SIEMENS / SAGEM Gigaset SX762 / SX763

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

20150409 zo0ok: When I cleaned up the ToH I thought about writing 2×333 in the CPU MHz column. But since it clearly stated in this article that the second core is for VOIP it is not clear that OpenWrt can use the second core in SMP fashion. Please clearify (and delete this note).

Ver. S/N OpenWrt Version Supported Model Specific Notes
v1 S30852-H70x-xxxx no original firmware version 2.x.x.x
v1 S30852-S70x-xxxx no original firmware version 2.x.x.x, see: https://forum.openwrt.org/viewtopic.php?id=36612
v2 S30852-S70x-xxxx trunk, backfire with patch original firmware version 4.x.x.x

v1 is based on amazon SoC, so we won't talk about that version here.

Beware when buying a SX762 second hand, it might have the correct serial number, but the wrong firmware, see link above

  • ADSL modem is working with both Annex A & Annex B supported.
  • WiFi is working out of the box with trunk. (ath5k)
  • FXS works and can be used with owsip daemon.
  • USB works with a ugly patch.
  • FXO port is not working.

Please check out the article flash.layout. It contains an example and a couple of explanations.

Default Flash Layout
partition start end size description
mtd0 0x00000000 0x0000e000 56KB first loader
mtd1 0x0000e000 0x00010000 8KB nvram (env)
mtd2 0x00010000 0x00700000 7104KB secondary loader + runtime
mtd3 0x000f0000 0x00700000 6208KB rootfs (squashfs)
mtd4 0x00700000 0x00720000 128KB oops
mtd5 0x00720000 0x00800000 896KB PSA (config)
Modified Flash Layout
partition start end size description
mtd0 0x00000000 0x00010000 64KB u-boot
mtd1 0x00010000 0x00020000 64KB u-boot environment
mtd2 0x00020000 0x00800000 8064KB linux

The original firmware contains two modified uboot bootloaders. Only the secondary one has a CLI.

  • The primary bootloader checks the header checksum (sha256) of the secondary bootloader
  • The secondary bootloader does the same thing with the firmware.
  • The sha256bit header checksum is generated by a 1024bit RSA private key which is currently unavailable.

Since the checking is only done for first 64Bytes of every 64k block it is possible to edit the secondary bootloader because it's size is less than 64k, by replacing lzma part and replacing it with lzma compressed u-boot. You have two options to install OpenWrt:

Replace only the secondary bootloader

If for any reason OpenWrt fails to boot, a recovery HTTP server can be started by keeping the reset button underneath pressed, while powering the router on.
Note that original fw .img can't be uploaded via recovery HTTP server.
  1. download a modified secondary bootloader here
  2. The modified secondary u-boot bootloader can be flashed from original web interface firmware upgrade section
  3. after replacing the original secondary bootloader over the original WebInterface with the version provided in the link, you need to reboot the device.
  4. since there is no OpenWrt in flash yet, after a reboot it will open HTTP server on 192.168.1.1 (tho it might be some other IP, such as 192.168.2.1; it probably depends on the IP preset in your nvram) asking for OpenWrt image.
The secondary_boot.img in the link above has broken networking, it works on some browsers and doesn't on others, but one can try older firefox versions, or booting win xp, or old linux distros in wm... After flashing it uploading through the HTTP server won't work. You have to use the serial interface and UART method afterwards as described below.

Replace both the primary and the secondary bootloader

This is used to flash u-boot as a primary bootloader. There are two methods to flash u-boot as a primary bootloader, first one from a runing openwrt image, and a second one from serial console
  1. before replacing the bootloader, make sure that you flashed secondary bootloader as noted above and that you are running openwrt fw from here
  2. obtain the replacement booloader by selecting it the buildmenu (configuration), or downlaod from snapshot
  3. if you compiled u-boot you will find the file u-boot-bootstrap.bin in ../trunk/bin/uboot-lantiq-gigaSX76X_DDRsamsung166/ after compilation.
  4. copy u-boot-bootstrap.bin to /tmp folder inside router filesystem.
  5. flash env to uboot_env partition with “dd if=/dev/mtdblock3 of=/dev/mtdblock4”
  6. flash u-boot-bootstrap.bin with “mtd write /tmp/u-boot-bootstrap.bin uboot”
  7. now reboot, run recovery HTTP server, and flash image from trunk
For the second method you must have a serial TTL interface installed! You need also a TFTP server and new built u-boot-bootstrap.bin in its root folder.
  1. U-boot CLI commands:
    setenv ipaddr 192.168.1.1
    setenv serverip 192.168.1.254
    
    //unprotect sectors
    protect off 1:0-20
    
    //first copy nvram to new address:
    era 0xb0010000 0xb001ffff
    cp.b 0xb000e000 0xb0010000 0x2000
    
    tftpboot 0x816e0000 u-boot-bootstrap.bin
    era 0xb0000000 0xb000ffff
    cp.b 0x816e0000 0xb0000000 0x10000
    reset
  1. since there is no OpenWrt in flash yet, first time after reboot the bootloader will open HTTP server on 192.168.0.119 asking for OpenWrt image.

Installation procedure for Barrier Breaker (BB)

(Thanks to snk for supporting and make it work)
Since the bootloader for AA is broken and there are not yet any BB-ready images, this will give you a temporary installation for BB. All BB images needed for installation can be found here.
This procedure uses a tftp server on your system. See the Wiki for detailed information. Set the computers IP address to 192.168.1.2. This is the serverip from which the router loads the images.

Follow the next steps for installation

  1. Download, sx762.img, sx762-fw.bin, u-boot.bin and place them into your tftp directory. The sx762-fw.bin contains the MAC address of your WIFI.
    Modify the bytes 22-27 (0x16-0x1b) of this file to contain your MAC address.
  2. Download u-boot.asc and place it in your local home directory.
  3. Set the router in UART mode and setup a serial link to your router (see below for detailed description).
  4. Copy the file u-boot.asc from your local home directory to the router ( “cat u-boot.asc > /dev/ttyUSB0”) and wait until the transfer is completed
  5. Because this bootloader is in RAM only we need to load the bootloader into ROM
    run update-uboot-nor
  6. After this is completed we can powerdown the router and remove the UART strippings. Leave the serial connection in place!
  7. Next power up the system and interrupt the bootproces with [space].
  8. Now we load the firmware into flash
    tftp sx762_fw.bin
    protect off 0xb07f0000 +$filesize
    erase 0xb07f0000 +$filesize
    cp.b $fileaddr 0xb07f0000 $filesize
    protect on 0xb07f0000 +$filesize
  9. Load the image into flash
    tftp sx762.img
    protect off $kernel_addr +$filesize
    erase $kernel_addr +$filesize
    cp.b $fileaddr $kernel_addr $filesize
  10. Reboot with the command: [reset].
  11. Enable wifi and off you go.
Architecture MIPS
Vendor Siemens/Sagem
Bootloader uboot
System-On-Chip Lantiq PSB 50702 E v1.3 or (v1.4) (MIPS 24Kc)
CPU/Speed 333 MHz (second core is for voip dsp)
Flash-Chip Spansion S29GL064A10TFIR4
Spansion S29GL064N90TFI04
Flash size 8 MiB
RAM 32 MiB
RAM Chip Samsung K4H561638H-UCB3
Micron MT46V16M16P-5B
Wireless SX763: Atheros AR2414A b/g/super g
SX762: Atheros AR2413 b/g
Ethernet Infineon ADM6996i (100Mbit)
Internet ADSL2+ (annex A and B)
USB Yes 1x 2.0
Serial Yes
JTAG Yes

CPU info:

system type : DANUBE
processor : 0
cpu model : MIPS 4KEc V4.1
BogoMIPS : 222.00
wait instruction : yes
microsecond timers : yes
tlb_entries : 16
extra interrupt vector : yes
hardware watchpoint : yes
VCED exceptions : not available
VCEI exceptions : not available

PCB:
Gigaset SX76x PCB Gigaset SX76x PCB Gigaset SX76x PCB Gigaset SX76x PCB Gigaset SX76x PCB

Note: This will void your warranty!

To get to the board you need:

  • unscrew 4 torx-10 screws underneath the cover,
  • pull the upper cover which is connected by click.

port.serial.

Pinout:
sx76x_serialv2.jpg sx76x_serialv2_zoom.jpg

If your serial cable requires a Vcc, you can use the lower-right pad (i.e. not the one just below the two GND pads, but the one below that).

Serial port is at 3.3V and the bitrate is 115200.

Serial output from default bootloader:

ROM VER: 1.0.3 CFG 01 Read EEPROMX X SHC Danube-External-Flash-Boot - Version V1.2 Mem-config: Flash: 8MB- 8MBx1 Ram: 32MB-32MBx1 Low level dbg is active... CPU0 MEMS ROM VER: 1.0.3 CFG 01 Read EEPROMX X SHC Danube-External-Flash-Boot - Version V1.2 Mem-config: Flash: 8MB- 8MBx1 Ram: 32MB-32MBx1 Low level dbg is active... CPU0 MEMS -- Danube Primary loader -- Version : 4.1.24.52.12 Build Profile : sx76x_danube_a Build Date : Jun 10 2009 - 17:11:31 --> Extract primary loader [ OK ] --> Validate secondary loader (FLASH) [ OK ] -- Danube Secondary loader -- Version : 4.1.28.52.12 Build Profile : sx76x_danube_b Build Date : Dec 15 2009 - 17:54:55 --> Extract secondary loader [ OK ] --> Press enter to activate cli [ 00 ] sx76x > help base - print or set address offset bootm - boot application image from memory bootp - boot image via network using BootP/TFTP protocol bootd - boot default, i.e., run 'bootcmd' cmp - memory compare cp - memory copy crc32 - checksum calculation erase - erase FLASH memory flinfo - print FLASH memory information go - start application at address 'addr' help - print online help loop - infinite loop on address range md - memory display mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nm - memory modify (constant address) printenv- print environment variables protect - enable or disable FLASH write protection rarpboot- boot image via network using RARP/TFTP protocol reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage setenv - set environment variables tftpboot- boot image via network using TFTP protocol and env variables ipaddr and serverip upgrade - data_block_name srcAddr srcLen 0/1 ? - alias for 'help' sx76x > printenv bootcmd=run flash_flash bootdelay=0 baudrate=115200 preboot=echo;echo Type "run flash_nfs" to mount root filesystem over NFS;echo hwboardid=sx76x-08-32 bootstrap=1 console_dev=ttyS1 validate_images=on keep_magic=on netdev=eth0 ramargs=setenv bootargs root=/dev/ram rw addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off ramdisk_addr=B0100000 flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr) bootfile=runtime.img primary_boot_file=primary_boot.img secondary_boot_file=secondary_boot.img runtime_file=runtime.img flashargs=setenv bootargs root=/dev/mtdblock1 rootfstype=squashfs flash_flash=run flashargs addmisc; bootm $(kernel_addr) update_primary=tftpboot 80400000 $(primary_boot_file);upgrade primary 80400000 $(filesize) 0 update_secondary=tftpboot 80400000 $(secondary_boot_file);upgrade secondary 80400000 $(filesize) 0 update_runtime=tftpboot 80400000 $(runtime_file);upgrade runtime 80400000 $(filesize) 0 reset_nvram=erase 0xB000E000 0xB000EBFF 1 addmisc=setenv bootargs $(bootargs) ethaddr=$(ethaddr) panic=1 tftp_RootDir=tftpboot tftp_DeviceDir=porta_danube tftp_Rootfspath=root kernelfile=uImage nfsargs=setenv bootargs root=/dev/nfs rw add_nfsrootfs=setenv bootargs $(bootargs) nfsroot=/$(tftp_RootDir)/$(tftp_DeviceDir)/$(tftp_Rootfspath) flash_nfs=run nfsargs add_nfsrootfs addip addmisc;bootm $(kernel_addr) nfs_flash=tftp 0x80400000 $(kernelfile);run flashargs addip addmisc;bootm 0x80400000 nfs_nfs=tftp 0x80400000 $(kernelfile);run nfsargs add_nfsrootfs addip addmisc;bootm 0x80400000 silent=0 rnd_num= hwid=Q706-B731 ethcnt=8 boardid=sx763 usbpower=1 platform_type=2 desc=CT013000000000xxxxxxxxx ethaddr=00:21:04:9E:xx:xx customer=0 default_variant=ethernet primary_version=v4.1.24.52.12 filesize=30180 gatewayip=192.168.2.1 ipaddr=192.168.2.1 serverip=192.168.2.16 variant=ethernet options=2 stdin=serial stdout=serial stderr=serial Environment size: 1933/3068 bytes


port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

Bootstrap pin funcion table:

X = boot_sel2 Y = boot_sel1 Z = boot_sel0 X Y Z function =============================================================== 0 0 0 External parallel flash 0 0 1 ROM > external parallel flash (default) 0 1 0 ROM > ethernet, MII0 0 1 1 ROM > PCI 1 0 0 ROM > UART1 1 0 1 ROM > serial SPI 1 1 0 ROM > NAND flash 1 1 1 ROM > Reverse MII0

Value 1 = 3.3v is connected to that pin
Value 0 = Pin is connected to digital GND

boot_sel2, boot_sel1, boot_sel0 pins location:
sx76x_boot_pins2-1-0.jpg
Note: boot_sel2 and boot_sel1 are by default on 0 and boot_sel0 is on 1.

To enable uart mode, short pins at boot_sel2 (see picture) and connect boot_sel0 to gnd. Than you can send u-boot.asc(downlaod here) to serial port.
For example if your serial port is ttyUSB0 than do: “cat u-boot.asc > /dev/ttyUSB0” and wait until u-boot starts.

UART mode looks like this:

ROM VER: 1.0.3
CFG 04
Read EEPROMX
 X
UART

SX763 uses a DC/DC switching regulator for 5V USB power, and unfortunately the chip is disabled by OpenWrt and other unofficial firmware (as of april 2013). The chip that provides 5V for USB has enable pin (number 7 to be exact), and the original firmware pulls the enable pin from 0.3V to 3.3V about two seconds before the relay makes a click sound.

According to datasheet, enable pin can be unconnected if we want the chip to auto-start, and that is exactly what we want. Therefore, we just need to disconnect the pin number 7 and SX763 will have 5V at USB connector all the time.

Note: When sx76x support gets back to trunk, there will be usb power by default so this hack wont be needed.

A close-up:

Another close-up is available at : http://pljusak.com/papuk/RSCN1314.JPG

The good sides of this hack are: 1) if you break the pin on the chip no harm is done, and 2) there are no side-effects in possible overloading the other 5V regulator that is used if you bring the 5V from another DC/DC regulator, as in hack that follows.

Previous version of 5V-USB hack follows:


Here is example of added usb power (5.05V measured) over simple pin solder so devices can be recognized on boot. You can even use WIFI dongles as from Attitude Adjustment 12.09-RC1 it works just fine. USB Dongle tested and working: Edimax EW-7722UnD a/b/g/n - Tested in 40mhz HT mode. Max speed measured (TCP): 20mbit (dirty conditions). Over USB hub you could add few more which makes this even a very good base station.

On USB port - solder first pin from top.

sx763_pcb_bottom.jpg sx763_usb5v_pin.jpg sx763_5v_pin.jpg

More info can be found on: http://linux.jezgra.net/2013/02/sx763-hack/

Please note that side-effects of this power mod are unknown. (Probably there should be no 'ugly-usb-patch' added anymore, so it doesn't give power on already powered pin.)

There are 10 gpio pins that i was able to find. Marked them on picture.

There is a tarball with basic code at http://opensource.sagemcom.com/index.php?id=54

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by 127.0.0.1