If you like BoxMatrix then please contribute Supportdata, Supportdata2, Firmware and/or Hardware (get in touch).
My metamonk@yahoo.com is not reachable by me since years. Please use hippie2000@webnmail.de instead.

FREETZ TYPE W504V 7270 V3

From BoxMatrix

BoxMatrix >> Development >> FREETZ TYPE W504V 7270 V3 @ BoxMatrix   -   IRC-Chat   -   Translate: de es fr it nl pl
News Selectors Models Accessories Components Environment Config Commands System Webif Software Develop Lexicon Community Project Media

Tarballs GPL-Browser FW-Probes FW-History FW-News Supportdata Hardware SVN Trac Freetz-News Freetz-Timeline Freetz-Releases Freetz-Mirror OpenWRT Research

Introduction[edit]

This is the Freetz-Alien for the Speedport W 504V MK, and turned the first Howto about coding a Freetz-Alien.

A Freetz-Alien modifies an AVM firmware to build Freetz for an alien model. This is mainly used for Telekom-Derivatives.

Comparison[edit]

The first step is to find an AVM model which best matches the alien model.
For the w504v this is easy since it's nearly a complete 7270v3 in Telekom casing style.

Features[edit]

The w504v just lacks the FONS0 port. This means we must patch CONFIG_CAPI_NT = n in the Alien-Script.

S
Model
Languages, Brandings
Internet
[Annex]
LAN
Ports
WLAN
802.11
PSTN
Lines
Phones SoC
Clock
RAM Flash USB
Host
Image
eos
sold
FRITZ!Box Fon WLAN 7270 v3
de, en, es, fr, it
avme, 1und1, avm, otwo
ADSL2+
A, B, J, M
USB-HSPA
100M: 4
300 Mb
2.4GHz
5GHz
POTS: 1
ISDN: 2
Analog: 2
ISDN: 8
DECT: 6
UR8
360 MHz
64 MB 16 MB
Ports: 1
USB: 2.0
FRITZ!Box Fon WLAN 7270-Image1.jpg
eos
dead
Speedport W 504V MK
de, en
avme
ADSL2+ 100M: 4
300 Mb
2.4GHz
5GHz
POTS: 1
ISDN: 2
Analog: 2
DECT: 6
UR8
360 MHz
64 MB 16 MB
Ports: 1
USB: 2.0
Speedport W 504V MK-Image3.jpg

Hardware[edit]

The w504v has a different FPGA. This means that we must adapt the FPGA-Bitfiles in the Alien-Script.

Chips-SelectorSoCRAMFlashFPGAFONDECTWLANLANUSBTrafoPSUMisc
FRITZ!Box Fon WLAN 7270 v3TNETD7531ZDW
TNETD80PGP
W9825G6EH-6M29W128GH-70N6
S29GL128P-90TFIR1
XC3S250EIA3222B
LM324
BCP53-16
SC14488-ANF80VEAR9220-AC1A
SE2593A20
AR8216-BH1A504-13-066-00
VOGT-5472
VOGT-5203
513-40-914-00
513-16-012-00
WE-52413-LF1
MP2205
MP2354DS
Speedport W 504V MKPSB7531ZDW
TNETD80PGP
MT48LC16M16A2-6AMX29GL128EHT2I-90GXC3S100EIA3222B
LM324
BCP53-16
SC14488-ANF80VEAR9220-AC1A
SE2593A20
AR8216-BH1A504-13-066-00
VOGT-5472
VOGT-5203
LFE8731
503-20-999-00
MP28252

Firmware[edit]

For older models including the 7270v3 there are different firmwares for german and international variants of a model.

  • The dumped international w504v firmware is 5.04-22376 using kernel 2.6.32.21.
  • The last international 7270v3 firmware using the same kernel is release 5.06-21061 - see the History
  • The latest international 7270v3 firmware is release 5.53-27445 using kernel 2.6.32.41

Freetz supports building for international 7270v3 5.20+ and 5.50+.

Config-Diff[edit]

Pseudo-Diff of the Config-Environment of the w504v 5.04 and 7270v3 5.53 firmwares.

################################################################################
+++ FRITZ.Box_Fon_WLAN_7270_v3.en-de-es-it-fr.74.05.53.image
--- fw_Speedport_W504V_avm_dump_v92.05.04.image
################################################################################

########################################
### Config changes
########################################

+++ AURA = y
--- AURA = n
+++ BETA_RELEASE = 0
--- BETA_RELEASE = 
+++ BOXLOWRESSOURCES = n
--- BOXLOWRESSOURCES = 
+++ BOX_FEEDBACK = n, y
--- BOX_FEEDBACK = n
+++ CAPI_NT = y
--- CAPI_NT = n
+++ CXX = n, y
--- CXX = 
+++ DECT_HOME = y
--- DECT_HOME = 
+++ DECT_MONI_EX = y
--- DECT_MONI_EX = n, y
+++ DSL_2DP = y
--- DSL_2DP = 
+++ DSL_MULTI_ANNEX = y
--- DSL_MULTI_ANNEX = n
+++ ECO_SYSSTAT = y
--- ECO_SYSSTAT = n
+++ ERR_FEEDBACK = y
--- ERR_FEEDBACK = 
+++ EWETEL_SMARTMETER = n, y
--- EWETEL_SMARTMETER = n
+++ FAXSEND = n
--- FAXSEND = 
+++ FON_IPPHONE = y
--- FON_IPPHONE = n
+++ HOME_AUTO = y
--- HOME_AUTO = 
+++ HOME_AUTO_NET = n
--- HOME_AUTO_NET = 
+++ HOSTNAME = fritz.fonwlan.box
--- HOSTNAME = speedport.ip
+++ INSTALL_TYPE = ar7_2MB_1eth_oem_AOL_32711, ur8_16MB_xilinx_4eth_2ab_isdn_nt_te_pots_wlan_usb_host_dect_plus_55266
--- INSTALL_TYPE = ar7_2MB_1eth_oem_AOL_32711, ur8_16MB_xilinx_4eth_2ab_isdn_pots_wlan_usb_host_dect_504avm_07585
+++ MANUAL_URL = <comp>
--- MANUAL_URL = 
+++ MEDIACLI = y
--- MEDIACLI = n
+++ MTD_MAIL = y
--- MTD_MAIL = n
+++ MTD_MAILSEND = y
--- MTD_MAILSEND = n
+++ MTD_RSS = y
--- MTD_RSS = n
+++ MULTI_COUNTRY = y
--- MULTI_COUNTRY = n
+++ MULTI_LANGUAGE = y
--- MULTI_LANGUAGE = n
+++ MYFRITZ = y
--- MYFRITZ = 
+++ NAS = y
--- NAS = n
+++ NCURSES = n
--- NCURSES = 
+++ NEWSLETTER_URL = <comp>
--- NEWSLETTER_URL = 
+++ ONLINEPB = y
--- ONLINEPB = n
+++ OPENSSL = 
--- OPENSSL = n
+++ PLC = n
--- PLC = 
+++ PLC_DETECTION = y
--- PLC_DETECTION = 
+++ PRODUKT = Fritz_Box_7270plus
--- PRODUKT = Fritz_Box_504avm
+++ PRODUKT_NAME = FRITZ!Box Fon WLAN 7270 v3
--- PRODUKT_NAME = Speedport W 504V
+++ PROV_DEFAULT = y
--- PROV_DEFAULT = n
+++ RAMDISK = y
--- RAMDISK = n
+++ SDK = y
--- SDK = n
+++ SPEECH_FEEDBACK = n, y
--- SPEECH_FEEDBACK = n
+++ SUBVERSION = <comp>
--- SUBVERSION = -22376
+++ TAM_MODE = 1
--- TAM_MODE = 0
+++ UPDATEFEATURE_URL = <comp>
--- UPDATEFEATURE_URL = 
+++ USB_GSM = y
--- USB_GSM = n
+++ USB_GSM_VOICE = y
--- USB_GSM_VOICE = n
+++ USB_TETHERING = n
--- USB_TETHERING = 
+++ VERSION = 05.53
--- VERSION = 05.04
+++ VERSION_MAJOR = 10, 74
--- VERSION_MAJOR = 10, 92
+++ VPN = y
--- VPN = n
+++ WEBUSB = y
--- WEBUSB = n
+++ WLAN_ATH_NM_COMBO = n
--- WLAN_ATH_NM_COMBO = 
+++ WLAN_ATH_NM_OFFLOAD = n
--- WLAN_ATH_NM_OFFLOAD = 
+++ WLAN_GUEST = y
--- WLAN_GUEST = n
+++ WLAN_WDS = n
--- WLAN_WDS = y
+++ WLAN_WDS2 = y
--- WLAN_WDS2 = 
+++ WLAN_WDS_NO_SLAVE = n
--- WLAN_WDS_NO_SLAVE = 

There are 3 groups of differences:

  • Hardware differences - CAPI_NT
  • Model differences - INSTALL_TYPE, PRODUKT, PRODUKT_NAME, VERSION_MAJOR
  • Omitted and new features

The first 2 groups need to be addressed in the Alien-Script. We want to turn the omitted and new features into Advantages.

Advantages[edit]

The Webinterface of the w504v looks surprisingly uncrippled for a Telekom model, but the Config diff shows the difference.
The alien will add these features, which partly were omitted and partly come from the more recent 7270v3 5.53 firmware:

I18N:

Networking

  • Support for stepping back to the prior DSL firmware - DSL_2DP
  • Support for using the MyFRITZ! service - MYFRITZ
  • Support for VPN - VPN
  • Support for detecting Powerline devices - PLC_DETECTION
  • Support for very early Smarthome support - HOME_AUTO - officially starting in 6.0

Wireless:

  • Support for a WLAN guest network - WLAN_GUEST
  • Support for WDS2 to act as a WLAN-Repeater with all recent models - WLAN_WDS2
  • Support for repeating DECT (!!!)

Telephony

  • Support for IP-Phones - FON_IPPHONE
  • Support for Online-Phonebooks - ONLINEPB
  • Support for reading Email with the FRITZ!Fon - MTD_MAIL
  • Support for sending Email with the FRITZ!Fon - MTD_MAILSEND
  • Support for reading RSS feeds with the FRITZ!Fon - MTD_RSS
  • Support for using the FRITZ!Fon as an audio player - MEDIACLI
  • Support for the DECT section in the Webinterface - DECT_HOME
  • Support for the extended DECT monitor - DECT_MONI_EX

USB-Host

System

Menuconfig[edit]

A Freetz build starts with installing the prerequisites, checking out the repo and running make menuconfig after,
a menu driven system to customize a build. Menuconfig uses the Linux Kconfig Language.

Model-Selection[edit]

The first step is to select a Hardware type / Target region / Firmware version (generation) to build Freetz for.
In our case this is 7270 v3 / avme international / FRITZ!OS 05.20+ or FRITZ!OS 05.50+, which specifies
the AVM firmware to borrow and adapt. This is already implemented and sets the .config variables:

  • FREETZ_TYPE_7270_V3
  • FREETZ_TYPE_LANG_EN
  • FREETZ_TYPE_FIRMWARE_05_2X or FREETZ_TYPE_FIRMWARE_05_5X

This combination does not permit building an alien so far. We have to modify config/ui/firmware.in for the following steps.

config FREETZ_TYPE_ALIEN_HARDWARE
       ...
       depends on ...
               ...
               (FREETZ_TYPE_7270_V3 && FREETZ_TYPE_LANG_EN) || \
               ...

This will enable the menu Compile image for 'alien' hardware and we have to specify for which model:

choice
        prompt "Alien hardware type"
        depends on FREETZ_TYPE_ALIEN_HARDWARE
        ...
        config FREETZ_TYPE_W504V_7270_V3
                bool "Speedport W504V MK"
                depends on FREETZ_TYPE_7270_V3 && FREETZ_TYPE_LANG_EN
                select FREETZ_REPLACE_KERNEL if FREETZ_TYPE_FIRMWARE_05_5X
                help
                        Enable this to compile a mod image for the Macedonian Speedport W504V.

If seleted this will set the FREETZ_TYPE_W504V_7270_V3 .config variable for our further needs.

The select FREETZ_REPLACE_KERNEL ... line is optional and is explained in the Replace-Kernel section below.

Firmware-Location[edit]

Menuconfig is not only used for the interactive part but does a lot of settings, like specifying the firmware and its location.
We have to modify config/mod/dl-firmware.in for the next steps.

For the 7270v3 there's a strange logic which disables our 7270v3 firmwares for aliens by default unless they are explicitely
whitelisted. Without these changes the alien firmware would be used as primary which fails, including the Alien-Script.

Looking at the amount of aliens which have to defeat this questionable not-alien-but logic this needs a review for sure.
However, this is an alien and no freetz improvement so we just extend this logic for now.

config FREETZ_DL_SITE
    ...
    default "@AVM/fritzbox.fon_wlan_7270_v3/firmware/english"                                                          if ((FREETZ_TYPE_7270_V3 && ! FREETZ_TYPE_ALIEN_HARDWARE) || FREETZ_TYPE_3270_V3_7270_V3 || FREETZ_TYPE_7240_7270 || FREETZ_TYPE_7570_7270 || FREETZ_TYPE_W504V_7270_V3) && FREETZ_TYPE_LANG_EN
    ...
config FREETZ_DL_SOURCE
    ...
    default "FRITZ.Box_7270_v3.Int.74.05.24.image"                                         if ((FREETZ_TYPE_7270_V3 && ! FREETZ_TYPE_ALIEN_HARDWARE) || FREETZ_TYPE_3270_V3_7270_V3 || FREETZ_TYPE_7240_7270 || FREETZ_TYPE_7570_7270 || FREETZ_TYPE_W504V_7270_V3) && FREETZ_TYPE_LANG_EN && FREETZ_TYPE_FIRMWARE_05_2X
    default "FRITZ.Box_Fon_WLAN_7270_v3.en-de-es-it-fr.74.05.53.image"                     if ((FREETZ_TYPE_7270_V3 && ! FREETZ_TYPE_ALIEN_HARDWARE) || FREETZ_TYPE_3270_V3_7270_V3 || FREETZ_TYPE_7240_7270 || FREETZ_TYPE_7570_7270 || FREETZ_TYPE_W504V_7270_V3) && FREETZ_TYPE_LANG_EN && FREETZ_TYPE_FIRMWARE_05_5X

Next we have to enable downloading the alien firmware:

config FREETZ_DL_ALIEN
       ...
       depends on \
               ...
               FREETZ_TYPE_W504V_7270_V3 || \
               ...

Next we specify the path. This would be ie.@TELEKOM/Speedport/Speedport W 504V MK but pointless for a dump.
We can not legally put the dump online anywhere so we use an empty path:

config FREETZ_DL_SITE2
       ...
       default ""            if FREETZ_TYPE_W504V_7270_V3 
       ...

Next we specify the filename. This is important so Freetz finds it since we have to place it manually to dl/fw.

config FREETZ_DL_SOURCE2
       ...
       default "fw_Speedport_W504V_avm_dump_v92.05.04.image"       if FREETZ_TYPE_W504V_7270_V3 
       ...

Finally there is an optional hash which is only used for downloaded files, but for the sake of completeness it would be:

config FREETZ_DL_SOURCE2_HASH
       ...
       default "<hash>"      if FREETZ_TYPE_W504V_7270_V3 
       ...

Skip this, we do not provide a hash.

Firmware-Prefix[edit]

To be able to distinguish between a normal 7270v3 build and an alien the alien gets a descriptive prefix to its filename.
We have to modify config/mod/prefix.in:

config FREETZ_TYPE_PREFIX_ALIEN_HARDWARE
       ...
       default "W504V_"      if FREETZ_TYPE_W504V_7270_V3 
       ...

Firmware-Signature[edit]

By default Freetz validates a firmware image by the AVM signatures it contains as an integrity test.
Since we only have a fake firmware built from a partition dump we have to disable this for our alien.

We have to modify config/ui/fwmod.in:

config FREETZ_FWMOD_VALIDATE
       ...
       depends on !FREETZ_TYPE_W504V_7270_V3 
       ...

Freetz TODO: Provide a method to just disable validation for the TK firmware, after this pull request.

Building[edit]

After all make menuconfig settings are finished we call make to start building Freetz.

Build-Process[edit]

Simplified Freetz does: (in unfinished order)

  • Download the firmware(s)
  • Download or build the toolchain (cross compiler etc)
  • Download and build the AVM enhanced kernel (if required)
  • Download and build busybox, libc and further packages
  • Unpack the firmware(s)
  • Install all built stuff
  • Apply all mod patches and possible removal patches
  • Run a possible Alien-Script
  • Repack the firmware

File-Structure[edit]

To understand how to code modifications it's important to know where everything is located.

The primary firmware is extracted to:

  • build/original/firmware - the content of the firmware tar image
  • build/original/filesystem - the content of the rootfs
  • build/original/kernel - the AVM kernel

Then build/original is cloned to build/modified before any changes are applied.

A possible alien firmware is extracted to:

  • build/.tk/original/firmware - ${FIRMWARE_TK_DIR}
  • build/.tk/original/filesystem - ${FILESYSTEM_TK_DIR}
  • build/.tk/original/kernel - ${KERNEL_TK_DIR}

All changes are applied to:

  • build/modified/firmware - ${FIRMWARE_MOD_DIR}
  • build/modified/filesystem - ${FILESYSTEM_MOD_DIR}
  • build/modified/kernel - ${KERNEL_MOD_DIR}

This is what is repacked later. Only use the variables listed above in Freetz scripts.

Alien-Script[edit]

We call our script 100-w504v_7270v3.sh and put it to patches/cond/100-aliens/scripts.

Script-Header[edit]

The header exits silently if the current build is not for our FREETZ_TYPE and otherwise fails if there is no alien firmware.

# 7270v3 firmware on Macedonian W504V hardware, grown at:
# https://boxmatrix.info/wiki/FREETZ_TYPE_W504V_7270_V3

isFreetzType W504V_7270_V3 || return 0

if [ -z "$FIRMWARE2" ]; then
	echo "ERROR: no tk firmware" 1>&2
	exit 1
fi
echo1 "adapt firmware for Macedonian W504V"

Default-Config[edit]

We have to rename the default config folder or we get a Reboot-Loop.

echo2 "moving default config dir"
mv "${FILESYSTEM_MOD_DIR}/etc/default.Fritz_Box_7270plus" "${FILESYSTEM_MOD_DIR}/etc/default.Fritz_Box_504avm"

Brandings[edit]

The Default-Config above has subfolders for each supported branding. These need to match or we get a Reboot-Loop.
Since both models are avme we can skip this step. Otherwise symlinks for missing brandings would have to be created.
Besides this symlinks for missing brandings would have to be created in /usr/www to have the files for the Webinterface.

Config-Environment[edit]

We have to adapt the Config-Environment in rc.conf. Freetz provides modsed, a sed wrapper which reports errors.

echo2 "patching rc.conf"

# model differences
modsed "s/CONFIG_PRODUKT_NAME=.*$/CONFIG_PRODUKT_NAME=\"FRITZ!Box Speedport W504V\"/g" "${FILESYSTEM_MOD_DIR}/etc/init.d/rc.conf"
modsed "s/CONFIG_PRODUKT=.*$/CONFIG_PRODUKT=\"Fritz_Box_504avm\"/g" "${FILESYSTEM_MOD_DIR}/etc/init.d/rc.conf"
modsed "s/CONFIG_INSTALL_TYPE=.*$/CONFIG_INSTALL_TYPE=\"ur8_16MB_xilinx_4eth_2ab_isdn_pots_wlan_usb_host_dect_504avm_07585\"/g" "${FILESYSTEM_MOD_DIR}/etc/init.d/rc.conf"

# no FONS0 port
modsed "s/CONFIG_CAPI_NT=.*$/CONFIG_CAPI_NT=\"n\"/g" "${FILESYSTEM_MOD_DIR}/etc/init.d/rc.conf"

FPGA-Bitfiles[edit]

Now it gets complicated a bit. The 7270v3 uses a 250k Sytem Gates FPGA and loads a single bitfile.bit.
The w504v uses a 100k Sytem Gates FPGA and loads bitfile_isdn.bit or bitfile_pots.bit, depending on the landline mode.
We have to change the bitfiles:

echo2 "changing bitfiles"
rm "${FILESYSTEM_MOD_DIR}/lib/modules/bitfile.bit"
cp "${FILESYSTEM_TK_DIR}/lib/modules/bitfile_isdn.bit" "${FILESYSTEM_MOD_DIR}/lib/modules"
cp "${FILESYSTEM_TK_DIR}/lib/modules/bitfile_pots.bit" "${FILESYSTEM_MOD_DIR}/lib/modules"

Now we have to replace S11-piglet, which loads Piglet_noemif.ko and its bitfiles.

echo2 "replacing S11-piglet"
cp -pf "${FILESYSTEM_TK_DIR}/etc/init.d/S11-piglet" "${FILESYSTEM_MOD_DIR}/etc/init.d"

Now we have to verify that Piglet_noemif.ko supports the parameters to pass separate bitfiles. modinfo says yes.
Otherwise we would have to copy Piglet_noemif.ko from the alien firmware.

Finally we must compare the names of the DECT firmware files, since they are also loaded in the alien S11-piglet.
In both firmwares they are dectfw_firstlevel_488.hex and dectfw_secondlevel_488.hex, so we are done with the Piglet.

See also the Remove-Piglet patches we adapt below.

LED-Mapping[edit]

A repeating issue with Telekom aliens is that they use the LEDs wrong (compared to the description on their casing).
This is a cosmetical problem and does not harm anything but it also affects the Button-Mapping.

AVM coded so many LED / Button driver solutions that you could write a book about it.
"20 years of mapping 200 functions to 5 LEDs using 1 new solution per year" would be an exaggerated title, but it's close.

In older firmware it was possible to "just" patch led.conf, but this does not work here.
See patches/cond/100-aliens/scripts/100-w701v_7170.sh.as an example how tricky this is for 12 LEDs.

The LED kernel drivers always were open source but AVM uses the proprietary external led_module.ko here.
This module is device specific and contains the LED and Button mappings for the respective model.

In the w504v firmware it appears as led_modul_Fritz_Box_504avm in lsmod.
In our alien with the 7270v3 module it appeared as led_modul_Fritz_Box_7270plus first.

We replaced the module, a method which is also used in patches/cond/100-aliens/scripts/100-w920v_7570.sh.
In the w920v alien it's only used for old 4.x firmware with kernel 2.6.19.2, since there is no module for a more recent kernel.
For more recent firmware one has to accept the 7570 LED-Mapping and use some tape to give LEDs matching descriptions.
That's the shit with closed source modules! Nonsense to make mappings between events and GPIO lines proprietary.

We first had a similar problem since we only have a module for kernel 2.6.32.21, but would need one for kernel 2.6.32.41.
We were lucky and patching the module version string was enough to make everything work:

echo2 "replacing led_module"
# target path fits for 5.24 and 5.53
cp -f "${FILESYSTEM_TK_DIR}/lib/modules/2.6.32.21/kernel/drivers/char/led_module.ko" "${FILESYSTEM_MOD_DIR}/lib/modules/2.6.32.41/kernel/drivers/char"
# patch the module version string
modsed "s/2\.6\.32\.21/2.6.32.41/g" "${FILESYSTEM_MOD_DIR}/lib/modules/2.6.32.41/kernel/drivers/char/led_module.ko"

WLAN-Config[edit]

Now we need to review wlan-feature.cfg, which contains some HWRevision sensitive config for WLAN.

Since it does not contain anything special for the 7270v3 or its HWR 145 we can skip this step.
Otherwise we would have cloned it or patched it for our HWR 164.

WAN-Router[edit]

This is still an open issue.

Our alien failed to be set up as a WAN-Router. The Webinterface accepted the settings but restarting the network stack after
made the box reboot and switch back to DSL-Router mode. A strange error since there are no hardware differenes to a 7270v3.

Experimentally replacing the proprietary dsl_ur8.ko module from the TK firmware fixed this issue.
But we don't want to use old DSL drivers so we must find a better solution which works with the 7270v3 module.

First it looks confusing that a DSL driver disturbs the WAN-Router mode which disables DSL.
But it's exactly this driver which distinguishes which model is capable of doing so. This is also called the ATA-Mode.

dsl_ur8.ko reads the HWRevision and decides whether a model gets the internal is_ATA_Ld_Hw flag.
This is reported in the boot log and the corresponding DSL mode could be entered later.

For the w504v the 7270v3 module plain does not know this correlation.
But it's closed source and there are no patchable HWR numbers in its strings.

We use another trick. We patch the HWRevision variable name inside dsl_ur8.ko to DMC, padding with 7 zero bytes.
DMC is not used by the 7270v3, so we can set it in the startup script E40-dsl to the HWR 145 of the 7270v3.

echo2 "patching dsl driver"
modsed "s/HWRevision/DMC\x00\x00\x00\x00\x00\x00\x00/g" "${FILESYSTEM_MOD_DIR}/lib/modules/2.6.32.41/kernel/drivers/dsl/dsl_ur8.ko"
echo2 "patching E40-dsl"
modsed "s/modprobe/echo \"DMC 145\" > \/proc\/sys\/urlader\/environment\nmodprobe/g" "${FILESYSTEM_MOD_DIR}/etc/init.d/E40-dsl"

Let's see if this works.

Install-Script[edit]

Now comes the most challenging and dangerous part, adapting the install script.
We only have a fake alien firmware built from a partition dump, so we have no install script to compare.

To be able to update through the Webinterface we have to adapt the 7270v3 install script,
which is dangerous on NOR-Flash models.

First we have to compare the mtd2 partition size of both models, the partition which contains the EVA bootloader.
This is very important since the flash_update.ko module used to update does not care about partition sizes.
It just gets an absolute offset in the Flash from the install script. mtd1 getting the update physically comes above mtd2.

Using a NOR-Flash install script for a smaller bootloader will overwrite parts of EVA and brick your device!

Thanks god both models have the same flash size and partition layout. So we can safely:

# patch install script to accept firmware for w504v
echo2 "applying install patch"
modsed "s/ur8_16MB_xilinx_4eth_2ab_isdn_nt_te_pots_wlan_usb_host_dect_plus_55266/ur8_16MB_xilinx_4eth_2ab_isdn_pots_wlan_usb_host_dect_504avm_07585/g" "${FIRMWARE_MOD_DIR}/var/install"

This was tested and works as expected, see Webif-Update below.

Replace-Kernel[edit]

Today Freetz only builds a kernel if there's the need to build additional Kernel-Modules or add features to the kernel.
By default Freetz uses the original AVM kernel for the modified image, if possible.
Replace-Kernel (short RK) enforces to use a Freetz built kernel instead.

Unfortunately RK support is a lot of tweaking and testing until it works, and this work requires a Serial-Console.
For the masses of Box-Models AVM developed there are plain not enough coders who want to void their warranty by soldering.
That's why there is no RK support for recent models and Freetz even removed the menu to activate RK manually.

Internally Menconfig still can select it where it's required and tested. This is ie. used for adding IPv6 support to the 7270v1.
RK also works for the 7270v3, thanks god, we need it for addressing the 5.5x Network issue explained below.

Activation[edit]

We had to modify config/ui/firmware.in again.

config FREETZ_TYPE_W504V_7270_V3
     ...
    select FREETZ_REPLACE_KERNEL if FREETZ_TYPE_FIRMWARE_05_5X
    ...

This is already done in the Model-Selection section above.

Patches[edit]

Since Freetz does not contain any kernel source changes to kernel code are collected as patches.

For the 2 firmwares we support these are in:

Global patches for this kernel version are in:

We use the per firmware folders, since they have different patching needs, see below.

Network[edit]

Our 5.5x alien booted with the 7270v3 AVM kernel but was not accessible at any LAN port.

This was due to missing HWRevision sensitive config for the avm_cpmac.ko network driver.

Even the latest 7270 kernel source does not have CPMAC config for the w504v.

See: ur8-7270-606/linux-2.6.32.60/drivers/net/avm_cpmac/cpmac_product_conf.c

We clone the config for the Fritz_Box_7270plus (HWRevision 145) and place it at the right position to preserve the order:

        { /* Fritz_Box_Puma */
            "157 ",
            ...
        },
        { /* Fritz_Box_504avm */
            "164 ",
            2,
            {
                {
                    CPMAC_PHY_TYPE_AR8216,
                    CPMAC_PHY_MODE_AR8216,
                    0x1f,
                    26,
                    0x0
                },
                {
                    CPMAC_PHY_TYPE_NONE,
                    CPMAC_PHY_MODE_DEFAULT,
                    0x1,
                    0xffff,
                    0x0
                }
            }
        },
        { /* Fritz_Box_7270v4 */
            "167 ",
            ...
        },

We apply these changes to:

source/kernel/ref-ur8-7270_05.51/linux-2.6.32/drivers/net/avm_cpmac/cpmac_product_conf.c

There is already make/kernel/patches/2.6.32.41/7270_05.51/490-fix_7570_alien_lan.patch patching the same file.

We merge both changes and call the patch 490-fix_alien_lan.patch (deleting the 7570 patch).

The 5.2x build boots the 7270v3 AVM kernel without RK and does not need to be patched for LAN.

Remove-Patches[edit]

Since an alien modifies the borrowed AVM firmware some Remove-Patches may need to get adapted to work correctly.

Remove-Piglet[edit]

Since we changed the FPGA-Bitfiles we have to explain to Freetz that we have multiple bitfiles now.
This will enable the options to remove POTS and ISDN bitfile(s) separately.

First we have to modify config/avm/features.in:

config FREETZ_AVM_HAS_PIGLET_POTS
        ...
        depends on \
             ... || \
             FREETZ_TYPE_W504V_7270_V3
...
config FREETZ_AVM_HAS_PIGLET_ISDN
        ...
        depends on \
             ... || \
             FREETZ_TYPE_W504V_7270_V3

Next we have to modify config/ui/patches.in:

config FREETZ_REMOVE_PIGLET_ISDN_AVAILABLE         ...
        ...
        default y if \
             ... || \
             FREETZ_TYPE_W504V_7270_V3
...
config FREETZ_REMOVE_PIGLET_POTS_AVAILABLE         ...
        ...
        default y if \
             ... || \
             FREETZ_TYPE_W504V_7270_V3

Quite some double logic but it does what it should.

Installation[edit]

Webif-Update[edit]

According to my firmware scanner the w504v supports unsigned firmware, see the Speedport W 504V MK History.

This was tested to be true and the Install-Script works as expected.

push_firmware[edit]

If you don't want to use the Webif-Update method use tools/push_firmware from your Freetz build (without arguments).

This will use TinyFTP to EVA uploading your last build to mtd1.

Usage[edit]

Factory-Reset[edit]

After the first successful boot of a new alien it is always recommended to perform a Factory-Reset.

This will apply clean defaults which match the installed firmware. This will not affect your Freetz settings.

Enjoy[edit]

If everything works enjoy your new toy!

Debugging[edit]

Downgrade[edit]

During development we often had to switch from the 5.5x build to 5.2x for testing, which is a Downgrade.

This is no problem if the Webinterface still supports a Downgrade, since this will perform a Factory-Reset to avoid problems.

The push_firmware method does not. Running 5.2x with a newer config caused ctlmgr to crash and we had no Webinterface.

We had to manually perform a Factory-Reset from a Shell:

setfactorydefaults
reboot

This could be run from Telnet, SSH (dropbear or openssh) or from System > Rudi Shell if the Freetz webif is still alife.

Watchdog[edit]

If an AVM service like ctlmgr crashes this is an ungraceful termination, which does not remove its Watchdog.

The Watchdog will notice that it did not get triggered within its timeout and causes a reboot.
For ctlmgr this is after approx. 2 minutes. To have more time for debugging we can disable this:

echo disable > /dev/watchdog

For hard to debug stuff you could put this temporarily to Freetz >> rc.custom in the Freetz webif.

Don't forget to remove this for production use later.

Reboot-Loop[edit]

During development it can happen that you get a reboot loop.

With a Serial-Console you can easily see what caused the crash.
But most developers try to avoid soldering since it voids the warranty of a box.

It is helpful to count the seconds between boots to get an idea where the problem resides.

A reboot after approx. 20 seconds typically shows a problem with the Default-Config or a Branding

A reboot after approx. 2 minutes typically comes from the Watchdog. You can disable it and study the logs.

MTD-Clean[edit]

Cleaning mtd3 and mtd4 during development with a zeroed file is a very bad habit from 20 years ago.
It should never be done without a prior backup since it always has negative consequences.

Since the w504v firmware still supports Telnet it was easy to get dumps.
After cleaning the partitions EVA only was reachable at the Telekom default IP 192.168.2.1.

We restored our backups and got the AVM default IP back.

Project[edit]

History[edit]

WIP[edit]

TODO[edit]

Future[edit]

After the sucessful cooperation to build the model article and Freetz-Alien within 7 evenings we will create another alien.
It will cover the Speedport W 503V MK, a way more limited Macedonia-only model, see FREETZ_TYPE_W503MK_7270_V3.