To use this ram redboot you need the serial console to send control+c. I need to build another redboot ram like the rom one to send control+c through button 1 while it loads to use it with telnet.

Thanks for the updated tutorial danitool.

what about sagem [1] livebox? Can it work under openwrt?

Firsts big thanks to danitool for the tutorial. I am recycling the Livebox 1.1 into something useful.
After spending some time trying to install opwenwrt on the livebox here goes my experience:

1- I went for the traditional openwrt flash partition using the rootfs_data so I can install packages. This only means skipping the step of running:

                   find ./trunk/package/base-files/ -type f -exec sed -i 's/rootfs_data/jffs_system/g' {} \;

        UPDATE: make sure (as mentioned in the previous posts) you add "-N big" in the cramfs image creation script: mkfs.cramfs -N big $TARGET openwrt.cramfs

  All the rest of steps for compiling openwrt remain the same as in the tutorial

2-  The 640K original partition was to small so I repartitioned the flash to get more space for the rootfs_data partition. The flash has a total size of 8MB. I reduced the size of the user_fs by 1 MB (now "fis list" shows the length of user_fs as 0x00620000 instead of the original 0x00720000) and increased the rootfs_data by 1MB (now "fis list" shows the length of rootfs_data as 0x001A0000 instead of the original 0x000A0000). This will leave you with a bit more of 5MB on user_fs (so openwrt.cramfs needs to be maximum 5MB) and leaves you 1.6MB on rootfs_data so you can install quite a few packages (I installed updatedd, openvpn, webif, ...).

       The commands to do the repartitioning in Redboot are:

       fis delete user_fs
       fis delete rootfs_data (or "fis delete jffs_system"  if you are using the original jffs_system partition)

       fis create user_fs -b 0x80800000 -l 0x00620000 -e 0x80800000
       fis create rootfs_data -b 0xBEA50000 -l 0x001A0000 -e 0x80545FB0

       Now to erase the rootfs_data partition you have to use this command:

       fis erase -f 0xBEA50000 -l 0x001A0000

       You can use the steps on danitool tutorial to flash openwrt again

3- I compiled openwrt kamikaze r24946 dated beginning of January. And the wifi did not work with the wireless file supplied in the tutorial.
    I though that the problem was the old firmware used for the wifi adapter dated on 2007. But it seems it is ok although is quite old...
       But I made the wifi work like this:

            - I edited with "vi" the file /etc/config/wireless (the wireless file inside the Livebox) and I deleted all the lines until it was empty

            - I run the command "wifi detect". This will output a basic configuration for the /etc/config/wireless. I copied this output and add it to the file /etc/config/wireless

            - Make to comment out (# in front of ) the line "option disabled 1" on /etc/config/wireless to enable the radio on the wifi

            - I run the command "wifi" and that command made the magic for me! It created the proper interfaces on openwrt (as seen by executing ifconfig and iwconfig)

            - The default configuration that "wifi detect" gave for me was an Access Point configuration with no authentication.
              I have verified with a mobile phone that I can see the network but I have not connected to it since I am not much interested on wifi at this point

I have not yet measured the livebox transfer speeds (danitool) but l can install packages with opkg with no problems.I will report when I do.
The variation I made on the kernel configuration (make kernel_menuconfig) was that I selected a desktop type of kernel instead of a server kernel.

I would suggest to update the tutorial to use rootfs_data and modify the flash partition system according to something similar to my point 2) so there is enough room to install a fair amount of packages to make the livebox useful.

Thanks again for the tutorial!

(Last edited by kubuntenado on 21 Jan 2011, 11:22)

Well, finally i did some profiling on the board, these are some results after running wget which consumes 100% CPU and a low transfer rate. BTW I don't have any skills to analyze them.

root@OpenWrt:/mnt# opreport
CPU: CPU with timer interrupt, speed 0 MHz (estimated)
Profiling through timer interrupt
          TIMER:0|
  samples|      %|
------------------
    27539 79.0828 vmlinux
     2743  7.8770 nf_conntrack
      816  2.3433 wget-nossl
      637  1.8293 ip_tables
      620  1.7804 nf_conntrack_ipv4
      504  1.4473 oprofiled
      445  1.2779 libuClibc-0.9.31.so
      401  1.1515 iptable_nat
      206  0.5916 busybox
      181  0.5198 iptable_mangle
      177  0.5083 nf_nat
      157  0.4509 oprofile
      110  0.3159 ld-uClibc-0.9.31.so
       98  0.2814 mac80211
       64  0.1838 b43
       51  0.1465 nf_defrag_ipv4
       24  0.0689 iptable_filter
       24  0.0689 libgcc_s.so.1
       22  0.0632 iptable_raw
        2  0.0057 cfg80211
        1  0.0029 fat
        1  0.0029 libpopt.so.0.0.0

http://files.myopera.com/danitool/liveb … file00.txt

(Last edited by danitool on 19 Jan 2011, 23:51)

More stuff. I've built another ram and rom redboot loader

http://files.myopera.com/danitool/liveb … tRAMBL.img
The RAM version, once loaded you can telnet it without pressing any button. This is for flashing the rom redboot. Do not use it to flash directly to the redboot partition!

http://files.myopera.com/danitool/liveb … lnet02.rom
The ROM version, it is able to read both little and BIG endian cramfs partitions. This makes things easier when you want back to original inventel's firmwares. Use the redboot ram version to flash it.

http://files.myopera.com/danitool/liveb … -uk.cramfs
The inventel's firmware version 5.06.2-uk. Added a telnet server, and without the root password.

enjoy

(Last edited by danitool on 31 Jan 2011, 22:43)

I solved the performance issue. The problem was dcache and icache not enabled by redboot, then it must enabled by the linux kernel itself at early start. Please delete the old patch and download this new one:

http://files.myopera.com/danitool/liveb … ebox.patch

Worked on home hub too, thanks danitool.

(Last edited by routednbooted on 8 Feb 2011, 07:15)

hi

how do i restore original inventel's firmware using redboot

RedBoot> fis list
Name              FLASH addr    Mem addr      Length           Entry point
RedBoot           0xBE400000  0xBE400000   0x00030000  0x00000000
vmlinux.bin.l7    0xBE430000  0x80041000   0x004FF000  0x80041000
FIS directory     0xBEBF0000  0xBEBF0000   0x0000F000  0x00000000
RedBoot config    0xBEBFF000  0xBEBFF000  0x00001000  0x00000000
RedBoot>

MadWolf2010, use this commands at Redboot prompt and flash the inventel cramfs image
http://files.myopera.com/danitool/liveb … -uk.cramfs

fis init
fis create -f 0xBE430000 -r 0xBE430000 -l 0x00720000 -n user_fs
fis create -f 0xBEB50000 -r 0xBEB50000 -l 0x000A0000 -n jffs_system
load -v -r -b 0x80800000 livebox_firmware_5.06.2-uk.cramfs
fis create -b 0x80800000 user_fs

(Last edited by danitool on 18 Feb 2011, 12:05)

hi i run the commands

RedBoot> fis init
About to initialize [format] FLASH image system - continue (y/n)? y*** Initializ
e FLASH Image System
... Erase from 0xbebf0000-0xbec00000: .
... Program from 0x80ff0000-0x81000000 at 0xbebf0000: .
RedBoot> fis create -f 0xBE430000 -r 0xBE430000 -l 0x00720000 -n user_fs
script : 0x80fe303d
Adresse de base utilisee : 1
... Erase from 0xbebf0000-0xbec00000: .
... Program from 0x80ff0000-0x81000000 at 0xbebf0000: .
RedBoot> fis create -f 0xBEB50000 -r 0xBEB50000 -l 0x000A0000 -n jffs_system
script : 0x80fe303d
Adresse de base utilisee : 1
... Erase from 0xbebf0000-0xbec00000: .
... Program from 0x80ff0000-0x81000000 at 0xbebf0000: .
RedBoot> load -v -r -b 0x80800000 livebox_firmware_5.06.2-uk.cramfs
Using default protocol (TFTP)
-
Raw file loaded 0x80800000-0x80d1bfff, assumed entry at 0x80800000
---- VERSION SANS SECURITE ---- AUCUN TEST N'EST EFFECTUE ----
close
RedBoot> fis create -b 0x80800000 user_fsscript : 0x80fe303d
Adresse de base utilisee : 80800000
An image named 'user_fs' exists - continue (y/n)? y
... Erase from 0xbe430000-0xbeb50000: ..........................................
........................................................................
... Program from 0x80800000-0x80f20000 at 0xbe430000: ..........................
................................................................................
........
... Erase from 0xbebf0000-0xbec00000: .
... Program from 0x80ff0000-0x81000000 at 0xbebf0000: .
RedBoot>

the when i enter the comand reset the 3rd lite the arrow lite lites up

check your boot script

fconfig boot_script true
fconfig boot_script_data
fis load -b 0x80010000 -m cramfs -f Image user_fs
exec -c "boot_loader=RedBoot root=1F01 mem=16M" 0x80010000

(Last edited by danitool on 19 Feb 2011, 00:41)

RedBoot> fconfig boot_script true
boot_script: Setting to true
RedBoot> fconfig boot_script_data
boot_script_data:
Enter script, terminate with empty line
>>

what do i enter

>>fis load -b 0x80010000 -m cramfs -f Image user_fs
>>exec -c "boot_loader=RedBoot root=1F01 mem=16M" 0x80010000
>>

the last line is an empty line

Hi, is there is any plan to developp a livebox pro (aka dv4410) openwrt firmware ?

I've tried to flash the one that you provided (dv4210) and openwrt doesn't boot.

Hi danitool, you have made good development.!!! Good job.

At this moment i need some help.
Four months ago i have bricked my livebox (i made some trivial mistakes).
I have a jtag but i can't enter processor in debug mode. Andyp, at his version of tjtag software says "we must pull down some signals" but did not specify.
Any info would be apreciated.

I never used jtag. The BT homehub is almost identical to livebox, and the psidoc guys use the redboot from livebox for installing openwrt. Perhaps you can use their method to recover your redboot, btw the flash chip isn't the same ( diferent adresses i think).

http://www.psidoc.com/showthread.php/9- … 5-via-JTAG

t3l3m4k0, The hub has a problem when the flash doesn't have a valid boot program, i think the chip crashes/locks up if it reaches a bad instruction before any sort of handler has loaded. You need to erase the first instruction/sector of flash By catching the processor as it powers up but before executing the first instruction or before it reaches the instruction that causes it to lock up. Theres two approaches i have used.

1, This worked for the hub V1.5 that has a hard reset. Set the jtag program to erase, (dont hit enter just enter the command) then poke the reset button while hitting go. You might have to try a few times to get it in sync. As long as you manage to erase the bad data from the first sector, the chip should enter debug mode after resetting.

2, This i had to do for the V1 that has a soft reset. Place a switch between the power supply and your device. Set the jtag program to erase, (dont hit enter just enter the command) and try to hit go on the jtag program at the same time as flicking the power on. Again, you might have to try a few times to get it in sync and as long as you manage to erase the bad data from the first sector, the chip should enter debug mode after resetting.

Problem with the jtag debrick program it tests for a cpu and bails out if it cant detect one. If you can program and somehow modify the debricker to keep sending the needed instructions in a very fast loop until it gets the reply to say cpu has entered debug mode and halted. Basically try to catch the cpu before it starts execution. I suppose that could work.

Good luck.

Thanks for yours comments, i will try this week and update if there are good news.

i used several times jtag interface with a Comtrend 536 (also bcm6348 SOC), and never have this troubles.

Thanks.

I've made another howto.
https://forum.openwrt.org/viewtopic.php?id=29101
Differences are:
1. The firmware now is splitted in two files: a gz compressed kernel, and a squasfsh compressed root filesystem
2. We need three partitions for this images: kernel, user_fs, and rootfs_data
3. The boot script is different

fis load -b 0x80010000 -d kernel
exec -c "noinitrd mem=16M" 0x80010000

Thus we don't need to touch kernel hacking when preparing the kernel to compile.
4. No need to use a cramfs filesystem.
5. For flashing images I've made a script which copies the images and returns the Redboot commands needed to fit them perfectly in the flash chip.
wrtparts.sh

#!/bin/bash

OPENWRT=trunk
cp -v $OPENWRT/bin/brcm63xx/openwrt-livebox-vmlinux.gz openwrt-kernel.gz
cp -v $OPENWRT/bin/brcm63xx/openwrt-brcm63xx-root.squashfs openwrt-root.squashfs

kernlength=`ls -l openwrt-kernel.gz |awk '{printf("%x\n",$5)}'`
rootfladdr=`printf '%x\n' $[0xBE430000+0x00$kernlength]`
rootlength=`ls -l openwrt-root.squashfs |awk '{printf("%x\n",$5)}'`
rfdataaddr=`printf '%x\n' $[0x$rootfladdr+0x00$rootlength]`
rfdataleng=`printf '%x\n' $[0xBEBF0000-0x00$rfdataaddr]`

echo "##################################################################"
echo "telnet 10.7.58.112 9000"
echo
echo "REDBOOT COMMANDS"
echo
echo "fis init"
echo
echo "load -v -r -b 0x80800000 openwrt-kernel.gz"
echo "fis create -f 0xBE430000 -r 0xBE430000 -l 0x00$kernlength -e 0x80010000 kernel"
echo
echo "load -v -r -b 0x80800000 openwrt-root.squashfs"
echo "fis create -f 0x$rootfladdr -r 0x$rootfladdr -l 0x00$rootlength -b 0x80800000 user_fs"
echo
echo "fis create -f 0x$rfdataaddr -r 0x$rfdataaddr -l 0x00$rfdataleng -n rootfs_data"
echo "fis erase -f 0x$rfdataaddr -l 0x00$rfdataleng"
echo
echo "##################################################################"
echo

6. Now we have a lot of space available, and opkg will work

(Last edited by danitool on 23 Mar 2011, 15:23)

Nice job, why didn't you put this into the Wiki? http://wiki.openwrt.org/toh/inventel/dv4210

You RedBoot patches are especially nice. You could drop the source code here:  http://wiki.openwrt.org/doc/techref/boo … le.patches

(Last edited by Orca on 31 Mar 2011, 17:44)

@ Danitool:  Hi! Great job. I see you were using a Sony-Ericson cable as a serial. I have one too and is wondering how to modify/connect it??
I even made a case (see thread: https://forum.openwrt.org/viewtopic.php?id=29056 ) about it, but no one answered. Can you help?

EDIT:  Thanks!!! More cable info on link above. 

(Last edited by PopOpen on 1 Apr 2011, 00:05)

Good job! How did you do it?

You're awesome !
This is working with DV 4210-WA
Thank for "How to" & img precompiled
Now my old router walk free.

Best regards

you are our hero! I already installed a couple of DV4210 via ethernet cable.
Using tftpd-hpa I had to specify ip address and route to Redboot, otherwise it would'n load the precompiled files:

Redboot > ip_addr -l 10.7.58.112
Redboot > ip_addr -h 10.7.58.114