Add support of Fritz_Box_HW259 - FRITZ!Box 7590 AX v2 Edition International

[Ircama]

Add support of Fritz_Box_HW259 - FRITZ!Box 7590 AX v2 Int.

EDIT: since a5adba8 freetz-ng can be installed on Fritz_Box_HW259 - FRITZ!Box 7590 AX.

---

I'm afraid that Fritz_Box_HW259 is not yet supported by freetz-ng (at least, not included in push_firmware at the moment).

tools/push_firmware obvously does not work.

Can you please drive on the right parameters and fit-boot/ram-boot mode? Notice that the generated images do not include '*/fit-image' at the moment, so generating a fit-boot image does not appear possible.

Relevant data

• FRITZ!Box 7590 AX v2 Edition International
• Fritz_Box_HW259
• Firmware version: 7590AX_07.57 (FRITZ!OS: 7.57)
• Image 7590AX_07.57 or 7590AX_07.57.all-rev107809_labor

Parameters manually obtained via FTP:

ProductID             Fritz_Box_HW259
annex                 A
autoload              yes
bootloaderVersion     1.11744
firmware_info         259.07.57
firmware_version      avme
flashsize             nor_size=0MB sflash_size=0KB nand_size=512MB
memsize               0x20000000
HWRevision            259
firstfreeaddress      0x852A7500
mtd0                  0x0,0x2C00000
mtd1                  0x900000,0x1100000
mtd2                  0x0,0x100000
mtd3                  0x100000,0x900000
mtd4                  0x1100000,0x1900000
my_ipaddress          192.168.178.1
prompt                Eva_AVM
linux_fs_start        1

make menuconfig runs without problems and generates the image.

make menuconfig

Hardware series (7490/7590)
Hardware type (7590 AX)
Target region (avme - international)
Firmware version (FRITZ!OS 07.70 Labor - UNTESTED)

Or

Firmware version (FRITZ!OS 07.50+)

Example of generated image:

-rw-r--r-- 1 user user 46131200 gen 15 01:04 7590AX_07.57.all-rev107809_labor_freetz-ng-23030M-1f6dce575_20240115-010359.image

Should we use fit-boot or ram-boot? Forcing Fit-boot to tools/push_firmware generates "Error: file is not a valid fit-boot image to be written to the device.".

Example of tar:

tar tvf images/7590AX_07.57.all_freetz-ng-23030M-1f6dce575_20240117-215824.image
drwxr-xr-x 0/0               0 2024-01-17 21:58 ./var/
-rw-r--r-- 0/0              35 2023-09-02 00:52 ./var/version
-rw-r--r-- 0/0           93153 2024-01-17 21:58 ./var/.config
-rw-r--r-- 0/0              14 2023-09-02 00:52 ./var/install-features
drwxr-xr-x 0/0               0 2024-01-17 21:58 ./var/tmp/
-rw-r--r-- 0/0        42999816 2024-01-17 21:58 ./var/tmp/filesystem.image
-rw-r--r-- 0/0         7213576 2024-01-17 21:58 ./var/tmp/kernel.image
-rw-r--r-- 0/0             356 2023-09-02 00:52 ./var/content
-rwxr-xr-x 0/0           55232 2023-09-02 00:52 ./var/chksum
-rw-r--r-- 0/0             290 2024-01-17 21:58 ./var/.packages
-rwxr-xr-x 0/0           20935 2024-01-17 21:58 ./var/install
-rw-r--r-- 0/0            2807 2023-09-02 00:52 ./var/info.txt
-rw-r--r-- 0/0             128 2024-01-17 21:58 ./var/signature

No '*/fit-image' wildcard exists.

The push_firmware sequence needs two reboot, then freezes with no upload, regardless I use -ram 512 -lfs 1 -f -w -map 0x00 (parameters which I am not sure are correct).

A subsequent reboot restarts normally (without freetz-ng).

push_firmware details

 * Product: Fritz_Box_HW259 (FRITZ!Box 7590 AX)
 * Using command: ftp
 * Target host: 192.168.178.1
 * Outgoing IP: unknown
 * Flash mode: ram-boot
 * Allowed memory size: 128 MB
 * Designated linux_fs_start: <other>
...
 * MAPSTART=0x80000000
 * FULLSIZE=0x08000000   (128 MB)
 * MAPLIMIT=0x88000000
 * FILESIZE=0x02fe3200   (~47 MB)
 * ALIBYTES=0x00000000   (~0 kB)
 * FREESIZE=0x0501ce00   (~80 MB)
 * MTDSTART=0x8501ce00

 * No reply from box, assuming switch-off or restart. Trying to re-detect box.
   Waiting ................................... found!

 * Detected linux_fs_start: '1'
 * Designated linux_fs_start: 0

The device freezes. I have to manually restart it.

 * No reply from box, assuming switch-off or restart. Trying to re-detect box.
   Waiting ......................................................................... found!

 * Box is back up again, initiating transfer.

Debugging on (debug=1).
---> TYPE I
---> MEDIA SDRAM
---> SETENV memsize 0x0501ce00
---> SETENV kernel_args_tmp mtdram1=0x8501ce00,0x88000000
ftp: setsockopt (ignored): Permission denied
---> PASV
---> STOR 0x8501ce00 0x88000000
netout: Connection reset by peer

In this case, the FTP put command is:

put /tmp/freetz_V7V/ramboot.flash 0x8501ce00 0x88000000

Considering that push_firmware needs adjustments, can you provide a list of valid FTP commands that I can do manually to upload the firmware (of course, provided that the generated firmware is appropriate and compatible with this rather recent HW)?

[fda77]

There is nothing new about HW 259, maybe AVM calls the avme / english branding v2? Where do you read it?

[Ircama]

There is nothing new about HW 259, maybe AVM calls the avme / english branding v2? Where do you read it?

The model type "FRITZ!Box 7590 AX v2 Edition International" is on the back label of the product (together with the FRITZ!Box password, Wi-Fi password WPA2, etc.):

The label "ProductID Fritz_Box_HW259" comes from the output of quote GETENV ProductID at boot, with Ethernet cable connection on the first Eth port, static address 192.168.178.220 of the client PC and repeated calls to ftp 192.168.178.1 until successful link:

ftp 192.168.178.1
user adam2 adam2
quote GETENV ProductID

[Edit: removed links as requested]

[fda77]

259 is the known 7590ax hwr. You "v2" is the cheap version without isdn.

https://www.teltarif.de/fritz-box-7590-ax-v2-avm-isdn/news/87120.html

AVM hat eine "Version 2" der FRITZ!Box 7590 AX mit redu­ziertem Funk­tions­umfang veröf­fent­licht. Die ISDN-Unter­stüt­zung fehlt.

So it does just not matter for freetz

[Ircama]

259 is the known 7590ax hwr. You "v2" is the cheap version without isdn.

Ok, yes, I checked now that 7590 AX and 7590 AX v2 should both have hw 259. In fact, the article you linked mentions that they should share the same firmware. Then, my questions might apply to 7590 AX too, because push_firmware does not appear to manage such hw ID:

• fit-boot or ram-boot mode?
  [Edit: answering myself: ram-boot]
• If fit-boot is needed, how can a fit-boot compatible image be produced? (The current toolchain generates a ".image" for that model.)
  [Edit: answering myself: if a model supports ram-boot, it cannot support fit-boot and vice versa.]
• Which are the right MAPSTART and FULLSIZE for hw ID 259?
  [Edit: answering myself: MAPSTART=0x80000000, FULLSIZE=0x0C000000
• Is it correct that, when I try uploading the generated freetz-ng image via web interface (http://fritz.box/ > System > Update > FRITZ!OS File), the UI returns a message of invalid firmware for this device (so, FTP must be the only upload process available for these models)?
  [Edit: Answering myself, this is correct; it is not possible to use the stock web UI to upload the freetz-ng firmware]

Thanks

[fda77]

The parameters are gone, i hope your questions are solved now: a6ee11b

[fda77]

You could try -ram 0, 128 could be to less

[Ircama]

There are problems with this device and the upload is not possible.

• quote REBOOT does not perform a power cycle.
  When push_firmware reads linux_fs_start and memsize, it logs in via FTP, performs quote GETENV variable_name and then issues a reboot (quote REBOOT). BTW, I suggest to add echo "Rebooting the device..." after calling enval="$(read_enval memsize)" and enval="$(read_enval linux_fs_start)", so that the user knows that the script is automatically driving a reboot. Anyway, with this device, the user must perform a power cycle by unplugging and plugging the power socket.

• quote SETENV memsize should be set to 0x20000000 for this device.

• I doubt that quote SETENV kernel_args_tmp mtdram1=... is used

• put filename <addr1> <addr2> is not accepted, The returned error is 501 unknown variable <addr1>. Other error: "502 Command not implemented". Maybe when using variables like mtd<X>, the put command might not return errors, but I doubt it can work because I do not get the data transfer statistics.

• I suggest adding -v to the ftp commands, so that responses from the device are shown

I tested the upload with Ubuntu, Windows, Raspberry Pi. The result is the same.

Connected to 192.168.178.1.
220 ADAM2 FTP Server ready
331 Password required for adam2
230 User adam2 successfully logged in
Remote system type is AVM.
Debugging on (debug=1).
---> TYPE I
200 Type set to BINARY
---> MEDIA SDRAM
200 Media set to MEDIA_SDRAM
---> SETENV memsize 0x1d01ce00
200 SETENV command successful
---> SETENV kernel_args_tmp mtdram1=0x9d01ce00,0xa0000000
200 SETENV command successful
local: /tmp/freetz_GTp/ramboot.flash remote: 0x9d01ce00 0xa0000000
ftp: setsockopt (ignored): Permission denied
---> PASV
227 Entering Passive Mode (192,168,178,1,12,2)
---> STOR 0x9d01ce00 0xa0000000
150 Opening BINARY data connection

NAND map:

         0
 0x2C00000 mtd0

       0x0 mtd2
  0x100000

  0x100000 mtd3
  0x900000

  0x900000 mtd1
 0x1100000

 0x1100000 mtd4
 0x1900000

 0x1900000 mtd5
0x20000000

mtd0                  0x0,0x2C00000
mtd1                  0x900000,0x1100000
mtd2                  0x0,0x100000
mtd3                  0x100000,0x900000
mtd4                  0x1100000,0x1900000
mtd5                  0x1900000,0x20000000

[fda77]

i dont have this device and i dont know what args/params are oaky, push-firmware uses AI. save your settings, do a avm-recovery and caputure it with tcpdump/wireshare to know the memsize used, this is hardcoded by avm in every recovery. Also you know then all other commands. if i remember correctly the intermediate reboots could be replaced by just a "quit"

[Ircama]

I found the required parameters! Thanks for this project and for your support.

            Fritz_Box_HW259*)   MAPSTART=0x80000000
                                FULLSIZE=0x0C000000 ;;  # 7590 AX (192 MB)

Also, ALIBYTES=0x0. It uses MEDIA SDRAM.

I used Ubuntu 20.04.3 LTS within WSL (Windows Subsystem for Linux). It allows compiling and installing.

I could not perform a reboot via FTP in any way (I added a note in push_firmware).

This week (depending on available time) I'll perform a PR with the new version of push_firmware supporting this device (I need to clean up a number of modifications).

$ tools/push_firmware

 * Analyzing 'images/7590AX_07.70.all-rev110391_inhaus_freetz-ng-23030M-1f6dce575_20240122-011634.image' ...

 * Warning: It seems your network is not able to reach
   192.168.178.1 directly. One(!) of these commands could help to fix:
bonding_masters: error fetching interface information: Device not found
   $ sudo ifconfig bonding_masters:0 192.168.178. up
   $ sudo ifconfig eth0:0 192.168.178.240 up
   Proceed anyway? ([y]/n) y
 * Product: Fritz_Box_HW259 (FRITZ!Box 7590 AX)
 * Using command: ftp
 * Target host: 192.168.178.1
 * Outgoing IP: unknown
 * Flash mode: ram-boot
 * Allowed memory size: 192 MB
 * Designated linux_fs_start: <other>

 !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!
 !!!  THERE IS NO WARRANTY AT ALL !!! USE AT YOUR OWN RISK   !!!

 * Are you sure, that you want to flash this file to the device?
   images/7590AX_07.70.all-rev110391_inhaus_freetz-ng-23030M-1f6dce575_20240122-011634.image
   Proceed? (y/[n]) y

 * You should now reboot your box (192.168.178.1). Waiting for shut down.
   Switch off, if reboot is not detected because it happens too quickly.
   Some newer bootloader versions allow to flash on power-cycle only.

 * MAPSTART=0x80000000
 * FULLSIZE=0x0C000000   (192 MB)

 * MAPLIMIT=0x8c000000
 * FILESIZE=0x030b2700   (~48 MB)
 * ALIBYTES=0x00000000   (~0 kB)
 * FREESIZE=0x08f4d900   (~143 MB)
 * MTDSTART=0x88f4d900

 * No reply from box, assuming switch-off or restart. Trying to re-detect box.
   Waiting ............. found!

 * Detected linux_fs_start: '0'
 * Designated linux_fs_start: 1

 * A reboot has been issued. Please manually unplug the power socket
   and plug it again if the box does not reboot itself.

 * No reply from box, assuming switch-off or restart. Trying to re-detect box.
   Waiting .................. found!

 * Box is back up again, initiating transfer.

Connected to 192.168.178.1.
220 ADAM2 FTP Server ready
331 Password required for adam2
230 User adam2 successfully logged in
Remote system type is AVM.
Debugging on (debug=1).
---> TYPE I
200 Type set to BINARY
---> MEDIA SDRAM
200 Media set to MEDIA_SDRAM
---> SETENV memsize 0x08f4d900
200 SETENV command successful
---> SETENV kernel_args_tmp mtdram1=0x88f4d900,0x8c000000
200 SETENV command successful
local: /tmp/freetz_qGc/ramboot.flash remote: 0x88f4d900 0x8c000000
ftp: setsockopt (ignored): Permission denied
---> PASV
227 Entering Passive Mode (192,168,178,1,12,17)
---> STOR 0x88f4d900 0x8c000000
150 Opening BINARY data connection
226 Transfer complete
51062528 bytes sent in 11.10 secs (4.3870 MB/s)
---> SETENV linux_fs_start 1
200 SETENV command successful
---> QUIT
221 Thank you for using the FTP service on ADAM2
FTP Finished

done

[Ircama]

Last point: the message ftp: setsockopt (ignored): Permission denied is not relevant and does not affect the FTP operation.

@fda77 I see that there are already some updates to push_firmware, thanks; I'll test the latest pull, but I think that the comment # Fritz_Box_HW259*) FULLSIZE=0x??000000 ;; # 7590 AX (??? MB) shall be first replaced with the found values. I'll base the PR on this test anyway.

Edit: the reason of ftp: setsockopt (ignored): Permission denied error is because I used the stock ftp command instead of the curl ftp one: tools/ftp. The right ftp client to use is tools/ftp.

[fda77]

you noticed the reboot commands are replaced too?
the 192mb are extracted from a recovery dump?
MAPSTART ist for all devices of this type the same, so its not needed - dont use optinal args if there is no reason!!
same for alignment.
ftp: setsockopt (ignored): Permission denied cant be hidden without hide all other errors :-/

[Ircama]

you noticed the reboot commands are replaced too?

Yes, sure. I have not tested your code yet, which now (if I remember well) avoids reboots (I'll do it), but when doing manually all tests myself during the WE, including quote BYE, quit, quote REBOOT, I could not reboot the device.

Then I have the perception that perhaps the AVM recovery tool slightly changed the behavior of the device firmware; for instance, after the recovery, I was able to issue again an ftp after the termination of the first one, while before, if I remember well, I could not restart an FTP after a disconnection. The Wireshark traces do not issue quote REBOOT. I do not have a branded device; anyway, the recovery tool first does a quote RETR env and a quote RETR count to generate values for a put mtdnand and at the end again quote RETR env; each of these sessions is terminated by quote BYE:

Removed parameters in the env:

    annex                 A
    country               039
    firmware_info         259.07.70
    language              it
    linux_fs_start        1

Added parameters:

    firmware_info         recovered=2

the 192mb are extracted from a recovery dump?

All values have been set by analyzing the recovery trace obtained via Wireshark; the MAPSTART and FULLSIZE parameters have been designed so that the computed values in SETENV memsize and SETENV kernel_args_tmp mtdram1 are the same as the ones in the recovery session. 192mb in my comment comes from FULLSIZE=0x0C000000.

MAPSTART ist for all devices of this type the same, so its not needed - dont use optinal args if there is no reason!!

I tested two different uploads and both succeeded. If you want to strictly replicate the recovery tool and you use FULLSIZE=0x0C000000, MAPSTART=0x80000000 is needed.

same for alignment.

Yes, the alignment is not used. I do not know whether tichksum plays a role in this.

ftp: setsockopt (ignored): Permission denied cant be hidden without hide all other errors :-/

Perhaps the backend has a limited implementation of the FTP session. One who does not know that, might suspect an issue.

Edit: the reason of ftp: setsockopt (ignored): Permission denied error is because I used the stock ftp command instead of the curl ftp one: tools/ftp. The right ftp client to use is tools/ftp.

[fda77]

There are 5 different kind of devices by avm regarding the way to flash by bootloader. So its possible the "reboot" dies not work for this bootloader

each of these sessions is terminated by quote BYE

Yes, thats also the change of the script some days ago

recovered=2

I cant remember, maybe in the IPPF are more infos about it

Perhaps the backend has a limited implementation of the FTP session

avm's recovery resets also all settings by writing a new config-partition, push-firmware does only flash the firmware

The bootloader is a old and very small (size) ftp server with a very limited command set. eg after a retr a reboot or reconnect is required...

Freetz has now netkit-ftp-host package and the warning-error-info-mesage of the ftp is gone. Some commits are still missing for this

[Ircama]

each of these sessions is terminated by quote BYE

Yes, thats also the change of the script some days ago

I tested your modifications and unfortunately they are not valid for this device. I had to revert 48ce67f.

We need to accept that the power cycles might be needed for some models and drive them with prompts. I'll prepare a PR with a proposal.

[Ircama]

Added PR #926

[Ircama]

@fraternl I realized I still have the following old freetz-ng images inside some outdated freetz-ng folders but I doubt they can be useful to you:

• 7590AX_07.57.all-rev107809_labor_freetz-ng-23030M-1f6dce575_20240115-011258.image
• 7590AX_07.57.all_freetz-ng-23030M-1f6dce575_20240115-102506.image
• 7590AX_07.57.all_freetz-ng-23030M-1f6dce575_20240117-215824.image
• 7590AX_07.57.all-rev107809_labor_freetz-ng-23030M-1f6dce575_20240115-010359.image

Wouldn't it be advisable for you to switch to version 7.81?

[fraternl]

I have enough Freetz images, I needed AVM images.
But I have them now.

Wouldn't it be advisable for you to switch to version 7.81?

Yes...
After I have a good solution for AVM-portforwarding.