Differences

This shows you the differences between two versions of the page.

toh:arcadyan:arv7510pw [2013/03/21 14:57]
malaakso
toh:arcadyan:arv7510pw [2014/04/13 11:09] (current)
malaakso U-Boot now in trunk
Line 1: Line 1:
====== Arcadyan ARV7510PW ====== ====== Arcadyan ARV7510PW ======
-**Work in progress!**+The ARV7510PW is an ADSL2+ router with 802.11n wireless commonly obtained via the Finnish ISP Elisa (Elisa kotiboksi). It is a rebranded Bewan Ibox. There is also another similar device based on Arcadyan ARV4510PW. The only difference seems to be the wireless mini-PCI card, which in ARV4510PW is only 802.11bg capable (Atheros AR241x). From outside these can be distinguished by the antenna color: ARV7510PW has a black antenna, ARV4510PW white. There exists also an all-black ARV4510PW, the Wippies Homebox. Finally, there are also ARV4510PW models where the wireless chip is not on a mini-PCI card, but rather soldered directly on the main board. The wireless in these models is not (yet) supported due to the missing EEPROM.
-The ARV7510PW is an ADSL2+ router with 802.11n wireless commonly obtained via the Finnish ISP Elisa (Elisa kotiboksi). It is a rebranded Bewan Ibox. There is also another similar device based on Arcadyan ARV4510PW. The only difference seems to be the wireless mini-PCI card, which in ARV4510PW is only 802.11bg capable (Atheros AR5212). From outside these can be distinguished by the antenna color: ARV7510PW has a black antenna, ARV4510PW white. There exists also an all-black ARV4510PW, the Wippies Homebox.+===== OpenWrt Status =====
-===== OpenWRT Status ===== +OpenWrt runs perfectly with some additional patches (see below). Installation may require a serial connection. The router is practically unbrickable by virtue of the UART boot capability.
- +
-OpenWrt runs perfectly with some additional patches (see below). Installation requires a serial connection. The router is practically unbrickable by virtue of the UART boot capability.+
===== Hardware ===== ===== Hardware =====
Line 14: Line 12:
| **Vendor:** | [[toh:arcadyan|Arcadyan]] | | **Vendor:** | [[toh:arcadyan|Arcadyan]] |
| **Bootloader:** | [[doc:techref:bootloader:brnboot]] | | **Bootloader:** | [[doc:techref:bootloader:brnboot]] |
-| **System-On-Chip:** | Infineon/[[doc:hardware:soc:soc.lantiq|Lantiq]] Xway Danube (PSB 50702 E V1.3)|+| **System-On-Chip:** | Infineon/[[doc:hardware:soc:soc.lantiq|Lantiq]] Xway Danube (PSB 50702 E V1.3 or V1.4)|
| **CPU Speed:** | 333 MHz | | **CPU Speed:** | 333 MHz |
| **Flash chip:** | Intel JS28F128J3D-75 | | **Flash chip:** | Intel JS28F128J3D-75 |
Line 31: Line 29:
===== Building OpenWrt ===== ===== Building OpenWrt =====
-The OpenWrt patches apply against the Attitude Adjustment branch of OpenWrt. The U-Boot patch applies against the current trunk. +Suitable U-Boot can be found under Boot Loaders -> uboot-lantiq-arv7510pw_nor/ram (works also with ARV4510PW). NOR-version will be installed to flash, RAM-version can be used with the UART boot option.
-[[http://ltl.tkk.fi/~malaakso/misc/0026-MTD-NO_XIP.patch|OpenWrt patch 1]] +
-[[http://ltl.tkk.fi/~malaakso/misc/0027-fix-pci-req-mask.patch|OpenWrt patch 2]] +
-[[http://ltl.tkk.fi/~malaakso/misc/0028-arv7510pw.patch|OpenWrt patch 3]] +
-[[http://ltl.tkk.fi/~malaakso/misc/0030-MIPS-add-board-support-for-Arcadyan-ARV7510.patch|U-Boot patch]]+
-In addition the OpenWrt Makefiles must be modified to produce images for ARV7510PW.+Following patches for trunk are needed: 
 +  * [[http://ltl.tkk.fi/~malaakso/misc/adm6996.patch|Enhance ADM6996 driver (optional)]] Provide per-port link status and data counters to swconfig. 
 +  * [[http://ltl.tkk.fi/~malaakso/misc/lantiq_mei.patch|Improve memory usage of ADSL driver]] Prevent out-of-memory errors when loading ADSL firmware. 
 +  * [[http://ltl.tkk.fi/~malaakso/misc/disable_jffs2_lzma.patch|Disable LZMA compression in JFFS2]] Workaround bug [[https://dev.openwrt.org/ticket/14839|#14839]]. 
 +  * [[http://ltl.tkk.fi/~malaakso/misc/disable-buffered.patch|Disable buffered writes to flash]] Prevent jffs2 corruption.
-Pre-built images (includes Luci) are available+Pre-built image for trunk (includes luci and kmod-ath5k): 
-[[http://ltl.tkk.fi/~malaakso/misc/openwrt-lantiq-arv7510pw_ram-u-boot.asc|U-Boot RAM image]] +   * [[http://ltl.tkk.fi/~malaakso/misc/openwrt-lantiq-xway-ARV4510PW-squashfs.image|OpenWrt image]]
-[[http://ltl.tkk.fi/~malaakso/misc/openwrt-lantiq-arv7510pw_nor-u-boot.img|U-Boot flash image]] +
-[[http://ltl.tkk.fi/~malaakso/misc/openwrt-lantiq-danube-ARV7510PW-squashfs.image|OpenWrt image]]+
===== Installation ===== ===== Installation =====
 +
 +==== Exploit method ====
 +
 +Older versions of the original firmware have a security exploit, which gives access to a flat text version of the router settings.
 +
 +Run this python3 script to check if the router is vulnerable
 +<code>
 +import urllib.request
 +req = urllib.request.Request('http://192.168.1.1/cgi-bin/export.cgi?Save=%3E+Back+up+your+parameterss&sExportMode=text&iExpert=3&sSuccessPage=backup.htm&sErrorPage=backup.htm')
 +req.add_header('Referer', 'http://192.168.1.1/en_US/admin/backup.htm')
 +r = urllib.request.urlopen(req)
 +f = open('router.txt', 'wb')
 +f.write(r.read())
 +f.close()
 +</code>
 +If it doesn't produce any errors:
 +  - Open the produced router.txt with your favourite editor.
 +  - Set UserTable_1_Unix_Enable to 1
 +  - Set UserTable_1_Unix_Password to $1$xopJA6FB$fJnqEswAbH0SDg.sPLUKf.
 +  - Set Services_Telnet_Enable to 1
 +  - Save the file and upload as you would with a standard backup
 +
 +Do not continue if you aren't willing or able to use UART method:
 +  - Copy ''openwrt-lantiq-arv7510pw_nor-u-boot.img'' and ''openwrt-lantiq-xway-ARV4510PW-squashfs.image'' onto a fat32 usb drive
 +  - Plug the usb drive into the router
 +  - telnet into the router as root with password as password
 +  - cd into the usb drive (can be found with mount)
 +  - umount /dev/rd/0
 +  - dd if=/dev/mtd/0 bs=1 of=routerBackup.bin
 +  - dd if=openwrt-lantiq-arv7510pw_nor-u-boot.img bs=1 of=/dev/mtdblock/0
 +  - dd if=openwrt-lantiq-xway-ARV4510PW-squashfs.image bs=1 seek=393216 of=/dev/mtdblock/0
 +  - wait a while
 +  - reboot
 +
 +After installation you should set your MAC-addresses with the commands
 +<code>
 +uci set network.lan.macaddr=xx:xx:xx:xx:xx:xx
 +uci set network.wan.macaddr=xx:xx:xx:xx:xx:xx
 +uci commit
 +</code>
 +and reboot.
 +
 +
 +==== UART method ====
The installation procedure in short: The installation procedure in short:
Line 53: Line 93:
  - Use the installed U-Boot to install OpenWrt to flash   - Use the installed U-Boot to install OpenWrt to flash
-==== Preparation ====+=== Preparation ===
You need a RS232-to-TTL cable connected to the serial header shown in the picture below. Short the UART boot pins with two jumper caps. You need a RS232-to-TTL cable connected to the serial header shown in the picture below. Short the UART boot pins with two jumper caps.
Line 59: Line 99:
{{:media:arv7510pw_top.jpg|}} {{:media:arv7510pw_top.jpg|}}
-Start TFTP server on your computer and copy ''openwrt-lantiq-arv7510pw_nor-u-boot.img'' and ''openwrt-lantiq-danube-ARV7510PW-squashfs.image'' to the TFTP server root. Connect your computer to the router with an ethernet cable and configure the IP address to 192.168.1.2, netmask 255.255.255.0.+Start TFTP server on your computer and copy ''openwrt-lantiq-arv7510pw_nor-u-boot.img'' and ''openwrt-lantiq-xway-ARV4510PW-squashfs.image'' to the TFTP server root. Connect your computer to the router with an ethernet cable and configure the IP address to 192.168.1.2, netmask 255.255.255.0.
-==== Loading U-Boot ====+=== Loading U-Boot ===
Use 115200 bps, 8-N-1, no flow control, as the serial connection parameter. Use 115200 bps, 8-N-1, no flow control, as the serial connection parameter.
Line 75: Line 115:
on the serial output. on the serial output.
-Send ''openwrt-lantiq-arv7510pw_ram-u-boot.asc'' as raw ascii to the router. U-Boot should start. Press any key to stop autoboot. At this point you can make a backup of the original firmware using ''md.l 0xb0000000 0x1000000'' and logging the output (takes roughly 2 hours). The flash can be erased by issuing first ''protect off all'' and then ''erase all''. Use first ''setenv ipaddr 192.168.1.1'', ''setenv serverip 192.168.1.2'' and ''setenv ethaddr xx:xx:xx:xx:xx:xx'' (ethernet address can be found from the sticker on top of the switch ports) to configure the network, and then ''tftp 0x80700000 openwrt-lantiq-arv7510pw_nor-u-boot.img'' to transfer the actual U-Boot image to memory. Write it to flash using ''cp.l 0x80700000 0xb0000000 ${filesize}''. Power off the router and remove the jumper caps from UART boot pins.+Send ''openwrt-lantiq-arv7510pw_ram-u-boot.asc'' as raw ascii to the router. U-Boot should start. Press any key to stop autoboot. At this point you can make a backup of the original firmware using ''md.l 0xb0000000 0x1000000'' and logging the output (takes roughly 2 hours). The flash can be erased by issuing first ''protect off all'' and then ''erase all''. Use first ''setenv ipaddr 192.168.1.1'', ''setenv serverip 192.168.1.2'' and ''setenv ethaddr xx:xx:xx:xx:xx:xx'' (ethernet address can be found from the sticker on top of the switch ports) to configure the network, and then ''tftp 0x80700000 openwrt-lantiq-arv7510pw_nor-u-boot.img'' to transfer the actual U-Boot image to memory. Write it to flash using ''cp.b 0x80700000 0xb0000000 ${filesize}''. Power off the router and remove the jumper caps from UART boot pins.
-==== Loading OpenWrt ====+=== Loading OpenWrt ===
-Power on the router. The U-Boot installed in the previous step should start. Press any key to stop autoboot. Use again ''setenv ipaddr 192.168.1.1'', ''setenv serverip 192.168.1.2'' and ''setenv ethaddr xx:xx:xx:xx:xx:xx'' to configure the network. Use ''saveenv'' to save these to flash. Use ''tftp 0x80700000 openwrt-lantiq-danube-ARV7510PW-squashfs.image'' to transfer the actual U-Boot image to memory. Write it to flash using ''cp.l 0x80700000 0xb0060000 ${filesize}''. Use ''reset'' to reset the board. Watch as U-Boot loads OpenWrt and proceed to configure it to your liking!+Power on the router. The U-Boot installed in the previous step should start. Press any key to stop autoboot. Use again ''setenv ipaddr 192.168.1.1'', ''setenv serverip 192.168.1.2'' and ''setenv ethaddr xx:xx:xx:xx:xx:xx'' to configure the network. Use ''saveenv'' to save these to flash. Use ''tftp 0x80700000 openwrt-lantiq-xway-ARV4510PW-squashfs.image'' to transfer the actual U-Boot image to memory. Write it to flash using ''cp.b 0x80700000 0xb0060000 ${filesize}''. Use ''reset'' to reset the board. Watch as U-Boot loads OpenWrt and proceed to configure it to your liking!
-===== Deficiencies of the default OpenWrt configuration ===== 
-  * Both buttons are configured to reset the device to default settings. => Remove or modify ''/etc/hotplug.d/button/10-generic.sh''. 
-  * The network switch configuration for VLANs is missing. => Insert the ''switch'' and ''switch_vlan'' sections to ''/etc/config/network''. 
-  * LEDs are not configured. 
===== Hardware notes ===== ===== Hardware notes =====
-The internal switch port numbering is opposite from the one printed on the box. Port 0 corresponds to the port labeled as "Port 4/Uplink". Port 5 is connected to the CPU. If you wish to use the uplink port as WAN, you need a VLAN config+The internal switch port numbering is opposite from the one printed on the box. Port 0 corresponds to the port labeled as "Port 4/Uplink". Port 5 is connected to the CPU. If you wish to use the uplink port as WAN with IP address obtained by DHCP, you need to modify the network configuration as follows
<code> <code>
-config switch_vlan "eth0_1+uci set network.@switch_vlan[0].ports="1 2 3 5t
-       option device   eth0 +uci add network switch_vlan 
-       option vlan    +uci set network.@switch_vlan[1].device=switch0 
-       option ports   "1 2 3 5t"+uci set network.@switch_vlan[1].vlan=2 
 +uci set network.@switch_vlan[1].ports="0 5t"
 +uci set network.wan.ifname=eth0.2 
 +uci set network.wan.proto=dhcp 
 +uci delete network.wan.username 
 +uci delete network.wan.password 
 +uci delete network.wan.ipv6 
 +uci commit 
 +reboot 
 +</code>;
-config switch_vlan "eth0_2" +The standard B type USB port (USB2) is not usable right now. 
-       option device  eth0 + 
-       option vlan    2 +Some units generate spurious button presses, which lead to reboots or other problems. Enabling the Schmitt-trigger may help. This can be achieved by modifying the U-Boot boot command and saving the modification to flash: 
-       option ports    &quot;0 5t&quot;+&lt;code&gt; 
 +setenv bootcmd 'mw.l 0xbe100b28 0x4008; bootm ${kernel_addr}' 
 +saveenv
</code> </code>
-and then set ''eth0.2'' as the WAN interface and ''eth0.1'' as the LAN interface. 
-The standard B type USB port (USB2) requires a B male/A female adapter to be used. Moreover, it seems to be unpowered, although there could be an as yet unidentified GPIO for controlling the power.+Units with V1.4 of the Danube SoC may become unstable when the ADSL status is queried. In this case it is recommended to edit the file /usr/lib/lua/luci/view/admin_status/index.htm and change the reference to /etc/init.d/dsl_control to point to a non-existent file.
===== Original firmware ===== ===== Original firmware =====
Line 124: Line 170:
Serial output from booting original firmware: Serial output from booting original firmware:
 +<HTML>
 +<p style="padding: 10px;border:1px solid grey;height:500px;font:10px/14px Georgia, Garamond, Serif;overflow:Auto;background-color:#FFFFFF">
<code> <code>
ROM VER: 1.0.3 ROM VER: 1.0.3
Line 602: Line 650:
Starting pid 2383, console /dev/null: '/bin/lighttpd' Starting pid 2383, console /dev/null: '/bin/lighttpd'
</code> </code>
 +</p>
 +</HTML>
 +
 +===== Tags =====
 +{{tag>lantiq danube ADSL2+}}

Back to top

toh/arcadyan/arv7510pw.1363874272.txt.bz2 · Last modified: 2013/03/21 14:57 by malaakso