16
registering 37 GPIOs
registering PCI controller with io_map_base unset
bus: 00 index 0 io port: [8000000, 800ffff]
bus: 00 index 1 mmio: [30000000, 37ffffff]
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
NET: Registered protocol family 1
audit: initializing netlink socket (disabled)
type=2000 audit(0.596:1): initialized
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. © 2001-2006 Red Hat, Inc.
msgmni has been set to 26
io scheduler noop registered
io scheduler cfq registered (default)
bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart
console handover: boot [early0] -> real [ttyS0]
bcm63xx_enet MII bus: probed
bcm963xx_flash: 0x00400000 at 0x1fc00000
bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank
AGP Here max_chips=00 map->size=400000 cfi.chipshift=17
NOR chip too large to fit in mapping. Attempting to cope...
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Reducing visibility of 8192KiB chip to 4096KiB
bcm963xx_flash: Read Signature value of
bcm963xx_flash: assuming RedBoot bootloader
bcm963xx_flash: Support for extended flash memory size : 0x00800000 ; ONLY 64MBIT SUPPORT
Searching for RedBoot partition table in bcm963xx at offset 0x7f0000
CPU 0 Unable to handle kernel paging request at virtual address c0076000, epc == 800140fc, ra == 8015915c
Oops[#1]:
Cpu 0
$ 0   : 00000000 10008400 c0066000 00000000
$ 4   : c0076000 4fc083ff 4fc18400 00000000
$ 8   : c03f0000 00000000 00000000 00000000
$12   : 80260000 00000001 8025a980 00000000
$16   : 00000000 007f0000 80382c00 80382c38
$20   : 8022fab0 00000000 007f0000 00010000
$24   : 00000000 000186a0                 
$28   : 802b4000 802b5d10 00010000 8015915c
Hi    : 0000007e
Lo    : 76ca1000
epc   : 800140fc 0x800140fc
    Not tainted

As you can see it trashes itself when searching for Redboot partitions and I think its due to the physical/virtual location for the flash. I am currently working on fixing this but incase I don't have the correct .config file, has anyone else managed to get an Openwrt kernel to boot on an Inventel Livebox? If so, can they post their config file.

Thanks

AndyP

Re: Inventel Livebox

Well, I finally managed to get a kernel that will boot a Livebox and have installed a squashfs image so I now get to a boot prompt. The boot log is as follows,

+ESA: 00:07:3a:d7:7f:66
WEP KEY : 0B49BABEA353A0FC8A03A9A266
Ethernet eth0: MAC address 00:07:3a:d7:7f:66
IP: 10.7.58.112/255.255.255.0, Gateway: 0.0.0.0
Default server: 0.0.0.0
Hardware version 0x0A BLUE5G.4_mod1
Factory Switch OFF

RedBoot(tm) bootstrap and debug environment [ROM]
Non-certified release, version UNKNOWN - built 22:49:54, Jul 19 2004

Platform: Blue_5g (MIPS32 4Kc)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x80000000-0x81000000, [0x8041de80-0x80fe1000] available
FLASH: 0xbe400000 - 0xbec00000, 128 blocks of 0x00010000 bytes each.
== Executing boot script in 0.200 seconds - enter ^C twice to abort
RedBoot> load -r -v -h 10.7.58.114 -m tftp -b 0x80010000 Image
-
Raw file loaded 0x80010000-0x8023f085, assumed entry at 0x80010000
RedBoot> exec -c "boot_loader=RedBoot root=1F01 mem=16M" 0x80010000
Now booting linux kernel:
Base address 0x8000fc00 Entry 0x80010000
Cmdline : boot_loader=RedBoot root=1F01 mem=16M <---------------------------------------------- THIS IS IGNORED BY OpenWRT
Linux version 2.6.27.19 (andyp@acernote) (gcc version 4.1.2) #5 Sat Mar 14 12:22:36 GMT 2009
Detected Broadcom 0x6348 CPU revision b0
CPU frequency is 256000000 Hz
16MB of RAM installed
console [early0] enabled
CPU revision is: 00029107 (Broadcom BCM6348)
board_livebox: board name: Livebox
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00001000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00001000
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200 <- THIS IS USED INSTEAD
Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes
PID hash table entries: 64 (order: 6, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13796k/16384k available (1812k kernel code, 2588k reserved, 305k data, 120k init, 0k highmem)
Calibrating delay loop... 252.92 BogoMIPS (lpj=505856)
Mount-cache hash table entries: 512
net_namespace: 776 bytes
NET: Registered protocol family 16
registering 37 GPIOs
registering PCI controller with io_map_base unset
bus: 00 index 0 io port: [8000000, 800ffff]
bus: 00 index 1 mmio: [30000000, 37ffffff]
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
NET: Registered protocol family 1
audit: initializing netlink socket (disabled)
type=2000 audit(0.605:1): initialized
squashfs: version 3.0 (2006/03/15) Phillip Lougher
JFFS2 version 2.2. �© 2001-2006 Red Hat, Inc.
msgmni has been set to 26
io scheduler noop registered
io scheduler cfq registered (default)
bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart
console handover: boot [early0] -> real [ttyS0]
bcm63xx_enet MII bus: probed
physmap platform flash device: 00800000 at 1e400000
physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Searching for RedBoot partition table in physmap-flash.0 at offset 0x7f0000
6 RedBoot partitions found on MTD device physmap-flash.0
Creating 6 MTD partitions on "physmap-flash.0":
0x00000000-0x00030000 : "RedBoot"
0x00030000-0x003c0000 : "user_fs"
0x003c0000-0x00750000 : "user_2_fs"
0x00750000-0x007f0000 : "jffs_system"
0x007f0000-0x007ff000 : "FIS directory"
0x007ff000-0x00800000 : "RedBoot config"
TCP bic registered
NET: Registered protocol family 17
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 120k freed
Please be patient, while OpenWrt loads ...
Algorithmics/MIPS FPU Emulator v1.5
- preinit -
Press CTRL-C for failsafe
- init -

Please press Enter to activate this console.


BusyBox v1.11.3 (2009-03-12 19:56:33 GMT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
KAMIKAZE (bleeding edge, r14863) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
---------------------------------------------------
root@(none):/# ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>
ip_tables: (C) 2000-2006 Netfilter Core Team
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use
nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
arp_tables: (C) 2002 David S. Miller

root@OpenWrt:/#

I have copied my OpenWRT and kernel config files to here, http://www.andyp.uwclub.net/OpenWRT.configs.tar.bz2
They were created on Kamikaze r14863 for anyone thats interested. So far I have not done anything with the OpenWRT Livebox but will start playing shortly. Many thanks to the OpenWRT team for all their hard work on this project.

AndyP

Re: Inventel Livebox

Very nice news

For long time you have worked hard on livebox.

Thanks

Re: Inventel Livebox

Good news Andy! Keep us informed please.
Do you think it will be possible to build a firmware file for installing OpenWrt via Ethernet/TFTP?
--bluegeeek

10 (edited by AndyP 2009-04-28 20:21:34)

Re: Inventel Livebox

Yesterday I finally managed to get my Livebox to boot from an OpenWRT kernel (r15001) that is stored in a cramfs partition on the Livebox. This then booted to a command prompt using a squashfs rootfs. I can then access the network from the Livebox and also mount a USB flash drive. I have not tried wireless yet, only wired.

Here is the bootlog (http://www.andyp.uwclub.net/openwrt.boot), along with the openwrt config (http://www.andyp.uwclub.net/openwrt.config),
kernel config (http://www.andyp.uwclub.net/kernel.config) and config-2.6.27 (http://www.andyp.uwclub.net/config-2.6.27).

The config-2.6.27 needs to be copied as is to /openwrt/trunk/target/linux/brcm63xx.
The kernel config needs to be copied as .config to /openwrt/trunk/build_dir/linux-brcm63xx/linux-2.6.27.19
The openwrt config needs to be copied as .config to /openwrt/trunk

I changed the network file (http://www.andyp.uwclub.net/network) in /openwrt/trunk/build_dir/target-mips-uClibc-0.9.29/root-brcm63xx/etc/config so that the lan was on eth0 so I could use the same yellow port on the Livebox for redboot network access as well as linux kernel access. The IP address of the Livebox (openwrt.config) was changed to be 10.7.58.112 (the same as Redboot) just to make things a little easier.
I then ran 'make' and waited.............and waited...............and waited.

The version or Redboot that I use (http://www.andyp.uwclub.net/redboot.20040719) allows Ctrl-C to break into it. You CANNOT use a ROM version of Redboot to flash a ROM version of RedBoot, a brick is the result, I know 'cos I did it. It needs to be done using a running linux, via JTAG or using a RAM version of RedBoot (I will try to build a RAM version of RedBoot that can be used to flash the ROM version, I have a version of the RedBoot sources released by Inventel which has some binary parts with it but does build). I first erased and then deleted any cramfs/squashfs/jffs partitions and created new kernel and rootfs partitions and ended up with this arrangement using the relevant 'fis erase' then 'fis delete' and finally 'fis create' commands within RedBoot

RedBoot 0XBE400000      0XBE400000      0X00030000      0x00000000
kernel  0XBE430000      0XBE430000      0X00130000      0X80800000
rootfs  0XBE560000      0XBE560000      0X002C0000      0X80800000
FIS     0XBEBF0000      0XBEBF0000      0X0000F000      0X00000000
Rconfig 0XBEBFF000      0XBEBFF000      0X00001000      0X00000000

I did NOT change the names of the RedBoot, FIS directory or RedBoot config partitions, they just don't all fit well in the text above.

I flashed the created squashfs image (http://www.andyp.uwclub.net/root.squashfs) to the rootfs partition on the Livebox using Redboot.

Using the mkcramfs binary (http://www.andyp.uwclub.net/mkcramfs) from one of the broadcom sets of sources (I can't remember where, will look to see) I created a cramfs image (http://www.andyp.uwclub.net/cramfs.fs) containing the vmlinux kernel from /openwrt/trunk/build_dir/linux-brcm63xx and then flashed it to the kernel partition.

I then modified the boot option by typing the following within RedBoot,

fconfig boot_script_data

and entering the following lines

fis load -b 0x80010000 -m cramfs -f vmlinux kernel
exec -c "boot_loader=RedBoot root=1F01 mem=16M" 0x80010000

This set RedBoot to load and boot my kernel. The bootlog is the result. Once I create a root password it will start sshd and stop telnetd on the
next reboot.

You do need serial port access to do all this. I am not sure if it can be done without but it might be possible.

Any questions, drop me a line.

Regards

        AndyP

Re: Inventel Livebox

bravo!!

congratulations for your work

Re: Inventel Livebox

Just a quick update.

Finally managed to get OpenWRT r15252 to build (far too many packages selected) so updated all the above files to this rev.
Also, found the sources to a copy of mkcramfs that will build Livebox compatible images, no switches required, just mkcramfs indir outfilename .  The sources and binary are at http://www.andyp.uwclub.net/cramfs.tar.bz2
Still working on a RAM copy of RedBoot to allow flashing of the ROM copy of RedBoot.

AndyP

Re: Inventel Livebox

Andy, this is the first time I use OpenWRT and thanks to your post I manage to install it on my livebox.
I have still some questions :

Wy do you need a ram based RedBoot?  I manage to flash my redboot with 'fcp -v' witch was installed on the original firmware (I think).

I also have some errors in dmesg like
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020020: 0x27bd instead
...
Empty flash at 0x0002c514 ends at 0x0002c524
...
Any idea where this come from ?

I have no wireless, is the module available ?

Thanks.

Re: Inventel Livebox

Yes, fcp is normally in the original firmware, but I was looking to build a RAM based RedBoot to allow flashing of the ROM based RedBoot for those who do not have command line access when the Livebox is running.

I saw errors like your when I had not erased the old partitions, only deleted them.

I have not looked at using wireless yet, I just bricked my Livebox running a RAM based RedBoot. Need to JTAG to recover. If I get a chance I will look at wireless support.

AndyP

Re: Inventel Livebox

Hi AndyP smile

Good luck with jtag and always the best for livebox smile

Sebastiii.

16 (edited by t3l3m4k0 2009-05-02 12:00:39)

Re: Inventel Livebox

@ AndyP,
Some days ago I obtained a Livebox, output from serial console says:

96432SDRAM16bit_5GX101201234Hardware version 0x90 BLUE5G.9
56+678ESA: 00:1d:68:88:0e:b0
WEP KEY : ACE17BA962C02A4B2D6EC26782
Auto-negotiation timed-out
10 MB Half-Duplex (assumed)
Ethernet eth0: MAC address 00:1d:68:88:0e:b0
IP: 10.7.58.112, Default server: 0.0.0.0
Hardware version 0x10 BLUE5G.9 WITHOUT_OPTION
Factory Settings Recovery Switch OFF High
Register : 1f

RedBoot(tm) bootstrap and debug environment [ROM]
Non-certified release, version release-wanadoo-fr - built 16:25:10, Jun 20 2006

Platform: Blue_5g (MIPS32 4Kc) 
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x80000000-0x81000000, [0x80445fb0-0x80fe2000] available
FLASH: 0xbe400000 - 0xbec00000, 128 blocks of 0x00010000 bytes each.
== Executing boot script in 0.200 seconds - enter ^C twice to abort
RedBoot> fis load -b 0x80010000 -m cramfs -f Image user_fs
Partition is : 0xbe430000 - 0x720000 
mlen : 0x4c4034 
begin_tag : 0xbe8f4000, end : 0xbe8f4034
Verif OK 
Looking for Image in cramfs user_fs partition
cramfs_load : b 0x80010000, c 0xBE430000, s 0x00720000, f Image
.............loaded 0x1900FC bytes

it has RedBoot partition newer than one you uses, ^C twice seems not work.

AndyP wrote:

The version or Redboot that I use (http://www.andyp.uwclub.net/redboot.20040719) allows Ctrl-C to break into it. You CANNOT use a ROM version of Redboot to flash a ROM version of RedBoot, a brick is the result, I know 'cos I did it. It needs to be done using a running linux, via JTAG or using a RAM version of RedBoot (I will try to build a RAM version of RedBoot that can be used to flash the ROM version, I have a version of the RedBoot sources released by Inventel which has some binary parts with it but does build). I first erased and then deleted any cramfs/squashfs/jffs partitions and created new kernel and rootfs partitions and ended up with this arrangement using the relevant 'fis erase' then 'fis delete' and finally 'fis create' commands within RedBoot

RedBoot 0XBE400000      0XBE400000      0X00030000      0x00000000
kernel  0XBE430000      0XBE430000      0X00130000      0X80800000
rootfs  0XBE560000      0XBE560000      0X002C0000      0X80800000
FIS     0XBEBF0000      0XBEBF0000      0X0000F000      0X00000000
Rconfig 0XBEBFF000      0XBEBFF000      0X00001000      0X00000000

I did NOT change the names of the RedBoot, FIS directory or RedBoot config partitions, they just don't all fit well in the text above.

First of all, i don't know much abot RedBoot.
Question are:
1.- I can download it and flash from serial console with fcp -v redboot.20040719 /dev/mtd0 ?
2.- If I only want to change redboot, i must erase, delete and create mtd1, mtd2, mtd3, and mtd4 partitions?
3.- Finaly, any knowledgement if we modify mtd4 partition paramenters (RedBoot config) and reflash it (*) , and leave mtd0 partition, (RedBoot), unchanged?

tnhx in advanced.

(*) there is a tool to read and modify it at http://andrzejekiert.ovh.org/software.html.en
first of all we can dump mtd4 partition to a file, modify it with fconfig tool and reflash it

17 (edited by ruff 2009-05-03 17:17:52)

Re: Inventel Livebox

Ehm... How do you prepare image for loading? openwrt bin contains kernel image and rootfs tgz and squashfs.
I've created cramfs image with

mkcramfs -v -i kamikadze/bin/openwrt-livebox-vmlinux.elf root/ vmlinux-openwrt.cramfs

then I've tried to load

load -v -r -b 0x80010000 vmlinux-openwrt.cramfs

as well as

load -v -r -b 0x80010000 openwrt-brcm63xx-root.squashfs
load -v -r -b 0x80010000 openwrt-livebox-vmlinux.gz

all of them give

RedBoot> exec 0x80010000
Now booting linux kernel:
 Base address 0x8000fc00 Entry 0x80010000
 Cmdline : root=1F01 panic=2
** command abort - illegal memory access?
RedBoot> exec
Now booting linux kernel:
 Base address 0x8000fc00 Entry 0x80010000
 Cmdline : root=1F01 panic=2
** command abort - illegal memory access?
RedBoot> go
$T0425:80010000;1d:80ffffd0;#bb$T0425:80010000;1d:80ffffd0;#bb$T0425:80010000;1d
:80ffffd0;#bb

i've checked after kernel load memory - it is really there

RedBoot> dump -b 0x80010000
80010000: 1F 8B 08 08 27 BF FA 49  02 03 76 6D 6C 69 6E 75  |....'..I..vmlinu|
80010010: 78 00 EC 5B 0F 74 54 E5  95 BF EF BD 49 F2 26 19  |x..[.tT.....I.&.|
..
RedBoot> load -v -r -b 0x80010000 openwrt-livebox-vmlinux.elf
Using default protocol (TFTP)
-
Raw file loaded 0x80010000-0x802554e3, assumed entry at 0x80010000
RedBoot> exec
Now booting linux kernel:
 Base address 0x8000fc00 Entry 0x80010000
 Cmdline : root=1F01 panic=2
** command abort - illegal memory access?
RedBoot> dump -b 0x80010000
80010000: 7F 45 4C 46 01 02 01 00  00 00 00 00 00 00 00 00  |.ELF............|
80010010: 00 02 00 08 00 00 00 01  80 01 44 50 00 00 00 34  |..........DP...4|
RedBoot>
--
Looking forward to reading yours.

Re: Inventel Livebox

t3l3m4k0 wrote:

1.- I can download it and flash from serial console with fcp -v redboot.20040719 /dev/mtd0 ?
2.- If I only want to change redboot, i must erase, delete and create mtd1, mtd2, mtd3, and mtd4 partitions?
3.- Finaly, any knowledgement if we modify mtd4 partition paramenters (RedBoot config) and reflash it (*) , and leave mtd0 partition, (RedBoot), unchanged?

1 - yes

# fcp -v redboot.20040719 /dev/mtd0
Erasing blocks: 3/3 (100%)
Writing data: 192k/192k (100%)
Verifying data: 192k/192k (100%)
#
# reboot
Sending SIGTERM to adsld and pppd.

and you have access to ctl+c
2 - no
3 - you can modify redboot config after getting to its promt via fconfig command, no need to manipulate partition directly

--
Looking forward to reading yours.

19 (edited by t3l3m4k0 2009-05-04 09:33:33)

Re: Inventel Livebox

@ ruff,
tnhx for your answers, i will try.

Interest about only changing mtd4 partition is for maintain squashfs support on last versions of RedBoot, as i read from AndyP web pages ( http://www.andyp.uwclub.net/livebox_writing_to_flash.html )

....

RedBoot Commands

Using the RedBoot commands requires that you have a copy of RedBoot installed on the Livebox that allows you to break into the boot process. The earlier versions would allow you to break into the boot process by typing Ctrl-C during the initial loading of RedBoot. Later versions removed this. Also, the latest versions used in the Livebox now run a checksum on the root filesystem and refuse to complete the boot if the checksum is wrong.

Unfortunately, none of the older versions understand the squashfs filesystem used by the latest firmwares. This makes things difficult but not impossible. If you have your own local PC that you can use as a TFTP server and have installed a JTAG connection on the Livebox, you can use JTAG or Linux comands to flash an old version of RedBoot to the Livebox which you can break into via the serial port with Ctrl-C, then flash the image you want and finally use TFTP to load the kernel to the Livebox for booting. This is the method that I currently use on my Livebox. The following assumes that the IP address of the TFTP Server is 10.7.58.114 (the default for Livebox RedBoot tftp).

...

Re: Inventel Livebox

t3l3m4k0 wrote:

Interest about only changing mtd4 partition is for maintain squashfs support on last versions of RedBoot, as i read from AndyP web pages ( http://www.andyp.uwclub.net/livebox_writing_to_flash.html )

you mean to hack new redboot to enter its prompt? Or writing redboot config with your own configuration from outside? As for promt - it looks like ctl-c sequence disabled in binary, as even with zero timeout you can send ctlc just before script is launched.

For direct manipulation here is some resources
http://lists.gateworks.com/avila/2007-November/000840.html
http://lists.gateworks.com/avila/2006-November/000592.html
http://lists.gateworks.com/avila/2006-November/000589.html
but it assumes redboot patching, which is not our case, as we do not have redboot source for bcm63.
Though, next mail states it is possible to enable rw access in 2.6 kernel
http://lists.gateworks.com/avila/2006-November/000593.html

merlin kamikadze # grep -i redboot target/linux/brcm63xx/*
target/linux/brcm63xx/config-2.6.27:CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
target/linux/brcm63xx/config-2.6.27:CONFIG_MTD_REDBOOT_PARTS=y
target/linux/brcm63xx/config-2.6.27:CONFIG_MTD_REDBOOT_PARTS_READONLY=y
target/linux/brcm63xx/config-2.6.27:CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED=y

have something to try, if I manage to boot openwrt finally %)

--
Looking forward to reading yours.

Re: Inventel Livebox

ruff wrote:

you mean to hack new redboot to enter its prompt? Or writing redboot config with your own configuration from outside? As for promt - it looks like ctl-c sequence disabled in binary, as even with zero timeout you can send ctlc just before script is launched.

i have in mind to make our own config, but it will only be util if binary are propper



good luck booting

Re: Inventel Livebox

So, the intention is to use old redboot image to prepare config and then replace it with new redboot, which should allow to boot normal squashfs openwrt image (using prepared config)? Unless redboot bin is modified to accept some presalted key in config - it could be done. fcp is not modifying redboot config partition, so...

Anyway, here is another nice howto of how to write redboot config partition
http://blog.coldtobi.de/1_coldtobis_blo … howto.html
so, having onboard fconfig utility which can craft custom redboot config data and ability to flash that data gives possibility to try both options.

--
Looking forward to reading yours.

Re: Inventel Livebox

Hello iam new in this forum.

I have found this topic and it is very interesting for me because i want to use a livebox in accespoint.

Do you know if the wireless work in the livebox with the openwrt firmware?

Thank you for your good job and sorry for my bad english!!!

24 (edited by ruff 2009-05-04 16:25:49)

Re: Inventel Livebox

juanito77 wrote:

i want to use a livebox in accespoint.

You can use it as access point with original firmware, just set up needed wifi security profile and bridge wlan interface with ethernet. I've been using the box in this mode till i found i can do more with it %)
Here is my /etc/wifi file to setup wpa security

WIFI_KEY_63=VeryNiceSecurityPhrase
WIFI_ESSID=ruff

SSID=${WIFI_ESSID:-$HNAME}
nas -H 34954 -P /var/run/nas.pid -l br0 -i wl0 -k $WIFI_KEY_63 -m 4 -s $SSID -w 2 -A -g 3600  > /dev/console 2>&1
wlctl ap 1
wlctl ssid $SSID
wlctl wpa_auth 4
wlctl wsec 2
wlctl close 0
wlctl auth 0
wlctl up
wlctl essid $SSID

and have wifi turned off in web config %)

--
Looking forward to reading yours.

25 (edited by juanito77 2009-05-04 19:10:46)

Re: Inventel Livebox

Ok thank you very much for you fast answer.

So if i undertstand what you say:

i connect my computer in ssh or in telnet
i edit /etc/wifi

And i change that:
(Wifi key is passphrase and essid is juanito, i use WEPkey because iam in campaign)



WIFI_KEY_63=passphrase
WIFI_ESSID=juanito

SSID=${WIFI_ESSID:-$HNAME}
nas -H 34954 -P /var/run/nas.pid -l br0 -i wl0 -k $WIFI_KEY_63 -m 4 -s $SSID -w 2 -A -g 3600  > /dev/console 2>&1
wlctl ap 1
wlctl ssid $SSID
wlctl wep_auth 4          %%%(iam in wep)%%%
wlctl wsec 2
wlctl close 0
wlctl auth 0
wlctl up
wlctl essid $SSID


And i disable wifi in web config


Thank you for your help