Sagem Livebox 2
(Sagem F@st3XXX)
El Livebox 2 es un router adsl wifi principalmente distribuido por Orange a sus clientes. La placa es fabricada por Sagem y el firmware desarrollado por Jungo (Openrg).
Versiones Soportadas
| Versión Modelo | Fecha Lanzamiento | S/N | Versión Openwrt Soportada | Notas Específicas Modelo |
|---|---|---|---|---|
| n/a | n/a | n/a | - | - |
Ver notas.
Reseñas de Hardware
| CPU | Ram | Flash | Red | USB | Serial | JTag |
|---|---|---|---|---|---|---|
| Lexra LX4189 @200MHz | 64MiB | 32MiB | 4 x 1 | Sí | Sí | Sí |
Es posible compilar software para procesadores Lexra usando las herramientas gnu gcc para el procesador MIPS-I R3000. Esto se puede lograr bien mediante la programación de una excepción “trap handler” para las intrucciones reservadas que detecte instrucciones no alineadas “load” y “store” y emule su funcionalidad con “shifts” y “loads” alineados, o bien modificando el compilador para que no genere las instrucciones lwl, lwr, swl, y swr. Con uno de estos cambios, cualquier código escrito en C puede funcionar en procesadores Lexra.
Los usuarios avanzados pueden incluso intentar acelerar sus loops internos críticos programándolos en código ensamblador usando el procesamiento de señales digitales (DSP), con instrucciones que Lexra implementó como extensiones del conjunto de instrucciones MIPS-I. Jonah Probell©
Esquema Flash
Por favor mira el artículo flash.layout. Tiene un ejemplo y un par de explicaciones.
Información memoria Flash
Query identification string:
Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set)
Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
Query system interface information:
Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
Typical timeout per single byte/word program: 64 us
Typical timeout for maximum-size multi-byte program: 64 us
Typical timeout per individual block erase: 512 ms
Typical timeout for full chip erase: 524288 ms
Maximum timeout for byte/word program: 512 us
Maximum timeout for multi-byte program: 2048 us
Maximum timeout per individual block erase: 4096 ms
Maximum timeout for chip erase: 2097152 ms
Device geometry definition:
Device Size: 33554432 B (32768 KiB, 32 MiB)
Flash Device Interface Code description: 0x0002 (x8/x16)
Maximum number of bytes in multi-byte program: 64
Number of Erase Block Regions within device: 1
Erase Block Region Information:
Region 0:
Erase Block Size: 131072 B (128 KiB)
Number of Erase Blocks: 256
Primary Vendor-Specific Extended Query:
Major version number: 1
Minor version number: 3
Address Sensitive Unlock: Required
Process Technology: Bad value
Erase Suspend: Read/write
Sector Protect: 1 sectors per group
Sector Temporary Unprotect: Supported
Sector Protect/Unprotect Scheme: Bad value
Simultaneous Operation: Not supported
Burst Mode Type: Supported
Page Mode Type: 8 word Page
ACC (Acceleration) Supply Minimum: 11500 mV
ACC (Acceleration) Supply Maximum: 12500 mV
Top/Bottom Sector Flag: Uniform bottom boot device
Program Suspend: Not supported
Logs de Arranque
OEM Bootlog (Openrg)
SAGEM Secure-boot v2.7 boxer 0.8 for ADI chipset CPU: ADI Fusiv 160 Family DRAM: 64 MB Flash: 32 MB Using default environment In: serial Out: serial Err: serial voxEmac Sagem boxer int OK. Searching valid operational firmware Operational Firmware validated at address bf580000 good regular firmware at @0xBF580000 with key @0xBF018411 partition not moved Launch regular code from flash bootm BF580140 ## Booting image at bf580140 ... Image Name: FAST3yyy_691288 Created: 2011-08-05 15:54:28 UTC Image Type: MIPS Linux Kernel Image (gzip compressed) Data Size: 8934130 Bytes = 8.5 MB Load Address: 80010000 Entry Point: 802e8000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... .----------------------------------------------------------------. | CPU_ID = 0x6836 | `----------------------------------------------------------------' .----------------------------------------------------------------. | DYNAMICALLY DETECTED SDRAM_SIZE = 128 Mbytes | `----------------------------------------------------------------' .----------------------------------------------------------------. | DYNAMICALLY DETECTED FLASH_SIZE = 32 Mbytes | `----------------------------------------------------------------' board_name : VOX160 - 0x6836 flash_layout is for VOX160 Failed insmod btn200 (No such file or directory) Press ESC to enter BOOT MENU mode. dd_openrg_init: registering openrg device discovery entity Permanent Parameters were stored in Rgconf RAM Stored version is 4.0.21.3.3.1.32.1.1.1.6.FAST3yyy_69127A, current version is 4.0.21.3.3.1.32.1.1.1.6.FAST3yyy_691288 ffs: entry:0: successfully mounted dev:/dev/mtdblock1 fs:jffs2 mount point:/mnt/ffs/A. ffs: entry:1: successfully mounted dev:/dev/mtdblock2 fs:jffs2 mount point:/mnt/ffs/B. do_main(2364) : Migration securité rm: cannot remove `.' or `..' rm: cannot remove `.' or `..' mv: unable to rename `/mnt/ffs/A/persist.txt': No such file or directory mv: unable to rename `/mnt/ffs/A/tr104.save.cfg': No such file or directory mv: unable to rename `/mnt/ffs/A/tr104.cfg': No such file or directory rm: cannot remove `.' or `..' rm: cannot remove `.' or `..' mv: unable to rename `/mnt/ffs/B/persist.txt': No such file or directory mv: unable to rename `/mnt/ffs/B/tr104.save.cfg': No such file or directory mv: unable to rename `/mnt/ffs/B/tr104.cfg': No such file or directory Switch (0x61) unsupported by this driver Failed insmod ethsw200 (No such file or directory) Configure switch for card 768 .----------------------------------------------------------------. | DYNAMICALLY DETECTED SWITCH_ID = 0x0061 | `----------------------------------------------------------------' Workaround for large module dspvoice pSerialNum = LK11063DP550884 LB2_SP 691288 ATHEROS AR9223/Merlin WiFi Card Detected WIFI : Pairing mode:0 opening reconfentity Entity MAIN AUTOM ID IS 348 Opening Boxer backup_restore entity Enter in the function http_open AutomInitFullEnv : INITING AUTOMATE ENVIRONMENT... reconf cgiscript_entity warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled warning #1 :new rg_conf entry but not signaled EEPROM ChainMask Init Tx=3 Rx=3 WIFI_CARD_ATHEROS_AR9223/AR9227: dev_if_wireless_changed: Green AP configuration updated ar5xxx_vap_green_ap_set_params: Set New Green AP configuration Green AP Delay: 5 Green AP Rx Chain: 0 Green AP Power Save Disabled ssdp_http_open (610) : c0a80101 dev_if_wireless_changed: Green AP configuration updated ar5xxx_vap_green_ap_set_params: Set New Green AP configuration Green AP Delay: 5 Green AP Rx Chain: 0 Green AP Power Save Disabled Channel Width 20MHz Ext Channel is DOWN sh: cannot create /proc/sys/dev/ath/htdupieenable: Directory nonexistent Set eth2 TxQueueLen to 1000 Enable short GI Enable ForceBiasAuto Set Aggregation State Set AMPDU Limit Enable 2 to 3 antennas automatic transition Enable Extra IE for INTEL Interop Enable WMM Enable U-APSD Disable doth Enable Country IE Disable Background Scan Set HTIE 11n in beacon ###### mt_ftth_change_conf from 0 to 0 ###### ethoa6 enable:1 ethoa4 enable:0 dsl0 enable:1 hsdpa_info:Wait 420 second after boot to start hsdpa connection ethoa6 enable:0 ethoa7 enable:0 eth1.835 enable:0 eth1.832 enable:0 ppp0 enable:0 action:U path:/dev/ethoa6/enabled value:0 action:U path:/dev/ethoa6/volatile_enabled value:0 Can't add mcast addr 01:00:5e:7f:ff:fa to bridge br1; ioctl ret = -1 ../../common/MasterControl/Info.cpp(188):Read WSC Config File:/etc/wsc_config.txt ../../common/MasterControl/Info.cpp(1529):Use eth0 address 98:8b:5d:2d:5c:a1 ../../common/MasterControl/Info.cpp(188):Read WSC Config File:/etc/wsc_config.txt ../../common/MasterControl/Info.cpp(1529):Use eth0 address 98:8b:5d:2d:5c:a1 [MT_LIVEBOX_TV] update_tv_mode:303(INFO) : Set default static ip to 1.1.1.1 ( address not used ) eth1 enable:1 ethoa0 enable:1 ethoa1 enable:1 ethoa2 enable:1 ethoa3 enable:1 eth1.840 enable:0 eth0.838 enable:0 action:U path:/dev/eth1/enabled value:1 action:U path:/dev/eth1/volatile_enabled value:1 Can't add mcast addr 01:00:5e:7f:ff:fa to bridge br1; ioctl ret = -1 ../../common/MasterControl/MasterControl.cpp(2877):Generated devPwd: 35087847 ../../common/WscCmd/WscCmd.cpp(1814):WscCmd::AP tmp file =cp /etc/template.conf ../../common/WscCmd/WscCmd.cpp(1820):WscCmd::AP Config file copied: cmd=cp /etc/template.conf /etc/hostapd.conf ../../common/WscCmd/WscCmd.cpp(2008):WscCmd::Params added to AP config file retry_notify(210) dev=br0, status=1, count=2 retry_notify(210) dev=br0, status=1, count=1 login: ../../common/InbWlan/InbWlan.cpp(244):UDP recv m_recvPort[0]= 1025 AutomInitGenericEnv : init of global context... AutomInitGenericEnv: force tests_for_sip to false AutomGetTestsWanup : Wan is not forced , real state used AutomInitGenericEnv : init the sub automate context... AutomInitGenericEnv : launch control agent... --> id ok... VoipCtrlAgent: SG_CTRL_AGENT_Start:--> id ok SG_CTRL_AGENT_Start : creating socket for automate0 fd = 3... SG_CTRL_AGENT_Start : create listener thread = 1026 AutomInitGenericEnv : create automate reception messages queue... AutomInitGenericEnv : init timer library... AutomInitGenericEnv : appel cb_Adsl_Result adslStatus =0 AutomGetIntfState : error occured trying to retrieve <adsl> interface state ...AutomGetIntfState : error occured trying to retrieve <ppp> interface state ... AutomInitGenericEnv : init ppp state... intfStateSet : Now setting intf </proc/voipStats/pppState> state with <0>!! procCounterAction : Now writing in </proc/voipStats/pppState> with command <d>!! intfStateSet : Now setting intf </proc/voipStats/vcconvState> state with <0>!! procCounterAction : Now writing in </proc/voipStats/vcconvState> with command <d>!! AutomGetIntfState : error occured trying to retrieve <adsl> interface state ...intfStateSet : Now setting intf </proc/voipStats/adslState> state with <0>!! procCounterAction : Now writing in </proc/voipStats/adslState> with command <d>!! AutomInitFullEnv : init the main automate context... AutomInitFullEnv : create automate transmission messages queues... procVoipStackActiveSet : Now setting voip stack </proc/voipStats/voipStackActive> with command <0>!! procCounterAction : Now writing in </proc/voipStats/voipStackActive> with command <0>!! AutomInitFullEnv : init the voip interface... procVoipIntfSet : Now setting voip interface </proc/voipStats/voipActiveDevice> with command <n>!! procCounterAction : Now writing in </proc/voipStats/voipActiveDevice> with command <n>!! AutomInitFullEnv : raz active calls number... procCounterAction : Now writing in </proc/voipStats/nbActiveCalls> with command <0>!! AutomInitFullEnv : mark the voip as deactivated... AutomInitFullEnv : launch eventually the factice binaries... AutomLaunchDeviceDecovery : appel fct AutomCreateProcess(DD_DAEMON_MODULE) AutomCreateProcess : Now creating DD_DAEMON_MODULE process... AutomCreateProcess : DD_DAEMON_MODULE LAUNCHED! with pid 907 AutomListenerThread : Waiting for input message retry_notify(210) dev=br0, status=1, count=0 Password: login:
Openwrt Bootlog
 | El bootloader original ha sido reemplazado para permitir arrancar otros firmwares. |
U-Boot 1.1.4 for FUSIV chipset by Ikanos(Jun 16 2009 - 15:49:51) CPU: IKANOS Fusiv 160 Family Ethernet Switch hardware reset DRAM: 64 MB Flash: 32 MB In: serial Out: serial Err: serial Net: voxEmac Type "h" for HELP. Have fun! Hit any key to stop autoboot: 5 4 3 2 1 0 ## Booting image at bf580000 ... Image Name: OpenWrt Created: 2011-11-20 18:46:55 UTC Image Type: MIPS Linux Kernel Image (gzip compressed) Data Size: 1263202 Bytes = 1.2 MB Load Address: 80010000 Entry Point: 802fa000 CRAMFS: inside this image Uncompressing Kernel Image ... OK Starting kernel ... Linux version 2.6.15 (acki@acki-laptop) (gcc version 3.4.3) #156 Sun Nov 20 19:46:22 CET 2011 _|_|_|_|_| _| _|_| _|_|_| _|_|_| _|_| _| _|_|_|_| _| _| _| _| _| _| _| _| _| _| _| _| _| _|_|_| _|_|_| _| _| _| _| _| _| _|_|_| _|_| _| _| _| _| _| _| _| _| _| _| _|_|_| _| _| _| _| _| _| _| _|_|_|_| _| _|_|_| _|_|_|_| CPU_ID = 0x6836 DETECTADOS DINAMICAMENTE = 64 Mbytes CPU revision is: 6836c400 Determined physical RAM map: memory: 00001000 @ 00000000 (usable) memory: 00001000 @ 00001000 (reserved) memory: 03ffe000 @ 00002000 (usable) memory: 04000000 @ 1c000000 (ROM data) Built 1 zonelists Kernel command line: root=/dev/mtdblock3 rootfstype=jffs2 init=/etc/preinit console=ttyS0,57600 Primary instruction cache 16kB, linesize 32 bytes. Primary data cache 8kB, linesize 32 bytes. Synthesized TLB refill handler (17 instructions). Synthesized TLB load handler fastpath (31 instructions). Synthesized TLB store handler fastpath (31 instructions). Synthesized TLB modify handler fastpath (25 instructions). PID hash table entries: 512 (order: 9, 8192 bytes) Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 61056k/65532k available (2508k kernel code, 4444k reserved, 475k data, 104k init, 0k highmem) Mount-cache hash table entries: 512 Checking for 'wait' instruction... unavailable. NET: Registered protocol family 16 Fusiv PCI: starting... SCSI subsystem initialized usbcore: registered new driver usbfs usbcore: registered new driver hub Bluetooth: Core ver 2.8 NET: Registered protocol family 31 Bluetooth: HCI device and connection manager initialized Bluetooth: HCI socket layer initialized ####### detected generic cardid 768 GPIO Initialisation (led/buttons/relays) NTFS driver 2.1.25 [Flags: R/O]. JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc. Initializing Cryptographic API io scheduler noop registered Random: 0x20cad394 Serial: 8250/16550 driver $Revision: 1.1.4.1.2.1 $ 1 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0xb9020000 (irq = 6) is a 16450 fusiv_flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 fusiv_flash: CFI does not contain boot bank location. Assuming top. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. .----------------------------------------------------------------. | INCORRECTAMENTE DETECTADOS = 32 Mbytes de FLASH | `----------------------------------------------------------------' Configurando particiones mtd Creating 4 MTD partitions on "fusiv_flash": 0x00000000-0x000a0000 : "boot" 0x000a0000-0x00580000 : "prueba" 0x00580000-0x00780000 : "kernel" 0x00780000-0x00d80000 : "jffs2" fusiv_flash: detected at 0x1e000000 size 33554432 bytes vox160-ehci-hcd vox160-ehci-hcd.0: EHCI Host Controller vox160-ehci-hcd vox160-ehci-hcd.0: new USB bus registered, assigned bus number 1 vox160-ehci-hcd vox160-ehci-hcd.0: irq 35, io mem 0x19230000 ehci_run-FBt : configure Speed for hcd = 811fae00 hci = 811faec8 confEHCI = 1 vox160-ehci-hcd vox160-ehci-hcd.0: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected vox160-ohci-hcd vox160-ohci-hcd.0: ADI VOX160 OHCI vox160-ohci-hcd vox160-ohci-hcd.0: new USB bus registered, assigned bus number 2 vox160-ohci-hcd vox160-ohci-hcd.0: irq 35, io mem 0x19240800 hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected usb 1-1: new high speed USB device using vox160-ehci-hcd and address 2 hub 1-1:1.0: USB hub found hub 1-1:1.0: 2 ports detected usbcore: registered new driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Initializing USB Mass Storage driver... usbcore: registered new driver usb-storage USB Mass Storage support registered. usbcore: registered new driver usbserial drivers/usb/serial/usb-serial.c: USB Serial Driver core drivers/usb/serial/usb-serial.c: USB Serial support registered for cp2101 usbcore: registered new driver CP2101 drivers/usb/serial/cp2101.c: Silicon Labs CP2101/CP2102 RS232 serial adaptor driver v0.04 u32 classifier OLD policer on NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 2, 16384 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered NET: Registered protocol family 1 NET: Registered protocol family 17 Bluetooth: L2CAP ver 2.8 Bluetooth: L2CAP socket layer initialized Bluetooth: SCO (Voice Link) ver 0.5 Bluetooth: SCO socket layer initialized Bluetooth: RFCOMM socket layer initialized Bluetooth: RFCOMM ver 1.6 Bluetooth: BNEP (Ethernet Emulation) ver 1.2 Bluetooth: BNEP filters: protocol multicast NET: Registered protocol family 8 NET: Registered protocol family 20 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (jffs2 filesystem) readonly. Freeing unused kernel memory: 104k freed mount: mounting devpts on /dev/pts failed: No such device - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - - init - init started: BusyBox v1.15.3 (2011-11-18 13:44:43 CET) Please press Enter to activate this console. BusyBox v1.15.3 (2011-11-18 13:44:43 CET) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M Backfire (10.03, unknown) -------------------------- * 1/3 shot Kahlua In a shot glass, layer Kahlua * 1/3 shot Bailey's on the bottom, then Bailey's, * 1/3 shot Vodka then Vodka. --------------------------------------------------- root@OpenWrt:/#
Modo Failsafe
Botones
→ hardware.button para saber como configurar y usar los botones.
El Livebox 2 tiene dos botones. Son Reset y Wireless Protected Setup:
| BOTÓN | Evento |
|---|---|
| Reset | reset |
| ((⚲)) | WPS, wifi on/off |
Hardware
Información
| Arquitectura: | MIPS (sin instrucciones lwl, lwr, swl, swr) |
| Vendedor: | Ikanos |
| bootloader: | U-Boot |
| System-On-Chip: | ADI FUSIV Vx160–IKF6836 |
| CPU/Velocidad | Lexra LX4189 V0.0 / 200 Mhz |
| Chip-Flash: | S29GL256P90TFCR2 / JS28F256M29EWL |
| Tamaño Flash: | 32 MiB |
| RAM / tamaño: | Micron MT46V64M8P-6T:F / 64 MiB |
| Wireless: | Atheros AR9223 802.11b/g/n |
| Ethernet: | Marvell 88E6061 con soporte vlan 802.1Q swconfig |
| Internet: | IKE 6488-A0 / ADSL2+ |
| USB: | 2x 2.0 / SMSC HUB USB2502-AEZG |
| Puerto Serie: | Sí |
| JTAG: | Sí |
El switch según Marvell soporta además QoS de forma nativa. Hay datasheet del modelo similar 88E6060. Este switch 88E6060 se encuentra en otros routers como el Netgear DG834G v1 (soportado por Openwrt).
Fotos
Número Modelo
Frente:
Trasero:
Foto de la parte trasera de la carcasa
Abriendo la carcasa
Nota: Esto anulará tu garantía!
Ponemos el livebox 2 boca abajo y vemos 4 soportes de goma:
Dichos soportes se quitan con facilidad, usando los dedos. Aparecerán 4 tornillos tipo TORX
En caso de no disponer de destornillador torx, un destornillador de precisión plano sirve perfectamente.
Una vez retirados los tornillos, la carcasa superior sale limpiamente. Podemos incluso extraer la placa sin problema. No hay ningún otro tipo de sujección aparte de los mencionados tornillos.
Placa-PCB:
Foto del SoC y del switch Marvell:
Foto de las dos versiones de memoria flash:
Puerto Serie
→ port.serial: información general acerca del puerto serie, cable serie, etc.
Como conectar el Puerto serie a este dispositivo concreto:
Foto del PCB con marcas
Para conectarlo a nuestro ordenador necesitaremos un adaptador de puerto serie TTL.
Velocidad: 57600
Bits de datos: 8
Paridad: ninguna
Bits de parada: 1
Control de flujo: xon/xoff
SoC VX160
JTAG
→ port.jtag información general acerca del puerto JTAG , cable JTAG, etc.
Como conectar el puerto JTAG de este dispositivo concreto:
Foto de la PCB con marcas:
La comunicación se puede establecer mediante un cable JTAG simple de tipo unbuffered. UrJtag no puede detectar el dispositivo pero parece que puede comunicarse con la cpu:
ubuntu@ubuntu:~$ sudo jtag UrJTAG 0.9 #1476 Copyright (C) 2002, 2003 ETC s.r.o. Copyright (C) 2007, 2008 Kolja Waschk and the respective authors UrJTAG is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. There is absolutely no warranty for UrJTAG. WARNING: UrJTAG may damage your hardware! Type "quit" to exit, "help" for help. jtag> cable DLC5 ppdev /dev/parport0 Initializing ppdev port /dev/parport0 jtag> discovery Detecting IR length ... 5 Detecting DR length for IR 11111 ... 1 Detecting DR length for IR 00000 ... 1 Detecting DR length for IR 00001 ... 671 Detecting DR length for IR 00010 ... 32 Detecting DR length for IR 00011 ... 671 Detecting DR length for IR 00100 ... 1 Detecting DR length for IR 00101 ... 1 Detecting DR length for IR 00110 ... 1 Detecting DR length for IR 00111 ... 306 Detecting DR length for IR 01000 ... 1 Detecting DR length for IR 01001 ... 1 Detecting DR length for IR 01010 ... 1 Detecting DR length for IR 01011 ... 1 Detecting DR length for IR 01100 ... 1 Detecting DR length for IR 01101 ... 1 Detecting DR length for IR 01110 ... 1 Detecting DR length for IR 01111 ... 1 Detecting DR length for IR 10000 ... 1 Detecting DR length for IR 10001 ... 1 Detecting DR length for IR 10010 ... 1 Detecting DR length for IR 10011 ... 1 Detecting DR length for IR 10100 ... 1 Detecting DR length for IR 10101 ... 1 Detecting DR length for IR 10110 ... 1 Detecting DR length for IR 10111 ... 1 Detecting DR length for IR 11000 ... 1 Detecting DR length for IR 11001 ... 1 Detecting DR length for IR 11010 ... 1 Detecting DR length for IR 11011 ... 1 Detecting DR length for IR 11100 ... 1 Detecting DR length for IR 11101 ... 1 Detecting DR length for IR 11110 ... 1
jtag> detect IR length: 5 Chain length: 1 Device Id: 00000010011111010011000111001011 (0x00000000027D31CB) Unknown manufacturer! chain.c(149) Part 0 without active instruction chain.c(200) Part 0 without active instruction chain.c(149) Part 0 without active instruction
Es 0x00000000027D31CB la ID real?
| Stepping | Part | Manufacturer | n/a |
|---|---|---|---|
| 0000 | 0010011111010011 | 00011100101 | 1 |
| n/a | ¿lx4189? | Gadzoox Networks | n/a |
Y si modificamos los archivos data de Urjtag de acuerdo con el comando discovery
jtag> detect IR length: 5 Chain length: 1 Device Id: 00000010011111010011000111001011 (0x00000000027D31CB) Manufacturer: Analog Devices Part(0): LX4189 Stepping: 0 Filename: /usr/share/urjtag/analog/lx4189/lx4189 chain.c(149) Part 0 without active instruction chain.c(200) Part 0 without active instruction ImpCode=0101000000000000000000000000000010110 1000000001001101101101101101101101101101100101 0101010101010101010101010101010101010101011101 1011011011011011011010110110110110110110110110 1101101101101101101101101101000110111111111111 1000111111101101101101101101101101101110110110 1101101101101111011010111010111101101010111101 1011100001001001001010101001111010010011111010 1101000000001001001001001000101000000000000000 0000000000000001010101000101000101000101000101 0000000000000000000000000100001001000000000000 0000001000101101101101100011000010110111000000 0000000000000001100111111111111000011111101001 0010010010010010001011010110110101010010010010 010010110010110010110110010010010010 FFFFFFFF EJTAG version: unknown (7) EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS64 chain.c(149) Part 0 without active instruction ejtag.c(482) Failed to enter debug mode, ctrl=0 detect: syntax error!
Desbriquear/Recuperación
Mods Bootloader
- puedes leer algo acerca del bootloader en general.
El bootloader original contiene comprobaciones de seguridad para evitar arrancar otros firmwares que no sean del fabricante. Ya que Uboot está bajo la licencia GPLv2 podríamos esperar que las modificaciones que ha hecho Jungo están publicadas y disponibles. De esta forma podríamos modificar Uboot para permitir arrancar Openwrt, además de flashearlo de forma sencilla. Jungo actualmente no ha publicado ningún código fuente.
Otra opción es reemplazar este bootloader por otro compatible con el chipset ikanos6836. Existe un bootloader para placas AGIF también hecho por Jungo compatible con este chipset. Jungo tampoco ha publicado el código fuente de este último Uboot modificado.