Sagem Livebox 2

(Sagem F@st3XXX)

The Livebox 2 is an adsl wifi router mainly distributed by Orange to their customers. The board is manufactured by Sagem and the firmware (Openrg) is developed by Jungo.

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
n/a n/a - - -

NOTE: Anything not included in model specific notes, or where a short comment couldn't be included on the notes.

Hardware Highlights

CPU Ram Flash Network USB Serial JTag
Lexra LX4189 @200MHz 64MiB 32MiB 4 x 1 Yes Yes Yes

It is possible to compile software for Lexra processors using the gnu gcc tools for the MIPS-I R3000 processor. This can be done either by writing an exception trap handler for reserved instructions that detects unaligned load and store instructions and emulates their functionality with shifts and aligned loads and stores or else modifying the compiler so that it does not generate lwl, lwr, swl, and swr instructions. With either of those changes, any C code can run on Lexra processors.
Advanced hobbyists might even choose to accelerate their critical inner loops by coding them in assembly code using digital signal processing (DSP) instructions that Lexra implemented as extensions to the MIPS-I instruction set.
Jonah Probell©

For more information about Lexra processors please download http://wlstorage.net/file/lexra-cpu-core-documentation.zip

Flash Layout

Please check out the article Flash Layout. It contains an example and a couple of explanations.

Flash chip info

Query identification string:
    Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set)
    Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
 Query system interface information:
    Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
    Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
    Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
     Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
    Typical timeout per single byte/word program: 64 us
    Typical timeout for maximum-size multi-byte program: 64 us
    Typical timeout per individual block erase: 512 ms
     Typical timeout for full chip erase: 524288 ms
    Maximum timeout for byte/word program: 512 us
    Maximum timeout for multi-byte program: 2048 us
    Maximum timeout per individual block erase: 4096 ms
     Maximum timeout for chip erase: 2097152 ms
Device geometry definition:
    Device Size: 33554432 B (32768 KiB, 32 MiB)
    Flash Device Interface Code description: 0x0002 (x8/x16)
    Maximum number of bytes in multi-byte program: 64
     Number of Erase Block Regions within device: 1
    Erase Block Region Information:
        Region 0:
            Erase Block Size: 131072 B (128 KiB)
            Number of Erase Blocks: 256
Primary Vendor-Specific Extended Query:
     Major version number: 1
    Minor version number: 3
    Address Sensitive Unlock: Required
    Process Technology: Bad value
    Erase Suspend: Read/write
    Sector Protect: 1 sectors per group
    Sector Temporary Unprotect: Supported
     Sector Protect/Unprotect Scheme: Bad value
    Simultaneous Operation: Not supported
    Burst Mode Type: Supported
    Page Mode Type: 8 word Page
    ACC (Acceleration) Supply Minimum: 11500 mV
    ACC (Acceleration) Supply Maximum: 12500 mV
     Top/Bottom Sector Flag: Uniform bottom boot device
    Program Suspend: Not supported 

Bootlogs

OEM Bootlog (Openrg)

SAGEM Secure-boot v2.7 boxer 0.8 for ADI chipset CPU: ADI Fusiv 160 Family DRAM: 64 MB Flash: 32 MB Using default environment In: serial Out: serial Err: serial voxEmac Sagem boxer int OK. Searching valid operational firmware Operational Firmware validated at address bf580000 good regular firmware at @0xBF580000 with key @0xBF018411 partition not moved Launch regular code from flash bootm BF580140 ## Booting image at bf580140 ... Image Name: FAST3yyy_691288 Created: 2011-08-05 15:54:28 UTC Image Type: MIPS Linux Kernel Image (gzip compressed) Data Size: 8934130 Bytes = 8.5 MB Load Address: 80010000 Entry Point: 802e8000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... .----------------------------------------------------------------. | CPU_ID = 0x6836 | `----------------------------------------------------------------' .----------------------------------------------------------------. | DYNAMICALLY DETECTED SDRAM_SIZE = 128 Mbytes | `----------------------------------------------------------------' .----------------------------------------------------------------. | DYNAMICALLY DETECTED FLASH_SIZE = 32 Mbytes | `----------------------------------------------------------------' board_name : VOX160 - 0x6836 flash_layout is for VOX160 Failed insmod btn200 (No such file or directory) Press ESC to enter BOOT MENU mode. dd_openrg_init: registering openrg device discovery entity Permanent Parameters were stored in Rgconf RAM Stored version is 4.0.21.3.3.1.32.1.1.1.6.FAST3yyy_69127A, current version is 4.0.21.3.3.1.32.1.1.1.6.FAST3yyy_691288 ffs: entry:0: successfully mounted dev:/dev/mtdblock1 fs:jffs2 mount point:/mnt/ffs/A. ffs: entry:1: successfully mounted dev:/dev/mtdblock2 fs:jffs2 mount point:/mnt/ffs/B. do_main(2364) : Migration securité rm: cannot remove `.' or `..' rm: cannot remove `.' or `..' mv: unable to rename `/mnt/ffs/A/persist.txt': No such file or directory mv: unable to rename `/mnt/ffs/A/tr104.save.cfg': No such file or directory mv: unable to rename `/mnt/ffs/A/tr104.cfg': No such file or directory rm: cannot remove `.' or `..' rm: cannot remove `.' or `..' mv: unable to rename `/mnt/ffs/B/persist.txt': No such file or directory mv: unable to rename `/mnt/ffs/B/tr104.save.cfg': No such file or directory mv: unable to rename `/mnt/ffs/B/tr104.cfg': No such file or directory Switch (0x61) unsupported by this driver Failed insmod ethsw200 (No such file or directory) Configure switch for card 768 .----------------------------------------------------------------. | DYNAMICALLY DETECTED SWITCH_ID = 0x0061 | `----------------------------------------------------------------' Workaround for large module dspvoice pSerialNum = LK11063DP550884 LB2_SP 691288 ATHEROS AR9223/Merlin WiFi Card Detected WIFI : Pairing mode:0 opening reconfentity Entity MAIN AUTOM ID IS 348 Opening Boxer backup_restore entity Enter in the function http_open AutomInitFullEnv : INITING AUTOMATE ENVIRONMENT... reconf cgiscript_entity warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled EEPROM ChainMask Init Tx=3 Rx=3 WIFI_CARD_ATHEROS_AR9223/AR9227: dev_if_wireless_changed: Green AP configuration updated ar5xxx_vap_green_ap_set_params: Set New Green AP configuration Green AP Delay: 5 Green AP Rx Chain: 0 Green AP Power Save Disabled ssdp_http_open (610) : c0a80101 dev_if_wireless_changed: Green AP configuration updated ar5xxx_vap_green_ap_set_params: Set New Green AP configuration Green AP Delay: 5 Green AP Rx Chain: 0 Green AP Power Save Disabled Channel Width 20MHz Ext Channel is DOWN sh: cannot create /proc/sys/dev/ath/htdupieenable: Directory nonexistent Set eth2 TxQueueLen to 1000 Enable short GI Enable ForceBiasAuto Set Aggregation State Set AMPDU Limit Enable 2 to 3 antennas automatic transition Enable Extra IE for INTEL Interop Enable WMM Enable U-APSD Disable doth Enable Country IE Disable Background Scan Set HTIE 11n in beacon ###### mt_ftth_change_conf from 0 to 0 ###### ethoa6 enable:1 ethoa4 enable:0 dsl0 enable:1 hsdpa_info:Wait 420 second after boot to start hsdpa connection ethoa6 enable:0 ethoa7 enable:0 eth1.835 enable:0 eth1.832 enable:0 ppp0 enable:0 action:U path:/dev/ethoa6/enabled value:0 action:U path:/dev/ethoa6/volatile_enabled value:0 Can't add mcast addr 01:00:5e:7f:ff:fa to bridge br1; ioctl ret = -1 ../../common/MasterControl/Info.cpp(188):Read WSC Config File:/etc/wsc_config.txt ../../common/MasterControl/Info.cpp(1529):Use eth0 address 98:8b:5d:2d:5c:a1 ../../common/MasterControl/Info.cpp(188):Read WSC Config File:/etc/wsc_config.txt ../../common/MasterControl/Info.cpp(1529):Use eth0 address 98:8b:5d:2d:5c:a1 [MT_LIVEBOX_TV] update_tv_mode:303(INFO) : Set default static ip to 1.1.1.1 ( address not used ) eth1 enable:1 ethoa0 enable:1 ethoa1 enable:1 ethoa2 enable:1 ethoa3 enable:1 eth1.840 enable:0 eth0.838 enable:0 action:U path:/dev/eth1/enabled value:1 action:U path:/dev/eth1/volatile_enabled value:1 Can't add mcast addr 01:00:5e:7f:ff:fa to bridge br1; ioctl ret = -1 ../../common/MasterControl/MasterControl.cpp(2877):Generated devPwd: 35087847 ../../common/WscCmd/WscCmd.cpp(1814):WscCmd::AP tmp file =cp /etc/template.conf ../../common/WscCmd/WscCmd.cpp(1820):WscCmd::AP Config file copied: cmd=cp /etc/template.conf /etc/hostapd.conf ../../common/WscCmd/WscCmd.cpp(2008):WscCmd::Params added to AP config file retry_notify(210) dev=br0, status=1, count=2 retry_notify(210) dev=br0, status=1, count=1 login: ../../common/InbWlan/InbWlan.cpp(244):UDP recv m_recvPort[0]= 1025 AutomInitGenericEnv : init of global context... AutomInitGenericEnv: force tests_for_sip to false AutomGetTestsWanup : Wan is not forced , real state used AutomInitGenericEnv : init the sub automate context... AutomInitGenericEnv : launch control agent... --> id ok... VoipCtrlAgent: SG_CTRL_AGENT_Start:--> id ok SG_CTRL_AGENT_Start : creating socket for automate0 fd = 3... SG_CTRL_AGENT_Start : create listener thread = 1026 AutomInitGenericEnv : create automate reception messages queue... AutomInitGenericEnv : init timer library... AutomInitGenericEnv : appel cb_Adsl_Result adslStatus =0 AutomGetIntfState : error occured trying to retrieve interface state ...AutomGetIntfState : error occured trying to retrieve interface state ... AutomInitGenericEnv : init ppp state... intfStateSet : Now setting intf state with <0>!! procCounterAction : Now writing in with command !! intfStateSet : Now setting intf state with <0>!! procCounterAction : Now writing in with command !! AutomGetIntfState : error occured trying to retrieve interface state ...intfStateSet : Now setting intf state with <0>!! procCounterAction : Now writing in with command !! AutomInitFullEnv : init the main automate context... AutomInitFullEnv : create automate transmission messages queues... procVoipStackActiveSet : Now setting voip stack with command <0>!! procCounterAction : Now writing in with command <0>!! AutomInitFullEnv : init the voip interface... procVoipIntfSet : Now setting voip interface with command !! procCounterAction : Now writing in with command !! AutomInitFullEnv : raz active calls number... procCounterAction : Now writing in with command <0>!! AutomInitFullEnv : mark the voip as deactivated... AutomInitFullEnv : launch eventually the factice binaries... AutomLaunchDeviceDecovery : appel fct AutomCreateProcess(DD_DAEMON_MODULE) AutomCreateProcess : Now creating DD_DAEMON_MODULE process... AutomCreateProcess : DD_DAEMON_MODULE LAUNCHED! with pid 907 AutomListenerThread : Waiting for input message retry_notify(210) dev=br0, status=1, count=0 Password: login:

Openwrt Bootlog

The U-boot bootloader has been replaced to avoid security checks, this allows to boot other firmwares.

U-Boot 1.1.4 for FUSIV chipset by Ikanos(Jun 16 2009 - 15:49:51) CPU: IKANOS Fusiv 160 Family Ethernet Switch hardware reset DRAM: 64 MB Flash: 32 MB In: serial Out: serial Err: serial Net: voxEmac Type "h" for HELP. Have fun! Hit any key to stop autoboot: 5  4  3  2  1  0 ## Booting image at bf580000 ... Image Name: OpenWrt Created: 2011-11-20 18:46:55 UTC Image Type: MIPS Linux Kernel Image (gzip compressed) Data Size: 1263202 Bytes = 1.2 MB Load Address: 80010000 Entry Point: 802fa000 CRAMFS: inside this image Uncompressing Kernel Image ... OK Starting kernel ... Linux version 2.6.15 (acki@acki-laptop) (gcc version 3.4.3) #156 Sun Nov 20 19:46:22 CET 2011 _|_|_|_|_| _| _|_| _|_|_| _|_|_| _|_| _| _|_|_|_| _| _| _| _| _| _| _| _| _| _| _| _| _| _|_|_| _|_|_| _| _| _| _| _| _| _|_|_| _|_| _| _| _| _| _| _| _| _| _| _| _|_|_| _| _| _| _| _| _| _| _|_|_|_| _| _|_|_| _|_|_|_| CPU_ID = 0x6836 DETECTADOS DINAMICAMENTE = 64 Mbytes CPU revision is: 6836c400 Determined physical RAM map: memory: 00001000 @ 00000000 (usable) memory: 00001000 @ 00001000 (reserved) memory: 03ffe000 @ 00002000 (usable) memory: 04000000 @ 1c000000 (ROM data) Built 1 zonelists Kernel command line: root=/dev/mtdblock3 rootfstype=jffs2 init=/etc/preinit console=ttyS0,57600 Primary instruction cache 16kB, linesize 32 bytes. Primary data cache 8kB, linesize 32 bytes. Synthesized TLB refill handler (17 instructions). Synthesized TLB load handler fastpath (31 instructions). Synthesized TLB store handler fastpath (31 instructions). Synthesized TLB modify handler fastpath (25 instructions). PID hash table entries: 512 (order: 9, 8192 bytes) Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 61056k/65532k available (2508k kernel code, 4444k reserved, 475k data, 104k init, 0k highmem) Mount-cache hash table entries: 512 Checking for 'wait' instruction... unavailable. NET: Registered protocol family 16 Fusiv PCI: starting... SCSI subsystem initialized usbcore: registered new driver usbfs usbcore: registered new driver hub Bluetooth: Core ver 2.8 NET: Registered protocol family 31 Bluetooth: HCI device and connection manager initialized Bluetooth: HCI socket layer initialized ####### detected generic cardid 768 GPIO Initialisation (led/buttons/relays) NTFS driver 2.1.25 [Flags: R/O]. JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc. Initializing Cryptographic API io scheduler noop registered Random: 0x20cad394 Serial: 8250/16550 driver $Revision: 1.1.4.1.2.1 $ 1 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0xb9020000 (irq = 6) is a 16450 fusiv_flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 fusiv_flash: CFI does not contain boot bank location. Assuming top. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. .----------------------------------------------------------------. | INCORRECTAMENTE DETECTADOS = 32 Mbytes de FLASH | `----------------------------------------------------------------' Configurando particiones mtd Creating 4 MTD partitions on "fusiv_flash": 0x00000000-0x000a0000 : "boot" 0x000a0000-0x00580000 : "prueba" 0x00580000-0x00780000 : "kernel" 0x00780000-0x00d80000 : "jffs2" fusiv_flash: detected at 0x1e000000 size 33554432 bytes vox160-ehci-hcd vox160-ehci-hcd.0: EHCI Host Controller vox160-ehci-hcd vox160-ehci-hcd.0: new USB bus registered, assigned bus number 1 vox160-ehci-hcd vox160-ehci-hcd.0: irq 35, io mem 0x19230000 ehci_run-FBt : configure Speed for hcd = 811fae00 hci = 811faec8 confEHCI = 1 vox160-ehci-hcd vox160-ehci-hcd.0: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected vox160-ohci-hcd vox160-ohci-hcd.0: ADI VOX160 OHCI vox160-ohci-hcd vox160-ohci-hcd.0: new USB bus registered, assigned bus number 2 vox160-ohci-hcd vox160-ohci-hcd.0: irq 35, io mem 0x19240800 hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected usb 1-1: new high speed USB device using vox160-ehci-hcd and address 2 hub 1-1:1.0: USB hub found hub 1-1:1.0: 2 ports detected usbcore: registered new driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Initializing USB Mass Storage driver... usbcore: registered new driver usb-storage USB Mass Storage support registered. usbcore: registered new driver usbserial drivers/usb/serial/usb-serial.c: USB Serial Driver core drivers/usb/serial/usb-serial.c: USB Serial support registered for cp2101 usbcore: registered new driver CP2101 drivers/usb/serial/cp2101.c: Silicon Labs CP2101/CP2102 RS232 serial adaptor driver v0.04 u32 classifier OLD policer on NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 2, 16384 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered NET: Registered protocol family 1 NET: Registered protocol family 17 Bluetooth: L2CAP ver 2.8 Bluetooth: L2CAP socket layer initialized Bluetooth: SCO (Voice Link) ver 0.5 Bluetooth: SCO socket layer initialized Bluetooth: RFCOMM socket layer initialized Bluetooth: RFCOMM ver 1.6 Bluetooth: BNEP (Ethernet Emulation) ver 1.2 Bluetooth: BNEP filters: protocol multicast NET: Registered protocol family 8 NET: Registered protocol family 20 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (jffs2 filesystem) readonly. Freeing unused kernel memory: 104k freed mount: mounting devpts on /dev/pts failed: No such device - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - - init - init started: BusyBox v1.15.3 (2011-11-18 13:44:43 CET) Please press Enter to activate this console. BusyBox v1.15.3 (2011-11-18 13:44:43 CET) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M Backfire (10.03, unknown) -------------------------- * 1/3 shot Kahlua In a shot glass, layer Kahlua * 1/3 shot Bailey's on the bottom, then Bailey's, * 1/3 shot Vodka then Vodka. --------------------------------------------------- root@OpenWrt:/#

Failsafe mode

Buttons

hardware.button on howto use and configure the hardware button(s).

The Livebox 2 has two buttons. They are Reset and Wireless Protected Setup:

BUTTON Event
Reset reset
((⚲)) WPS, wifi on/off

Hardware

Info

Architecture: Lexra (MIPS clone without lwl, lwr, swl, swr instructions)
Vendor: Ikanos
Bootloader: U-Boot
System-On-Chip: ADI FUSIV Vx160–IKF6836
CPU/Speed Lexra LX4189 V0.0 / 200 Mhz
Flash-Chip: S29GL256P90TFCR2 / JS28F256M29EWL
Flash size: 32 MiB
RAM / size: Micron MT46V64M8P-6T:F / 64 MiB
Wireless: Atheros AR9223 802.11b/g/n
Ethernet: Marvell 88E6061 w/ vlan support swconfig
Internet: IKE 6488-A0 / ADSL2+
USB: 2x 2.0 / SMSC HUB USB2502-AEZG
Serial: Yes
JTAG: Yes

Photos

Model Number

Front:

Photo of front of the casing

Back:

Photo of back of the casing

Opening the case

Note: This will void your warranty!

  • To remove the cover do a/b/c

board

Photo of PCB

System on Chip

Photo of SoC and switch

Flash-chip Flash-chip

Photo of two different flash-chip models

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Photo of PCB with markings

serial port

You'll need to connect it with a serial TTL adapter.

Speed: 57600
Data bits: 8
Parity: none
Stop bits: 1
Flow control: xon/xoff

SoC VX160

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

JTAG

Photo of PCB with markings

The communication can be established with a simple unbuffered JTAG cable. UrJtag can't detect the device but it seems the communication with the cpu is ok:

ubuntu@ubuntu:~$ sudo jtag

UrJTAG 0.9 #1476
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008 Kolja Waschk and the respective authors

UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.

WARNING: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.

jtag> cable DLC5 ppdev /dev/parport0
Initializing ppdev port /dev/parport0

jtag> discovery
Detecting IR length ... 5
Detecting DR length for IR 11111 ... 1
Detecting DR length for IR 00000 ... 1
Detecting DR length for IR 00001 ... 671
Detecting DR length for IR 00010 ... 32
Detecting DR length for IR 00011 ... 671
Detecting DR length for IR 00100 ... 1
Detecting DR length for IR 00101 ... 1
Detecting DR length for IR 00110 ... 1
Detecting DR length for IR 00111 ... 306
Detecting DR length for IR 01000 ... 1
Detecting DR length for IR 01001 ... 1
Detecting DR length for IR 01010 ... 1
Detecting DR length for IR 01011 ... 1
Detecting DR length for IR 01100 ... 1
Detecting DR length for IR 01101 ... 1
Detecting DR length for IR 01110 ... 1
Detecting DR length for IR 01111 ... 1
Detecting DR length for IR 10000 ... 1
Detecting DR length for IR 10001 ... 1
Detecting DR length for IR 10010 ... 1
Detecting DR length for IR 10011 ... 1
Detecting DR length for IR 10100 ... 1
Detecting DR length for IR 10101 ... 1
Detecting DR length for IR 10110 ... 1
Detecting DR length for IR 10111 ... 1
Detecting DR length for IR 11000 ... 1
Detecting DR length for IR 11001 ... 1
Detecting DR length for IR 11010 ... 1
Detecting DR length for IR 11011 ... 1
Detecting DR length for IR 11100 ... 1
Detecting DR length for IR 11101 ... 1
Detecting DR length for IR 11110 ... 1
jtag> detect
IR length: 5
Chain length: 1
Device Id: 00000010011111010011000111001011 (0x00000000027D31CB)
  Unknown manufacturer!
chain.c(149) Part 0 without active instruction
chain.c(200) Part 0 without active instruction
chain.c(149) Part 0 without active instruction
Is 0x00000000027D31CB the real ID?

Stepping Part Manufacturer n/a
0000 0010011111010011 00011100101 1
n/a ¿lx4189? Gadzoox Networks n/a

And if we modify Urjtag files accordingly to the discovery command

jtag> detect
IR length: 5
Chain length: 1
Device Id: 00000010011111010011000111001011 (0x00000000027D31CB)
  Manufacturer: Analog Devices
  Part(0):         LX4189
  Stepping:     0
  Filename:     /usr/share/urjtag/analog/lx4189/lx4189
chain.c(149) Part 0 without active instruction
chain.c(200) Part 0 without active instruction
ImpCode=0101000000000000000000000000000010110
1000000001001101101101101101101101101101100101
0101010101010101010101010101010101010101011101
1011011011011011011010110110110110110110110110
1101101101101101101101101101000110111111111111
1000111111101101101101101101101101101110110110
1101101101101111011010111010111101101010111101
1011100001001001001010101001111010010011111010
1101000000001001001001001000101000000000000000
0000000000000001010101000101000101000101000101
0000000000000000000000000100001001000000000000
0000001000101101101101100011000010110111000000
0000000000000001100111111111111000011111101001
0010010010010010001011010110110101010010010010
010010110010110010110110010010010010 FFFFFFFF
EJTAG version: unknown (7)
EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS64
chain.c(149) Part 0 without active instruction
ejtag.c(482) Failed to enter debug mode, ctrl=0
detect: syntax error!
Maybe there is something wrong.

FIXME

One possibility is to build a clone of the CAVNEX JTAG programmer. It reportedly supports the Lexra LX4000 and the LX5000 series.

CAVNEX JTAG programmer for Lexra LX4000 series

Sadly, CAVNEX are not in business today. But other, high resolution photos of their buffered (74hc244) JTAG programmer supporting the Lexra series, component datasheets, and a JTAG programming tool for BillyGatesWare, and much much more, are available from here.

Debricking

Bootloader Mods

  1. you could read about bootloader in general

No sourcecode is available. Orange didn't release the modified u-boot used in this router, thus violating the GPL spite they dedicate a page to GPL:
http://assistance.orange.fr/livebox-logiciels-open-source-777.php
Of course this is just another joke from an ISP (like others).

However, Edimax released some code with an uboot for vx160 chipsets. Inside the gpl released for the AR-7284WnB router we can find the TBSBOOT which is just a crippled u-boot compatible with vx160 among others.

Here the TBSBOOT source code with the toolchain included:
uboot-vx160.tar.gz

Hardware mods

  • as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

SPI Boot Mod

Still not tested.

It may be possible to flash a bootloader in a SPI flash memory and make the board boot from it. Useful for recovery purposes since the JTAG interface is still unusable. However this method is still not tested and probably a custom bootloader with support for a particular SPI flash memory should be used.

Notes

Discussion forum at:
ikanos-vx160 (Google groups)

Howto to make work openwrt (very hackish) at:
Hackerspace Brussels

Tags

For some Help with the Tags, please have a look here: tags

Back to top

toh/sagem/livebox.2.txt · Last modified: 2013/07/07 22:59 (external edit)