Differences

This shows you the differences between two versions of the page.

toh:inventel:dv4210 [2013/01/04 23:09]
danitool 64MB RAM mod
toh:inventel:dv4210 [2014/03/20 19:04] (current)
danitool
Line 125: Line 125:
==== Flash Layout ==== ==== Flash Layout ====
-First let's have a quick view at the Flash Layout with the stock firmware and after OpenWrt has been installed. +  * OEM firmware versions < 5.06.2 (cramfs partitions)<code>
-<code>+
RedBoot> fis list RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point Name              FLASH addr  Mem addr    Length      Entry point
Line 136: Line 135:
FIS directory    0xBEBF0000  0xBEBF0000  0x0000F000  0x00000000 FIS directory    0xBEBF0000  0xBEBF0000  0x0000F000  0x00000000
RedBoot config    0xBEBFF000  0xBEBFF000  0x00001000  0x00000000</code> RedBoot config    0xBEBFF000  0xBEBFF000  0x00001000  0x00000000</code>
-But for versions > 5.06.2 (squashfs partitions)<code>+  * OEM firmware versions > 5.06.2 (squashfs partitions)<code>
Name              FLASH addr  Mem addr    Length      Entry point Name              FLASH addr  Mem addr    Length      Entry point
RedBoot          0xBE400000  0xBE400000  0x00030000  0x00000000 RedBoot          0xBE400000  0xBE400000  0x00030000  0x00000000
Line 146: Line 145:
FIS directory    0xBEBF0000  0xBEBF0000  0x0000F000  0x00000000 FIS directory    0xBEBF0000  0xBEBF0000  0x0000F000  0x00000000
RedBoot config    0xBEBFF000  0xBEBFF000  0x00001000  0x00000000</code> RedBoot config    0xBEBFF000  0xBEBFF000  0x00001000  0x00000000</code>
-For flashing Openwrt we can use this more appropriate flash layout. The size of partitions depends on the size of the images we will flash. +  * OpenWrt firmware, the size of partitions depends on the size of the images we will flash.<code>
-<code>+
RedBoot> fis list                                                                                                                          RedBoot> fis list                                                                                                                         
Name              FLASH addr  Mem addr    Length      Entry point                                                                          Name              FLASH addr  Mem addr    Length      Entry point                                                                         
Line 159: Line 157:
RedBoot config    0xBEBFF000  0xBEBFF000  0x00001000  0x00000000  RedBoot config    0xBEBFF000  0xBEBFF000  0x00001000  0x00000000 
</code> </code>
- When you later want to understand, what the programs ''mtd'' and ''sysupgrade'' do, have a second look here: 
-  * cf. -> [[/toh/tp-link/tl-wr1043nd#flash.layout]] or [[doc:techref:Flash Layout]] 
-  * Obtain the data: ''cat /proc/mtd'', ''dmesg'', ''df -h'', ''df'', ''mount'' 
-=== Flash device in physical memory map === + 
-The flash chip is mapped physically into the CPU's memory with this addresses and size: +===== Basic configuration ===== 
-<code+-> [[doc:howto:basic.config|Basic configuration]] After flashing, proceed with this.\\ 
-(0x1e400000) Physical start address of flash mapping    +Set up your Internet connection, configure wireless, configure USB port, etc. 
-(0xbfc00000) Physical start address of the lowest 4MBytes + 
-(0xbe400000) Physical start address of the highest 4MBytes  + 
-(0x800000) Physical length of flash mapping  +===== Specific Configuration ===== 
-</code+==== Interfaces ==== 
-=== Flash-chip info === +The default network configuration is
-NOR 56/48-Pin Standard TSOP+^ Interface Name ^ Description ^ Default configuration ^ 
 +| br-lan | LAN & WiFi | 192.168.1.1/24 |  
 +| eth0 | WAN | dhcp |  
 +| eth1 | LAN | bridged |  
 +| wlan0 | WiFi | disabled |  
 + 
 +==== Failsafe mode ==== 
 +-> [[doc:howto:generic.failsafe]] 
 + 
 +==== Buttons ==== 
 +-> [[doc:howto:hardware.button]] on howto use and configure the hardware button(s). 
 + 
 +The Livebox has 2 buttons. They are ASSOCIATION BUTTON and PAGE BUTTON. There are no associated events to these buttons in Openwrt by default, you can customize it. 
 +^ BUTTON ^ onboard name ^ OEM name ^ Openwrt name ^ GPIO ^ SoC pin ^ action ^ 
 +| Button 1 | S2 |ASSOCIATION_BUTTON | BTN_1 | 36 | W25 | not configured | 
 +| Button 2 | S1 |PAGE_BUTTON | BTN_2 | 7 | AD5 | not configured | 
 +| not soldered | S3 | n/a | n/a | n/a | G26 |System Reset | 
 + 
 +==== Leds ==== 
 + 
 +The Livebox has 5 leds. Adsl-fail is used as default for indicating the router is on. 
 +^ Led ^^  onboard name  ^  GPIO  ^  default trigger  ^  
 +| <color red>⚠</color> | adsl-fail |  DS1  |  0  | "default-on" | 
 +| <color red>@</color> | adsl |  DS2  |  1  | --- | 
 +| <color red>➤➤</color> |traffic |  DS3  |  2  | --- | 
 +| <color red>✆</color> | phone |  DS4  |  3  | --- | 
 +| <color red><nowiki>(())</nowiki></color> | wifi |  DS5  |  4  | --- | 
 +| not soldered ||  DS6  |  5  | --- | 
 +| not soldered ||  DS7  |  6  | conected to the eth1 phy, then always high | 
 + 
 +Read: \\ [[doc:uci:system#leds|System configuration: Leds]] \\ to configure the leds 
 + 
 + 
 +**leds and gpio6 detail** 
 + 
 +{{:toh:inventel:livebox_leds.jpg?200|}} 
 +{{:toh:inventel:livebox_gpio6.jpg?200|}} 
 + 
 +===== Hardware ===== 
 +==== Info ==== 
 +| **[[wp>Instruction set|Instruction set]]:**   | [[wp>MIPS architecture|MIPS]] || 
 +| **Vendor:**          | [[wp>Broadcom]] || 
 +| **[[doc:techref:Bootloader]]:**    | [[doc:techref:bootloader:RedBoot]] || 
 +| **[[doc:hardware:soc|System-On-Chip]]:**  | Broadcom BCM6348 || 
 +| **[[doc:hardware:cpu|CPU]]/Speed**        | BMIPS3300 V0.7 / 256 MHz || 
 +| **Flash-Chip:**      | Spansion S29GL064A11TFIR4  (Bottom Boot Sector Addresses) || 
 +| **Flash size:**      | 8192 KiB || 
 +| **RAM:**            | Hynix HY57V281620FTP-H / 16 MiB / 133 MHz \\ Samsung K4S281632I-UC75 / 16 MiB / 133 MHz \\ ISSI IS42S16800A-7T / 16 MiB / 143 MHz | DV4210 WS \\ DV4210 WA \\ DV4410 | 
 +| **Wireless:**        | Broadcom 4318 802.11b/g (mini-pci) \\ PCMCIA | DV4210 \\ DV3210| 
 +| **Ethernet:**        | 1 internal phy + 1 external phy Altima ac101L \\ 1 internal phy + [[http://wiki.openwrt.org/_media/toh/bcm5325_pinout.png|BCM5325]] | DV4210, DV3210 \\ DV4410 | 
 +| **Internet:**        | ADSL2+  || 
 +| **USB:**            | 1x 1.1 host + 1 slave (udc) || 
 +| **FXS:**            | slic STLC3055N || 
 +| **Digital Signal Processor:** | Texas Instruments TMS320VC5402 | DV3210, DV4410| 
 +| **Bluetooth:**      | bb4g-t10 (NXP PCD80715HL) module connected via SPI || 
 +| **[[doc:hardware:port.serial|Serial]]:**          | [[#Serial|Yes]] || 
 +| **[[doc:hardware:port.jtag|JTAG]]:**            | [[#JTAG|Yes]]  || 
 + 
 +==== Photos ==== 
 +^ Photo of front of the casing, and opening the case  ^^^^ 
 +| {{:toh:inventel:livebox_case.jpg?100x80|}} | {{:toh:inventel:livebox_case2.jpg?100x80|}} | {{:toh:inventel:livebox_caseopen.jpg?100x80|}} | {{:toh:inventel:livebox_caseopen2.jpg?100x80|}} | 
 + 
 +^^ Photo of PCB  ^^^ 
 +| **DV4210** | **DV4410** | **DV3210** | 
 +| {{:toh:inventel:board_dv4210.jpeg?200x150|}} | {{:toh:inventel:dv4410_board.jpg?200x150|}} | {{:toh:inventel:board_dv3210.jpg?200x150|}} | 
 + 
 + 
 +==== Thermal Balls ==== 
 + 
 +| {{:toh:inventel:livebox1_thermal_balls.jpg?200x200|}} | {{:doc:hardware:soc:bcm6348_kpbg_pinout.png?200x200|}} | These are the thermal balls at the board, the  bcm6348 SoC has been removed. You can guess how the SoC is wired at the board tracing pins and comparing it with the available bcm6348 pinout. | 
 + 
 +==== Serial ==== 
 +-> [[doc:hardware:port.serial]]  
 + 
 +| {{:toh:inventel:livebox_serial.jpg?200|}} |The livebox has an external accesible serial port TTL. It is a DEC MMJ connector. \\ You can build a serial TTL adapter, or use those cheap USB adapters for cellphones. Using a TTL USB serial converter is easier, it only uses TX, RX and GND. | 
 + 
 +|{{:toh:inventel:rj45-mmj.jpg?100|rj45 mmj mod}} | Sometimes maybe difficult to find the DEC MMJ connector. We can carefully modify a RJ45 ethernet one to fit it perfectly in the serial port| 
 + 
 + 
 + 
 +==== Flash-chip ==== 
 +(NOR 56/48-Pin Standard TSOP)
<code>Query identification string: <code>Query identification string:
        Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set)         Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set)
Line 218: Line 294:
        Top/Bottom Sector Flag: Bottom boot device         Top/Bottom Sector Flag: Bottom boot device
</code> </code>
 +
 +=== Flash device in physical memory map ===
 +BCM6348 SoCs allow only to load a bootloader from the fixed address 0x1FC00000. This restricts the max size of the flash memory to be 4 MB, unless the bootloader makes some trick to allow bigger sizes, like our redboot does:
 +  * The bootloader is first loaded from the physical address 0x1FC00000 (the middle of the flash where the bootloader really lives), and then the bootloader itself remaps whole flash to see the 8MB. The problem is that once remapped the bottom sectors are seen as if they were in the middle of the flash.\\ {{:media:toh:thomson:livebox1-flash_remapping.png?300|}}
 +
 +
 +==== JTAG ====
 +-> [[doc:hardware:port.jtag]] general information about the JTAG port, JTAG cable, etc.
 +
 +To use a simple unbuffered cable we only need to connect **TDI**, **TDO**, **TMS** and **TCK**. We also may connect the nTRST pin if we need it.
 +| {{:meta:icons:tango:dialog-information.png|}} | The **nTRST** and **nSRST** (system reset) are bridged, as a result of this the functionallity of this pin is just acting as a regular system reset. Of course we can separate  these pins cutting physically the bridge, but for sure you won't need to do it unless you are experimenting with your JTAG, or if you have a serious brick and you want to use the nTRST functionallity to make a proper TAP reset before flashig | {{:toh:inventel:ntrst_nsrst-bridge.jpg?200x110|}}|
 +This is the pinout of the 30 pin connector and JTAG testpoints:
 +\\
 +{{:toh:inventel:livebox_jtag-30pin3.jpg?500|JTAG-30pin}}
 +\\
 +**Photo of PCB with markings**
 +
 +Use a debrick utility to backup the original firmware, or debrick the device (broken bootloader):
 +\\
 +[[https://docs.google.com/leaf?id=0B07LcVZMfvdkZTc1MDA5MjUtZTMzYy00OGQzLWE5MjAtODFiN2RkMTJmNDQ5&sort=name&layout=list&num=50|An updated version of debrick on Google Docs]]
 +
 +=== Backup the entire flash ===
 +Plug the power cord, wait 4 seconds and enter the command:
 +<code>nice ./debrick -backup:custom /window:1e400000 /start:1e400000 /length:800000 /silent /notimestamp</code>
 +If we want to extract partitions we need to reverse endianess:
 +<code>cat CUSTOM.BIN | ./switchend > backup_livebox.bin</code>
 +Now for extracting, first we cut the binary accordingly to the flash layout (versions > 5.06.2)
 +<code>dd if=backup_livebox.bin count=196608  bs=1 skip=0      of=mtd0-Redboot.rom
 +dd if=backup_livebox.bin count=3735552 bs=1 skip=196608  of=mtd1-user_fs.squashfs
 +dd if=backup_livebox.bin count=3735552 bs=1 skip=3932160 of=mtd2-user_2_fs.squashfs
 +dd if=backup_livebox.bin count=655360  bs=1 skip=7667712 of=mtd3-jffs_system.jffs2
 +dd if=backup_livebox.bin count=61440  bs=1 skip=8323072 of=mtd4-FIS_directory
 +dd if=backup_livebox.bin count=4096    bs=1 skip=8384512 of=mtd5-Redboot.config</code>
 +Extract squash filesystems:
 +<code>sudo unsquashfs -i -d user_fs  mtd1-user_fs.squashfs
 +sudo unsquashfs -i -d user_2_fs mtd2-user_2_fs.squashfs</code>
 +Mount the jffs2 filesystem
 +<code>modprobe mtdram total_size=16384
 +modprobe mtdblock
 +modprobe jffs2
 +jffs2dump -b -c -e jffs_system.jffs2 mtd3-jffs_system.jffs2
 +dd if=jffs_system.jffs2 of=/dev/mtdblock0
 +mount /dev/mtdblock0 mount/ -t jffs2</code>
 +
 +
 +=== Debrick ===
 +[[doc:howto:generic.debrick]]
 +
 +Debrick the device flashing the redboot:
 +\\
 +If your redboot is broken, you can put a new working redboot via JTAG.
 +First you'll need to do byte reordering with an utility. Use **redim** (darkfader tool):
 +<code>./redim *,2,-2 -i redboot.rom -o CUSTOM.BIN</code>
 +The utility and CUSTOM.BIN already reordered:
 +\\
 +http://files.myopera.com/danitool/livebox/redboot03_jtag.zip
 +
 +Now, plug the power and enter the comand:
 +<code>rmmod lp
 +nice ./debrick -flash:custom /window:1fc00000 /start:1fc00000 /length:30000 /silent /nodma
 +</code>
 +If the JTAG utility stops with the message:
 +\\
 +//<color crimson><nowiki>Halting Processor ... <Procesor did NOT enter Debug Mode!></nowiki> </color>//
 +\\
 +and nothing else happens, then **you'll need to deal with System Reset (bridged to nTRST)** pin to perform a fast reset before flashing. Also in the BIOS of your PC, you may need to set Parallel Port into ECP, EPP or "Bi-Directional" mode. Read on: [[wp>IEEE_1284#IEEE_1284_modes|IEEE 1284 modes]].
 +
 +Debricking with this method is tested and working fine. This is a successful session of restoring the redboot via JTAG:
 +<HTML>
 +<p style="margin-left: 40px;margin-right: 40px;padding: 10px;border:1px solid grey;height:300px;font:10px/13px Georgia, Garamond, Serif;overflow:Auto;background-color:#FFFFFF">
 +<code>[root@tool hairydebrick]# nice ./debrick -flash:custom /window:1fc00000 /start:1fc00000 /length:30000 /silent /nodma
 +
 +====================================
 +WRT54G/GS EJTAG Debrick Utility v4.8
 +====================================
 +
 +Probing bus ... Done
 +
 +Instruction Length set to 5
 +
 +CPU Chip ID: 00000110001101001000000101111111 (0634817F)
 +*** Found a Broadcom BCM6348 Rev 1 CPU chip ***
 +
 +    - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
 +    - EJTAG Version ....... : 1 or 2.0
 +    - EJTAG DMA Support ... : Yes
 +    *** DMA Mode Forced Off ***
 +
 +Issuing Processor / Peripheral Reset ... Done
 +Enabling Memory Writes ... Done
 +Halting Processor ... <Processor Entered Debug Mode!> ... Done
 +Clearing Watchdog ... Done
 +
 +Probing Flash at (Flash Window: 0x1fc00000) ... Done
 +
 +Flash Vendor ID: 00000000000000000000000000000001 (00000001)
 +Flash Device ID: 00000000000000000010001000000000 (00002200)
 +*** Found a AMD 29lv320MB 2Mx16 BotB  (4MB) Flash Chip ***
 +
 +    - Flash Chip Window Start .... : 1fc00000
 +    - Flash Chip Window Length ... : 00400000
 +    - Selected Area Start ........ : 1fc00000
 +    - Selected Area Length ....... : 00030000
 +
 +*** You Selected to Flash the CUSTOM.BIN ***
 +
 +=========================
 +Flashing Routine Started
 +=========================
 +Total Blocks to Erase: 10
 +
 +Erasing block: 1 (addr = 1fc00000)...Done
 +Erasing block: 2 (addr = 1fc02000)...Done
 +Erasing block: 3 (addr = 1fc04000)...Done
 +Erasing block: 4 (addr = 1fc06000)...Done
 +Erasing block: 5 (addr = 1fc08000)...Done
 +Erasing block: 6 (addr = 1fc0a000)...Done
 +Erasing block: 7 (addr = 1fc0c000)...Done
 +Erasing block: 8 (addr = 1fc0e000)...Done
 +Erasing block: 9 (addr = 1fc10000)...Done
 +Erasing block: 10 (addr = 1fc20000)...Done
 +
 +Loading CUSTOM.BIN to Flash Memory...
 +Done  (CUSTOM.BIN loaded into Flash Memory OK)
 +
 +=========================
 +Flashing Routine Complete
 +=========================
 +elapsed time: 4319 seconds
 +
 +
 + *** REQUESTED OPERATION IS COMPLETE ***
 +
 +[root@tool hairydebrick]#
 +</code>
 +</p>
 +</HTML>
 +
 +==== GPIOs ====
 +There are 37 GPIOs, probably some of them are unused, these seems to be the pretended use of each one, this may depend of the board version (ie: some boards have pccard, or DSP).
 +^ GPIO ^ direction ^ hardware function ^
 +| GPIO_00 ............. GPIO_05 | OUT | led |
 +| GPIO_06  | OUT | AC101L_RESET# **and** led_DS7 **and** DSP_RST_N|
 +| GPIO_07  | IN  | button 2 |
 +| GPIO_08, ............., GPIO_15 | IN | MII  BLK |
 +| GPIO_16, ............., GPIO_27 | IN | PCI  PCCARD BLK|
 +| GPIO_28 | OUT | BT_DECT_RST |
 +| GPIO_29 | IN | BCM5325_SPI_SS# |
 +| GPIO_30 | - | NC |
 +| GPIO_31 | IN | DECT_SPI_SS# |
 +| GPIO_32 | IN | BCM5325_MDC **or** AC101L_MDC |
 +| GPIO_33 | IN | BT_INT |
 +| GPIO_34 | IN | DECT_INT |
 +| GPIO_35 | IN | DSP_INT2# |
 +| GPIO_36 | IN | button 1 |
 +
 +==== SPI ====
 +**[[wp>Serial_Peripheral_Interface_Bus|Serial Peripheral Interface]]**
 +| Conected to a bluetooth device bb4g-t10 (no information available) \\ If we remove the paper over the bluetooth IC we can see the exact part number: \\ **NXP PCD80715HL** - (//VEGA THUNDERBIRD BASEBAND// IC family bought by [[http://www.dspg.com|DSPG]]) | {{:toh:inventel:livebox_spi_ribbon.jpg?150x100|}}  {{:toh:inventel:livebox_bluetooth.jpg?150x100|}} |
 +
 +
 +| {{:toh:inventel:livebox_spi_pinout2.jpg?150x100|}} | This is the SPI pinout, and some gpios. Note a second twin unsoldered connector, it also has SPI (pads 6, 7, 8, bridged to the bluetooth connector). |
 +| {{:toh:inventel:livebox_spi_testpoints.jpg?150x100|SPI testpoints}} | The SPI pins are also located here at these testpoints. |
 +
 +==== USB ====
 +The livebox has two USBs, they work at full speed using the OHCI module:
 +|{{:toh:inventel:usb_host_sch.png?150x100|}} | One is a host usb 1.1. In the pic you can see the schematic. |
 +
 +| {{:meta:icons:tango:dialog-information.png|}} |There is a known problem with hotplugging, everytime you plug a device in the usb, the board restarts itself. This maybe caused by a faulty hardware design. We can solve it soldering another electrolytic capacitor in parallel with the 10uF one. Use a 470 uF one (see pic) | {{ :toh:inventel:usb_capacitor.jpg?150x100|}} |
 +
 +| {{:toh:inventel:usb_slave_sch.png?150x100|}} | The second USB port is slave. In OpenWrt this port is totally useless, in fact the preliminary support for UDC has been dropped. You can mod this port to convert it to a **host port** (see [[#USB Mod]]), as a result of this you will have **two** working usb host ports in your board. |
 +
 +==== DSP ====
 +[[wp>Digital_signal_processor|Digital Signal Processor]]
 +| {{:toh:inventel:livebox_dsp.jpg?150x100|GPIOs DSP}} | Some liveboxes boards have a TMS320VC5402 Digital Signal Processor like in the DV4410 or DV3210. \\ In the pic you can see relevant GPIOs used by the DSP when present. \\ BTW, it seems there aren't in any case drivers for DSPs FIXME |
 +
 +==== PCMCIA ====
 +
 +{{:toh:inventel:pcmcia_dv3210_a.jpg?150x100|}}  {{:toh:inventel:pcmcia_dv3210_b.jpg?150x100|}}  {{:toh:inventel:pcmcia_dv3210_c.jpg?150x100|}}
 +
 +
 +
 +===== Bootloader Mods =====
 +-> you could read about [[doc:techref:bootloader]] in general
 +
 +| {{:meta:icons:tango:package-x-generic.png|}} | There are several Redboot mods for this board, even those redboots can work with other boards. The redboot sourcecode and the patch used to build **redboot**: \\ [[https://files.myopera.com/danitool/linux/bootloaders/redboot-blue5g.tar.gz|redboot-blue5g.tar.gz]] |
 +
 +==== Redboot RAM ====
 +
 +For flashing a new Redboot with Redboot we need a RAM redboot version \\
 +http://files.myopera.com/danitool/livebox/redbootRAMBL.img
 +
 +First gain access Redboot through the serial console. \\
 +Or if you already are using a modded Redboot with telnet enabled just use the ethernet cable (yellow port). Use the button1, press while powering on, wait 5 seconds and release the button:
 +
 +<code>telnet 10.7.58.112 9000</code>
 +
 +put the redbootRAMBL.img into your tftp server. And then:
 +
 +<code>RedBoot> load -v redbootRAMBL.img
 +...
 +RedBoot> go
 +... </code>
 +Open another terminal console and telnet it again
 +<code>telnet 10.7.58.112 9000</code>
 +
 +be sure you are now using the RAM version:
 +
 +<code>RedBoot> version
 +RedBoot(tm) bootstrap and debug environment [RAM]
 +</code>
 +And now flash the new redboot
 +
 +<code>RedBoot>load -v -r -b 0x80800000 newredboot.rom
 +....
 +RedBoot>fis create RedBoot -r 0xBE400000 -e 0x00000000
 +......</code>
 +
 +==== flashcp for flashing a new bootloader ====
 +We can also install a new bootloader from inside Openwrt. With the OEM inventel firmware fcp can write the bootloader image to the mtd0 partition. And with Openwrt firmware we can use **flashcp** (fcp is the old flashcp name).
 +<code>opkg update
 +opkg install mtd-utils-flashcp
 +</code>
 +Now proceed with flashing:
 +<code>
 +root@OpenWrt:/# cd /tmp
 +root@OpenWrt:/# wget ftp://ourlocalserver/newbootloader.rom
 +....
 +root@OpenWrt:/# flashcp -v newbootloader.rom /dev/mtd0
 +.....
 +</code>
 +
 +==== CFE ====
 +There exists a fully featured CFE for the livebox. The **board ID**s are //blue5g9// (DV4210) and //blue5g6.3// (livebox pro V1). However not (yet) supported officially by Openwrt. It maybe more comfortable for most users since CFE has a web server for updating firmwares.
 +| {{:meta:icons:tango:package-x-generic.png|}} | Here the links for the CFE binary, prebuilt firmwares and the patch for **Backfire** \\ [[https://files.myopera.com/danitool/linux/bootloaders/CFE_blue5g9-nvr.zip|CFE_blue5g9-nvr.zip]] \\ [[https://files.myopera.com/danitool/livebox/livebox1_backfire_firmwares-CFE.zip|livebox1_backfire_firmwares-CFE.zip]] |
 +
 +The cfe from the [[http://support.netcommwireless.com/product/fixed-line/nb6plus4w|NB6Plus4W Rev1]] router also works with this board. But it divides the flash chip in two banks, only 4 MiB will be available with this CFE, and the button 1 won't work to use it for stopping CFE and loading firmwares through its web interface. Don't use this bootloader.
 +[[http://files.myopera.com/danitool/linux/bootloaders/NB6Plus4W_Rev1_CFE.rom|NB6Plus4W_Rev1_CFE.rom]]
 +
 +===== Hardware mods =====
 +-> as a beginner, you really should inform yourself about [[doc:hardware:soldering]] in general and then obtain some practical experience!
 +
 +==== 64MiB RAM Mod ====
 +| {{:toh:inventel:livebox_ram.jpeg?150x100|}} |The RAM and the flash chip are located under the minipci. For this mod you'll need two RAM chips 32 MiB each one. Note this board uses SDR, and each chip is 16bit bus width. Check datasheets before choosing a suitable RAM chip. |
 +| {{:toh:inventel:livebox1-64mb_ram-mod.jpg?150x100|}} | Both chips should be identical. And you'll need a custom bootloader to recognize 64 MB, 2 chips (32 bit bus width). Here the custom **Redboot/CFE** for this and other RAM sizes/confirgurations\\ [[https://files.myopera.com/danitool/linux/bootloaders/CFE_blue5g9-nvr.zip|CFE_blue5g9-nvr.zip]]\\ [[https://files.myopera.com/danitool/linux/bootloaders/REDBOOT_blue5g.zip|REDBOOT_blue5g.zip]] |
 +
 + ==== USB Mod ====
 +You can convert your usb slave port to host. See details in the pics:
 +| {{:toh:inventel:usb_slave-host_mod_sch.png?150|}} | The mod is very simple, but to isolate the **USB1_PWRFLT** (AD12) is very difficult since you must cut two layers of copper, making a deep ditch. Don't try to isolate the pin (and thus this mod) if you don't know what are you doing. \\ The 470uF electrolytic capacitor is optional but highly recommendable to avoid problems with hotplugging. The capacitors at the D+ D- lines are already present in the board, thus you won't need to solder them. |
 +| {{:toh:inventel:slave-host_mod.jpg?150x100|}} |  {{:toh:inventel:slave-host_mod1.jpg?150x100|}}  {{:toh:inventel:slave-host_mod2.jpg?150x100|}}  {{:toh:inventel:slave-host_mod3.jpg?150x100|}}  {{:toh:inventel:slave-host_mod4.jpg?150x100|}} ||
 +
 +Now for making it work we need to patch the kernel. This is the patch for Backfire:
 +<code diff>--- a/drivers/usb/host/ohci-bcm63xx.c
 ++++ b/drivers/usb/host/ohci-bcm63xx.c
 +@@ -24,7 +24,6 @@
 +          * port 2 can be shared with USB slave, but all boards seem to
 +          * have only one host port populated, so we can hardcode it
 +          */
 +- ohci->num_ports = 1;
 +
 + ret = ohci_init(ohci);
 + if (ret < 0)
 +@@ -80,7 +79,7 @@
 +
 + clk_enable(clk);
 + usb_host_clock = clk;
 +- bcm_rset_writel(RSET_OHCI_PRIV, 0, OHCI_PRIV_REG);
 ++ bcm_rset_writel(RSET_OHCI_PRIV, 1, OHCI_PRIV_REG);
 +
 + } else if (BCMCPU_IS_6358()) {
 + reg = bcm_rset_readl(RSET_USBH_PRIV, USBH_PRIV_SWAP_REG);
 +</code>
 +Build Openwrt with this patch and flash the new firmware, or just replace your ohci-hcd.ko module with the new one in the router. This is a log from dmesg with both USBs working as hosts:
 +<HTML>
 +<p style="margin-left: 1%;margin-right: 25%;padding: 10px;border:1px solid grey;height:300px;font:10px/13px Georgia, Garamond, Serif;overflow:Auto;background-color:#FFFFFF">
 +<code>....
 +....
 +NET: Registered protocol family 24
 +
 +nf_conntrack version 0.5.0 (213 buckets, 852 max)
 +
 +ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
 +bcm63xx_ohci
 +bcm63xx_ohci.0: BCM63XX integrated OHCI controller
 +bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered, assigned bus number 1
 +bcm63xx_ohci bcm63xx_ohci.0: irq 20, io mem 0xfffe1b00
 +usb usb1: configuration #1 chosen from 1 choice
 +hub 1-0:1.0: USB hub found
 +hub 1-0:1.0: 2 ports detected
 +
 +Initializing USB Mass Storage driver...
 +usbcore: registered
 +new interface driver usb-storage
 +USB Mass Storage support registered.
 +
 +usb 1-1: new full speed USB device using bcm63xx_ohci and address 2
 +
 +usb 1-1: configuration #1 chosen from 1 choice
 +scsi0 : SCSI emulation for USB Mass Storage devices
 +
 +scsi 0:0:0:0: CD-ROM            Vodafone CD ROM (Huawei)  2.31 PQ: 0 ANSI: 2
 +
 +usb 1-2: new full speed USB device using bcm63xx_ohci and address 3
 +
 +usb 1-2: configuration #1 chosen from 1 choice
 +scsi1 : SCSI emulation for USB Mass Storage devices
 +
 +scsi 1:0:0:0: Direct-Access    M-Sys    Dell Memory Key  4.60 PQ: 0 ANSI: 0 CCS
 +sd 1:0:0:0: [sda] 239872 512-byte logical blocks: (122 MB/117 MiB)
 +sd 1:0:0:0: [sda] Write Protect is off
 +sd 1:0:0:0: [sda] Assuming drive cache: write through
 +sd 1:0:0:0: [sda] Assuming drive cache: write through
 + sda: sda1
 +sd 1:0:0:0: [sda] Assuming drive cache: write through
 +sd 1:0:0:0: [sda] Attached SCSI removable disk
 +</code>
 +</p>
 +</HTML>
 +
 +===== Firmware mods =====
 +  * Wireless router with a [[:doc:recipes:3gdongle|3g-dongle]] (**12.09**, without luci):\\ [[https://files.myopera.com/danitool/livebox/OpenWrt_AA-usb_3g-brcm_wl_mini.zip|OpenWrt_AA-usb_3g-brcm_wl_mini.zip]]
 +
===== Bootlogs ===== ===== Bootlogs =====
==== OEM bootlog ==== ==== OEM bootlog ====
Line 1391: Line 1789:
- 
-===== Basic configuration ===== 
--> [[doc:howto:basic.config|Basic configuration]] After flashing, proceed with this.\\ 
-Set up your Internet connection, configure wireless, configure USB port, etc. 
- 
- 
-===== Specific Configuration ===== 
-==== Interfaces ==== 
-The default network configuration is: 
-^ Interface Name ^ Description ^ Default configuration ^ 
-| br-lan | LAN & WiFi | 192.168.1.1/24 |  
-| eth0 | WAN | dhcp |  
-| eth1 | LAN | bridged |  
-| wlan0 | WiFi | disabled |  
- 
-==== Failsafe mode ==== 
--> [[doc:howto:generic.failsafe]] 
- 
-==== Buttons ==== 
--> [[doc:howto:hardware.button]] on howto use and configure the hardware button(s). 
- 
-The Livebox has 2 buttons. They are ASSOCIATION BUTTON and PAGE BUTTON. There are no associated events to these buttons in Openwrt by default, you can customize it. 
-^ BUTTON ^ onboard name ^ OEM name ^ Openwrt name ^ GPIO ^ SoC pin ^ action ^ 
-| Button 1 | S2 |ASSOCIATION_BUTTON | BTN_1 | 36 | W25 | not configured | 
-| Button 2 | S1 |PAGE_BUTTON | BTN_2 | 7 | AD5 | not configured | 
-| not soldered | S3 | n/a | n/a | n/a | G26 |System Reset | 
- 
-==== Leds ==== 
- 
-The Livebox has 5 leds. Adsl-fail is used as default for indicating the router is on. 
-^ Led ^^  onboard name  ^  GPIO  ^  default trigger  ^  
-| <color red>⚠</color> | adsl-fail |  DS1  |  0  | "default-on" | 
-| <color red>@</color> | adsl |  DS2  |  1  | --- | 
-| <color red>➤➤</color> |traffic |  DS3  |  2  | --- | 
-| <color red>✆</color> | phone |  DS4  |  3  | --- | 
-| <color red><nowiki>((⚲))</nowiki></color> | wifi |  DS5  |  4  | --- | 
-| not soldered ||  DS6  |  5  | --- | 
-| not soldered ||  DS7  |  6  | conected to the eth1 phy, then always high | 
- 
-Read: \\ [[doc:uci:system#leds|System configuration: Leds]] \\ to configure the leds 
- 
- 
-**leds and gpio6 detail** 
- 
-{{:toh:inventel:livebox_leds.jpg?200|}} 
-{{:toh:inventel:livebox_gpio6.jpg?200|}} 
- 
-===== Hardware ===== 
-==== Info ==== 
-| **[[wp>Instruction set|Architecture]]:**    | [[wp>MIPS architecture|MIPS]] || 
-| **Vendor:**          | [[wp>Broadcom]] || 
-| **[[doc:techref:Bootloader]]:**    | [[doc:techref:bootloader:RedBoot]] || 
-| **[[doc:hardware:soc|System-On-Chip]]:**  | bcm6348 || 
-| **[[doc:hardware:cpu|CPU]]/Speed**        | BMIPS3300 V0.7 / 256 MHz || 
-| **Flash-Chip:**      | Spansion S29GL064A11TFIR4  (Bottom Boot Sector Addresses) || 
-| **Flash size:**      | 8192 KiB || 
-| **RAM:**            | Hynix HY57V281620FTP-H / 16 MiB / 133 MHz \\ Samsung K4S281632I-UC75 / 16 MiB / 133 MHz \\ ISSI IS42S16800A-7T / 16 MiB / 143 MHz | DV4210 WS \\ DV4210 WA \\ DV4410 | 
-| **Wireless:**        | Broadcom 4318 802.11b/g (mini-pci) \\ PCMCIA | DV4210 \\ DV3210| 
-| **Ethernet:**        | 1 internal phy + 1 external phy Altima ac101L \\ 1 internal phy + [[http://wiki.openwrt.org/_media/toh/bcm5325_pinout.png|BCM5325]] | DV4210, DV3210 \\ DV4410 | 
-| **Internet:**        | ADSL2+  || 
-| **USB:**            | 1x 1.1 host + 1 slave (udc) || 
-| **FXS:**            | slic STLC3055N || 
-| **Digital Signal Processor:** | Texas Instruments TMS320VC5402 | DV3210, DV4410| 
-| **Bluetooth:**      | bb4g-t10 (NXP PCD80715HL) module connected via SPI || 
-| **[[doc:hardware:port.serial|Serial]]:**          | [[#Serial|Yes]] || 
-| **[[doc:hardware:port.jtag|JTAG]]:**            | [[#JTAG|Yes]]  || 
- 
-==== Photos ==== 
-^ Photo of front of the casing, and opening the case  ^^^^ 
-| {{:toh:inventel:livebox_case.jpg?100x80|}} | {{:toh:inventel:livebox_case2.jpg?100x80|}} | {{:toh:inventel:livebox_caseopen.jpg?100x80|}} | {{:toh:inventel:livebox_caseopen2.jpg?100x80|}} | 
- 
-^^ Photo of PCB  ^^^ 
-| **DV4210** | **DV4410** | **DV3210** | 
-| {{:toh:inventel:board_dv4210.jpeg?200x150|}} | {{:toh:inventel:dv4410_board.jpg?200x150|}} | {{:toh:inventel:board_dv3210.jpg?200x150|}} | 
- 
- 
-==== Thermal Balls ==== 
- 
-| {{:toh:inventel:livebox1_thermal_balls.jpg?200x200|}} | {{:doc:hardware:soc:bcm6348_kpbg_pinout.png?200x200|}} | These are the thermal balls at the board, the  bcm6348 SoC has been removed. You can guess how the SoC is wired at the board tracing pins and comparing it with the available bcm6348 pinout. | 
- 
-==== Serial ==== 
--> [[doc:hardware:port.serial]]  
- 
-| {{:toh:inventel:livebox_serial.jpg?200|}} |The livebox has an external accesible serial port TTL. It is a DEC MMJ connector. \\ You can build a serial TTL adapter, or use those cheap USB adapters for cellphones. Using a TTL USB serial converter is easier, it only uses TX, RX and GND. | 
- 
-|{{:toh:inventel:rj45-mmj.jpg?100|rj45 mmj mod}} | Sometimes maybe difficult to find the DEC MMJ connector. We can carefully modify a RJ45 ethernet one to fit it perfectly in the serial port| 
- 
-==== JTAG ==== 
--> [[doc:hardware:port.jtag]] general information about the JTAG port, JTAG cable, etc. 
- 
-To use a simple unbuffered cable we only need to connect **TDI**, **TDO**, **TMS** and **TCK**. We also may connect the nTRST pin if we need it. 
-| {{:meta:icons:tango:dialog-information.png|}} | The **nTRST** and **nSRST** (system reset) are bridged, as a result of this the functionallity of this pin is just acting as a regular system reset. Of course we can separate  these pins cutting physically the bridge, but for sure you won't need to do it unless you are experimenting with your JTAG, or if you have a serious brick and you want to use the nTRST functionallity to make a proper TAP reset before flashig | {{:toh:inventel:ntrst_nsrst-bridge.jpg?200x110|}}|  
-This is the pinout of the 30 pin connector and JTAG testpoints: 
-\\ 
-{{:toh:inventel:livebox_jtag-30pin3.jpg?500|JTAG-30pin}} 
-\\ 
-**Photo of PCB with markings** 
- 
-Use a debrick utility to backup the original firmware, or debrick the device (broken bootloader):  
-\\ 
-[[https://docs.google.com/leaf?id=0B07LcVZMfvdkZTc1MDA5MjUtZTMzYy00OGQzLWE5MjAtODFiN2RkMTJmNDQ5&sort=name&layout=list&num=50|An updated version of debrick on Google Docs]] 
- 
-=== Backup the entire flash === 
-Plug the power cord, wait 4 seconds and enter the command: 
-<code>nice ./debrick -backup:custom /window:1e400000 /start:1e400000 /length:800000 /silent /notimestamp</code> 
-If we want to extract partitions we need to reverse endianess: 
-<code>cat CUSTOM.BIN | ./switchend > backup_livebox.bin</code> 
-Now for extracting, first we cut the binary accordingly to the flash layout (versions > 5.06.2) 
-<code>dd if=backup_livebox.bin count=196608  bs=1 skip=0      of=mtd0-Redboot.rom 
-dd if=backup_livebox.bin count=3735552 bs=1 skip=196608  of=mtd1-user_fs.squashfs 
-dd if=backup_livebox.bin count=3735552 bs=1 skip=3932160 of=mtd2-user_2_fs.squashfs 
-dd if=backup_livebox.bin count=655360  bs=1 skip=7667712 of=mtd3-jffs_system.jffs2 
-dd if=backup_livebox.bin count=61440  bs=1 skip=8323072 of=mtd4-FIS_directory 
-dd if=backup_livebox.bin count=4096    bs=1 skip=8384512 of=mtd5-Redboot.config</code> 
-Extract squash filesystems: 
-<code>sudo unsquashfs -i -d user_fs  mtd1-user_fs.squashfs 
-sudo unsquashfs -i -d user_2_fs mtd2-user_2_fs.squashfs</code> 
-Mount the jffs2 filesystem 
-<code>modprobe mtdram total_size=16384  
-modprobe mtdblock  
-modprobe jffs2  
-jffs2dump -b -c -e jffs_system.jffs2 mtd3-jffs_system.jffs2 
-dd if=jffs_system.jffs2 of=/dev/mtdblock0 
-mount /dev/mtdblock0 mount/ -t jffs2</code> 
- 
- 
-=== Debrick === 
-[[doc:howto:generic.debrick]] 
- 
-Debrick the device flashing the redboot: 
-\\ 
-If your redboot is broken, you can put a new working redboot via JTAG. 
-First you'll need to do byte reordering with an utility. Use **redim** (darkfader tool): 
-<code>./redim *,2,-2 -i redboot.rom -o CUSTOM.BIN</code> 
-The utility and CUSTOM.BIN already reordered: 
-\\ 
-http://files.myopera.com/danitool/livebox/redboot03_jtag.zip 
- 
-Now, plug the power and enter the comand: 
-<code>rmmod lp 
-nice ./debrick -flash:custom /window:1fc00000 /start:1fc00000 /length:30000 /silent /nodma 
-</code> 
-If the JTAG utility stops with the message:  
-\\ 
-//<color crimson><nowiki>Halting Processor ... <Procesor did NOT enter Debug Mode!></nowiki> </color>// 
-\\ 
-and nothing else happens, then **you'll need to deal with System Reset (bridged to nTRST)** pin to perform a fast reset before flashing. Also in the BIOS of your PC, you may need to set Parallel Port into ECP, EPP or "Bi-Directional" mode. Read on: [[wp>IEEE_1284#IEEE_1284_modes|IEEE 1284 modes]]. 
- 
-Debricking with this method is tested and working fine. This is a successful session of restoring the redboot via JTAG: 
-<HTML> 
-<p style="margin-left: 40px;margin-right: 40px;padding: 10px;border:1px solid grey;height:300px;font:10px/13px Georgia, Garamond, Serif;overflow:Auto;background-color:#FFFFFF"> 
-<code>[root@tool hairydebrick]# nice ./debrick -flash:custom /window:1fc00000 /start:1fc00000 /length:30000 /silent /nodma 
- 
-==================================== 
-WRT54G/GS EJTAG Debrick Utility v4.8 
-==================================== 
- 
-Probing bus ... Done 
- 
-Instruction Length set to 5 
- 
-CPU Chip ID: 00000110001101001000000101111111 (0634817F) 
-*** Found a Broadcom BCM6348 Rev 1 CPU chip *** 
- 
-    - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904) 
-    - EJTAG Version ....... : 1 or 2.0 
-    - EJTAG DMA Support ... : Yes 
-    *** DMA Mode Forced Off *** 
- 
-Issuing Processor / Peripheral Reset ... Done 
-Enabling Memory Writes ... Done 
-Halting Processor ... <Processor Entered Debug Mode!> ... Done 
-Clearing Watchdog ... Done 
- 
-Probing Flash at (Flash Window: 0x1fc00000) ... Done 
- 
-Flash Vendor ID: 00000000000000000000000000000001 (00000001) 
-Flash Device ID: 00000000000000000010001000000000 (00002200) 
-*** Found a AMD 29lv320MB 2Mx16 BotB  (4MB) Flash Chip *** 
- 
-    - Flash Chip Window Start .... : 1fc00000 
-    - Flash Chip Window Length ... : 00400000 
-    - Selected Area Start ........ : 1fc00000 
-    - Selected Area Length ....... : 00030000 
- 
-*** You Selected to Flash the CUSTOM.BIN *** 
- 
-========================= 
-Flashing Routine Started 
-=========================  
-Total Blocks to Erase: 10 
- 
-Erasing block: 1 (addr = 1fc00000)...Done 
-Erasing block: 2 (addr = 1fc02000)...Done 
-Erasing block: 3 (addr = 1fc04000)...Done 
-Erasing block: 4 (addr = 1fc06000)...Done 
-Erasing block: 5 (addr = 1fc08000)...Done 
-Erasing block: 6 (addr = 1fc0a000)...Done 
-Erasing block: 7 (addr = 1fc0c000)...Done 
-Erasing block: 8 (addr = 1fc0e000)...Done 
-Erasing block: 9 (addr = 1fc10000)...Done 
-Erasing block: 10 (addr = 1fc20000)...Done 
- 
-Loading CUSTOM.BIN to Flash Memory... 
-Done  (CUSTOM.BIN loaded into Flash Memory OK) 
- 
-========================= 
-Flashing Routine Complete 
-========================= 
-elapsed time: 4319 seconds 
- 
- 
- *** REQUESTED OPERATION IS COMPLETE *** 
- 
-[root@tool hairydebrick]#  
-</code> 
-</p> 
-</HTML> 
- 
-==== GPIOs ==== 
-There are 37 GPIOs, probably some of them are unused, these seems to be the pretended use of each one, this may depend of the board version (ie: some boards have pccard, or DSP).  
-^ GPIO ^ direction ^ hardware function ^ 
-| GPIO_00 ............. GPIO_05 | OUT | led | 
-| GPIO_06  | OUT | AC101L_RESET# **and** led_DS7 **and** DSP_RST_N| 
-| GPIO_07  | IN  | button 2 | 
-| GPIO_08, ............., GPIO_15 | IN | MII  BLK | 
-| GPIO_16, ............., GPIO_27 | IN | PCI  PCCARD BLK| 
-| GPIO_28 | OUT | BT_DECT_RST | 
-| GPIO_29 | IN | BCM5325_SPI_SS# | 
-| GPIO_30 | - | NC | 
-| GPIO_31 | IN | DECT_SPI_SS# | 
-| GPIO_32 | IN | BCM5325_MDC **or** AC101L_MDC | 
-| GPIO_33 | IN | BT_INT | 
-| GPIO_34 | IN | DECT_INT | 
-| GPIO_35 | IN | DSP_INT2# | 
-| GPIO_36 | IN | button 1 |  
- 
-==== SPI ==== 
-**[[wp>Serial_Peripheral_Interface_Bus|Serial Peripheral Interface]]**  
-| Conected to a bluetooth device bb4g-t10 (no information available) \\ If we remove the paper over the bluetooth IC we can see the exact part number: \\ **NXP PCD80715HL** - (//VEGA THUNDERBIRD BASEBAND// IC family bought by [[http://www.dspg.com|DSPG]]) | {{:toh:inventel:livebox_spi_ribbon.jpg?150x100|}}  {{:toh:inventel:livebox_bluetooth.jpg?150x100|}} | 
- 
- 
-| {{:toh:inventel:livebox_spi_pinout2.jpg?150x100|}} | This is the SPI pinout, and some gpios. Note a second twin unsoldered connector, it also has SPI (pads 6, 7, 8, bridged to the bluetooth connector). | 
-| {{:toh:inventel:livebox_spi_testpoints.jpg?150x100|SPI testpoints}} | The SPI pins are also located here at these testpoints. | 
- 
-==== USB ==== 
-The livebox has two USBs, they work at full speed using the OHCI module: 
-|{{:toh:inventel:usb_host_sch.png?150x100|}} | One is a host usb 1.1. In the pic you can see the schematic. | 
- 
-| {{:meta:icons:tango:dialog-information.png|}} |There is a known problem with hotplugging, everytime you plug a device in the usb, the board restarts itself. This maybe caused by a faulty hardware design. We can solve it soldering another electrolytic capacitor in parallel with the 10uF one. Use a 470 uF one (see pic) | {{ :toh:inventel:usb_capacitor.jpg?150x100|}} | 
- 
-| {{:toh:inventel:usb_slave_sch.png?150x100|}} | The second USB port is slave. In OpenWrt this port is totally useless, in fact the preliminary support for UDC has been dropped. You can mod this port to convert it to a **host port** (see [[#USB Mod]]), as a result of this you will have **two** working usb host ports in your board. | 
- 
-==== DSP ==== 
-[[wp>Digital_signal_processor|Digital Signal Processor]] 
-| {{:toh:inventel:livebox_dsp.jpg?150x100|GPIOs DSP}} | Some liveboxes boards have a TMS320VC5402 Digital Signal Processor like in the DV4410 or DV3210. \\ In the pic you can see relevant GPIOs used by the DSP when present. \\ BTW, it seems there aren't in any case drivers for DSPs FIXME | 
- 
-==== PCMCIA ==== 
- 
-{{:toh:inventel:pcmcia_dv3210_a.jpg?150x100|}}  {{:toh:inventel:pcmcia_dv3210_b.jpg?150x100|}}  {{:toh:inventel:pcmcia_dv3210_c.jpg?150x100|}} 
- 
- 
- 
-===== Bootloader Mods ===== 
-  - you could read about [[doc:techref:bootloader]] in general 
- 
-| {{:meta:icons:tango:package-x-generic.png|}} | There are several Redboot mods for this board, even those redboots can work with other boards. The redboot sourcecode and the patch used to build **redbootelnet04**: \\ [[http://files.myopera.com/danitool/livebox/redboot-blue5g.tar.gz|redboot-blue5g.tar.gz]] | 
- 
-==== Redboot RAM ==== 
- 
-For flashing a new Redboot with Redboot we need a RAM redboot version \\ 
-http://files.myopera.com/danitool/livebox/redbootRAMBL.img 
- 
-First gain access Redboot through the serial console. \\ 
-Or if you already are using a modded Redboot with telnet enabled just use the ethernet cable (yellow port). Use the button1, press while powering on, wait 5 seconds and release the button: 
- 
-<code>telnet 10.7.58.112 9000</code> 
- 
-put the redbootRAMBL.img into your tftp server. And then: 
- 
-<code>RedBoot> load -v redbootRAMBL.img 
-... 
-RedBoot> go 
-... </code> 
-Open another terminal console and telnet it again 
-<code>telnet 10.7.58.112 9000</code> 
- 
-be sure you are now using the RAM version: 
- 
-<code>RedBoot> version 
-RedBoot(tm) bootstrap and debug environment [RAM] 
-</code> 
-And now flash the new redboot 
- 
-<code>RedBoot>load -v -r -b 0x80800000 newredboot.rom 
-.... 
-RedBoot>fis create RedBoot -r 0xBE400000 -e 0x00000000 
-......</code> 
- 
-==== flashcp for flashing a new redboot ==== 
-We can also install a new redboot from inside Openwrt. With the OEM inventel firmware fcp can write the redboot image to the mtd0 partition. And with Openwrt firmware we can use **flashcp** (fcp is the old flashcp name). 
-<code>opkg update 
-opkg install mtd-utils-flashcp 
-</code> 
-Now proceed with flashing: 
-<code> 
-root@OpenWrt:/# cd /tmp 
-root@OpenWrt:/# wget ftp://ourlocalserver/newredboot.rom 
-.... 
-root@OpenWrt:/# flashcp -v newredboot.rom /dev/mtd0 
-..... 
-</code> 
- 
-==== CFE ==== 
-The cfe from the [[http://support.netcommwireless.com/product/fixed-line/nb6plus4w|NB6Plus4W Rev1]] router works with this board. But it divides the flash chip in two banks, only 4 MiB will be available with this CFE, and the button 1 won't work to use it for stopping CFE and loading firmwares through its web interface. A serial TTL adapter is mandatory for managing this CFE. And once flashed probably a JTAG is needed to back to Redboot again. 
- 
-[[http://files.myopera.com/danitool/linux/bootloaders/NB6Plus4W_Rev1_CFE.rom|NB6Plus4W_Rev1_CFE.rom]] 
- 
-===== Hardware mods ===== 
-  - as a beginner, you really should inform yourself about [[doc:hardware:soldering]] in general and then obtain some practical experience! 
- 
-==== 64MiB RAM Mod ==== 
-| {{:toh:inventel:livebox_ram.jpeg?150x100|}} |The RAM and the flash chip are located under the minipci. For this mod you'll need two RAM chips 32 MiB each one. Note this board uses SDR, and each chip is 16bit bus width. Check datasheets before choosing a suitable RAM chip. | 
-| {{:toh:inventel:livebox1-64mb_ram-mod.jpg?150x100|}} | Both chips should be identical. And you'll need a custom bootloader to recognize 64 MB, 2 chips (32 bit bus width). Here the custom CFE for this and other RAM sizes/confirgurations\\ [[https://files.myopera.com/danitool/linux/bootloaders/CFE_blue5g9-nvr.zip|CFE_blue5g9-nvr.zip]] | 
- 
- ==== USB Mod ==== 
-You can convert your usb slave port to host. See details in the pics: 
-| {{:toh:inventel:usb_slave-host_mod_sch.png?150|}} | The mod is very simple, but to isolate the **USB1_PWRFLT** (AD12) is very difficult since you must cut two layers of copper, making a deep ditch. Don't try to isolate the pin (and thus this mod) if you don't know what are you doing. \\ The 470uF electrolytic capacitor is optional but highly recommendable to avoid problems with hotplugging. The capacitors at the D+ D- lines are already present in the board, thus you won't need to solder them. | 
-| {{:toh:inventel:slave-host_mod.jpg?150x100|}} |  {{:toh:inventel:slave-host_mod1.jpg?150x100|}}  {{:toh:inventel:slave-host_mod2.jpg?150x100|}}  {{:toh:inventel:slave-host_mod3.jpg?150x100|}}  {{:toh:inventel:slave-host_mod4.jpg?150x100|}} || 
- 
-Now for making it work we need to patch the kernel. This is the patch for Backfire: 
-<code diff>--- a/drivers/usb/host/ohci-bcm63xx.c 
-+++ b/drivers/usb/host/ohci-bcm63xx.c 
-@@ -24,7 +24,6 @@ 
-          * port 2 can be shared with USB slave, but all boards seem to 
-          * have only one host port populated, so we can hardcode it 
-          */ 
-- ohci->num_ports = 1; 
-  
- ret = ohci_init(ohci); 
- if (ret < 0) 
-@@ -80,7 +79,7 @@ 
-  
- clk_enable(clk); 
- usb_host_clock = clk; 
-- bcm_rset_writel(RSET_OHCI_PRIV, 0, OHCI_PRIV_REG); 
-+ bcm_rset_writel(RSET_OHCI_PRIV, 1, OHCI_PRIV_REG); 
-  
- } else if (BCMCPU_IS_6358()) { 
- reg = bcm_rset_readl(RSET_USBH_PRIV, USBH_PRIV_SWAP_REG); 
-</code> 
-Build Openwrt with this patch and flash the new firmware, or just replace your ohci-hcd.ko module with the new one in the router. This is a log from dmesg with both USBs working as hosts: 
-<HTML> 
-<p style="margin-left: 1%;margin-right: 25%;padding: 10px;border:1px solid grey;height:300px;font:10px/13px Georgia, Garamond, Serif;overflow:Auto;background-color:#FFFFFF"> 
-<code>.... 
-.... 
-NET: Registered protocol family 24 
- 
-nf_conntrack version 0.5.0 (213 buckets, 852 max) 
- 
-ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver 
-bcm63xx_ohci  
-bcm63xx_ohci.0: BCM63XX integrated OHCI controller 
-bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered, assigned bus number 1 
-bcm63xx_ohci bcm63xx_ohci.0: irq 20, io mem 0xfffe1b00 
-usb usb1: configuration #1 chosen from 1 choice 
-hub 1-0:1.0: USB hub found 
-hub 1-0:1.0: 2 ports detected 
- 
-Initializing USB Mass Storage driver... 
-usbcore: registered  
-new interface driver usb-storage 
-USB Mass Storage support registered. 
- 
-usb 1-1: new full speed USB device using bcm63xx_ohci and address 2 
- 
-usb 1-1: configuration #1 chosen from 1 choice 
-scsi0 : SCSI emulation for USB Mass Storage devices 
- 
-scsi 0:0:0:0: CD-ROM            Vodafone CD ROM (Huawei)  2.31 PQ: 0 ANSI: 2 
- 
-usb 1-2: new full speed USB device using bcm63xx_ohci and address 3 
- 
-usb 1-2: configuration #1 chosen from 1 choice 
-scsi1 : SCSI emulation for USB Mass Storage devices 
- 
-scsi 1:0:0:0: Direct-Access    M-Sys    Dell Memory Key  4.60 PQ: 0 ANSI: 0 CCS 
-sd 1:0:0:0: [sda] 239872 512-byte logical blocks: (122 MB/117 MiB) 
-sd 1:0:0:0: [sda] Write Protect is off 
-sd 1:0:0:0: [sda] Assuming drive cache: write through 
-sd 1:0:0:0: [sda] Assuming drive cache: write through 
- sda: sda1 
-sd 1:0:0:0: [sda] Assuming drive cache: write through 
-sd 1:0:0:0: [sda] Attached SCSI removable disk 
-</code> 
-</p> 
-</HTML> 
- 
-==== I²C GPIO Mod ==== 
- 
-==== I²C Tiny-USB Mod ==== 
===== Notes ===== ===== Notes =====
Line 1838: Line 1835:
[[meta:tags]] [[meta:tags]]
-{{tag>bcm63xx bcm6348 FastEthernet 2Port 2PHY USB MiniPCI 802.11bg 16RAM 8Flash MIPS MIPS32 4Kc ADLS2+ b43 JTAG Serial}}+{{tag>bcm63xx bcm6348 FastEthernet 2NIC USB 1WNIC MiniPCI 802.11bg b43 16RAM 8Flash MIPS MIPS32 JTAG Serial}}

Back to top

toh/inventel/dv4210.1357337372.txt.bz2 · Last modified: 2013/01/04 23:09 (external edit)