In dmesg it says etop: invalid MAC, using random, so that config partition is for sure screwed up. Use some hex editor to extract those last 64bytes from dump, transfer it with scp to router and flash it with "mtd write filelocation board_config".

About the ath5k, looks like there is a same problem like on my gigaset router, it says pci 0000:00:0e.0: [168c:ff1a] type 0 class 0x000200, and 168c:ff1a isn't added to to ath5k driver, there is a patch i added /package/mac80211/patches/910-ath5k-ff16-picid.patch, edit it to look like this and recompile:

--- a/drivers/net/wireless/ath/ath5k/pci.c
+++ b/drivers/net/wireless/ath/ath5k/pci.c
@@ -45,6 +45,8 @@ static DEFINE_PCI_DEVICE_TABLE(ath5k_pci
     { PCI_VDEVICE(ATHEROS, 0x001b) }, /* 5413 Eagle */
     { PCI_VDEVICE(ATHEROS, 0x001c) }, /* PCI-E cards */
     { PCI_VDEVICE(ATHEROS, 0x001d) }, /* 2417 Nala */
+    { PCI_VDEVICE(ATHEROS, 0xff16) },
+    { PCI_VDEVICE(ATHEROS, 0xff1a) },
     { 0 }
 };
 MODULE_DEVICE_TABLE(pci, ath5k_pci_id_table);

I did recover the partition from u-boot

changed the patch and compiled:

Linux version 3.1.0 (esalgado@ubuntu) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #4 Fri Nov 11 12:40:50 PST 2011
SoC: Danube rev 1.3
bootconsole [early0] enabled
CPU revision is: 00019641 (MIPS 24Kc)
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
On node 0 totalpages: 16384
free_area_init_node: node 0, pgdat 80288480, node_mem_map 81000000
  Normal zone: 128 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 16256 pages, LIFO batch:3
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyLTQ1,115200 rootfstype=squashfs,jffs2 machtype=ARV4518PW
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 16kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=00000008
Readback ErrCtl register=00000008
Memory: 62056k/65536k available (2215k kernel code, 3480k reserved, 371k data, 168k init, 0k highmem)
NR_IRQS:256
CPU Clock: 333MHz
Calibrating delay loop... 221.18 BogoMIPS (lpj=442368)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
MIPS: machine is ARV4518PW - SMC7908A-ISP, Airties WAV-221
bio: create slab <bio-0> at 0
pci 0000:00:0e.0: [168c:ff1a] type 0 class 0x000200
pci 0000:00:0e.0: reg 10: [mem 0x00000000-0x0000ffff]
pci 0000:00:0e.0: BAR 0: assigned [mem 0x18000000-0x1800ffff]
pci 0000:00:0e.0: BAR 0: set to [mem 0x18000000-0x1800ffff] (PCI address [0x18000000-0x1800ffff])
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
PCI: CLS 0 bytes, default 32
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 126
gptu: succeeded to request irq 127
gptu: succeeded to request irq 128
gptu: succeeded to request irq 129
gptu: succeeded to request irq 130
gptu: succeeded to request irq 131
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 121
io scheduler noop registered
io scheduler deadline registered (default)
ltq_asc.0: ttyLTQ0 at MMIO 0x1e100400 (irq = 104) is a ltq_asc
ltq_asc.1: ttyLTQ1 at MMIO 0x1e100c00 (irq = 112) is a ltq_asc
console [ttyLTQ1] enabled, bootconsole disabled
ltq_nor: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x00007f Chip ID 0x0022f9
ltq_nor: Found an alias at 0x400000 for the chip at 0x0
ltq_nor: Found an alias at 0x800000 for the chip at 0x0
ltq_nor: Found an alias at 0xc00000 for the chip at 0x0
Amd/Fujitsu Extended Query Table at 0x0040
  Amd/Fujitsu Extended Query version 1.1.
number of CFI chips: 1
Creating 4 MTD partitions on "ltq_nor":
0x000000000000-0x000000020000 : "uboot"
0x000000020000-0x000000030000 : "uboot_env"
0x000000030000-0x0000003f0000 : "linux"
Creating 2 MTD partitions on "ltq_nor":
0x000000030000-0x000000116591 : "kernel"
mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
0x000000116591-0x0000003f0000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=2C0000, len=130000 
0x0000002c0000-0x0000003f0000 : "rootfs_data"
0x0000003f0000-0x000000400000 : "board_config"
ltq_mii: probed
Registering RTL8306SD switch with Chip ID: 0x5988, version: 0x0000
eth0: attached PHY [Realtek RTL8306S] (phy_addr=0:00, irq=-1)
TCP westwood registered
NET: Registered protocol family 17
8021q: 802.1Q VLAN Support v1.8
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 168k freed
Compat-wireless backport release: compat-wireless-2011-10-14
Backport based on wireless-testing.git master-2011-11-04
cfg80211: Calling CRDA to update world regulatory domain
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: World regulatory domain updated:
cfg80211:     (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211:     (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
PCI: Enabling device 0000:00:0e.0 (0000 -> 0002)
ath5k 0000:00:0e.0: registered as 'phy0'
ath5k phy0: unable to init EEPROM
ath5k: probe of 0000:00:0e.0 failed with error -5
NET: Registered protocol family 8
NET: Registered protocol family 20
Button Hotplug driver version 0.4.1
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 24
nf_conntrack version 0.5.0 (972 buckets, 3888 max)
IFX MEI Version 5.00.00

Infineon CPE API Driver version: DSL CPE API V3.24.4.4
    ATM (A1) firmware version 1.0.19
ifxmips_atm: ATM init succeed
dwc_otg: version 2.60a 22-NOV-2006
DWC_otg: Using DMA mode
dwc_otg dwc_otg.0: DWC OTG Controller
dwc_otg dwc_otg.0: new USB bus registered, assigned bus number 1
dwc_otg dwc_otg.0: irq 62, io mem 0xffffffffbe101000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
DISCONNECTED PORT
device eth0 entered promiscuous mode
br-lan: port 1(eth0) entering forwarding state
br-lan: port 1(eth0) entering forwarding state
jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
jffs2_build_filesystem(): unlocking the mtd device... done.
jffs2_build_filesystem(): erasing all blocks after the end marker... done.
JFFS2 notice: (891) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.

Now it seems to initialize the driver, but with the error

PCI: Enabling device 0000:00:0e.0 (0000 -> 0002)
ath5k 0000:00:0e.0: registered as 'phy0'
ath5k phy0: unable to init EEPROM
ath5k: probe of 0000:00:0e.0 failed with error -5

I am now doing a "make clean && make" to make sure it is fully recompiled...

Thanks for support, Delboy!

Edit 12/11/11: nah, it did nothing. Now I'm sure tha last 64kb of the flash are OK. Please, tell me if you need me to do any tests!!

(Last edited by gnumengor on 12 Nov 2011, 17:39)

I tried to flash an easybox 802 (ARV752DPW) and foobared the bootloader, too.

Is the UART procedure exactly the same as with the arv4518pw ? Do I have to look for R80 and R65 , too ?
Will a 3.3v serial do the job?

Hello, somebody knows how upgrade firmware from SMC 7908A-ISP (interior sticker says: ARV4518PW-A-LF-LT) to the latest Open-WRT firmware step by step and making a backup from original firmware (Ya.com-ARF4518PW-v0.10.016(20090729).bin) step by step before?. Because I don´t find a detailed tutorial about how do this step by step. Anwer please and thank you very much.

First... Thanks to Roc, for being my guide and suffer my continous mails
And thanks to Delboy, to try to help me with the ath5k wifi driver!!!

Instructions for Linux.

First Step: you have to get access to the serial console!

Open your router with a screwdriver, and have a look at http://wiki.openwrt.org/toh/arcadyan/arv4518pw and check where to plug the serial TX, RX and GND

You need to get a serial port for your computer... I bought a Bus Pirate from here:
http://www.seeedstudio.com/depot/bus-pi … Path=61_68
and plugged it with a disasembled IDC4-IDC4 cable from an old motherboard.

Once you have that serial port connected, connect to the console:

screen /dev/ttyUSB0 115200

Turn on the router, and in the console, you have to reach to the brnboot command line:

ROM VER: 1.0.3
CFG 01
Read
ROM VER: 1.0.3
CFG 01
Read EEPROMX
 X



=======================================================================
Wireless ADSL Gateway DANUBE Loader 64M-V0.02 build Apr 24 2008 16:12:25
                    Arcadyan Technology Corporation
=======================================================================
MXIC MX29LV320ABTC bottom boot 16-bit mode found

Copying boot params.....DONE


Press Space Bar 3 times to enter command mode ...123
Yes, Enter command mode ...

Then, press ! to enter to the administrative interface.

Second step: backup your firmware.

Close the screen session: press CTRL+A, K, and confirm you want to "kill this window" by pressing Y

Now you can make a backup of the original firmware before writing anything to the chip. You will find this useful if something happens...

For that, you have to clone this tool, written by Roc Vallès

git clone https://github.com/rvalles/brntool

then install python-serial module. In Debian/Ubuntu:

apt-get install python-serial

then, you can start dumping the firmware

./brntool.py --read=AR4518PW_whole.dump --addr=0xB0000000 --verbose --size=0x400000

then run the tool, and wait like... 30minutes-1hour for it to end.
Is a good idea to run the tool twice and compare the two dumps to be sure its 100% accurate:

./brntool.py --read=AR4518PW_whole.dump2 --addr=0xB0000000 --verbose --size=0x400000

cmp AR4518PW_whole.dump AR4518PW_whole.dump2

Third step: load the U-Boot Boot Loader

Download this: the last build from trunk of u-boot boot loader for your router, to be loaded through brnboot:
http://downloads.openwrt.org/snapshots/ … u-boot.bin

Connect again to the serial console (you still have the router turned on and with the administrative command line on!).

screen /dev/ttyUSB0 115200

Select the option to "Load code from memory" or something like that (I can't access it anymore...). It should tell you it is waiting for the code.

Close the screen session: press CTRL+A, K, and confirm you want to "kill this window" by pressing Y

Send the u-boot.bin with xmodem:

sx u-boot.bin </dev/ttyUSB0 >/dev/ttyUSB0
Sending u-boot.bin, 1024 blocks: Give your local XMODEM receive command now.
Bytes Sent: 131072   BPS:8007

Connect again to the serial console:

screen /dev/ttyUSB0 115200

You shouldn't see anything... press "y" and "Enter"... U-Boot should load!

I will try to continue this tutorial later, now it's time to prepare the supper!

I have to say that everything in the router works for me... except for Wifi. I built my own openwrt from source, but the ath5k driver can't read platform data... something is wrong in the code. But I plugged in a Wifi-USB stick and... it sucks... but works

Have a nice day,
Edgar

(Last edited by gnumengor on 25 Nov 2011, 21:09)

Hola denuevo, tan solo comentar que con la utilidad "brntool" bajo linux Xandros indicaba que aparecia un error al cargar el modulo serial en la linea 5 y como no se programar el script en Python pues lo deje. Despues me pase a Windows XP y la utilidad "brndumper.exe" mostraba el siguiente mensaje de error: " No se encuentra el ordinal 2206 en la biblioteca de vínculos dinámicos LIBEAY32.dll" y como no se programar en Visual C , o en lo que halla sido programado, pues tambien lo deje.
Pienso que ambas aplicaciones no estan del todo depuradas, por lo que me arriesgue con mi SMC 7908A-ISP que esta basado en el Arcadyan ARV4518PW-A-LF-LT y creo que lo he conseguido en parte, te digo como lo hice:

Una vez puesto en el puerto serie un adaptador de tension LVTTL para consola serie a 3.3V, logre dar con los pines adecuados: 3 Rx, 5 Tx, 9 Gnd y 10 Vcc. Por lo que bajo mi Windows XP abri el Hyperterminal y consegui conectar al cargador BRN de Danube, pulsando tres veces la barra espaciadora y para entrar en modo avanzado teclee la letra. !

Escogi la opcion: [u] Upload to Flash y cuando me aparecieron la disposicion de todas las particiones de la memoria flash escogi la opcion: [0] Boot para cambiar el gestor de arranque que traia BRN por el nuevo "u-boot" para ello me solicito un fichero imagen del cargador y le envie por Hyperterminal con las opciones:  baudios 115200bps, bits de datos 8, paridad ninguna y bit de stop 1 mas control de flujo por XMODEM, y le envie el fichero: uboot-lantiq-arv4518PW_flash-bootstrap.bin y todo fue bien.

Ya con el nuevo gestor de arranque U-Boot pude activar el servidor HTTP (httpd) que me solicitaba via web un fichero el cual le subi el nucleo: openwrt-lantiq-danube-ARV4518PW-uImage y tras reiniciar segui los mismos pasos para enviarle el fichero del sistema de archivos: openwrt-lantiq-danube-ARV4518PW-squashfs.image

Hasta ahora todo bien, y dije que lo he conseguido en parte porque el unico problema es que quien halla compilado este firmware para este router wifi se le olvido incluir en el propio nucleo que este router tiene soporte USB para asi poderle insertar un pendrive y que me sirva para compartirlo en red mediante Samba y tambien se le olvido que dicho router wifi tambien tiene integrado un dispositivo inalambrico de Atheros y modelo AR2417; pues al final no me ha sido posible de conectarme al repositorio que viene configurado por defecto (http://downloads.openwrt.org/backfire/1 … e/packages) para descargar e instalar dichas aplicaciones .ipk mediante la interfaz web LuCI por lo siguiente:

para el soporte basico del USB necesita del fichero: kmod-nls-base que no existe en dicho repositorio luego sin esto ya no puedo seguir; y para poder usar la interfaz wifi Atheros AR2417 el modulo: kmod-madwifi no me sirve pues no contempla la posibilidad de trabajar con dicho chipset (solamente trabaja con:  RF2133 y RF2425) sin embargo el modulo: kmod-ath5k si trabaja con el modelo AR2417 pero en la interfaz Luci no aparece reconocida dicho dispositivo inalambrico.

Asi que esperare que pronto el grupo de desarrolladores de Open-WRT se percaten de estas carencias y lo solventen pronto como sí suelen hacer bien los del firmware DD-WRT que de momento tampoco tiene soporte para este router wifi.

Si sabes de alguna forma para hacerle funcionar el soporte USB y la tarjeta de red WiFi AR2417 que lleva integrada pues acepto consejos aunque se me da mejor trabajar en modo grafico que en modo comandos y digo yo que si dichos firmwares se crearon con una interfaz web seria para configurarlos de forma totalmente grafica y no con comandos no?

I got USB support compiling OpenWRT from sources myself, using this guide: http://wiki.openwrt.org/doc/howto/build

Select USB support in make menuconfig to make it work.

Just be carefull when selecting options and packages, the squashfs.image needs to be smaller than 3700kb (more or less) or you will overwrite the last 64kb of the flash, where wifi calibration data is stored!

Try to look for python-serial package for Xandros and install it, and then brntool will work ok. It's important for you to get those last 64kb of the flash for disaster recovery

I have a Belkin F7D2401.  It is an Ralink RF3052F.  The board also has an Infineon PSB 50602 HL version 1.2.

I am using a TTL-to-USB adapter (PL2303) to connect to it using 115200 8N1 (minicom, microcom, putty, cat etc) and all works fine, so it seems.

This modem have, rather had, the BRN loader.  I accidentally tried to flash a firmware bigger than the size, but it was too late when I realized that this had wiped out BRN.  No backups. :-(

Now I get this in the serial console:

ROM VER: 1.2.0                                                         
CFG 04                                                                 
UART

Since the text UART is there, I suppose I didn't try to figure out any additional work to enable the UART mode.

I tried sending various u-boot.asc files.  Since none of them worked, I tried various combinations, such as using cat, pasting in minicom and others, pasting as a file in minicom, using hardware/software/both/no flow control, adding auto line feed when pasting, using both DOS and UNIX mode (with and without LF in newlines) u-boot.asc files, etc etc.  None of them could load U Boot.

I also tried using gct Perl script from uboot-lantiq to create u-boot.asc files.  This was using Belkin's source code for another similar router which created a map file and an srec file.

* Do I need to use u-boot.asc files with CR/LF?  Ir does it matter?

* Should I have any form of flow control or disable both?

* I didn't re-connect the USB cable between attempts.  Does this matter?  Does TTL-TO-USB controller buffer the input to add when the router is booted the next time?

Any thoughts?  And thanks in advance!

P.S.: This is my first post here. Hello everyone!

Could you upload photo of the router board. What is main chip?
Try with this uboot. Just connect with minicom, do a CTRL+A E (turn on local echo) and then paste contents of u-boot.asc in minicom. Wait for couple of minutes to finish and if nothing is happening, close minicom, turn router off and try again (dont forget to turn on the local echo again). From my expiriance in 3 out of 10 times something goes wrong even if i follow exactly same steps every time.

http://www.mediafire.com/?1wgsmpvrz8kxv0a

PSB 50602 HL, google returns nothing same for lantiq site, but it is probably some AMAZON-SE, and uboot-lantiq doesn't have suport for that, so you will need to find original bootlaoder and flash it with jtag.

Here goes.  Couldn't get one that shows the text on Infineon PSB 50601 HL version 1.2 (which I wrongly mentioned as a 50602 earlier).

No luck yet. :-(

Tried starting minocom first and then turning on the router (to avoid minicom sending AT codes to initialize the "modem"), and also the other way round, but nothing happens.  Local echo was always turned on.  An LED on PL2303 keeps flashing to indicate activity while paste is going on.  And yes, I tried each method at least 3-4 times.

Sorry, it is a 50601.  And yes, it's an AMAZON-SE.

If I were to work on uboot-lantiq support for this board, what does it take?

How easy/hard it is to find the original bootloader?  If I find it, is it possible to send it over UART/Serial?  Or is jtag my only option?

Was going through the SVN and perhaps EASY50601 may be what I need.  Compiling for that target now, can't find pre-built files at http://downloads.openwrt.org/snapshots/trunk/lantiq/.

Did you tried this one http://downloads.openwrt.org/snapshots/ … u-boot.asc . I found here https://dev.openwrt.org/browser/trunk/t … ?rev=27026

(Last edited by angrybb on 4 Dec 2011, 09:05)

Thanks!

I tried turning software flow control on/off, minicom paste as well as using cat in the terminal, starting minicom before and after turning the router on and so on, each permutation more than once.  Other things include pressing the front button to see if it triggers something.  But no luck just yet. :-(

Also, I am under the impression that U-Boot is to do with package/uboot-lantiq/ than linux/lantiq/.  If so, the above patch would enable support in the firmware, but not in u-boot itself.  Please correct me if I am wrong.

How long should I typically wait before seeing U-boot booting after the u-boot.asc file is completely pasted or cat is finished?  I waited for few minutes during each try _after_ the paste is complete.  Is it not long enough?

I am also beginning to feel that I am doing something fundamentally wrong.  Since I got a line "UART" on the serial console, I didn't do anything else to enable the UART mode.

Just a thought: maybe the upload is working but uboot uses a different baud rate. You could try to switch to 9600 after the upload.

It seems there is no uboot for amazon. When i select amazon in menuconfig i cant select any bootloader.

(Last edited by angrybb on 5 Dec 2011, 09:19)

Thanks!  Tried several variants of this very interesting suggestion, but still can't get past the "UART" prompt. :-(

Also, if I start with any other baud rate than 115200, I get garbage on the screen instead of a "UART" prompt.  Starting with 115200 and switching afterwards still gets a blank screen.  So I suppose if the upload is working and uboot switches to 9600, we should at least get some garbage instead of a blank screen.  But I'll keep exploring possibilities in the baud rate change possibilities.

I like to work on it.  Any suggestions to get started?  I can't find any detailed information about the 50601 board except a two page brochure.

I also considered the possibility that UART/upload goes at 115000, uboot works but at 9600 so I get a blank screen, and then I switch to 9600 and get a blank screen because uboot has already printed some output and waiting.  So I tried sending various keystrokes including ctrl+c to see if I get anything.  But nothing yet. :-(

How do I know if it is the PCB 50601 HL SoC is used, or that of the RA3052F?  The "1.2" indicates that it is likely to be the former.

(Last edited by rivendell on 6 Dec 2011, 05:17)

It is amazon-se because it says
ROM VER: 1.2.0                                                         
CFG 04                                                                 
UART
and only lantiq soc has internal ROM. Probably amazon-se is used for main cpu+adsl and RT3052F for wlan and switch.
Even if you find a backup of original bootlaoder, you can only backup via jtag because ramboot images are different, and none of those images from current uboot-lantiq will work because they dont have ase specific files.

Thanks.  I've been reading up about JTAG, and should be able to solder a connector pretty soon.  The million dollar question is, where can I find a backup bootloader? :-(

I also started studying MIPS architecture / assembly / instruction set to add ASE support for uboot-lantiq, but that may take a while.

Check out http://www.downloads.netgear.com/files/ … 28_src.zip  once I looked into it I saw there uboot for amazon se and ar9, and some .asc where there, maybe it will work

(Last edited by Delboy on 6 Dec 2011, 13:45)

Thanks.  Tried the u-boot.asc files that were included in both DGN3500 and DGN3500B firmware, and still the same result.  And the u-boot/board/ifx/ doesn't seem to have ASE specific stuff.