This is mainly a draft. Will be completed soon.
Please correct spelling and wording. I'm not a native speaker.
Astoria networks ARV752DPW22
In Germany also sold as Arcor/Vodafone DSL-EasyBox 803A.
Hardware
Highlights
| CPU | Ram | Flash | Network | USB | Serial | UART mode | FXS |
|---|---|---|---|---|---|---|---|
| Lantiq Xway Danube @333Mhz Dual Core | 64MB | 8MB | 4 Ports | Yes | Yes | Yes | 2xPOTS, 1xISDN |
Overview
| Architecture: | MIPS |
| Target: | Lantiq Xway Danube |
| Vendor: | Arcadyan |
| Bootloader: | brnboot |
| System-On-Chip: | |
| CPU/Speed | 333 Mhz |
| Flash-Chip: | |
| Flash size: | 8MB |
| RAM: | 64MB |
| RAM Chip: | |
| Wireless: | RaLink RT3062F; 802.11b/g/n, 2 fixed internal antennas |
| Ethernet: | Atheros AR8216; 4x LAN 100MBit/s |
| Internet: | ADSL2+ (annex A and B) |
| FXS: | 2x POTS + 1x ISDN S0 |
| USB: | Yes 3 x 2.0 |
| Serial: | Yes 3.3V |
| JTAG: | ? |
| Power: | external PSU, 15V DC, max 1,6A (16W typical) polarity: -(+) |
Details
CPU
# cat /proc/cpuinfo system type : Danube rev 1.5 machine : ARV752DPW22 - Arcor A803 processor : 0 cpu model : MIPS 24KEc V4.1 BogoMIPS : 221.18 wait instruction : yes microsecond timers : yes tlb_entries : 16 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x07d0, 0x0b40, 0x0f50] ASEs implemented : mips16 dsp shadow register sets : 1 kscratch registers : 0 core : 0 VCED exceptions : not available VCEI exceptions : not available
PCI
# lspci 00:0e.0 Network controller: Ralink corp. Device 3592 00:0f.0 USB controller: VIA Technologies, Inc. VT82xxxxx UHCI USB 1.1 Controller (rev 62) 00:0f.1 USB controller: VIA Technologies, Inc. VT82xxxxx UHCI USB 1.1 Controller (rev 62) 00:0f.2 USB controller: VIA Technologies, Inc. USB 2.0 (rev 65)
USB
# lsusb Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
The external USB ports are connected to the USB 2.0 root hubs.
The port behind the small cover (meant for an UMTS stick) is connected to bus 001 the other two are connected to bus 002.
LAN
eth0 is connected to port #0 of the Atheros AR8216 switch.
The switch has 6 ports. Port #1 is not connected.
The ports #2 to #5 are the ports LAN1 to LAN4 on the backside of the router.
The max MTU size of eth0 is 1500.
The switch can manage up to 16 VLANS.
# swconfig dev eth0 help
switch0: eth0(Atheros AR8216), ports: 6 (cpu @ 0), vlans: 16
--switch
Attribute 1 (int): enable_vlan (Enable VLAN mode)
Attribute 2 (none): apply (Activate changes in the hardware)
Attribute 3 (none): reset (Reset the switch)
--vlan
Attribute 1 (int): vid (VLAN ID (0-4094))
Attribute 2 (ports): ports (VLAN port mapping)
--port
Attribute 1 (int): pvid (Primary VLAN ID)
Attribute 2 (string): link (Get port link information)
# swconfig dev eth0 show
Global attributes:
enable_vlan: 0
Port 0:
pvid: 0
link: port:0 link:up speed:100baseT full-duplex
Port 1:
pvid: 0
link: port:1 link:down
Port 2:
pvid: 0
link: port:2 link:down
Port 3:
pvid: 0
link: port:3 link:down
Port 4:
pvid: 0
link: port:4 link:down
Port 5:
pvid: 0
link: port:5 link:down
ascii layout
_____________________________________________
/ switch AR8216 \
| port0 port1 port2 port3 port4 port5 |
\_____________________________________________/
| | | | |
WLAN---CPU---eth0-----------/ LAN 1 LAN 2 LAN 3 LAN 4
WLAN
ISDN
POTS
LEDs
| Symbol | Color |
|---|---|
| Power | red + blue |
| WAN | red + blue |
| VoIP | red + blue |
| WLan | red |
| UMTS USB looks a bit like a mic symbol |
red |
| red | |
| LAN1 | green |
| LAN2 | green |
| LAN3 | green |
| LAN4 | green |
| ISDN | green |
| POTS 1 | green |
| POTS 2 | green |
The following mapping is wrong [2012/10/11]:
[ 0.748000] Registered led device: soc:blue:power [ 0.748000] Registered led device: soc:red:internet [ 0.748000] Registered led device: soc:red:power [ 0.748000] Registered led device: soc:red:wps [ 0.752000] Registered led device: soc:red:fxo [ 0.752000] Registered led device: soc:red:voice [ 0.752000] Registered led device: soc:green:usb [ 0.752000] Registered led device: soc:green:wifi [ 0.752000] Registered led device: soc:green:wifi1 [ 0.752000] Registered led device: soc:blue:wifi [ 0.756000] Registered led device: soc:blue:wifi1 [ 0.756000] Registered led device: soc:green:eth1 [ 0.756000] Registered led device: soc:green:eth2 [ 0.756000] Registered led device: soc:green:eth3 [ 0.756000] Registered led device: soc:green:eth4
buttons
There are 4 buttons on the device.
One on the side was originally meant to switch the WLan on and off.
One on the back was meant as a reset button.
A protected one on the back side was meant to get back to the original configuration.
And then there is a 4th button near the leds on the back side.
serial port
Board voltage is 3.3V so you will need a cheap usb to serial adapter which are already at 3.3v.
For compatible USB to serial cables see: port.serial.cables
Pinout:
| 4 | GND |
| 3 | RX |
| 2 | TX |
| 1 | Vcc 3.3V |
Opening the case
Note: This will void your warranty!
To get to the board you need:
- unscrew 2 Phillips screws underneath the cover,
- pull (strong!) the upper cover which is connected by click.
Photos
case
PCB
WLan antennas
Bootlogs
OEM bootlog
þ
ROM VER: 1.0.3
CFG 01
Readà
ROM VER: 1.0.3
CFG 01
Read EEPROMX
X
=======================================================================
Wireless ADSL Gateway DANUBE Loader V1.04.00 build Mar 19 2010 10:00:29
Arcadyan Technology Corporation
=======================================================================
MXIC MX29LV640BB bottom boot 16-bit mode found
Copying boot params.....DONE
Press Space Bar 3 times to enter command mode ...
Flash Checking
Flash Checking - fw/ui... Passed.
Image[1] at 0xb00b0000, len:1999780, type:0
Image[2] at 0xb0298400, len:968414, type:10
Image[3] at 0xb0384c00, len:272391, type:11
Image[4] at 0xb03c7800, len:259453, type:12
Image[5] at 0xb0407000, len:150508, type:60
Image[6] at 0xb042c000, len:452105, type:90
Firmware image at 0, ART image at -1
Run-up Normal Firmware...
Unzipping firmware at 0x80002000 ... [ZIP 3] [ZIP 1] done
Run-time code running ...
In c_entry() function ...
install_exception
Co config = 80008483
[INIT] Interrupt ...
DANUBE_BCU_CON:0x4009FFFF
DANUBE_BCU_ECON:0x00000000
DANUBE_BCU_EADD:0x00000000
DANUBE_BCU_ECON:0x00000000
DANUBE_SLAVE_BCU_CON:0x4009FFFF
DANUBE_SLAVE_BCU_ECON:0x00000000
DANUBE_SLAVE_BCU_EADD:0x00000000
DANUBE_SLAVE_BCU_EDAT:0x00000000##### _ftext = 0x80002000
##### _fdata = 0x807989C0
##### __bss_start = 0x808425E4
##### end = 0x83467160
allocate_memory_after_end> len 695332, ptr 0x8346f160
##### Backup Data from 0x807989C0 to 0x8346F160~0x83518D84 len 695332
##### Backup Data completed
##### Backup Data verified
[GPIO FLOW] SetGpio() Begin ..
gptu: totally 6 16-bit timers/counters
Init timer = 0
************************ LED all ON
************************ LED all OFF
[GPIO FLOW] SetGpio() End.
[INIT] System Log Pool startup ...
[INIT] MTinitialize ..
[INIT] usrclk
CPU Clock 333333334 Hz
mips_counter_frequency:166666667
r4k_offset: 00028b0a(166666)
init_US_counter : time1 = 260467 , time2 = 40260499, diff 40000032
US_counter = 48
cnt1 40987793 cnt2 40990037, diff 2244
Runtime code version: 30.05.211
System startup...
[INIT] Memory COLOR 0, 5000000 bytes ..
[INIT] Memory COLOR 1, 262144 bytes ..
[INIT] Memory COLOR 2, 8516576 bytes ..
danube pci startup...
PCI clock 33.3MHz
cut-off PCI internal clock
DANUBE_GPIO_P1_ALTSEL0=65c7
DANUBE_GPIO_P1_ALTSEL1=0
DANUBE_GPIO_P1_DIR=c1fe
[PCI-SCAN] get PCI dev-0e, func-00(0x70), class:0x0280, vid:0x1814, did:0x3592
[PCI-SCAN] get PCI dev-0f, func-00(0x78), class:0x0c03, vid:0x1106, did:0x3038
[PCI-SCAN] get PCI dev-0f, func-01(0x79), class:0x0c03, vid:0x1106, did:0x3038
[PCI-SCAN] get PCI dev-0f, func-02(0x7a), class:0x0c03, vid:0x1106, did:0x3104
Scanning bus 00
Found 00:70 [1814/3592] 000280 00
Found 00:78 [1106/3038] 000c03 00
Found 00:79 [1106/3038] 000c03 00
Found 00:7a [1106/3104] 000c03 00
Fixups for bus 00
Bus scan for 00 returning with max=00
[pcibios_init] PCI slot 0e, function 00...
35921814 04000007 02800000 00008000 18000000 00000000 00000000 00000000
00000000 00000000 00000000 35921814 00000000 00000040 00000000 04020100
[pcibios_init] PCI slot 0f, function 00...
30381106 02100000 0c030062 00801600 00000000 00000000 00000000 00000000
1ae00001 00000000 00000000 30381106 00000000 00000080 00000000 00000100
[pcibios_init] PCI slot 0f, function 01...
30381106 02100000 0c030062 00801600 00000000 00000000 00000000 00000000
1ae00021 00000000 00000000 30381106 00000000 00000080 00000000 00000200
[pcibios_init] PCI slot 0f, function 02...
31041106 02100000 0c032065 00801600 18010000 00000000 00000000 00000000
00000000 00000000 00000000 31041106 00000000 00000080 00000000 00000300
interrupt pin 2 not supported!
wrong interrupt pin 2
interrupt pin 3 not supported!
wrong interrupt pin 3
MXIC MX29LV640BB bottom boot 16-bit mode found
Set flash memory layout to Boot Parameters found !!!
Bootcode version: V1.04.00
Serial number: R0340020162
Hardware version: 01B
01.07.2011-10:36:41
[BUILD-PIN] PIN:R0340020162, MAC:88252C6207E0, Key:NULL
[BUILD-WPA]: Key:6981010EE
[BUILD-PIN]: PIN:23037601, len=8
MXIC MX29LV640BB bottom boot 16-bit mode found
MXIC MX29LV640BB bottom boot 16-bit mode found
read_config_from_flash> unknown config
[CONFIG] read_config_from_flash ret=0
MXIC MX29LV640BB bottom boot 16-bit mode found
nLen:98, Magic:0x33343536
my CFGVersionMagic = 33343536, old CFGVersionMagic on flash = 33343536
my CFGsize = 234464, my CFGDescSize = 38365
my Version = 30.05.211, Version on flash= 30.05.211
[CONFIG] old cfg version:[30.05.211], [3.0.5.2.11.100]
source CFGsize = 234464, CFGDescSize = 38365
MXIC MX29LV640BB bottom boot 16-bit mode found
OldCfgHexSize:12499
Unzipping from 816C2EB0 to 816B98C0 ... [ZIP 2] allocate_memory_after_end> len 81516, ptr 0x83518da0
done
Uncompressed size = 38363
Tail1 : END_III_Config_t
Size of Old CFG_DESC is :38363!!!
useCfgDesc:1
MyCfgHexSize:12499
Unzipping from 816B67D4 to 816AD1E4 ... [ZIP 2] done
Uncompressed size = 38363
My CFGDescSize:38365
useCfgDesc:1
Tail : END_III_Config_t
useCfgDesc:3
Restore Config file from ver:30.05.211!!!
[CONFIG] DS_Tail:[t_ARV752DPW]
[CONFIG] load_config ret=1
[updateConfig] flash version:[30.05.211], [3.0.5.2.11.100]
[updateConfig] code version:[30.05.211], [3.0.5.2.11.100]
##@@!! voip_generate_LACDN> accountidx=0, outboundProxy = 030.sip.arcor.de
##@@!! userId = 03080610473
##@@!! local_area = 030
##@@!! destination_number = 80610473
##@@!! voip_generate_LACDN> accountidx=1, outboundProxy =
##@@!! userId =
##@@!! local_area =
##@@!! destination_number =
##@@!! voip_generate_LACDN> accountidx=2, outboundProxy =
##@@!! userId =
##@@!! local_area =
##@@!! destination_number =
##@@!! voip_generate_LACDN> accountidx=3, outboundProxy =
##@@!! userId =
##@@!! local_area =
##@@!! destination_number =
##@@!! voip_generate_LACDN> accountidx=4, outboundProxy =
##@@!! userId =
##@@!! local_area =
##@@!! destination_number =
##@@!! voip_generate_LACDN> accountidx=5, outboundProxy =
##@@!! userId =
##@@!! local_area =
##@@!! destination_number =
##@@!! voip_generate_LACDN> accountidx=6, outboundProxy =
##@@!! userId =
##@@!! local_area =
##@@!! destination_number =
##@@!! voip_generate_LACDN> accountidx=7, outboundProxy =
##@@!! userId =
##@@!! local_area =
##@@!! destination_number =
##@@!! voip_generate_LACDN> accountidx=8, outboundProxy =
##@@!! userId =
##@@!! local_area =
##@@!! destination_number =
##@@!! voip_generate_LACDN> accountidx=9, outboundProxy =
##@@!! userId =
##@@!! local_area =
##@@!! destination_number =
!!! Invalid wireless channel range 0 ~ 0
!!! Use default value 1 ~ 13
update Ethernet Uplink related parameters
default route: 0.0.0.0
[CheckUSBBackConf]Erase the garbage config in usbBackConf_s
BufferInit:
BUF_HDR_SZ=160 BUF_ALIGN_SZ=4 BUFFER_OFFSET=416
BUF_BUFSZ0=576 BUF_BUFSZ1=4352
NUM_OF_B0=0 NUM_OF_B1=2000
BUF_POOL0_SZ=0 BUF_POOL1_SZ=9024000
sizeof(BUFFER0)=736,sizeof(BUFFER1)=4512
*BUF0=0x82859be4 *BUF1=0x81fbe9c4
Altgn *BUF0=0x82859c00 *BUF1=0x81fbe9e0
End at BUF0:0x82859c00, BUF1:0x82859be0
BUF0[0]=0x82859c00 BUF1[0]=0x81fbe9e0
buffer0 pointer init OK!
buffer1 pointer init OK!
[qm_lnk_init] CLOCKHZ=1000 ...
[qm_lnk_init] add if 3 into QM link 0
[qm_lnk_init] add if 4 into QM link 0
[qm_cbq_enable] no QM attached
[qm_cbq_detach] no QM is attached at link 0
pkt_avgsz=250, pkt_maxsz=1600, mtu=1600
f=1054199/100000, ns_per_byte=758869/1000
ptime=2000000000/1000, cptime=0/1000, offtime=0/1000
New cls: id=0, bw=758 ns/byte, maxd=0 ms,
maxb=32, minb=2, avgpktsz=250, maxpktsz=1600,
offtime=0, parent=0, borrow=0
pri=0, maxidle=31, minidle=-2428,
maxq=96, clsfg=17
pkt_avgsz=1600, pkt_maxsz=1600, mtu=1600
f=10542/100000, ns_per_byte=75886927/1000
ptime=18446744073709551615/1000, cptime=18446744073709551615/1000, offtime=18446744073709551615/1000
New cls: id=1, bw=75886 ns/byte, maxd=0 ms,
maxb=16, minb=1, avgpktsz=1600, maxpktsz=1600,
offtime=108619, parent=81203e50, borrow=81203e50
pri=5, maxidle=28942, minidle=-242838,
maxq=48, clsfg=21
qm_cbq_attach(): cbqp->cbq_res=104
pkt_avgsz=250, pkt_maxsz=1600, mtu=1600
f=1043657/100000, ns_per_byte=766534/1000
ptime=2000000000/1000, cptime=0/1000, offtime=0/1000
New cls: id=2, bw=766 ns/byte, maxd=0 ms,
maxb=32, minb=4, avgpktsz=250, maxpktsz=1600,
offtime=0, parent=81203e50, borrow=81203e50
pri=5, maxidle=31, minidle=-2452,
maxq=48, clsfg=21
pkt_avgsz=250, pkt_maxsz=1600, mtu=1600
f=1/100000, ns_per_byte=4294967295/1000
[qm_cbq_newcls] warning: bandwidth of the class may be low enough to cause INT overflow
ptime=2000000000/1000, cptime=18446744073709551615/1000, offtime=18446744073709551615/1000
New cls: id=3, bw=1342177 ns/byte, maxd=0 ms,
maxb=16, minb=4, avgpktsz=250, maxpktsz=1600,
offtime=1366279, parent=81202850, borrow=81202850
pri=6, maxidle=0, minidle=-4294966,
maxq=48, clsfg=20
pkt_avgsz=250, pkt_maxsz=1600, mtu=1600
f=1/100000, ns_per_byte=4294967295/1000
[qm_cbq_newcls] warning: bandwidth of the class may be low enough to cause INT overflow
ptime=2000000000/1000, cptime=18446744073709551615/1000, offtime=18446744073709551615/1000
New cls: id=4, bw=1342177 ns/byte, maxd=0 ms,
maxb=16, minb=4, avgpktsz=250, maxpktsz=1600,
offtime=1366279, parent=81202850, borrow=81202850
pri=0, maxidle=0, minidle=-4294966,
maxq=96, clsfg=21
pkt_avgsz=250, pkt_maxsz=1600, mtu=1600
f=1/100000, ns_per_byte=4294967295/1000
[qm_cbq_newcls] warning: bandwidth of the class may be low enough to cause INT overflow
ptime=2000000000/1000, cptime=18446744073709551615/1000, offtime=18446744073709551615/1000
New cls: id=5, bw=1342177 ns/byte, maxd=0 ms,
maxb=16, minb=4, avgpktsz=250, maxpktsz=1600,
offtime=1366279, parent=81202850, borrow=81202850
pri=1, maxidle=0, minidle=-4294966,
maxq=48, clsfg=23
pkt_avgsz=250, pkt_maxsz=1600, mtu=1600
f=1/100000, ns_per_byte=4294967295/1000
[qm_cbq_newcls] warning: bandwidth of the class may be low enough to cause INT overflow
ptime=2000000000/1000, cptime=18446744073709551615/1000, offtime=18446744073709551615/1000
New cls: id=6, bw=1342177 ns/byte, maxd=0 ms,
maxb=16, minb=4, avgpktsz=250, maxpktsz=1600,
offtime=1366279, parent=81202850, borrow=81202850
pri=2, maxidle=0, minidle=-4294966,
maxq=48, clsfg=23
pkt_avgsz=250, pkt_maxsz=1600, mtu=1600
f=1/100000, ns_per_byte=4294967295/1000
[qm_cbq_newcls] warning: bandwidth of the class may be low enough to cause INT overflow
ptime=2000000000/1000, cptime=18446744073709551615/1000, offtime=18446744073709551615/1000
New cls: id=7, bw=1342177 ns/byte, maxd=0 ms,
maxb=16, minb=4, avgpktsz=250, maxpktsz=1600,
offtime=1366279, parent=81202850, borrow=81202850
pri=3, maxidle=0, minidle=-4294966,
maxq=48, clsfg=23
pkt_avgsz=250, pkt_maxsz=1600, mtu=1600
f=1/100000, ns_per_byte=4294967295/1000
[qm_cbq_newcls] warning: bandwidth of the class may be low enough to cause INT overflow
ptime=2000000000/1000, cptime=18446744073709551615/1000, offtime=18446744073709551615/1000
New cls: id=8, bw=1342177 ns/byte, maxd=0 ms,
maxb=16, minb=4, avgpktsz=250, maxpktsz=1600,
offtime=1366279, parent=81202850, borrow=81202850
pri=4, maxidle=0, minidle=-4294966,
maxq=48, clsfg=23
pkt_avgsz=250, pkt_maxsz=1600, mtu=1600
f=1043657/100000, ns_per_byte=766534/1000
ptime=2000000000/1000, cptime=0/1000, offtime=0/1000
New cls: id=9, bw=766 ns/byte, maxd=0 ms,
maxb=16, minb=4, avgpktsz=250, maxpktsz=1600,
offtime=0, parent=81202850, borrow=81202850
pri=6, maxidle=31, minidle=-2452,
maxq=48, clsfg=20
CLOCKHZ=1000
gConfig.Interface[0].IP_Addr = 127.0.0.1
gConfig.Interface[0].Subnet_Mask = 255.255.255.255
***** [iput_IpLinkUp] ifno=0, link_type:12
TRAP(linkUp) : send ok!
Interface 0 ip = 127.0.0.1
gConfig.Interface[1].IP_Addr = 192.168.2.1
gConfig.Interface[1].Subnet_Mask = 255.255.255.0
ifno=1, vlan=0, vid=1, port_mask=0xf
DANUBE_RCU_RST_STAT Watchdog 0 reset cause flag 0 Watchdog 1 reset cause flag 0
DMA g_desc_list=0x816A7FA0
danube_sw_chip_init: in MII mode
Probe switch chip....RTL8306 ver.series 0 ver.chipid 590 ver.revision 0
Atheros8216 detected
chip_id = 2
init switch chip deriverdanube_sw_chip_init: switch_chip= 2
init QoS for switch
enter athr_VLANInit
[VLAN] port: 0x000f, ifCount=1
------->add port 2 to vlan 1
------->add port 3 to vlan 1
------->add port 4 to vlan 1
------->add port 5 to vlan 1
mac_0_init: interface 1 registered to VLAN 1, port_mask=f
MAC Address: 88:25:2c:62:07:e0
***** [iput_IpLinkUp] ifno=1, link_type:12
TRAP(linkUp) : send ok!
Interface 1 ip = 192.168.2.1
gConfig.Interface[2].IP_Addr = 0.0.0.0
gConfig.Interface[2].Subnet_Mask = 0.0.0.0
[HWLAN] ifno=2 irno=7 port=0x00000000
pci_find_slot bus 0 devfn 70
dev->bus->number 0 dev->devfn 70
pci_find_slot bus 0 devfn 70
dev->bus->number 0 dev->devfn 70
pci_find_slot bus 0 devfn 70
dev->bus->number 0 dev->devfn 70
pci_find_slot bus 0 devfn 70
dev->bus->number 0 dev->devfn 70
pci_find_slot bus 0 devfn 70
dev->bus->number 0 dev->devfn 70
===> rt2860_probe
PCI: Enabling device 00:0e.0 (0007 -> 0006)
pcibios_set_master> lat=0x80
--> RTMPAllocAdapterBlock
RTMP_ADAPTER_mem : 80b009c4, sizeof(RTMP_ADAPTER) 415336
=== pAd = FFFFFFFF80B009C4, size = 415336 ===
<-- RTMPAllocAdapterBlock, Status=0
pAd->CSRBaseAddress =0xffffffffb8000000
AP Driver version-2.2.5.0
NVM is EEPROM
Allocate a net device with private data size=0!
RtmpOSNetDevAttach()--->
<---RtmpOSNetDevAttach(), ret=0
<=== rt2860_probe
***** [iput_IpLinkUp] ifno=2, link_type:12
TRAP(linkUp) : send ok!
Interface 2 ip = 192.168.2.1
gConfig.Interface[3].IP_Addr = 0.0.0.0
gConfig.Interface[3].Subnet_Mask = 0.0.0.0
ppe: ATM init succeeded (firmware version 1.1.0.2.1.13)
ATM_UBR
Init SAR ifno:3 g_atm_vcc[0] CONN:1 VPI/VCI:1/32
MAC Address: 88:25:2c:62:07:e1
Interface 3 ip = 0.0.0.0
gConfig.Interface[4].IP_Addr = 0.0.0.0
gConfig.Interface[4].Subnet_Mask = 0.0.0.0
ATM_CBR
Init SAR ifno:4 g_atm_vcc[1] CONN:2 VPI/VCI:2/32
MAC Address: 88:25:2c:62:07:e2
Interface 4 ip = 0.0.0.0
gConfig.Interface[11].IP_Addr = 0.0.0.0
gConfig.Interface[11].Subnet_Mask = 0.0.0.0
IFLNK_PPPOE init : (Linkp)ifno = 11 idx = 2
IFLNK_PPPOE init : (Driverp)ifno = 11 idx = 3
pppInit> set (PPPShutdownRequest[ifno] = 0)
[pppoe_init]
Interface 11 ip = 0.0.0.0
gConfig.Interface[12].IP_Addr = 0.0.0.0
gConfig.Interface[12].Subnet_Mask = 0.0.0.0
IFLNK_PPPOE init : (Linkp)ifno = 12 idx = 2
IFLNK_PPPOE init : (Driverp)ifno = 12 idx = 3
pppInit> set (PPPShutdownRequest[ifno] = 0)
[pppoe_init]
[PPPoE]gInitOk==1 , So Not Do pppoe_init
Interface 12 ip = 0.0.0.0
gConfig.Interface[20].IP_Addr = 0.0.0.0
gConfig.Interface[20].Subnet_Mask = 0.0.0.0
[HWLAN] ifno=20 irno=7 port=0x00000000
***** [iput_IpLinkUp] ifno=20, link_type:12
TRAP(linkUp) : send ok!
Interface 20 ip = 192.168.2.1
gConfig.Interface[21].IP_Addr = 0.0.0.0
gConfig.Interface[21].Subnet_Mask = 0.0.0.0
[HWLAN] ifno=21 irno=7 port=0x00000000
***** [iput_IpLinkUp] ifno=21, link_type:12
TRAP(linkUp) : send ok!
Interface 21 ip = 192.168.2.1
gConfig.Interface[22].IP_Addr = 0.0.0.0
gConfig.Interface[22].Subnet_Mask = 0.0.0.0
[HWLAN] ifno=22 irno=7 port=0x00000000
***** [iput_IpLinkUp] ifno=22, link_type:12
TRAP(linkUp) : send ok!
Interface 22 ip = 192.168.2.1
gConfig.Interface[23].IP_Addr = 0.0.0.0
gConfig.Interface[23].Subnet_Mask = 0.0.0.0
[HWLAN] ifno=23 irno=7 port=0x00000000
***** [iput_IpLinkUp] ifno=23, link_type:12
TRAP(linkUp) : send ok!
Interface 23 ip = 192.168.2.1
gConfig.Interface[25].IP_Addr = 0.0.0.0
gConfig.Interface[25].Subnet_Mask = 0.0.0.0
pppInit> set (PPPShutdownRequest[ifno] = 0)
if_umts_init() WAN interface 25, UMTS-COM1: baudrate=115200
if_umts_init() MAC:88:25:2C:62:07:E1
umtsReceQueueInit() Host controller disable, bypass queue init...
RUNTASK id=2 umtsReceQueueTsk...
RUNTASK id=3 umtsReceTsk...
RUNTASK id=4 umtsWritTsk...
Interface 25 ip = 0.0.0.0
ruleCheck()> Group: 0, Error: Useless rule index will be truncated, from idx:1
ruleCheck()> Group: 1, Error: Useless rule index will be truncated, from idx:27
ruleCheck()> Group: 2, Error: Useless rule index will be truncated, from idx:0
CBAC rule format check succeed !!
reqCBACBuf()> init match pool, Have: 1000
Memory Address: 0xffffffff81166c90 ~ 0xffffffff8116da0c
reqCBACBuf()> init timeGap pool, Have: 10000
Memory Address: 0xffffffff8116da0c ~ 0xffffffff8119e760
reqCBACBuf()> init sameHost pool, Have: 2000
Memory Address: 0xffffffff8119e760 ~ 0xffffffff811ae180
CBAC rule pool initialized !!
[init_if] local_if_mask=0xf80007
[init_if] local_wiredif_mask=0x80002
[init_if] local_wirelessif_mask=0xf00004
[init_if] localorVPN_if_mask=0xf80007
Init NAT data structure
RUNTASK id=5 if_task if0...
RUNTASK id=6 if_task if1...
RUNTASK id=7 if_task if2...
RUNTASK id=8 if_task if3...
RUNTASK id=9 if_task if4...
RUNTASK id=10 if_task if20...
RUNTASK id=11 if_task if21...
RUNTASK id=12 if_task if22...
RUNTASK id=13 if_task if23...
RUNTASK id=14 if_task if25...
RUNTASK id=15 timer_task...
RUNTASK id=16 conn_mgr...
RUNTASK id=17 main_8021x...
Build Day = Jun 30 2011
RUNTASK id=18 saveRandomSeedTask...
[VFS_init] Start...
[VFS_init] vfsState:1
vfs_codepage_init() TimeZone:23, vfs_cp_idx:23, vfs_cp_ID:5
fat_codePageInit() TimeZone:23, codePage:CP850, cPID:5, cpSize:256, toUpSize:30
ntfs_codepage timezone:23, lan= 0
ntfs_codePageInit() TimeZone:23, codePage:5
==[vfs_register_filesystem]============================
list size:7, Method:0x807ba324
1) Type:0x01, Name:FAT12
2) Type:0x04, Name:FAT16
3) Type:0x06, Name:FAT16
4) Type:0x0b, Name:FAT32
5) Type:0x0c, Name:FAT32
6) Type:0x0e, Name:FAT16
7) Type:0x81, Name:Minix
=================================================================
[VFS_init] FAT init OK
==[vfs_register_filesystem]============================
list size:1, Method:0x807baee0
1) Type:0x07, Name:NTFS/HPFS
=================================================================
[VFS_init] NTFS init OK
[VFS_init]-[vfs_mount_root] Start...
[VFS_init]-[vfs_mount_root] Init
Linux bootlog
booting from u-boot from original bootloader
[DANUBE Boot]:y
Go to Memory Address: (default:0x80002000) : 0x
Jump to address 0x80002000 ...
U-Boot 2010.03 (Sep 29 2012 - 18:24:13)
Board: ARV752DPW22
SoC: Danube/Twinpass/Vinax-VE V1.5, DDR Speed 166 MHz, CPU Speed 333 MHz
DRAM: 64 MB
Flash: 8 MB
*** Warning - bad CRC, using default environment
Net: bring up ebu gpio
initializing ar8216 switch... initialized
lq_cpe_eth
Hit any key to stop autoboot: 0
## Booting kernel from Legacy Image at b0020000 ...
Image Name: MIPS OpenWrt Linux-3.3.8
Created: 2012-09-04 19:43:16 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1011964 Bytes = 988.2 kB
Load Address: 80002000
Entry Point: 80002000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #4 Fri Aug 31 16:20:51 UTC 2012
[ 0.000000] SoC: Danube rev 1.5
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 00019641 (MIPS 24KEc)
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone PFN ranges:
[ 0.000000] Normal 0x00000000 -> 0x00004000
[ 0.000000] Movable zone start PFN for each node
[ 0.000000] Early memory PFN ranges
[ 0.000000] 0: 0x00000000 -> 0x00004000
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
[ 0.000000] Kernel command line: console=ttyLTQ1,115200 rootfstype=squashfs,jffs2 machtype=ARV752DPW22
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Primary instruction cache 16kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
[ 0.000000] Writing ErrCtl register=00074f68
[ 0.000000] Readback ErrCtl register=00074f68
[ 0.000000] Memory: 61832k/65536k available (2399k kernel code, 3704k reserved, 403k data, 176k init, 0k highmem)
[ 0.000000] NR_IRQS:256
[ 0.000000] CPU Clock: 333MHz
[ 0.000000] Calibrating delay loop... 221.18 BogoMIPS (lpj=442368)
[ 0.040000] pid_max: default: 32768 minimum: 301
[ 0.044000] Mount-cache hash table entries: 512
[ 0.052000] NET: Registered protocol family 16
[ 0.060000] gpiochip_add: registered GPIOs 0 to 15 on device: ltq_gpio
[ 0.064000] gpiochip_add: registered GPIOs 16 to 31 on device: ltq_gpio
[ 0.068000] MIPS: machine is ARV752DPW22 - Arcor A803
[ 0.072000] gpiochip_add: registered GPIOs 100 to 115 on device: ltq_ebu
[ 0.104000] bio: create slab
backup flash
brntool
A dump of the firmware is done in ~1 hour. Ro dump twice as recomended by the autor of brntool you have to plan 2 hours to backup your device.
First you have to enter the "Administrator Mode" in DANUBE Boot.
- plug in USB2serial adapter
screen /dev/ttyUSB0 115200- power on the device
- hurry press 3x space bar
- type an exclamation mark (!) to enter the administration mode
Press Space Bar 3 times to enter command mode ...123 Yes, Enter command mode ... [DANUBE Boot]:! Enter Administrator Mode ! ====================== [#] Set Serial Number [2] Use Normal Firmware [3] Use ART-Testing Firmware [9] Taggle ART Firmware Enable/Disable [A] Set MAC Address [E] Erase Flash [G] Run Runtime Code [H] Set Options [M] Upload to Memory [P] Print Boot Params [R] Read from Memory [T] Memory Test [U] Upload to Flash [V] Set Board Version [W] Write to Memory [Y] Go to Memory [Z] Dump DDR Ram Register [0] Primary = Image 0 [1] Primary = Image 1 ====================== [DANUBE Boot]:
Kill your serial terminal (screen: "[CTRL]+[A], [K]" and confirm exit with [Y]"). Now you are able to dump the original firmware as shown below.
# time ./brntool.py --read=ARV752DPW22_orig.dump --addr=0xB0000000 --verbose --size=0x800000 Waiting for a prompt... Ok. .............................. [abbreviated version, you will see **many** more dots and hopefully no exclamation marks] real 61m27.738s user 1m18.327s sys 0m47.164s
Powercycle the router, enter the "Admin Mode" of the bootloader and dump the firmware again:
# ./brntool.py --read=ARV752DPW22_orig2.dump --addr=0xB0000000 --verbose --size=0x800000
Compare the files. If everything is ok you will end with 2 identical files:
# ls -l ARV752DPW22_orig*.dump -rw-r--r--. 1 root root 8388608 12. Feb 23:32 ARV752DPW22_orig.dump -rw-r--r--. 1 root root 8388608 13. Feb 00:58 ARV752DPW22_orig2.dump # diff ARV752DPW22_orig.dump ARV752DPW22_orig2.dump # cmp ARV752DPW22_orig.dump ARV752DPW22_orig2.dump # md5sum ARV752DPW22_orig* 7eeffb26ab4d23214b0bfd3e14a34812 ARV752DPW22_orig2.dump 7eeffb26ab4d23214b0bfd3e14a34812 ARV752DPW22_orig.dump
As you see, the two files are the same. If you compare your own output with this example you probably note the md5sums differ, thats ok: You have to end with md5sums different like shown here in this example, because my MAC Adress/Serial No./configuration its also saved in this dump.
Layout of the original Flash Image
If you select "[E] Erase Flash" in the bootloader you can see the original flash layout:
[DANUBE Boot]:e
ERASE Flash
---------------------------------------
Area Address Length
---------------------------------------
[0] Boot 0xB0000000 128K
[1] Configuration 0xB0020000 512K
[2] Special Area 0xB00A0000 64K
[3] Code Image 0xB00B0000 7424K
[4] Boot Params 0xB07F0000 64K
[5] Flash Image 0xB0000000 8192K
---------------------------------------
Enter area to ERASE:
press [ESC]!!!
Explaination
these are the assumptions:
| Area | content |
|---|---|
| Boot | brnboot |
| Configuration | router OS parameters |
| Special Area | ART Image |
| Code Image | router OS |
| Boot Params | brnboot parameters |
U-Boot
Downloads: OpenWrt Trunk uboot
There are 3 different possibilities to run u-boot:
- uboot-lantiq-arv752DPW22_brnboot meant to be loaded from brnboot as a 2nd stage bootloader, on memory
- uboot-lantiq-arv752DPW22_flash meant to be flashed into the unit as the main bootloader, (at 0xB0000000-0xB000FFFF ???)
- uboot-lantiq-arv752DPW22_ramboot meant to be uploaded via UART by the cpu if flash's bootloader is broken, for rescue purposes
see below
run u-boot noninvasive via serial port
- download u-boot.bin
- get into administrative mode of bootloader
- choose
[M] Upload to Memory
at default address 0x80002000 - exit terminal
- send u-boot.bin via XMODEM protocoll:
sx u-boot.bin </dev/ttyUSB0 >/dev/ttyUSB0 - get to the console via terminal egain & type [Return]
- choose
[Y] Go to Memory
to default address 0x80002000
u-boot starts like this:
[DANUBE Boot]:Y Go to Memory Address: (default:0x80002000) : 0x Jump to address 0x80002000 ... U-Boot 2010.03 (Sep 29 2012 - 18:24:13) Board: ARV752DPW22 SoC: Danube/Twinpass/Vinax-VE V1.5, DDR Speed 166 MHz, CPU Speed 333 MHz DRAM: 64 MB Flash: 8 MB *** Warning - bad CRC, using default environment Net: bring up ebu gpio initializing ar8216 switch... initialized lq_cpe_eth Hit any key to stop autoboot: 0 Wrong Image Format for bootm command ERROR: can't get kernel image! Failed to execute bootcmd (maybe invalid u-boot environment?), starting httpd to update firmware... starting httpd server from server 192.168.1.1 http start ..........................................................................
You can hit [Ctrl] + [C] to get to the command line or hitting a key at the requested time.
install OpenWRT via serial port
Attention:
In this paragraph you have to take action on bootloader [bl] cmd line and sometimes on u-boot [ub] cmd line and sometimes local [lo].
Don't mix up!
Download the squash image openwrt-lantiq-danube-ARV752DPW22-squashfs.image.
At first create a flash image that doesn't destroy the original bootloader.
To do this take a copy of the original bootloader code (first 128k of the backup firmware) and attach the squash image to it:
[lo]: cat ARV752DPW22_boot.dump openwrt-lantiq-danube-ARV752DPW22-squashfs.image > flash.img
Then erase all flash blocks not needed on the u-boot command line:
[ub]: ARV752DPW22 ⇒ erase 1:9-134
This takes some time.
Then reset and write the just created flash.img via XMODEM to the flash at area 5 (whole flash):
choose
[bl]: [U] Upload to Flash
[bl]: [5] Flash Image 0xB0000000 8192K and transmit via
[lo]: sx flash.img </dev/ttyUSB0 >/dev/ttyUSB0
This takes some more time to transmit and then takes some time again to get written to the flash. Be patient!!
Wait until the bootloader command line is interactive again. Be patient!!
The openwrt image is on the flash but it doesn't start automatically because u-boot isn't on flash yet.
To boot OpenWRT put u-boot into ram again and start it. That's it.
UART Mode
There is a special mode where you can load a firmware via serial port when the bootloader is broken.
This info is taken from: Arcor-User-Forum.
You need to set the hardware into UART mode by modifying the hardware:
- shortcut R80 and
- bring +3.3V on the left side of R65
Tags
toh/astoria/arv752dpw22.txt · Last modified: 2012/10/22 22:28 by wutje