User Tools

Site Tools


toh:arcadyan:arv7510pw

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Previous revision
toh:arcadyan:arv7510pw [2013/02/20 11:32]
toh:arcadyan:arv7510pw [2014/12/18 16:31] (current)
python1320 [VoIP] added an old package
Line 1: Line 1:
 ====== Arcadyan ARV7510PW ====== ====== Arcadyan ARV7510PW ======
  
-**Work ​in progress!**+The ARV7510PW is an ADSL2+ router with 802.11n wireless commonly obtained via the Finnish ISP Elisa (Elisa kotiboksi). It is a rebranded Bewan Ibox. There is also another similar device based on Arcadyan ARV4510PW. The only difference seems to be the wireless mini-PCI card, which in ARV4510PW is only 802.11bg capable (Atheros AR241x). From outside these can be distinguished by the antenna color: ARV7510PW has a black antenna, ARV4510PW white. There exists also an all-black ARV4510PW, the Wippies Homebox. Finally, there are also ARV4510PW models where the wireless chip is not on a mini-PCI card, but rather soldered directly on the main board. The wireless in these models is not (yet) supported due to the missing EEPROM.
  
-The ARV7510PW is an ADSL2+ router with 802.11n wireless commonly obtained via the Finnish ISP Elisa (Elisa kotiboksi). It is a rebranded Bewan Ibox. There is also another similar device based on Arcadyan ARV4510PW. The only difference seems to be the wireless mini-PCI card, which in ARV4510PW is only 802.11bg capable (Atheros AR5212). From outside these can be distinguished by the antenna color: ARV7510PW has a black antenna, ARV4510PW white.+===== OpenWrt Status =====
  
-===== OpenWRT Status ===== +OpenWrt runs perfectly with some additional patches (see below). Installation ​may require ​a serial connection. The router is practically unbrickable by virtue of the UART boot capability.
- +
-OpenWrt runs perfectly with some additional patches (see below). Installation ​requires ​a serial connection. The router is practically unbrickable by virtue of the UART boot capability.+
  
 ===== Hardware ===== ===== Hardware =====
Line 14: Line 12:
 | **Vendor:** | [[toh:​arcadyan|Arcadyan]] | | **Vendor:** | [[toh:​arcadyan|Arcadyan]] |
 | **Bootloader:​** | [[doc:​techref:​bootloader:​brnboot]] | | **Bootloader:​** | [[doc:​techref:​bootloader:​brnboot]] |
-| **System-On-Chip:​** | Infineon/​[[doc:​hardware:​soc:​soc.lantiq|Lantiq]] Xway Danube (PSB 50702 E V1.3)|+| **System-On-Chip:​** | Infineon/​[[doc:​hardware:​soc:​soc.lantiq|Lantiq]] Xway Danube (PSB 50702 E V1.3 or V1.4)|
 | **CPU Speed:** | 333 MHz | | **CPU Speed:** | 333 MHz |
 | **Flash chip:** | Intel JS28F128J3D-75 | | **Flash chip:** | Intel JS28F128J3D-75 |
Line 24: Line 22:
 | **Ethernet:​** | Infineon ADM6996I, 4x LAN 100 Mbps | | **Ethernet:​** | Infineon ADM6996I, 4x LAN 100 Mbps |
 | **Wireless:​** | Ralink RT2860T, 802.11n 300 Mbps, 2.4 GHz, 2 antennas | | **Wireless:​** | Ralink RT2860T, 802.11n 300 Mbps, 2.4 GHz, 2 antennas |
-| **Phone:** | 2x RJ11 |+| **Phone:** | 2x RJ11  |
 | **Serial:** | yes (with header) | | **Serial:** | yes (with header) |
 | **JTAG:** | yes (no header) | | **JTAG:** | yes (no header) |
Line 31: Line 29:
 ===== Building OpenWrt ===== ===== Building OpenWrt =====
  
-The OpenWrt patches apply against the Attitude Adjustment branch of OpenWrt. The U-Boot ​patch applies against the current trunk. +Suitable ​U-Boot ​can be found under Boot Loaders ​-> uboot-lantiq-arv7510pw_nor/ram (works also with ARV4510PW)NOR-version will be installed to flash, RAM-version can be used with the UART boot option.
-[[http://​ltl.tkk.fi/​~malaakso/​misc/​0026-MTD-NO_XIP.patch|OpenWrt patch 1]] +
-[[http://​ltl.tkk.fi/​~malaakso/​misc/​0027-fix-pci-req-mask.patch|OpenWrt patch 2]] +
-[[http://ltl.tkk.fi/​~malaakso/​misc/​0028-arv7510pw.patch|OpenWrt patch 3]] +
-[[http://​ltl.tkk.fi/​~malaakso/​misc/​0030-MIPS-add-board-support-for-Arcadyan-ARV7510.patch|U-Boot patch]]+
  
-In addition the OpenWrt Makefile must be modified to produce images ​for ARV7510PW.+Following patches ​for trunk are needed: 
 +   * [[http://​ltl.tkk.fi/​~malaakso/​misc/​lantiq_mei.patch|Improve memory usage of ADSL driver]] Prevent out-of-memory errors when loading ADSL firmware. 
 +   * [[http://​ltl.tkk.fi/​~malaakso/​misc/​disable_jffs2_lzma.patch|Disable LZMA compression in JFFS2]] Workaround bug [[https://​dev.openwrt.org/​ticket/​14839|#​14839]]. 
 +   * [[http://​ltl.tkk.fi/​~malaakso/​misc/​disable-buffered.patch|Disable buffered writes to flash]] Prevent jffs2 corruption.
  
-**Attention:** The current ​U-Boot ​has broken ethernet and TFTP does not work! As a workaround ​images can be transmitted with Y-Modem protocol using ''​loady''​.+Pre-built image for trunk (includes luci and kmod-ath5k): 
 +   [[http://​ltl.tkk.fi/​~malaakso/​misc/​openwrt-lantiq-xway-ARV4510PW-squashfs.image|OpenWrt image]] 
 +Pre-built ​U-Boot
 +   * [[http://​ltl.tkk.fi/​~malaakso/​misc/​openwrt-lantiq-arv7510pw_nor-u-boot.img|NOR-version]] 
 +   * [[http://​ltl.tkk.fi/​~malaakso/​misc/​openwrt-lantiq-arv7510pw_ram-u-boot.asc|RAM-version]] 
 + 
 +Official OpenWrt ​images ​for [[https://​downloads.openwrt.org/​barrier_breaker/​14.07/​lantiq/​xway/​|lantiq xway]] may also work. Bleeding edge testing version ​can be downloaded from [[https://​downloads.openwrt.org/​snapshots/​trunk/​lantiq/​|here]].
  
 ===== Installation ===== ===== Installation =====
 +
 +==== Exploit method ====
 +
 +Older versions of the original firmware have a security exploit, which gives access to a flat text version of the router settings.
 +
 +Run this python3 script to check if the router is vulnerable
 +<​code>​
 +import urllib.request
 +req = urllib.request.Request('​http://​192.168.1.1/​cgi-bin/​export.cgi?​Save=%3E+Back+up+your+parameterss&​sExportMode=text&​iExpert=3&​sSuccessPage=backup.htm&​sErrorPage=backup.htm'​)
 +req.add_header('​Referer',​ '​http://​192.168.1.1/​en_US/​admin/​backup.htm'​)
 +r = urllib.request.urlopen(req)
 +f = open('​router.txt',​ '​wb'​)
 +f.write(r.read())
 +f.close()
 +</​code>​
 +If it doesn'​t produce any errors:
 +  - Open the produced router.txt with your favourite editor.
 +  - Set UserTable_1_Unix_Enable to 1
 +  - Set UserTable_1_Unix_Password to $1$xopJA6FB$fJnqEswAbH0SDg.sPLUKf.
 +  - Set Services_Telnet_Enable to 1
 +  - Save the file and upload as you would with a standard backup
 +
 +Do not continue if you aren't willing or able to use UART method:
 +  - Copy ''​openwrt-lantiq-arv7510pw_nor-u-boot.img''​ and ''​openwrt-lantiq-xway-ARV4510PW-squashfs.image''​ onto a fat32 usb drive
 +  - Plug the usb drive into the router
 +  - telnet into the router as root with password as password
 +  - cd into the usb drive (can be found with mount)
 +  - umount /dev/rd/0
 +  - dd if=/​dev/​mtd/​0 bs=1 of=routerBackup.bin
 +  - dd if=openwrt-lantiq-arv7510pw_nor-u-boot.img bs=1 of=/​dev/​mtdblock/​0
 +  - dd if=openwrt-lantiq-xway-ARV4510PW-squashfs.image bs=1 seek=393216 of=/​dev/​mtdblock/​0
 +  - wait a while
 +  - reboot
 +
 +After installation you should set your MAC-addresses with the commands
 +<​code>​
 +uci set network.lan.macaddr=xx:​xx:​xx:​xx:​xx:​xx
 +uci set network.wan.macaddr=xx:​xx:​xx:​xx:​xx:​xx
 +uci commit
 +</​code>​
 +and reboot.
 +
 +
 +==== UART method ====
  
 The installation procedure in short: The installation procedure in short:
Line 50: Line 97:
   - Use the installed U-Boot to install OpenWrt to flash   - Use the installed U-Boot to install OpenWrt to flash
  
-==== Preparation ​====+=== Preparation ===
  
-You need a RS232-to-TTL cable connected to the serial header shown in the picture below. Short the UART boot pins with two jumper caps.+You need a RS232-to-TTL cable connected to the serial header shown in the picture below. Short the UART boot pins with two jumper caps. If the router misbehaves, remove the Vcc-cable, but leave ground attached
  
 {{:​media:​arv7510pw_top.jpg|}} {{:​media:​arv7510pw_top.jpg|}}
  
-Start TFTP server on your computer and copy ''​u-boot.img''​ and ''​openwrt-lantiq-danube-ARV7510PW-squashfs.image''​ to the TFTP server root. Connect your computer to the router with an ethernet cable and configure the IP address to 192.168.0.2, netmask 255.255.255.0.+Start TFTP server on your computer and copy ''​openwrt-lantiq-arv7510pw_nor-u-boot.img''​ and ''​openwrt-lantiq-xway-ARV4510PW-squashfs.image''​ to the TFTP server root. Connect your computer to the router with an ethernet cable and configure the IP address to 192.168.1.2, netmask 255.255.255.0.
  
-==== Loading U-Boot ​====+=== Loading U-Boot ===
  
-Use 115200 ​bps, 8-N-1, no flow controlas the serial connection ​parameter.+Use baud rate 115200, 8-N-1, no flow control as the serial connection ​parameters.
  
-Power on the router. You should see+Power on the router. You should see the following on the serial output.
 <​code>​ <​code>​
 ROM VER: 1.0.3 ROM VER: 1.0.3
Line 70: Line 117:
 UART UART
 </​code>​ </​code>​
-on the serial output.+The router now waits for bootloader code. Send ''​openwrt-lantiq-arv7510pw_ram-u-boot.asc''​ as raw ascii to the router. U-Boot should start. Press any key to stop autoboot when prompted.
  
-Send ''​u-boot.asc''​ as raw ascii to the router. U-Boot should start. Press any key to stop autoboot. ​At this point you can make a backup of the original firmware using ''​md.l 0xb0000000 0x1000000''​ and logging the output (takes roughly 2 hours). The flash can be erased by issuing first ''​protect off all''​ and then ''​erase all''​. Use ''​tftp 0x80700000 u-boot.img''​ to transfer the actual U-Boot image to memory. Write it to flash using ''​cp.l 0x80700000 0xb0000000 0x40000''​. Power off the router and remove the jumper caps from UART boot pins.+At this point you can make a backup of the original firmware using ''​md.l 0xb0000000 0x1000000''​ and logging the output (takes roughly 2 hours). ​
  
-==== Loading OpenWrt ====+To flash u-boot now, run the following in the bootloader'​s shell 
 +<​code>​ 
 +# remove flash protection 
 +protect off all 
 +# erase all flash (also the bootloader) 
 +erase all 
 +# set bootloader ip-address to connect from 
 +setenv ipaddr 192.168.1.1 
 +# Set the ip-address to load the bootloader from 
 +setenv serverip 192.168.1.2 
 +# Ethernet address can be found from the sticker on top of the switch ports 
 +setenv ethaddr 00:​01:​02:​03:​04:​05 
 +# Download bootloader to ram 
 +tftp 0x80700000 openwrt-lantiq-arv7510pw_nor-u-boot.img 
 +# Write bootloader to permanent flash memory 
 +cp.b 0x80700000 0xb0000000 ${filesize} 
 +</​code>​
  
-Power on the router. The U-Boot installed in the previous step should start. Press any key to stop autoboot. Use ''​setenv ethaddr xx:​xx:​xx:​xx:​xx:​xx''​ to configure your MAC address. It can be found from the sticker on top of the ethernet ports. Use ''​saveenv''​ to save it to flash. Use ''​tftp 0x80700000 openwrt-lantiq-danube-ARV7510PW-squashfs.image''​ to transfer the actual U-Boot image to memory. Write it to flash using ''​cp.l 0x80700000 0xb0060000 0x340004''​. Use ''​reset''​ to reset the board. Watch as U-Boot loads OpenWrt ​and proceed to configure it to your liking!+=== Loading ​OpenWrt ​===
  
-===== Deficiencies of the default ​OpenWrt ​configuration =====+Power on the router. The U-Boot installed in the previous step should start. Press any key to stop autoboot.  
 +Run the following to now load openwrt firmware: 
 +<​code>​ 
 +setenv ipaddr 192.168.1.1 
 +setenv serverip 192.168.1.2 
 +setenv ethaddr 00:​01:​02:​03:​04:​05 
 +# Save environment settings to the bootloader'​s memory 
 +saveenv 
 +# Download openwrt to ram 
 +tftp 0x80700000 openwrt-lantiq-xway-ARV4510PW-squashfs.image 
 +# Write openwrt to permanent flash memory 
 +cp.b 0x80700000 0xb0060000 ${filesize} 
 +# reboot router to boot to openwrt 
 +reset 
 +</​code>​ 
 +Watch as U-Boot loads OpenWrt ​and proceed to configure it to your liking! ​
  
-  * Both buttons are configured to reset the device ​to default settings=> Remove or modify ''/​etc/​hotplug.d/​button/​10-generic.sh''​+The router is usable after it finishes cleanup: 
-  ​* The network switch configuration for VLANs is missing=> Insert ​the ''​switch'' ​and ''​switch_vlan''​ sections to ''​/etc/​config/​network''​+<​code>​ 
-  * LEDs are not configured.+[  127.012000] jffs2_scan_eraseblock():​ End of filesystem marker found at 0x0 
 +[  127.020000] jffs2_build_filesystem():​ unlocking ​the mtd device... ​done
 + 157.432000] jffs2_build_filesystem():​ erasing all blocks after the end marker... done. 
 +[  206.468000] jffs2: notice: (1273) jffs2_build_xattr_subsystem:​ complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) ​and 0 of xref (0 dead, 0 orphan) found. 
 +procd: - init complete - 
 +</code> 
 + 
 +To reflash a new version without erasing bootloader or bootloader settings (this is only for subsequent debricking of the router):<​code>​ 
 +tftp 0x80700000 openwrt-lantiq-xway-ARV4510PW-squashfs.image 
 +erase 0xb0060000 +${filesize} 
 +cp.b 0x80700000 0xb0060000 ${filesize} 
 +bootm 0xb0060000 
 +</​code>​
  
 ===== Hardware notes ===== ===== Hardware notes =====
  
-The internal switch port numbering is opposite from the one printed on the box. Port 0 corresponds to the port labeled as number 4, "WAN/​Uplink"​. Port 5 is connected to the CPU. If you wish to use the uplink port as WAN, you need a VLAN config+==== Switch ==== 
 +The internal switch port numbering is opposite from the one printed on the box. Port 0 corresponds to the port labeled as "Port 4/​Uplink"​. Port 5 is connected to the CPU. If you wish to use the uplink port as WAN with IP address obtained by DHCP, you need to modify the network configuration as follows
 <​code>​ <​code>​
-config ​switch_vlan "eth0_1+uci set network.@switch_vlan[0].ports="1 2 3 5t
-        ​option ​device ​  eth0 +uci add network switch_vlan 
-        ​option vlan     +uci set network.@switch_vlan[1].device=switch0 
-        ​option ​ports    "1 2 3 5t"+uci set network.@switch_vlan[1].vlan=2 
 +uci set network.@switch_vlan[1].ports="5t" 
 +uci set network.wan.ifname=eth0.2 
 +uci set network.wan.proto=dhcp 
 +uci delete network.wan.username 
 +uci delete network.wan.password 
 +uci delete network.wan.ipv6 
 +uci commit 
 +reboot 
 +</​code>​
  
-config switch_vlan "​eth0_2"​ +==== USB ==== 
-        option ​device ​  ​eth0 +The power supply of the USB ports may be inadequate for LTE sticks or other USB devices demanding high currents. Replacing the 47 µF electrolytic capacitors connected to pin 1 of the USB ports with 1000 µF/10 V low-ESR models will allow the router to handle high current pulses. Another ​option ​is to use a powered USB hub. 
-        ​option vlan     ​2 + 
-        ​option ports    "0 5t"+The usb-ethernet port (standard B type USB, USB2) is unpowered and not usable at the moment. It requires usb-gadget support to function as the usb-ethernet port. 
 +You would at least need to enable the following in kernel configuration and then ''​modprobe g_ether''​ 
 +<​code>​ 
 +<M> Support for USB Gadgets  
 +<​M> ​  ​Ethernet Gadget (with CDC Ethernet support) 
 +[*]     ​RNDIS support (EXPERIMENTAL) 
 +</​code>​ 
 + 
 +==== GPIO ==== 
 +Some units generate spurious button presses, which lead to reboots or other problems. Enabling the Schmitt-trigger may help. This can be achieved by modifying the U-Boot boot command and saving the modification to flash: 
 +<​code>​ 
 +setenv bootcmd 'mw.l 0xbe100b28 0x4008; bootm ${kernel_addr}'​ 
 +saveenv
 </​code>​ </​code>​
-and then set ''​eth0.2''​ as the WAN interface and ''​eth0.1''​ as the LAN interface. 
  
-The standard B type USB port (USB2) requires a B male/A female adapter to be usedMoreover, ​it seems to be unpowered, although there could be an as yet unidentified GPIO for controlling ​the power.+==== ADSL ==== 
 +Units with V1.4 of the Danube SoC may become unstable when the ADSL status is queried. In this case it is recommended ​to edit the file /​usr/​lib/​lua/​luci/​view/​admin_status/​index.htm and change the reference to /​etc/​init.d/​dsl_control to point to a non-existent file.
  
 +==== VoIP ====
 +The VoIP ports seem to be working in the latest OpenWrt release.
 +Interesting packages for potential VoIP support include:
 +  * kmod-ltq-tapi
 +  * kmod-ltq-vmmc
 +  * kmod-ltq-ifxos
 +  * asterisk18-chan-lantiq
 +  * https://​code.google.com/​p/​danube-voip/​
 ===== Original firmware ===== ===== Original firmware =====
  
Line 108: Line 228:
 By default the device runs Linux 2.6.16. The serial console does not accept any input, and there is no telnet or ssh available. The web interface of the original firmware is extremely limited, and the configuration is done remotely by ISP via TR-069. There is a local firmware update page, but it doesn'​t accept third party firmwares. By default the device runs Linux 2.6.16. The serial console does not accept any input, and there is no telnet or ssh available. The web interface of the original firmware is extremely limited, and the configuration is done remotely by ISP via TR-069. There is a local firmware update page, but it doesn'​t accept third party firmwares.
  
-The original firmware is not encrypted or obfuscated in any way, contrary to many other Arcadyan devices. Therefore it might be easy to produce acceptably packaged firmwares. For people with MIPS (dis)assembly skills, here is the [[http://​ltl.tkk.fi/​~malaakso/​misc/​firmware.cgi|cgi script]] and the [[http://​ltl.tkk.fi/​~malaakso/​misc/​fwburn|firmware flash tool]] extracted from the original firmware.+The original firmware is not encrypted or obfuscated in any way, contrary to many other Arcadyan devices. Therefore it might be easy to produce acceptably packaged firmwares. Adding a header like in the original firmware might be enough. For people with MIPS (dis)assembly skills, here is the [[http://​ltl.tkk.fi/​~malaakso/​misc/​firmware.cgi|cgi script]] and the [[http://​ltl.tkk.fi/​~malaakso/​misc/​fwburn|firmware flash tool]] extracted from the original firmware.
  
 The ''​ART''​ partition contains the squashfs file system of the actual firmware. Partition ''​Config''​ contains a writable ext2 file system, where configuration is kept. During firmware update ''​OldFirmware''​ is replaced and marked ''​Firmware'',​ and ''​Firmware''​ becomes ''​OldFirmware''​. The ''​ART''​ partition contains the squashfs file system of the actual firmware. Partition ''​Config''​ contains a writable ext2 file system, where configuration is kept. During firmware update ''​OldFirmware''​ is replaced and marked ''​Firmware'',​ and ''​Firmware''​ becomes ''​OldFirmware''​.
Line 121: Line 241:
  
 Serial output from booting original firmware: Serial output from booting original firmware:
 +<​HTML>​
 +<p style="​padding:​ 10px;​border:​1px solid grey;​height:​500px;​font:​10px/​14px Georgia, Garamond, Serif;​overflow:​Auto;​background-color:#​FFFFFF">​
 <​code>​ <​code>​
 ROM VER: 1.0.3 ROM VER: 1.0.3
Line 599: Line 721:
 Starting pid 2383, console /dev/null: '/​bin/​lighttpd'​ Starting pid 2383, console /dev/null: '/​bin/​lighttpd'​
 </​code>​ </​code>​
 +</p>
 +</​HTML>​
 +
 +===== Tags =====
 +{{tag>​lantiq danube ADSL2+}}
toh/arcadyan/arv7510pw.1361356355.txt.bz2 · Last modified: 2013/02/20 11:32 (external edit)