User Tools

Site Tools


toh:arcadyan:arv752dpw

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Previous revision
toh:arcadyan:arv752dpw [2012/12/26 23:09]
toh:arcadyan:arv752dpw [2016/01/06 22:00] (current)
tmomas Put some emphasis on actual testing before confirming support
Line 1: Line 1:
 +====== Arcadyan ARV752DPW ======
  
 +The ARV752DPW is a combined ADSL/​VOIP/​SIP/​UMTS/​3G-enabled WLAN router and home PBX device, primarily sold as "​Easybox 802" by Vodafone Germany. It was also sold in the past by German fixed-line phone company Arcor, prior to the aquisition of Arcor by Vodafone.
 +
 +In the so called "​open"​ or user-defined configuration mode whith the firmware by Vodafone, the device can suit as a standalone UMTS/3G network router in combination with a compatible UMTS/3G USB modem, with any 3G network, the APN can be configured without any restrictions.
 +
 +===== OpenWRT Status =====
 +**BAUSTELLE**
 +The Device is not thorougly tested with OpenWrt. **Do not** follow the Informations here if you don't have a backup router inplace, you may end up with a bricked device... you've been warned.
 +
 +This site here is Work in Progress. Please help if you have some usefull Informations,​ any help is welcome!
 +
 +
 +<WRAP box center 80%> {{:​meta:​icons:​tango:​48px-emblem-question.svg.png }} If you can **confirm** that OpenWrt is running on this device (i.e. you or someone else has **tested** it), please update the data accordingly. -> Click //View/Edit data//
 +/* Special style definitions for the various Tables of Hardware. ​           */
 +{{page>​meta:​infobox:​tohstyles&​noheader&​nofooter&​noeditbtn&​inline&​indent&​link}}
 +---- datatable ----
 +cols    : Model, Versions, Supported Since Rev_url, Supported Since Rel, Supported Current Rel, Device Techdata_pageid
 +align   : l,c,l,c,c,c
 +filter ​ : Model*~ARV752DPW
 +filter ​ : Version=R01
 +----</​WRAP>​
 +
 +===== Hardware info =====
 +| **Architecture:​** ​    | MIPS                                                                   |
 +| **Target:​** ​          | ifxmips / lantiq ​                                                      |
 +| **Vendor:​** ​          | [[toh:​arcadyan:​|Arcadyan]] ​                                            |
 +| **Bootloader:​** ​      | [[doc:​techref:​bootloader:​brnboot]] ​                                    |
 +| **System-On-Chip:​** ​  | Infineon/​[[doc:​hardware:​soc:​soc.lantiq|Lantiq]] Xway Danube ​           |
 +| **CPU Speed:​** ​       | 333 Mhz                                                                |
 +| **Flash chip:​** ​      | Macronix MX 29LV640EBTI-70G ​                                           |
 +| **Flash size:​** ​      | 8 MiB                                                                  |
 +| **RAM chip:​** ​        | PSC A3S12D40ETP ​                                                       |
 +| **RAM size:​** ​        | 64 MiB (DDR400 SDRAM) ​                                                 |
 +| **USB:​** ​             | 3x USB2.0 (one of these ports is connected with a grey cable) ​         |
 +| **WAN:​** ​             | 1x RJ45                                                                |
 +| **MODEM:​** ​           | ADSL (G.992.1 & T1.413, V2), ADSL2 (G.992.3), ADSL2+ (G.992.5) ​        |
 +| **Ethernet:​** ​        | Realtek RTL8306G, 4x LAN 100MBit/​s ​                                    |
 +| **Wireless:​** ​        | Ralink RT2860T, 802.11n 300MBit/​s ​ 2.4 GHz 2 antennas ​                 |
 +| **Phone:​** ​           | 3x FXS ( 2x TAE ports which provide POTS via a SIP gateway), ISDN S0   |
 +| **ISDN:​** ​            | XHFC-2SU ​                                                              |
 +| **Serial:​** ​          | yes (see picture below) ​                                               |
 +| **JTAG:​** ​            | no                                                                     |
 +| **Buttons:​** ​         | power switch, WPS button, reset button ​                                |
 +| **Power:​** ​           | external PSU, 15V DC, 1,6A (25W max, 16W typical) polarity: -(+)       |
 +
 +===== Pictures =====
 +   * [[http://​www.google.com/​search?​q=vodafone+easybox+802&​tbm=isch| Random pictures of Arcadyan ARV752DPW (google picture search)]]
 +  * Serial console connectors in the middle of the mainboard: The serial cable is the selfmade black thick one, connected with 3 Pins to the serial port. The thinner gray cable (4 pin) in the downer right is one of three usb-connectors of this board)
 +{{:​media:​arcadyan:​arv752dpw.jpg?​400}}\\
 +{{media:​arcadyan:​easybox_802_pcb_map.jpg?​400}}
 +
 +===== serial console pin layout =====
 +<​code>​
 + ​6 ​ 7  8  9  10
 +[ ][ ][ ][ ][ ]
 +[ ]Rx Tx [ ]Gnd
 + ​1 ​ 2  3  4  5
 +</​code>​
 +
 +Pin 1 is marked with an small arrow on the motherboard,​ speed is 115200 8N1
 +
 +=== console output ===
 +After connect and power on the device you should see something like this:
 +
 +    [root@localhost]#​ screen /​dev/​ttyUSB0 115200
 +
 +<​code>​
 +ROM VER: 1.0.3
 +CFG 01
 +Read EEPROMX
 + X
 +
 +========================================================================
 +Wireless ADSL Gateway DANUBE Loader V1.00.01 build Sep 24 2008 10:11:06
 +                    Arcadyan Technology Corporation
 +========================================================================
 +MXIC MX29LV640BB bottom boot 16-bit mode found
 +
 +Copying boot params.....DONE
 +
 +Press Space Bar 3 times to enter command mode ...123
 +Yes, Enter command mode ...
 +
 +[DANUBE Boot]:
 +</​code>​
 +
 +===== Layout of the original Flash Image =====
 +If you select "''​[E] Erase Flash''"​ in the bootloader you can see the original flash layout:
 +
 +''​[DANUBE Boot]:E
 +ERASE Flash
 +---------------------------------------
 +    Area            Address ​     Length ​
 +---------------------------------------
 +[0] Boot            0xB0000000 ​    128K
 +[1] Configuration ​  ​0xB0020000 ​    256K
 +[2] None            0xB0060000 ​     64K
 +[3] Special Area    0xB0070000 ​     64K
 +[4] Primary Setting 0xB0080000 ​     64K
 +[5] Code Image 0    0xB0090000 ​   3776K
 +[6] Code Image 1    0xB0440000 ​   3776K
 +[7] Boot Params ​    ​0xB07F0000 ​     64K
 +[8] Flash Image     ​0xB0000000 ​   8192K
 +---------------------------------------
 +Enter area to ERASE: **ESC pressed** ​
 +ERROR: Not a valid area.''​
 +
 +===== U-Boot =====
 +There are three ways to get U-Boot running on the device. Each approach requires different uboot images. At the moment trunk snapshot does not contain those images. ​
 +See [[arv752dpw#​Downloads|Downloads]] for copies.
 +
 +In case your u-boot supports loady, you can upload everything you need via YModem Transfer.
 +If loady is not supported, the user pgid69 has written a nice [[arv752dpw#​Downloads|python script]] to easily write data to your router:
 +
 +[[https://​forum.openwrt.org/​viewtopic.php?​pid=183315#​p183315|Is this router based on the infineon danube?]]
 +
 +==== 1. BRNBOOT ====
 +Temporarily load U-Boot as second stage bootloader from within the vendor Bootloader (brnboot) Requires: **uboot-lantiq-arv752DPW_brnboot** ​
 +
 +(taken and tested from [[:​toh:​astoria/​arv752dpw22|ARV752DPW22 Wiki Article]]
 +
 +=== run u-boot noninvasive via serial port ===
 +
 +  - download uboot-lantiq-arv752DPW_brnboot version for u-boot ( [[arv752dpw#​Downloads|see Downloads]] )
 +  - get into administrative mode of bootloader (hit exclamation mark "​!"​)
 +  - choose\\ ''​[M] Upload to Memory''​\\ at default address 0x80002000
 +  - exit terminal (screen: Ctrl-a-k , minicom: ctrl-a-z )
 +  - send u-boot.bin via XMODEM protocoll:​\\ ''​sx u-boot.bin </​dev/​ttyUSB0 >/​dev/​ttyUSB0''​
 +  - get to the console via terminal egain & type **[Return]**
 +  - choose\\ ''​[Y] Go to Memory''​\\ to default address 0x80002000
 +
 +u-boot starts like this:​\\ ​
 +<​code>​
 +[DANUBE Boot]:Y
 +
 +Go to Memory Address: (default:​0x80002000) : 0x
 +Jump to address 0x80002000 ...
 +
 +
 +U-Boot 2010.03 (Sep 29 2012 - 18:24:13)
 +
 +Board: ARV752DPW
 +SoC: Danube/​Twinpass/​Vinax-VE V1.5, DDR Speed 166 MHz, CPU Speed 333 MHz
 +DRAM:  64 MB
 +Flash: ​ 8 MB
 +*** Warning - bad CRC, using default environment
 +</​code>​
 +
 +You can hit **[Ctrl]** + **[C]** to get to the command line or hitting a key at the requested time.
 +
 +==== 2. FLASH ====
 +Use this image when you want to put the u-boot permanently on the flash. Requires: **uboot-lantiq-arv752DPW_flash**
 +
 +From a running u-boot (see instructions above)
 +
 +1. copy flash image to ram (see steps 2-6 [[:​toh:​arcadyan/​arv752dpw#​run.u-boot.noninvasive.via.serial.port|from above]] with 0x80500000 as address before executing the u-boot at address 0x80002000, download u-boot.bin, see [[arv752dpw#​Downloads|Downloads]] )
 +
 +2. unprotect the sector where the U-BOOT config is being stored.
 +  protect off 0xb0010000 0xb001FFFF
 +
 +2. erase the flash
 +  erase 0xb0000000 0xb001FFFF
 +
 +3. write the uploaded u-boot.bin to flash (here; 0x80500000 is the RAM adress, where i've uploaded my file)
 +  cp.b 0x80500000 0xb0000000 10000
 +
 +4. protect the config sector
 +  protect on 0xb0010000 0xb001FFFF
 +
 +5. reboot device and hope for the best :​)  ​
 +  reset
 +
 +
 +* If kernel ignores parameters from u-boot, remove the preceding - in linux'​s hardcoded cmdline
 +
 +**PANIC! i flashed U-Boot, now TFTP/HTTP in U-BOOT is not working anymore**
 +
 +calm down, you can upload everything you need via your serial connection.
 +
 +
 +==== 3. UART ====
 +
 +Hand over the u-boot directly to the cpu with UART, this requires soldering and is intended for rescue purposes. ​ Requires: **uboot-lantiq-arv752DPW_ramboot**
 +
 +You need to shortcut R80 and bring +3.3V on the left side of R65, see picture.\\
 +{{:​media:​arcadyan:​arv752dpw-uart.jpg?​512|}}
 +
 +If you power on the device you will see this on serial console:
 +
 +  ROM VER: 1.0.3
 +  CFG 04
 +  Read EEPROMX
 +   X
 +  UART
 +
 +Jumpstart your Device by getting a suitable u-boot.asc File ( **uboot-lantiq-arv752DPW_ramboot** ).
 +see [[arv752dpw#​Downloads|Downloads]]
 +
 +send this file via your serial connection to the router.
 +  cat u-boot.asc > /​dev/​ttyUSB0
 +
 +or by using cutecom, send file - plain
 +
 +after the file is transmitted,​ uboot should load.
 +Beware, u-boot is being currently loaded only in the ram.
 +powering off your router will kill your u-boot, you will need to start again with this procedure.
 +
 +To restore u-boot completely, upload u-boot via your serial connection and write it back to flash using the u-boot functions (see 2. FLASH)
 +----
 +
 +===== FXS/FXO =====
 +There are some parts for telephony on the PCB. This parts are currently not supported.
 +
 +==== Links ====
 +Sip client for infineon danube based routers running openwrt:
 +http://​code.google.com/​p/​danube-voip/​
 +
 +Some research on university of freiburg germany (german):
 +http://​lab.ks.uni-freiburg.de/​issues/​515
 +
 +A "​map"​ of the PCB:
 +http://​lab.ks.uni-freiburg.de/​attachments/​download/​431/​baugruppen.jpg
 +
 +==== Parts ====
 +ISDN
 +   * XHFC-2SU ISDN 3409 or XHFC-2SU ISDN 3109
 +   * http://​www.colognechip.com/​isdn/​controllers/​frame-xhfc-2su.htm (Datasheet/​Linux driver)
 +NTBA
 +   * PEF80902
 +
 +POTS
 +   * Si3011
 +   * Si3050
 +
 +===== Backup =====
 +Please Backup your original firmware!
 +
 +==== Tools ==== 
 +
 +   * https://​github.com/​rvalles/​brntool
 +   * http://​code.google.com/​p/​brndumper/​
 +
 +==== brntool ====
 +I will use brntool to explain the backup here. As an alternative you could use brndumper to save the original firmware. (if you prefer a grafical interface brndumper may be better for you)
 +
 +You have to download the small Python tool. You also need the packages python and phyton-Serial(Debian and clones) or pyserial(Redhat and clones) to run brntool. ​
 +
 +Acording to the readme of brntool:
 +''"​A successful flash block read will output '​.'​ while a botched one (a byte or
 +more gets lost in the serial port) will output '​!'​ and retry. Even so, unless
 +in a hurry, I'd recommend to at least dump twice and compare the dumps, just
 +to be on the safe side."''​
 +
 +A dump of the firmware is done in ~~1 hour. to dump twice as recomended by the autor of brntool you have to plan 2 hours to backup your device. First you have to enter the "​Administrator Mode" in DANUBE Boot. Just fire up your serial terminal (''​screen /​dev/​ttyUSB0 115200''​),​ power on the device, hurry press 3x space bar. You will see the bootloader prompt: ''​[DANUBE Boot]:''​. Then type a exclamation mark (!) to enter the administration mode in the DANUBE bootloader. You will see this output:
 +
 +''​Press Space Bar 3 times to enter command mode ...123
 +Yes, Enter command mode ...
 +
 +
 +[DANUBE Boot]:!
 +
 +Enter Administrator Mode !
 +
 +======================
 + [#] Set Serial Number
 + [2] Use Normal Firmware
 + [3] Use ART-Testing Firmware
 + [9] Taggle ART Firmware Enable/​Disable
 + [A] Set MAC Address
 + [E] Erase Flash
 + [G] Run Runtime Code
 + [H] Set Options
 + [M] Upload to Memory
 + [P] Print Boot Params
 + [R] Read from Memory
 + [T] Memory Test
 + [U] Upload to Flash
 + [V] Set Board Version
 + [W] Write to Memory
 + [Y] Go to Memory
 + [Z] Dump DDR Ram Register
 + [0] Primary = Image 0
 + [1] Primary = Image 1
 +======================
 +
 +[DANUBE Boot]:''​
 +
 +Kill your serial terminal (screen: "​ctrl+a,​ k" and confirm exit with "​y"​). Now you are able to dump the original firmware as shown below. ​
 +
 +''​
 +[root@localhost]#​ time ./​brntool.py --read=ARV752DPW_whole.dump --addr=0xB0000000 --verbose --size=0x800000
 +Waiting for a prompt... Ok.
 +....................!...!............!.... [abbreviated version, you will see **many** more dots and exclamation marks]
 +real 61m27.738s
 +user 1m18.327s
 +sys 0m47.164s''​
 +
 +Powercycle the router, enter the "Admin Mode" of the bootloader and dump the firmware again: ​
 +
 +''​[root@localhost]#​ ./​brntool.py --read=ARV752DPW_whole2.dump --addr=0xB0000000 --verbose --size=0x800000''​
 +
 +Compare the files. If everything is ok you will end with 2 identical files:
 +
 +''​[root@localhost]#​ ls -l ARV752DPW_whole*.dump
 +-rw-r--r--. 1 root root 8388608 12. Feb 23:32 ARV752DPW_whole2.dump
 +-rw-r--r--. 1 root root 8388608 13. Feb 00:58 ARV752DPW_whole.dump
 +[root@localhost]#​ diff ARV752DPW_whole.dump ARV752DPW_whole2.dump
 +[root@localhost]#​ cmp ARV752DPW_whole.dump ARV752DPW_whole2.dump
 +[root@localhost]#​ md5sum ARV752DPW_whole*
 +b245fc54da24db7a81bb915e968453f8 ​ ARV752DPW_whole2.dump
 +b245fc54da24db7a81bb915e968453f8 ​ ARV752DPW_whole.dump
 +''​
 +
 +As you see, the two files are the same. If you compare your own output with this example you probably note the md5sums differ, thats ok: You **have** to end with md5sums different like shown here in this example, because my MAC Adress/​Serial No./​configuration its also saved in this dump.
 +
 +
 +===== Flash to OpenWRT without opening the device =====
 +
 +** This information is very old. But it is still posible to boot to the Recovery Mode.**
 +
 +** Tested on similar device - Arcadyam ARV752DPW22 (EasyBox 803) **
 +
 +**WIP: DO NOT FOLLOW THIS INFORMATIONS AT THE MOMENT: SIGNED FIRMWARE IS NOT WORKING** (uboot can't find the ethernet devices, a bugreport is opened, stay tuned, we are working on this issue)
 +
 +   * download a prebuild, signed firmware image from http://​nanl.de/​todo.. (alternative download location: https://​belug.de/​~lutz/​pub/​todo..)
 +   * press and hold the "​reset"​-button:​ use a toothpick or paper clip to press and **hold** the button
 +   * power on the device (hold the reset button while power on the device)
 +   * release the reset-Button 3 seconds after power on
 +   * use an ethernet cable that forms a direct connection between the router and your computer or notebook (you **MUST NOT** use a switch, you will need a direct cabled connection. WLAN will also **not** work at this state)
 +   * configure your ethernet device to a static ip address 192.168.2.100,​ netmask is 255.255.255.0 (/24)
 +   * open a browser and navigate to http://​192.168.2.1
 +   * you will see the "​Recovering Tool" user interface shown in the picture below: ​
 +   ​{{:​media:​arcadyan:​recovering_tool.png?​512|}}
 +   * select "​Firmware"​ as upgrade target, pick up the previously downloaded firmware file, and press the "​APPLY"​ button
 +   * confirm the messages: the firmware will be uploaded and flashed onto the device
 +
 +**DO NOT POWER OFF THE DEVICE!** Drink some coffee, tea... simply do nothing, just wait. The first reboot will take some time, because the device will be flashed with new firmware. **AGAIN: DO NOT POWER OFF THE DEVICE!** The LED in front of the device will show you the status and success of the process:
 +   - a permanent white glowing of the "​Power"​ LED (approximately 50 sec) 
 +   - flashing (approximately 1 flash per second) of the "​Power"​ LED (white light, approximately 30 sec)
 +
 +  * reload/​refresh your browser, if you see the power LED flashing for ~30 seconds: you will see the "​Recovering Tool" user interface again
 +  * select reboot from the "​Recovering Tool" user interface
 +
 +Drink more tea now... wait, and do not power off the device. The second reboot will take a bit longer, compared with the first one. The LED in front of the device will show you the current state of the process again:
 +   - a permanent **red** glowing of the "​Power"​ LED (approximately 3 sec)
 +   - all lights are off (approximately 40 sec)
 +   - a permanent **blue** glowing of the "​internet"​ LED (approximately 2 sec)
 +   - all lights are off
 +
 +Power off the device now, its bricked :) 
 +
 +Just kidding... powercycle your device now.
 +
 +   * reconfigure your ethernet device to a static ip 192.168.1.100,​ netmask 255.255.255.0
 +   * navigate in your browser from http://​192.168.2.1 to http://​192.168.1.1
 +
 +Congratulations:​ you will see the failsafe interface of uboot:\\
 +{{:​media:​arcadyan:​failsafe_ui.png?​512|}}
 +
 +
 +===== Downloads =====
 +
 +Successfully flashed and tested Attitude Adjustment image (bootloader is still missing here!) :
 +   * http://​downloads.openwrt.org/​attitude_adjustment/​12.09/​lantiq/​danube/​openwrt-lantiq-danube-ARV752DPW-squashfs.image
 +
 +U-Boot snapshots are broken at the moment (August 2013), here is a backup for some working images:
 +
 +   * uboot-lantiq-arv752DPW_ramboot : http://​www.galax.is/​files/​802/​u-boot.asc
 +   * uboot-lantiq-arv752DPW_flash :   ​http://​www.galax.is/​files/​802/​flash-uboot.bin
 +   * uboot-lantiq-arv752DPW_brnboot : http://​www.galax.is/​files/​802/​brnboot-uboot.bin
 +
 +Also, 12.09-rc1 still contains some automatically built images:
 +
 +   * http://​downloads.openwrt.org/​attitude_adjustment/​12.09-rc1/​lantiq/​danube/​
 +
 +
 +The lantiq snapshot repo may contain some useful images:
 +   * http://​downloads.openwrt.org/​snapshots/​trunk/​lantiq/​
 +
 +Alternatively,​ try this repo to build u-boot yourself:
 +   * https://​github.com/​Pteridium/​U-boot_Lantiq_Danube
 +
 +Python script to transfer over serial: ​
 +   * http://​www.galax.is/​files/​802/​write-to-uboot.py
 +     ​(original source: https://​forum.openwrt.org/​viewtopic.php?​pid=183315#​p183315 )
 +
 +===== Tags =====
 +[[meta:​tags|How to add tags]]
 +{{tag>​FastEthernet 1NIC 1WNIC 4Port USB ath5k 64RAM 4Flash MIPS32 24K ADSL2+ fxo lantiq danube}}