Are you telling me that you have a buspirate but you don't have a small phillips screwdriver and a small, flat-head, one?
Tsk, tsk
As per the arv7518, it has a different switch (supported), double the flash (8M instead of 4) and a different wifi chip (ar9223, badly supported with my patches, badly here meaning that performance is atrocious).
Everything else is the same (basically the SoC, which is the danube), though the led mapping is probably different.

FWIW, I recovered that screwdriver, got the case open, connected into the serial. I'm seeing the boot menus and stuff. I've also flashed a test image from this forum on the device using the standard website, so now I have uboot chainloaded from brnload, which in turn loads some old image of openwrt. Nice.
I'll play with it a little more and then go sleep. I do work tomorrow .

Spent some time playing this xmodem/brnboot/ubootfromngp'stestimage

ATM using the test image from ngp.
I've managed to flash some stuff with xmodem from brnboot and with tftp + era + cp.b on u-boot. Think I have the gist of it.

Now, I'm trying to move on to more interesting stuff. It seems brnboot doesn't like loading anything from flash that isn't prepared for it with whatever obfuscation procedure, and I don't even care: I just wanna ged rid of it and place u-boot there instead.

So I went and built my own u-boot from openwrt svn, as u-boot git doesn't seem to have configs for arv4518 (remember upstream!!! Is it even worth it for openwrt to have a fork of u-boot? ) . As a start, the ram version since we know it works. Problem is it just hangs, both loaded from brnboot or from u-boot itself. The image name is "uboot-lantiq-arv4518PW_ramboot".

It just freezes like that. Using 0x80002000 is about as bad. Also tried uploading via XMODEM with brnboot and jumping to the address, for both addresses. It freezes all the same.

Pointers?

However, the uboot-lantiq-arv4518PW_brnboot one works when loaded to memory and jumped to from uboot. Why would the ramdisk one not work and this one do? Did I get it wrong, about which of these has which purpose? I'm very confused. I'm afraid to flash the real one and then see myself trying that boot-from-UART rescue procedure...

Pointers are welcome.

The various u-boot targets: https://forum.openwrt.org/viewtopic.php … 75#p120175

Steps to replace brnboot with u-boot: https://forum.openwrt.org/viewtopic.php … 24#p121424

Yes, I was looking at those. I guess I just misunderstood the ramdisk one (I still don't understand why it doesn't work anyway. It's supposed to be the one to copy on ram and jump to, so wtf). "Second stage" brnboot works as I was commenting. I'm a bit afraid to flash the real one at the bootloader area but it *should* work.
Did flash openwrt at the firmware area like this:

ARV4518 =>  setenv ipaddr 192.168.0.10
ARV4518 => setenv serverip 192.168.0.2
ARV4518 => tftp openwrt.img
Using lq_cpe_eth device
TFTP from server 192.168.0.2; our IP address is 192.168.0.10
Filename 'openwrt.img'.
Load address: 0x80100000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################
done
Bytes transferred = 3342340 (330004 hex)
ARV4518 => era  0xB0030000+0x330004
erase - erase FLASH memory

ARV4518 =>   era  0xB0030000 +0x330004

.................................................... done
Erased 52 sectors
ARV4518 =>  cp.b 0x80100000 0xB0030000 0x330004
Copy to Flash... 9....8....7....6....5....4....3....2....1....done

Did flash openwrt at what linux considers the linux area of the flash like this: cp.b 0x80100000 0xB0020000 0x330004
The image I flashed is a openwrt-lantiq-xway-ARV4518PW-jffs2-64k.image I built myself. u-boot loaded from brnboot seems to boot it fine
Notice the following:

The interesting thing here is that in openwrt's built uboot defaults, printenv is like this:

Which is nonsense for me. Why would kernel_addr=0xb0020000 if openwrt image's linux considers this same address to be uboot_env? (which made me flash it twice. At first I flashed it to 0xb0020000 going by kernel_addr on uboot and since it was safe per brnboot-obtained knowledge of the flash layout, then got the "can't find uImage" problem and saw linux's opinion on flash layout on the logs). Likely this is because it's the u-boot brnboot version, rather than the flashable one.

Anyway, things seem under control now and I'm pretty happy about it .

Tomorrow I might make the effort and write some documentation for the device on the wiki. I had to do a lot of documentation digging and guesswork to get here, which I consider criminal. Only one person should ever need to do so and then he should write proper documentation for those that come next!.

Gonna flash the real u-boot on the bootloader area now. Let's hope that goes well .

uh-oh. That's not so easy.

33055837   64 -rw-r--r--   1 rvalles  rvalles     65536 jul 12 17:03 ./uboot-lantiq-arv4518PW_flash/u-boot-bootstrap.bin
33055618  128 -rw-r--r--   1 rvalles  rvalles    131072 jul 12 17:03 ./uboot-lantiq-arv4518PW_brnboot/u-boot.bin
33055839  248 -rw-r--r--   1 rvalles  rvalles    250299 jul 12 17:04 ./uboot-lantiq-arv4518PW_ramboot/u-boot.asc
33055621  128 -rw-r--r--   1 rvalles  rvalles    131072 jul 12 17:04 ./uboot-lantiq-arv4518PW_ramboot/u-boot.bin

Just what is this u-boot-bootstrap.bin? Why is it not 128KB? Where's my flashable u-boot?

No idea, I just built it and I got the same
Keep in mind that the posts I pointed you to were made at a time when arv4518 patches weren't in openwrt, so at the time I built u-boot with ngp's patches plus mine (for the arv7518). What got merged later maybe is different.

Edit: there's an u-boot.bin in the build dir, trunk/build_dir/linux-lantiq_xway/u-boot-2010.03/arv4518PW_flash, don't know the difference between the plain version and the bootstrap one.

Edit2: this is from a checkout previous to the latest rename (TPTB enjoy renaming this platform more than fixing issues) so the path may be different now.

(Last edited by pippolippi on 12 Jul 2011, 20:31)

Yeah.
-rwxr-xr-x  1 rvalles rvalles 115944 12 jul 17:03 u-boot.bin
Gonna try and flash that now. Fingers crossed. I'll use uboot to flash it, as tftp feels more reliable than the xmodem thingy. If it doesn't work, it'll be time to have fun with the UART boot.

Wait a moment and read here:
http://www.mail-archive.com/u-boot@list … 43737.html
maybe the u-boot-bootstrap.bin is the real thing.

Yep. I'm hoping the other image would have worked (by initialising the ram himself, I guess?). The bootstrap one definitely did.

ROM VER: 1.0.3
CFG 01
Read EEPROMX
 X


U-Boot 2010.03 (Jul 12 2011 - 17:03:36)

Board: ARV4518PW
SoC: Danube/Twinpass/Vinax-VE V1.3, DDR Speed 166 MHz, CPU Speed 333 MHz
DRAM:  64 MB
Flash:  4 MB
*** Warning - bad CRC, using default environment

Net:   
searching for rtl8306 switch ... found
lq_cpe_eth
Hit any key to stop autoboot:  0 
ARV4518 =>  
ARV4518 => printenv
bootcmd=run flash_flash
bootdelay=2
baudrate=115200
loads_echo=
ipaddr=192.168.1.1
serverip=192.168.1.101
rootpath="/export"
gatewayip=192.168.1.254
netmask=255.255.255.0
ram_addr=0x80500000
kernel_addr=0xb0020000
flashargs=setenv bootargs rootfstype=squashfs,jffs2
nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=${serverip}:${rootpath} 
addip=setenv bootargs ${bootargs} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}:${netdev}:off
addmisc=setenv bootargs ${bootargs} init=/etc/preinit console=ttyS1,115200 ethaddr=${ethaddr} ${mtdparts}
flash_flash=run flashargs addip addmisc;bootm ${kernel_addr}
flash_nfs=run nfsargs addip addmisc;bootm ${kernel_addr}
net_flash=run load_kernel flashargs addip addmisc;bootm ${ram_addr}
net_nfs=run load_kernel nfsargs addip addmisc;bootm ${ram_addr}
load_kernel=tftp ${ram_addr} ${tftppath}openwrt-ifxmips-uImage
update_uboot=tftp 0x80500000 ${tftppath}u-boot-ARV4518PW.bin;era 0xb0000000 +${filesize};cp.b 0x80500000 0xb0000000 ${filesize}
update_openwrt=tftp ${ram_addr} ${tftppath}ARV4518PW-squashfs.image;era ${kernel_addr} +${filesize};cp.b ${ram_addr} ${kernel_addr} ${filesize}
stdin=serial
stdout=serial
stderr=serial
ethaddr=00:22:2d:3e:84:60
ethact=lq_cpe_eth
ver=U-Boot 2010.03 (Jul 12 2011 - 17:03:36)

Environment size: 1269/65532 bytes
ARV4518 => saveenv
Saving Environment to Flash...
Un-Protected 1 sectors
Erasing Flash...
. done
Erased 1 sectors
Writing to Flash... 9....8....7....6....5....4....3....2....1....done
Protected 1 sectors
ARV4518 => md 0xb0010000
b0010000: edb22872 626f6f74 636d643d 72756e20    ..(rbootcmd=run 
b0010010: 666c6173 685f666c 61736800 626f6f74    flash_flash.boot
b0010020: 64656c61 793d3200 62617564 72617465    delay=2.baudrate
b0010030: 3d313135 32303000 6c6f6164 735f6563    =115200.loads_ec
b0010040: 686f3d00 69706164 64723d31 39322e31    ho=.ipaddr=192.1
b0010050: 36382e31 2e310073 65727665 7269703d    68.1.1.serverip=
b0010060: 3139322e 3136382e 312e3130 3100726f    192.168.1.101.ro
b0010070: 6f747061 74683d22 2f657870 6f727422    otpath="/export"
b0010080: 00676174 65776179 69703d31 39322e31    .gatewayip=192.1
b0010090: 36382e31 2e323534 006e6574 6d61736b    68.1.254.netmask
b00100a0: 3d323535 2e323535 2e323535 2e300072    =255.255.255.0.r
b00100b0: 616d5f61 6464723d 30783830 35303030    am_addr=0x805000
b00100c0: 3030006b 65726e65 6c5f6164 64723d30    00.kernel_addr=0
b00100d0: 78623030 32303030 3000666c 61736861    xb0020000.flasha
b00100e0: 7267733d 73657465 6e762062 6f6f7461    rgs=setenv boota
b00100f0: 72677320 726f6f74 66737479 70653d73    rgs rootfstype=s

And I guess it uses 64KB from 0xb0010000 to hold the config. Now I suppose I could flash openwrt on 0xb0020000. However, I'm guessing the openwrt kernel will still look at 0xb0030000 instead, thinking that u-boot is 128KB + 64KB config. Gonna explore openwrt's menuconfig to see if I can find a way to convince it of otherwise.

I think you could change the flash layout in mach-arv45xx.c (static struct mtd_partition arv45xx_partitions[] ) but I think it's possible to pass the real flash layout from u-boot as a kernel parameter. Not really sure about it though.

(Last edited by pippolippi on 12 Jul 2011, 22:22)

And I can't seem to find that in the menuconfig. Grepped around for 30000 without much success either.

I'm tired and I work tomorrow, so I'll be going to sleep. If you happen to know how to tell the kernel where the uImage is so that it can find the subpartitions, poke me.

Tomorrow I'll put some docs on the wiki. For what it's worth, I have a few notes on my local wiki already. I'm hoping they'll be of use to somebody.

Also, these board configs really need to find their way to u-boot's git.

No, not in menuconfig, but changing the layout of the flash in the source I told you (mach-arv45xx.c).

Bleh, I was so tired I never noticed that post while I was writing the other. Thanks a lot.

(Last edited by rvalles on 13 Jul 2011, 04:17)

static struct mtd_partition arv45xx_partitions[] =
{
        {
                .name   = "uboot",
                .offset = 0x0,
                .size   = 0x10000,
        },
        {
                .name   = "uboot_env",
                .offset = 0x10000,
                .size   = 0x10000,
        },
        {
                .name   = "linux",
                .offset = 0x20000,
                .size   = 0x3d0000,
        },
        {
                .name   = "board_config",
                .offset = 0x3f0000,
                .size   = 0x10000,
        },
};

And things are fine, openwrt is happy and spacey .

If I destroy board_config, system hangs when trying to init the wireless chip, so I guess there's some relevant firmware stored there or sth. It's good I made a backup before testing.

Wrote some env macros to flash stuff from tftp on u-boot. So convenient!

(Last edited by rvalles on 13 Jul 2011, 18:57)

Yes, it's good: that's where the calibration data, as well as the system mac, resides, and (supposedly) each individual router has its own.

Another "trick" is that the image has a built-in kernel command line, and ignores the command line from u-boot.
To avoid that, edit the Makefile in the image subdirectory, and remove the leading dash from "xway_cmdline", i.e, from

xway_cmdline=-console=ttyLTQ1,115200 rootfstype=squashfs,jffs2

to

xway_cmdline=console=ttyLTQ1,115200 rootfstype=squashfs,jffs2

Another "brilliant" idea that took me an afternoon to find, wondering why oh why my carefully crafted command line parameters weren't working

Good to know. I'll go to sleep now (have to wake up for work...) and guess I'll copyedit my localwiki page about the router into openwrt's wiki tomorrow.

Created a wiki entry for it:
http://wiki.openwrt.org/toh/arv4518pw

And added to the hardware / work in progress list as astoria - arv4518.

All,

Thanks a lot for all your efforts on this hardware. I'm trying to follow this thread by reading it frequently and hoping that once I will be able to flash mine with a working image. As I see we have reached a milestone, many thanks for all the contributors on that.
I see that there are new ARV4518PW images in the trunk section, and now we have a tutorial on how to flash uboot. How far are we from the stage where we will be able to flash a working image with uboot to the device?

dp79

You can already, and it's working to some decent degree. It's just maybe a little harder than necessary for non-devs. If you're adventurous, you could manage with the wiki page I just created and skimming through the thread.

(Last edited by rvalles on 14 Jul 2011, 22:33)

Hi,

I think I will give it a try, I just need some clarifications. I see you've created a list of the from to memory addresses for each mtd blocks. So how do I delete (or overwrite) the old brn boot loader? I have an usb 3.3V serial programmer cabel and lets say I 've aleady soldered it to the appropriate pins. What's next? I assume, I just need an app for serial communication and erase the bootloader part of the flash and write the new one. Or should I repartition the Flah using the memory addresses you've posted on your wiki and then write the bootloader to 0x0 - 0x10000? Once I can get uboot on, I think I will be able to get the flash on by myself. So let's say I have the serial connection estabilished with the device....Could you give me the list of commands I need to run and the name of the app for the serial comm?

Many thanks ahead!

    dp79

Did update the wiki a little. About "how to", first of all make a backup of everything. Ideally, write down the original flash layout somewhere, and backup your flash by sections, on separate files. Then backup those files, just in case. Secondly, use brnboot to load u-boot (the image that's for brnboot) from uart into ram via xmodem and then to jump to it.

Once in u-boot, assuming it works fine as it should, you'd use printenv/setenv to set network config to something that suits your needs, tftp to download the burnable 64KB u-boot into ram, then crc32 to make sure what you have is correct.

Following that is the dangerous part: protect off all, erase, cp.b. Read u-boot documentation for details on how to do it.

Using, e.g., brndumper

IIRC brnboot-uboot is hardcoded to work at a specific ram address, 0x80200000?

To the address where the original bootloader was (0xB0000000).

hi,

I have a SMC7908A (from ya.com) and I have seen some image files for this device have been published with the latest RC5 but after reading the wiki entry it´s not clear for me how to test this image files.

Is safe to try this images without a serial console cable attached to the device? Could I flash the image file named "openwrt-lantiq-danube-ARV4518PW-squashfs.image" using the original web interface to get a openwrt working? Or maybe I should flash using tftp? (haven´t seen anything tftp flashing in the wiki)

Or maybe I should be patient and wait for a stable release ready for final user?

many thanks for any help.