OpenWrt Forum Archive

Topic: Siemens sx762, wrong u-boot environment. (I think)

The content of this topic has been archived between 31 Mar 2018 and 29 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I followed these instructions to install OpenWRT on my sx762 Danube. The link to the primary bootloader was dead, so I took the one from here: http://downloads.openwrt.org/attitude_a … 166_flash/.
The failsafe webinterface came up, and I flashed OpenWRT from trunk. However, it didn't boot.

After connecting serial, I saw a warning that the u-boot environment had the wrong CRC, using default. This is the default:

DANUBE => printenv
bootcmd=run flash_flash
bootdelay=2
baudrate=115200
loads_echo=
ethaddr=00:01:02:03:04:05
ipaddr=192.168.0.119
ram_addr=0x80500000
kernel_addr=0xb0020000
mtdparts=mtdparts=ifx-nor:256k(uboot)ro,64k(uboot_env)ro,64k(kernel),-(rootfs)
flashargs=setenv bootargs rootfstype=squashfs,jffs2
nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=${serverip}:${rootpath} 
addip=setenv bootargs ${bootargs} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}:${netdev}:off
addmisc=setenv bootargs ${bootargs} init=/etc/preinit console=ttyS1,115200 ethaddr=${ethaddr} ${mtdparts}
flash_flash=run flashargs addip addmisc;bootm ${kernel_addr}
flash_nfs=run nfsargs addip addmisc;bootm ${kernel_addr}
net_flash=run load_kernel flashargs addip addmisc;bootm ${ram_addr}
net_nfs=run load_kernel nfsargs addip addmisc;bootm ${ram_addr}
load_kernel=tftp ${ram_addr} ${tftppath}openwrt-ifxmips-uImage
update_uboot=tftp 0x80500000 ${tftppath}u-boot.bin;era 0xb0000000 +${filesize};cp.b 0x80500000 0xb0000000 ${filesize}
update_openwrt=tftp ${ram_addr} ${tftppath}openwrt-ifxmips-squashfs.image;era ${kernel_addr} +${filesize};cp.b ${ram_addr} ${kernel_addr} ${filesize}
ethact=lq_cpe_eth
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 2010.03-svn34185 (Nov 16 2012 - 07:35:05)

Environment size: 1267/65532 bytes

When booting, I get this:

## Booting kernel from Legacy Image at b0020000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.17
   Created:      2013-10-26  15:50:50 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1220482 Bytes =  1.2 MB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 3.10.17 (Mijzelf@ubuntu) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2013.05 r38539) ) #2 Sat Oct 26 15:50:02 UTC 2013
<snip>
[    0.000000] Kernel command line: console=ttyLTQ0,115200 init=/etc/preinit
<snip>
[    0.380000] 3 ofpart partitions found on MTD device ltq_nor
[    0.384000] Creating 3 MTD partitions on "ltq_nor":
[    0.388000] 0x000000000000-0x000000030000 : "uboot"
[    0.396000] 0x000000030000-0x000000040000 : "uboot_env"
[    0.404000] 0x000000040000-0x000000800000 : "firmware"
<snip>
[    0.516000] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    0.524000] Please append a correct "root=" boot option; here are the available partitions:
[    0.532000] 1f00             192 mtdblock0  (driver?)
[    0.536000] 1f01              64 mtdblock1  (driver?)
[    0.540000] 1f02            7936 mtdblock2  (driver?)
[    0.544000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

Seeing this it seems to me the command line is not passed to the kernel (console has a different value), and also the command line as constructed by uboot doesn't seem to contain a 'root=' line.
I tried to change

flashargs=setenv bootargs root=/dev/mtdblock2 rootfstype=squashfs,jffs2

but that didn't help. It had no impact on the commandline as seen by the kernel.

How to proceed?

(Last edited by Mijzelf on 1 Nov 2013, 14:04)

your u-boot try load kernel on b0020000, but OpenWrt partition table firmware starts at  b0040000. you can try change kernel_addr value to 0xb0040000 and run update_openwrt procedure

update_openwrt? You mean to tftp a new kernel+rootfs? I guess I'll have to set a server IP then?

I mean this string

update_openwrt=tftp ${ram_addr} ${tftppath}openwrt-ifxmips-squashfs.image;era ${kernel_addr} +${filesize};cp.b ${ram_addr} ${kernel_addr} ${filesize}

Yes, you need to run TFTP service on own PC and set server IP same as you PC have.

But maybe would be better edit file where need change partition table.

                                    partition@0 {
                                            label = "uboot";
                                            reg = <0x0 0x10000>;
                                    };
    
                                    partition@10000 {
                                            label = "uboot_env";
                                            reg = <0x10000 0x10000>;
                                    };
    
                                    partition@20000 {
                                            label = "firmware";
                                            reg = <0x20000 0x7e0000>;
                                    };

(Last edited by neryba on 31 Oct 2013, 09:08)

neryba wrote:

I mean this string

update_openwrt=tftp ${ram_addr} ${tftppath}openwrt-ifxmips-squashfs.image;era ${kernel_addr} +${filesize};cp.b ${ram_addr} ${kernel_addr} ${filesize}

Yes, you need to run TFTP service on own PC and set server IP same as you PC have.

I have troubles to get the image via the FailSafe UI.
Can I do this also from the bootloader prompt?

After rebooting and stopping the httpd service I get  the SX76X > prompt.

update_openwrt should work there?

wvdakker wrote:

update_openwrt should work there?

I would even say this is the only place where it works: at the u-boot prompt. wink

Samweis wrote:
wvdakker wrote:

update_openwrt should work there?

I would even say this is the only place where it works: at the u-boot prompt. wink

I will try it later this day. I would make my day smile

If it works then an update of the wiki page would be nice.

(Last edited by wvdakker on 31 Oct 2013, 09:07)

Hi,

SX76X => printenv
baudrate=115200
preboot=echo;echo Type "run flash_nfs" to mount root filesystem over NFS;echo
hwboardid=sx76x-08-32
bootstrap=1
console_dev=ttyS1
validate_images=on
keep_magic=on
netdev=eth0
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
ramdisk_addr=B0100000
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
bootfile=runtime.img
primary_boot_file=primary_boot.img
secondary_boot_file=secondary_boot.img
runtime_file=runtime.img
flashargs=setenv bootargs root=/dev/mtdblock1 rootfstype=squashfs
flash_flash=run flashargs addmisc; bootm $(kernel_addr)
update_primary=tftpboot 80400000 $(primary_boot_file);upgrade primary 80400000 $(filesize) 0
update_secondary=tftpboot 80400000 $(secondary_boot_file);upgrade secondary 80400000 $(filesize) 0
update_runtime=tftpboot 80400000 $(runtime_file);upgrade runtime 80400000 $(filesize) 0
reset_nvram=erase 0xB000E000 0xB000EBFF 1
addmisc=setenv bootargs $(bootargs) ethaddr=$(ethaddr) panic=1
tftp_RootDir=tftpboot
tftp_DeviceDir=porta_danube
tftp_Rootfspath=root
kernelfile=uImage
nfsargs=setenv bootargs root=/dev/nfs rw
add_nfsrootfs=setenv bootargs $(bootargs) nfsroot=/$(tftp_RootDir)/$(tftp_DeviceDir)/$(tftp_Rootfspath)
flash_nfs=run nfsargs add_nfsrootfs addip addmisc;bootm $(kernel_addr)
nfs_flash=tftp 0x80400000 $(kernelfile);run flashargs addip addmisc;bootm 0x80400000
nfs_nfs=tftp 0x80400000 $(kernelfile);run nfsargs add_nfsrootfs addip addmisc;bootm 0x80400000
primary_version=v4.1.24.52.12
silent=0
rnd_num=
hwid=Q705-M121
ethcnt=8
boardid=sx762
usbpower=1
options=1
customer=0
platform_type=2
variant=adsl
desc=LK027210325
ethaddr=98:8B:5D:F1:F4:D8
default_variant=adsl
stdin=serial
stdout=serial
stderr=serial
ipaddr=192.168.1.1
serverip=192.168.1.16
gatewayip=192.168.1.1
kernel_addr=0xB0020000
ram_addr=0x80100000
bootdelay=2
bootcmd=httpd
ethact=lq_cpe_eth
ver=U-Boot 2010.03 (Oct 17 2012 - 01:54:36)

I tried to get the image with the update-runtime command. I noticed I had an older version then Mijzelf had.
After sniffering the ethernet port I saw the arp requests from the router: who has 192.168.1.16 (server, which is my laptop).
My laptop answered with the MAC address. However  the router keeps arping and does not see the arp replies from my system.

4296    176.113574000    SagemCom_f1:f4:d8    Broadcast    ARP    60    Who has 192.168.1.16?  Tell 192.168.1.1
4297    176.113621000    HewlettP_87:be:f7    SagemCom_f1:f4:d8    ARP    42    192.168.1.16 is at 08:2e:5f:87:be:f7

If I ping the router in the meantime I get a normal ICMP reply.

What is wrong here. Is there a faulty version? Mijzelf can you give me a link to your version?

thx.

(Last edited by wvdakker on 31 Oct 2013, 19:14)

I downloaded the secondary bootloader and openwrt from the links in the wiki:
https://sx76x-openwrt-danube.googlecode … y_boot.img and http://sx76x-openwrt-danube.googlecode. … rts.image. After flashing the secondary bootloader, I uploaded openwrt using the Failsafe webserver. That worked fine, and I continued to replace the 1st bootloader.
That worked, but then I got in troubles.

I'm at the moment building a new image, with the changed flash partitions, as suggested by neryba.

But your secondary bootloader is not the same a I have.
You have the update_openwrt command. Your printenv settings are different.

Mine: ver=U-Boot 2010.03 (Oct 17 2012 - 01:54:36
Yours:  ver=U-Boot 2010.03-svn34185 (Nov 16 2012 - 07:35:05)

It looks like the TCP/IP stack is not working very well. On the other hand..... why
am I the first to notice that wink

I exchanged my primary bootloader.

And indeed it has a bad networking driver. I do not succeed in uploading something.

DANUBE => httpd
starting httpd server from server 192.168.0.1
http start
........request for file /
.............expecting 4718854 bytes
received data will be stored at 80500000
521 / 4718596
1681 / 4718596
2841 / 4718596
.4001 / 4718596
..5161 / 4718596
......................6321 / 4718596
7481 / 4718596
..............................................................................8641 / 4718596
......................................................................................................................................................................
10961 / 4718596

In wireshark I see a lot of retransmits, and the times in between gets longer and longer, and eventually times out.
So far I tried another cable, another port on the router, halfduplex, 10Mbit, smaller MTU. Nothing works.
Tftp has similar problems, and it seems this u-boot doesn't support serial upload.

Tomorrow I'll try a different host, if nobody has a better idea.

/edit: Does anybody know a way to retransmit quickly, and do it a lot of times, if no ack is received?

A strange thing is that the openwrt which is currently in the box, is uploaded using the failsafe server of the current u-boot. So it *has* worked.

(Last edited by Mijzelf on 31 Oct 2013, 22:49)

Only thing I can upload is the secondary bootloader. After clearing it with

//unprotect sectors
protect off 1:0-20

//first copy nvram to new address:
era 0xb0010000 0xb001ffff
cp.b 0xb000e000 0xb0010000 0x2000

The primary bootloader kicks in and I can upload a secondary bootloader without
any problems.
After a httpd start I also the request for file /, then expecting the file size (which is the actual size of the file I upload, so there is
communication).
So TFTP and HTTP doesnt work in de secondary bootloader I downloaded. Ping is going ok.

Searching the internet for the fileversion Mijzelf used ended up in a -uboot.bin file. But this looks like a primary bootloader and is 130kB in size.

(Last edited by wvdakker on 1 Nov 2013, 07:07)

? I gave the links to both bootloaders I used. Both are exactly 64kB.

Found the problem with the 'bad' TCP connection. It looks like the httpd server messed things up.

Stopping the boot proces before the httpd services start. Solved things.

After updating the primairy boot loader I ended up with a dead system:

ROM VER: 1.0.3
CFG 01
Read EEPROMX
 X

Holding the reset button and unplugging the power and reinserting it doesnt change anything.
Also the led from PORT1 is not on. The link stays down.
It look like the primary bootloader is not loaded well.

Any ideas to solve it? Or have I a dead-duck?

It's dead...

Only 2 ways: 1. jtag OR 2. external programmer (and de-soldering your flash).

wvdakker wrote:

Solved things.

What? How?

Any ideas to solve it?

According to the wiki you can short 4 solder islands, and upload a (provided) u-boot over serial.

I solved the TCP/IP problem by interrupting the autoboot proces before the httpd kicks in.

If I stop the autoboot proces.... tftpboot en tftp works ok and I can uplad firmware.
If I stop the autoboot proces, then start httpd and stop it.... tftpboot and tftp fails.

So my conclusion..... the httpd service is corrupting the tcp/ip stack.

Update:

After shorting the uboot-1 and uboot-2 islands as mentioned in the wiki I managed to get the router back.

ROM VER: 1.0.3
CFG 04
Read EEPROMX
 X
UART

/* upload the uboot.asc file */

U-Boot 2013.01 (Oct 31 2013 - 10:36:04) sx76x

Board: Gigaset sx76x
SoC:   Lantiq Danube-S v1.5
CPU:   111.111 MHz
IO:    111.111 MHz
BUS:   55.556 MHz
BOOT:  UART
DRAM:  32 MiB
Flash: 8 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ltq-eth
Hit any key to stop autoboot:  0 
GIGASX76X # setenv ipaddr 192.168.1.1
GIGASX76X # setenv serverip 192.168.1.16
GIGASX76X # setenv ethaddr 00:11:22:33:44:55
GIGASX76X # run addip
GIGASX76X # run addeth
GIGASX76X # printenv
addconsole=setenv bootargs $bootargs console=$consoledev,$baudrate
addeth=setenv bootargs $bootargs ethaddr=$ethaddr
addip=setenv bootargs $bootargs ip=$ipaddr:$serverip::::$netdev:off
addmachtype=setenv bootargs $bootargs machtype=GIGASX76X
baudrate=115200
bootargs=ip=192.168.1.1:::::eth0:off ethaddr=00:11:22:33:44:55
bootcmd=run addeth; bootm ${kernel_addr}
bootdelay=2
consoledev=ttyLTQ1
ethact=ltq-eth
ethaddr=00:11:22:33:44:55
ipaddr=192.168.1.1
kernel_addr=0xB0040000
load-uboot-nor=tftpboot u-boot.bin
load-uboot-norspl=tftpboot u-boot.ltq.norspl
load-uboot-norspl-lzma=tftpboot u-boot.ltq.lzma.norspl
load-uboot-norspl-lzo=tftpboot u-boot.ltq.lzo.norspl
loadaddr=0x81000000
netdev=eth0
serverip=192.168.1.16
stderr=serial
stdin=serial
stdout=serial
update-uboot-nor=run load-uboot-nor write-uboot-nor
write-uboot-nor=protect off 0xB0000000 +$filesize && erase 0xB0000000 +$filesize && cp.b $fileaddr 0xB0000000 $filesize

Environment size: 984/2044 bytest   
GIGASX76X # run update-uboot-nor            
Using ltq-eth device
TFTP from server 192.168.1.16; our IP address is 192.168.1.1
Filename 'u-boot.bin'.
Load address: 0x81000000
Loading: ###################################
         2.2 MiB/s
done
Bytes transferred = 178668 (2b9ec hex)
.......... done
Un-Protected 10 sectors

.......... done
Erased 10 sectors
Copy to Flash... 10....9....8....7....6....5....4....3....2....1....done

However, after booting the bootloader doesnt kick in and I am back in the

ROM VER: 1.0.3
CFG 01
Read EEPROMX
 X

It looks like the update-uboot-nor doesnt store the flash right.
Or am I missing something here?

Where does that u-boot-nor come from? Mine is only 64k. If you are interested, I have a backup of the original primary bootloader.

Mijzelf wrote:

Where does that u-boot-nor come from? Mine is only 64k. If you are interested, I have a backup of the original primary bootloader.

I have much progress. Router is alive again.

I downloaded the bootloader from http://downloads.openwrt.org/snapshots/ … x76x_nor/.

It boots ok.I can even ping from the CLI my laptop interface. Tftpboot is working ok.

ROM VER: 1.0.3
CFG 01
Read EEPROMX
 X


U-Boot 2013.01 (Oct 31 2013 - 10:35:47) sx76x

Board: Gigaset sx76x
SoC:   Lantiq Danube-S v1.5
CPU:   333.333 MHz
IO:    166.667 MHz
BUS:   83.333 MHz
BOOT:  NOR
DRAM:  32 MiB
Flash: 8 MiB
In:    serial
Out:   serial
Err:   serial
Net:   ltq-eth
Hit any key to stop autoboot:  0 
GIGASX76X # 
GIGASX76X # help
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
editenv - edit environment variable
env     - environment handling commands
erase   - erase FLASH memory
exit    - exit script
false   - do nothing, unsuccessfully
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print command description/usage
iminfo  - print header information for application image
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mdio    - MDIO utility commands
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
showvar - print local hushshell variables
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
version - print monitor, compiler and linker version
GIGASX76X # printenv
addconsole=setenv bootargs $bootargs console=$consoledev,$baudrate
addeth=setenv bootargs $bootargs ethaddr=$ethaddr
addip=setenv bootargs $bootargs ip=$ipaddr:$serverip::::$netdev:off
addmachtype=setenv bootargs $bootargs machtype=GIGASX76X
baudrate=115200
bootargs=ethaddr=00:11:22:33:44:55 ethaddr=00:11:22:33:44:55 ethaddr=00:11:22:33:44:55
bootcmd=run addeth; bootm ${kernel_addr}
bootdelay=2
consoledev=ttyLTQ1
ethact=ltq-eth
ethaddr=00:11:22:33:44:55
fileaddr=8040000
filesize=FFCF
ipaddr=192.168.1.1
kernel_addr=0xB0040000
load-uboot-nor=tftpboot u-boot.bin
load-uboot-norspl=tftpboot u-boot.ltq.norspl
load-uboot-norspl-lzma=tftpboot u-boot.ltq.lzma.norspl
load-uboot-norspl-lzo=tftpboot u-boot.ltq.lzo.norspl
loadaddr=0x81000000
netdev=eth0
serverip=192.168.1.16
stderr=serial
stdin=serial
stdout=serial
update-uboot-nor=run load-uboot-nor write-uboot-nor
write-uboot-nor=protect off 0xB0000000 +$filesize && erase 0xB0000000 +$filesize && cp.b $fileaddr 0xB0000000 $filesize

Environment size: 1041/8188 bytes

Question now is.... how can I get the other bootloaders into memory?

I sure need to upload the secondary_bootloader. I even think I miss the primary_bootloader.
I can tftpboot them. However at which memory address I must store them?

wvdakker wrote:

It looks like the update-uboot-nor doesnt store the flash right.
Or am I missing something here?

No, you are right.
Via U-Art you only upload the bootloader.asc to RAM.
On a reset you are back to were you were, unless you upload and flash a working u-boot-nor image.

If you have difficulties uploading an image over the network, you can upload via serial connection. Either build your own u-boot with sources from here, which has loadx. Or use ubootwrite.py.

wvdakker wrote:

Question now is.... how can I get the other bootloaders into memory?

I sure need to upload the secondary_bootloader. I even think I miss the primary_bootloader.
I can tftpboot them. However at which memory address I must store them?

You don't need a secondary bootloader. The only purpose of that secundary bootloader was to ensure only signed (by Siemens) firmware could be uploaded. Now you've got an open bootloader, which is capable to load openwrt directly.

This bootloader is 3*64kB in size, 64kB for the environment, means that openwrt should be flashed @4*64kB, which is 0x040000. Your environment shows a 'kernel_addr=0xB0040000', so I guess you'll have to store it there.

I guess you'll need an openwrt which is aware of that address. I had (and still have) a 64kB bootloader, while my flash mapping in the kernel had 192kB reserved for it. I think that is the reason my kernel can't find it's rootfs. It's searching at the wrong place in flash. It thinks it is flashed at 256kB, while it is at 128kB.

Mijzelf wrote:

This bootloader is 3*64kB in size, 64kB for the environment, means that openwrt should be flashed @4*64kB, which is 0x040000. Your environment shows a 'kernel_addr=0xB0040000', so I guess you'll have to store it there.

I guess you'll need an openwrt which is aware of that address. I had (and still have) a 64kB bootloader, while my flash mapping in the kernel had 192kB reserved for it. I think that is the reason my kernel can't find it's rootfs. It's searching at the wrong place in flash. It thinks it is flashed at 256kB, while it is at 128kB.

Ok. I understand.

I upload the kernel image http://downloads.openwrt.org/attitude_a … shfs.image and renamed it into runtime.img.

After entering:

tftpboot $loadaddr runtime.img
protect off 1:0-20
cp.b $loadaddr $kernel_addr $filesize

this worked whitout errors.

and starting it with

bootcmd

gave a wrong image message.

Close... but no sigar .... yet

(Last edited by wvdakker on 2 Nov 2013, 11:51)

Two thoughts:

1) In my logs I found this:

DANUBE => flinfo

Bank # 1: CFI conformant FLASH (16 x 16)  Size: 8 MB in 135 Sectors
  AMD Standard command set, Manufacturer ID: 0x01, Device ID: 0x227E
  Erase timeout: 16384 ms, write timeout: 2 ms
  Buffer write timeout: 5 ms, buffer size: 32 bytes

  Sector Start Addresses:
  B0000000        B0002000        B0004000        B0006000        B0008000      
  B000A000        B000C000        B000E000        B0010000   RO   B0020000      
  B0030000        B0040000        B0050000        B0060000        B0070000      
  B0080000        B0090000        B00A0000        B00B0000        B00C0000      
  B00D0000        B00E0000        B00F0000        B0100000        B0110000      
  B0120000        B0130000        B0140000        B0150000        B0160000      
  B0170000        B0180000        B0190000        B01A0000        B01B0000      
  B01C0000        B01D0000        B01E0000        B01F0000        B0200000      
  B0210000        B0220000        B0230000        B0240000        B0250000      
  B0260000        B0270000        B0280000        B0290000        B02A0000      
  B02B0000        B02C0000        B02D0000        B02E0000        B02F0000      
  B0300000        B0310000        B0320000        B0330000        B0340000      
  B0350000        B0360000        B0370000        B0380000        B0390000      
  B03A0000        B03B0000        B03C0000        B03D0000        B03E0000      
  B03F0000        B0400000        B0410000        B0420000        B0430000      
  B0440000        B0450000        B0460000        B0470000        B0480000      
  B0490000        B04A0000        B04B0000        B04C0000        B04D0000      
  B04E0000        B04F0000        B0500000        B0510000        B0520000      
  B0530000        B0540000        B0550000        B0560000        B0570000      
  B0580000        B0590000        B05A0000        B05B0000        B05C0000      
  B05D0000        B05E0000        B05F0000        B0600000        B0610000      
  B0620000        B0630000        B0640000        B0650000        B0660000      
  B0670000        B0680000        B0690000        B06A0000        B06B0000      
  B06C0000        B06D0000        B06E0000        B06F0000        B0700000      
  B0710000        B0720000        B0730000        B0740000        B0750000      
  B0760000        B0770000        B0780000        B0790000        B07A0000      
  B07B0000        B07C0000        B07D0000        B07E0000        B07F0000      

So the flash has 135 sectors. (With a different size, somehow) You unprotected the first 20 or 21 sectors,  which is not enough to flash the 3MB image. If unprotecting is necessary, you only flashed the first few kB's. On the other hand, there is an RO sign around 128kB, so maybe only the u-boot code is supposed to be protected. Which makes sense. 

2) According to my listing in the first post, update_openwrt is done this way:

tftp ${ram_addr} ${tftppath}openwrt-ifxmips-squashfs.image;era ${kernel_addr} +${filesize};cp.b ${ram_addr} ${kernel_addr} ${filesize}

I don't see that you erased the flash, before copying the image.

Got it working:

tftp firmware.img
Using ltq-eth device
TFTP from server 192.168.1.25; our IP address is 192.168.1.1
Filename 'firmware.img'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##############################################################
         1.4 MiB/s
done
Bytes transferred = 4718596 (480004 hex)
GIGASX76X # protect off $kernel_addr +$filesize
......................................................................... done
Un-Protected 73 sectors
GIGASX76X # erase $kernel_addr +$filesize

......................................................................... done
Erased 73 sectors
GIGASX76X # cp.b $fileaddr $kernel_addr $filesize
Copy to Flash... 10....9....8....7....6....5....4....3....2....1....done
GIGASX76X # reset<FD>
ROM VER: 1.0.3
CFG 01
Read EEPROMX
 X


U-Boot 2013.01 (Oct 26 2013 - 12:18:03) sx76x

Board: Gigaset sx76x
SoC:   Lantiq Danube-S v1.3
CPU:   333.333 MHz
IO:    166.667 MHz
BUS:   83.333 MHz
BOOT:  NOR
DRAM:  32 MiB
Flash: 8 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ltq-eth
Hit any key to stop autoboot:  0 
## Booting kernel from Legacy Image at b0040000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.17
   Created:      2013-11-02  14:40:01 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1219783 Bytes = 1.2 MiB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 3.10.17 (Mijzelf@ubuntu) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2013.05 r38539) ) #4 Sat Nov 2 14:39:16 UTC 2013
[    0.000000] SoC: Danube rev 1.3
<snip>