OpenWrt Forum Archive

Topic: Is this router based on the infineon danube?

The content of this topic has been archived between 1 Oct 2014 and 1 May 2018. Unfortunately there are posts – most likely complete pages – missing.

trndr wrote:

Hi, I've been tying to use the ARV7510PW images (with wiki patches) on a ARV4510PW-A (Bewan vodafone branded)
It seems like everything works, except WIFI (AR2417).
I keep getting:

PCI: Enabling device 0000:00:0e.0 (0000 -> 0002)
ath5k 0000:00:0e.0: registered as 'phy0'
ath5k phy0: unable to init EEPROM
ath5k: probe of 0000:00:0e.0 failed with error -5

Anybody able to help me with this?

Have the arv4510pw and arv7510pw different flash sizes? If yes make sure if the lan mac address is correct.

Pteridium wrote:

Have the arv4510pw and arv7510pw different flash sizes? If yes make sure if the lan mac address is correct.

Same flash size but different WIFI cards.

snk wrote:

It seems that the wireless chip requires separate EEPROM data. Usually this is located in some separate partition in flash. In 12.09 there are two functions related to this, arv_register_ath5k and ltq_register_ath5k. The first function needs as argument the offset of this EEPROM data in flash (see e.g. function arv4518pw_init in target/linux/lantiq/files/arch/mips/lantiq/xway/mach-arv.c for usage).

Edit: Does it have wireless on a separate mini-PCI card? Those shouldn't need separate EEPROM. IIRC in the ARV4510PW-A-LF-L3 I've seen this is the case.

Sadly this version is on board WIFI, for some reason they decided to reuse the name on different versions so the layout of a Vodafone Bewan ARV4510PW-A VIS is not the same as a Wippies Homebox LF-L3. Edit: Firmware seems to be the same though.

Do you have any idea how I can track down / dump the original WIFI EEPROM data.
The original flash layout is:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01000000 00020000 "Flash"
mtd1: 00020000 00008000 "Loader"
mtd2: 00020000 00020000 "Config"
mtd3: 007e0000 00020000 "Firmware"
mtd4: 007e0000 00020000 "OldFirmware"

in addition to that there is

mtd5: 00673000 00020000 "ART"

which is a mount to firmware after kernel.

The only places I can find the router MAC address in a hexdump of Flash is at the start of the loader, which seems odd.

(Last edited by trndr on 16 Apr 2013, 18:15)

trndr wrote:

Do you have any idea how I can track down / dump the original WIFI EEPROM data.
The original flash layout is:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01000000 00020000 "Flash"
mtd1: 00020000 00008000 "Loader"
mtd2: 00020000 00020000 "Config"
mtd3: 007e0000 00020000 "Firmware"
mtd4: 007e0000 00020000 "OldFirmware"

in addition to that there is

mtd5: 00673000 00020000 "ART"

which is a mount to firmware after kernel.

The only places I can find the router MAC address in a hexdump of Flash is at the start of the loader, which seems odd.

Well, there are some similarities with the arv4518pw. In this router the mac and the atheros calibration data are in the last partition, but the flash size is different.
Which openwrt version and revision are you flashing?

Pteridium wrote:
trndr wrote:

Do you have any idea how I can track down / dump the original WIFI EEPROM data.
The original flash layout is:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01000000 00020000 "Flash"
mtd1: 00020000 00008000 "Loader"
mtd2: 00020000 00020000 "Config"
mtd3: 007e0000 00020000 "Firmware"
mtd4: 007e0000 00020000 "OldFirmware"

in addition to that there is

mtd5: 00673000 00020000 "ART"

which is a mount to firmware after kernel.

The only places I can find the router MAC address in a hexdump of Flash is at the start of the loader, which seems odd.

Well, there are some similarities with the arv4518pw. In this router the mac and the atheros calibration data are in the last partition, but the flash size is different.
Which openwrt version and revision are you flashing?

Attitude Adjustment r 36330 with build rules for ARV7510PW

Yea I saw the similarities as well, but could never figure out which partition you found the mac and calibration data. Since mtd5 seems like a flat reference to mtd3 without kernel data.
The router with default firmware always has a fall-back firmware version. And the firmware if dumped is valid for flashing so it can't have any modifications.
Also the router seems to be breaking the MAC rules and assigning the same MAC to lan, wlan and wan.

trndr wrote:

Sadly this version is on board WIFI, for some reason they decided to reuse the name on different versions so the layout of a Vodafone Bewan ARV4510PW-A VIS is not the same as a Wippies Homebox LF-L3. Edit: Firmware seems to be the same though.

Do you have any idea how I can track down / dump the original WIFI EEPROM data.
The original flash layout is:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01000000 00020000 "Flash"
mtd1: 00020000 00008000 "Loader"
mtd2: 00020000 00020000 "Config"
mtd3: 007e0000 00020000 "Firmware"
mtd4: 007e0000 00020000 "OldFirmware"

in addition to that there is

mtd5: 00673000 00020000 "ART"

which is a mount to firmware after kernel.

The only places I can find the router MAC address in a hexdump of Flash is at the start of the loader, which seems odd.

Ok, seems like it is not in flash after all. Do you see an EEPROM chip near the wireless chip? It's normally a small chip with eight legs.

I also just noticed that your PCI device number is 0000:00:0e.0, which implies slot 14. In the patch for 7510 wireless is in slot 12. This also means that you probably need to change the IRQ as well, probably to

[14] = INT_NUM_IM0_IRL0 + 22,

Do you see something about "unknown slot" in dmesg?

snk wrote:
trndr wrote:

Sadly this version is on board WIFI, for some reason they decided to reuse the name on different versions so the layout of a Vodafone Bewan ARV4510PW-A VIS is not the same as a Wippies Homebox LF-L3. Edit: Firmware seems to be the same though.

Do you have any idea how I can track down / dump the original WIFI EEPROM data.
The original flash layout is:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01000000 00020000 "Flash"
mtd1: 00020000 00008000 "Loader"
mtd2: 00020000 00020000 "Config"
mtd3: 007e0000 00020000 "Firmware"
mtd4: 007e0000 00020000 "OldFirmware"

in addition to that there is

mtd5: 00673000 00020000 "ART"

which is a mount to firmware after kernel.

The only places I can find the router MAC address in a hexdump of Flash is at the start of the loader, which seems odd.

Ok, seems like it is not in flash after all. Do you see an EEPROM chip near the wireless chip? It's normally a small chip with eight legs.

I also just noticed that your PCI device number is 0000:00:0e.0, which implies slot 14. In the patch for 7510 wireless is in slot 12. This also means that you probably need to change the IRQ as well, probably to

[14] = INT_NUM_IM0_IRL0 + 22,

Do you see something about "unknown slot" in dmesg?

Only things that are close to the wifi chip are the USB controler(via vt6212l) and what I think is main flash (JS28F128J).

I can't find any "unknown slot" in dmesg.
But it does state it should be slot 14

[    0.116000] PCI host bridge to bus 0000:00
[    0.120000] pci_bus 0000:00: root bus resource [mem 0x18000000-0x19ffffff]
[    0.124000] pci_bus 0000:00: root bus resource [io  0x1ae00000-0x1affffff]
[    0.128000] pci 0000:00:0e.0: [168c:ff1a] type 0 class 0x000200
[    0.128000] pci 0000:00:0e.0: reg 10: [mem 0x00000000-0x0000ffff]
[    0.128000] pci 0000:00:0f.0: [1106:3038] type 0 class 0x000c03
[    0.128000] pci 0000:00:0f.0: reg 20: [io  0xfce0-0xfcff]
[    0.128000] pci 0000:00:0f.0: supports D1 D2
[    0.128000] pci 0000:00:0f.0: PME# supported from D0 D1 D2 D3hot
[    0.128000] pci 0000:00:0f.1: [1106:3038] type 0 class 0x000c03
[    0.128000] pci 0000:00:0f.1: reg 20: [io  0xfce0-0xfcff]
[    0.128000] pci 0000:00:0f.1: supports D1 D2
[    0.128000] pci 0000:00:0f.1: PME# supported from D0 D1 D2 D3hot
[    0.128000] pci 0000:00:0f.2: [1106:3104] type 0 class 0x000c03
[    0.128000] pci 0000:00:0f.2: reg 10: [mem 0x00000000-0x000000ff]
[    0.128000] pci 0000:00:0f.2: supports D1 D2
[    0.128000] pci 0000:00:0f.2: PME# supported from D0 D1 D2 D3hot
[    0.132000] pci 0000:00:0e.0: BAR 0: assigned [mem 0x18000000-0x1800ffff]
[    0.136000] pci 0000:00:0f.2: BAR 0: assigned [mem 0x18010000-0x180100ff]
[    0.140000] pci 0000:00:0f.0: BAR 4: assigned [io  0x1ae00000-0x1ae0001f]
[    0.144000] pci 0000:00:0f.1: BAR 4: assigned [io  0x1ae00020-0x1ae0003f]
[    0.148000] pci 0000:00:0e.0: SLOT:14 PIN:1 IRQ:30
[    0.152000] pci 0000:00:0f.0: SLOT:15 PIN:1 IRQ:66
[    0.156000] pci 0000:00:0f.1: SLOT:15 PIN:2 IRQ:66
[    0.160000] pci 0000:00:0f.2: SLOT:15 PIN:3 IRQ:66

Full dmesg:

[    0.000000] Linux version 3.3.8 (trndr@chernobyl) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #7 Fri Apr 12 07:17:37 BST 2013
[    0.000000] SoC: Danube rev 1.3
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019641 (MIPS 24KEc)
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00002000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00002000
[    0.000000] On node 0 totalpages: 8192
[    0.000000] free_area_init_node: node 0, pgdat 8029f250, node_mem_map 81000000
[    0.000000]   Normal zone: 64 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 8128 pages, LIFO batch:0
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line: console=ttyLTQ1,115200 rootfstype=squashfs,jffs2 machtype=ARV7510PW
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Primary instruction cache 16kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 29364k/32768k available (2286k kernel code, 3404k reserved, 391k data, 172k init, 0k highmem)
[    0.000000] NR_IRQS:256
[    0.000000] CPU Clock: 333MHz
[    0.000000] Calibrating delay loop... 221.18 BogoMIPS (lpj=442368)
[    0.036000] pid_max: default: 32768 minimum: 301
[    0.040000] Mount-cache hash table entries: 512
[    0.048000] NET: Registered protocol family 16
[    0.056000] gpiochip_add: registered GPIOs 0 to 15 on device: ltq_gpio
[    0.060000] gpiochip_add: registered GPIOs 16 to 31 on device: ltq_gpio
[    0.064000] MIPS: machine is ARV7510PW - Elisa kotiboksi
[    0.068000] gpiochip_add: registered GPIOs 200 to 223 on device: ltq_stp
[    0.080000] MAC invalid using random
[    0.108000] bio: create slab <bio-0> at 0
[    0.116000] PCI host bridge to bus 0000:00
[    0.120000] pci_bus 0000:00: root bus resource [mem 0x18000000-0x19ffffff]
[    0.124000] pci_bus 0000:00: root bus resource [io  0x1ae00000-0x1affffff]
[    0.128000] pci 0000:00:0e.0: [168c:ff1a] type 0 class 0x000200
[    0.128000] pci 0000:00:0e.0: reg 10: [mem 0x00000000-0x0000ffff]
[    0.128000] pci 0000:00:0f.0: [1106:3038] type 0 class 0x000c03
[    0.128000] pci 0000:00:0f.0: reg 20: [io  0xfce0-0xfcff]
[    0.128000] pci 0000:00:0f.0: supports D1 D2
[    0.128000] pci 0000:00:0f.0: PME# supported from D0 D1 D2 D3hot
[    0.128000] pci 0000:00:0f.1: [1106:3038] type 0 class 0x000c03
[    0.128000] pci 0000:00:0f.1: reg 20: [io  0xfce0-0xfcff]
[    0.128000] pci 0000:00:0f.1: supports D1 D2
[    0.128000] pci 0000:00:0f.1: PME# supported from D0 D1 D2 D3hot
[    0.128000] pci 0000:00:0f.2: [1106:3104] type 0 class 0x000c03
[    0.128000] pci 0000:00:0f.2: reg 10: [mem 0x00000000-0x000000ff]
[    0.128000] pci 0000:00:0f.2: supports D1 D2
[    0.128000] pci 0000:00:0f.2: PME# supported from D0 D1 D2 D3hot
[    0.132000] pci 0000:00:0e.0: BAR 0: assigned [mem 0x18000000-0x1800ffff]
[    0.136000] pci 0000:00:0f.2: BAR 0: assigned [mem 0x18010000-0x180100ff]
[    0.140000] pci 0000:00:0f.0: BAR 4: assigned [io  0x1ae00000-0x1ae0001f]
[    0.144000] pci 0000:00:0f.1: BAR 4: assigned [io  0x1ae00020-0x1ae0003f]
[    0.148000] pci 0000:00:0e.0: SLOT:14 PIN:1 IRQ:30
[    0.152000] pci 0000:00:0f.0: SLOT:15 PIN:1 IRQ:66
[    0.156000] pci 0000:00:0f.1: SLOT:15 PIN:2 IRQ:66
[    0.160000] pci 0000:00:0f.2: SLOT:15 PIN:3 IRQ:66
[    0.164000] Switching to clocksource MIPS
[    0.172000] NET: Registered protocol family 2
[    0.180000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.184000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    0.192000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.200000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.204000] TCP reno registered
[    0.208000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.216000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.220000] NET: Registered protocol family 1
[    0.224000] PCI: Enabling device 0000:00:0f.0 (0000 -> 0001)
[    0.232000] PCI: Enabling device 0000:00:0f.1 (0000 -> 0001)
[    0.236000] PCI: Enabling device 0000:00:0f.2 (0000 -> 0002)
[    0.244000] PCI: CLS 0 bytes, default 32
[    0.244000] gptu: totally 6 16-bit timers/counters
[    0.248000] gptu: misc_register on minor 63
[    0.252000] gptu: succeeded to request irq 126
[    0.256000] gptu: succeeded to request irq 127
[    0.260000] gptu: succeeded to request irq 128
[    0.268000] gptu: succeeded to request irq 129
[    0.272000] gptu: succeeded to request irq 130
[    0.276000] gptu: succeeded to request irq 131
[    0.284000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.288000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.300000] msgmni has been set to 57
[    0.304000] io scheduler noop registered
[    0.308000] io scheduler deadline registered (default)
[    0.312000] ltq_asc.1: ttyLTQ1 at MMIO 0x1e100c00 (irq = 112) is a ltq_asc
[    0.320000] console [ttyLTQ1] enabled, bootconsole disabled
[    0.336000] ltq_nor: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000089 Chip ID 0x008821
[    0.344000] ltq_nor: Found an alias at 0x1000000 for the chip at 0x0
[    0.344000] ltq_nor: Found an alias at 0x2000000 for the chip at 0x0
[    0.344000] ltq_nor: Found an alias at 0x3000000 for the chip at 0x0
[    0.344000] Intel/Sharp Extended Query Table at 0x010A
[    0.348000] Intel/Sharp Extended Query Table at 0x010A
[    0.352000] Intel/Sharp Extended Query Table at 0x010A
[    0.360000] Intel/Sharp Extended Query Table at 0x010A
[    0.364000] Intel/Sharp Extended Query Table at 0x010A
[    0.368000] Using auto-unlock on power-up/resume
[    0.372000] cfi_cmdset_0001: Erase suspend on write enabled
[    0.380000] erase region 0: offset=0x0,size=0x8000,blocks=4
[    0.380000] erase region 1: offset=0x20000,size=0x20000,blocks=127
[    0.380000] Creating 4 MTD partitions on "ltq_nor":
[    0.384000] 0x000000000000-0x000000040000 : "uboot"
[    0.392000] 0x000000040000-0x000000060000 : "uboot_env"
[    0.396000] 0x000000060000-0x000000fe0000 : "linux"
[    0.404000] found squashfs behind kernel
[    0.408000] Creating 2 MTD partitions on "ltq_nor":
[    0.412000] 0x000000060000-0x00000014d1d4 : "kernel"
[    0.416000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.432000] 0x00000014d1d4-0x000000fe0000 : "rootfs"
[    0.436000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.452000] mtd: partition "rootfs" set to be root filesystem
[    0.456000] mtd: partition "rootfs_data" created automatically, ofs=560000, len=A80000 
[    0.464000] 0x000000560000-0x000000fe0000 : "rootfs_data"
[    0.472000] 0x000000fe0000-0x000001000000 : "board_config"
[    0.500000] ltq_mii: probed
[    0.528000] Registering RTL8306SD switch with Chip ID: 0x5988, version: 0x0000
[    0.536000] eth0: attached PHY [Realtek RTL8306S] (phy_addr=ltq_etop-fffffff:00, irq=-1)
[    0.548000] Registered led device: soc:blue:power
[    0.548000] Registered led device: soc:red:power
[    0.552000] Registered led device: soc:blue:lan1
[    0.552000] Registered led device: soc:blue:lan2
[    0.552000] Registered led device: soc:blue:lan3
[    0.552000] Registered led device: soc:blue:lan4
[    0.552000] Registered led device: soc:blue:wlan
[    0.552000] Registered led device: soc:blue:adsl
[    0.556000] Registered led device: soc:blue:internet
[    0.556000] Registered led device: soc:red:internet
[    0.556000] Registered led device: soc:blue:voip
[    0.556000] Registered led device: soc:blue:phone1
[    0.556000] Registered led device: soc:blue:phone2
[    0.556000] Registered led device: soc:blue:usb1
[    0.560000] Registered led device: soc:blue:usb2
[    0.560000] Registered led device: soc:blue:usb3
[    0.560000] Registered led device: soc:blue:unlabeled
[    0.560000] TCP cubic registered
[    0.564000] NET: Registered protocol family 17
[    0.568000] 8021q: 802.1Q VLAN Support v1.8
[    0.592000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    0.596000] Freeing unused kernel memory: 172k freed
[    8.116000] JFFS2 notice: (358) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 12 of xref (0 dead, 2 orphan) found.
[    9.728000] SCSI subsystem initialized
[   10.176000] usbcore: registered new interface driver usbfs
[   10.180000] usbcore: registered new interface driver hub
[   10.188000] usbcore: registered new device driver usb
[   11.376000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[   11.384000] ehci_hcd 0000:00:0f.2: EHCI Host Controller
[   11.388000] ehci_hcd 0000:00:0f.2: new USB bus registered, assigned bus number 1
[   11.396000] ehci_hcd 0000:00:0f.2: irq 66, io mem 0x18010000
[   11.412000] ehci_hcd 0000:00:0f.2: USB 2.0 started, EHCI 1.00
[   11.416000] hub 1-0:1.0: USB hub found
[   11.416000] hub 1-0:1.0: 4 ports detected
[   11.436000] uhci_hcd: USB Universal Host Controller Interface driver
[   11.444000] uhci_hcd 0000:00:0f.0: UHCI Host Controller
[   11.448000] uhci_hcd 0000:00:0f.0: new USB bus registered, assigned bus number 2
[   11.456000] uhci_hcd 0000:00:0f.0: irq 66, io base 0x1ae00000
[   11.460000] hub 2-0:1.0: USB hub found
[   11.464000] hub 2-0:1.0: 2 ports detected
[   11.468000] uhci_hcd 0000:00:0f.1: UHCI Host Controller
[   11.472000] uhci_hcd 0000:00:0f.1: new USB bus registered, assigned bus number 3
[   11.480000] uhci_hcd 0000:00:0f.1: irq 66, io base 0x1ae00020
[   11.488000] hub 3-0:1.0: USB hub found
[   11.488000] hub 3-0:1.0: 2 ports detected
[   11.576000] Initializing USB Mass Storage driver...
[   11.580000] usbcore: registered new interface driver usb-storage
[   11.584000] USB Mass Storage support registered.
[   35.336000] Compat-drivers backport release: compat-drivers-2012-09-04-2-gddac993
[   35.340000] Backport based on wireless-testing.git master-2012-09-07
[   35.348000] compat.git: wireless-testing.git
[   35.396000] cfg80211: Calling CRDA to update world regulatory domain
[   35.400000] cfg80211: World regulatory domain updated:
[   35.404000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[   35.412000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   35.420000] cfg80211:   (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[   35.428000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[   35.436000] cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   35.440000] cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   37.148000] PCI: Enabling device 0000:00:0e.0 (0000 -> 0002)
[   37.152000] ath5k 0000:00:0e.0: registered as 'phy0'
[   38.232000] ath5k: phy0: unable to init EEPROM
[   38.236000] ath5k: probe of 0000:00:0e.0 failed with error -5
[   38.272000] NET: Registered protocol family 8
[   38.272000] NET: Registered protocol family 20
[   38.332000] Button Hotplug driver version 0.4.1
[   39.064000] PPP generic driver version 2.4.2
[   39.556000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   39.956000] NET: Registered protocol family 24
[   40.052000] nf_conntrack version 0.5.0 (461 buckets, 1844 max)
[   41.504000] xt_time: kernel timezone is -0000
[   41.936000] IFX MEI Version 5.00.00
[   42.088000] 
[   42.088000] Infineon CPE API Driver version: DSL CPE API V3.24.4.4
[   42.264000]     ATM (A1) firmware version 1.0.19
[   42.264000] ifxmips_atm: ATM init succeed
[   42.500000] usbcore: registered new interface driver usbserial
[   42.508000] USB Serial support registered for generic
[   42.512000] usbcore: registered new interface driver usbserial_generic
[   42.516000] usbserial: USB Serial Driver core
[   42.720000] usbcore: registered new interface driver ums-alauda
[   42.756000] usbcore: registered new interface driver ums-cypress
[   42.788000] usbcore: registered new interface driver ums-datafab
[   42.820000] usbcore: registered new interface driver ums-freecom
[   42.912000] usbcore: registered new interface driver ums-isd200
[   42.944000] usbcore: registered new interface driver ums-jumpshot
[   42.976000] usbcore: registered new interface driver ums-karma
[   43.012000] usbcore: registered new interface driver ums-sddr09
[   43.044000] usbcore: registered new interface driver ums-sddr55
[   43.080000] usbcore: registered new interface driver ums-usbat
[   43.240000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled/input/input0
[   53.164000] device eth0 entered promiscuous mode
[   53.172000] br-lan: port 1(eth0) entered forwarding state
[   53.176000] br-lan: port 1(eth0) entered forwarding state
[   55.180000] br-lan: port 1(eth0) entered forwarding state

Do I understand it right that "+ ltq_pci_data.irq[12] = INT_NUM_IM3_IRL0 + 31;" should be "+ ltq_pci_data.irq[14] = INT_NUM_IM0_IRL0 + 22;" ?

(Last edited by trndr on 17 Apr 2013, 06:25)

trndr wrote:

Do I understand it right that "+ ltq_pci_data.irq[12] = INT_NUM_IM3_IRL0 + 31;" should be "+ ltq_pci_data.irq[14] = INT_NUM_IM0_IRL0 + 22;" ?

Ahh, I forgot that IRQ for slot 14 is already defined in the common part for all Arcadyan boards. So no need to do that.

I suppose that the problem is then just the missing EEPROM. Try to find some magic values like here. In SX763 the EEPROM is in a file inside the filesystem, so it was decided to include it in the machine header. You could also check the "Config" partition. MAC address is not included in the EEPROM, so trying to find that doesn't help.

snk wrote:

I suppose that the problem is then just the missing EEPROM. Try to find some magic values like here. In SX763 the EEPROM is in a file inside the filesystem, so it was decided to include it in the machine header. You could also check the "Config" partition. MAC address is not included in the EEPROM, so trying to find that doesn't help.

In the arv4518pw and arv7518pw, in the last flash partition there is, before the calibration data, a funny "Atheros Communications". Maybe if you find these characters the eeprom info is near.

As snk said, in the above routers, near the wifi chips there are 8 pads for eeprom chips.

Cheers guys, I found what appears to be the magic values (in loader of all places), but it appears the endian is wrong after 10bytes compared to the SX763 magic values.
http://pastebin.com/1Xf5rx98

trndr wrote:

Cheers guys, I found what appears to be the magic values (in loader of all places), but it appears the endian is wrong after 10bytes compared to the SX763 magic values.
http://pastebin.com/1Xf5rx98

The function arv_register_ath5k does the necessary byteswapping for you. Since you probably want to (or already have?) replace brnboot with U-Boot, you could either hard code the EEPROM like in SX763, or you could copy it to the partition at the end of the flash and read it from there. You also need to put the MAC address somewhere (on 7510 I pass it as an argument from U-Boot).

Another option is to use U-Boot as secondary bootloader after brnboot and leave brnboot intact, but I don't have any experience on how well that works.

snk wrote:
trndr wrote:

Cheers guys, I found what appears to be the magic values (in loader of all places), but it appears the endian is wrong after 10bytes compared to the SX763 magic values.
http://pastebin.com/1Xf5rx98

The function arv_register_ath5k does the necessary byteswapping for you. Since you probably want to (or already have?) replace brnboot with U-Boot, you could either hard code the EEPROM like in SX763, or you could copy it to the partition at the end of the flash and read it from there. You also need to put the MAC address somewhere (on 7510 I pass it as an argument from U-Boot).

Another option is to use U-Boot as secondary bootloader after brnboot and leave brnboot intact, but I don't have any experience on how well that works.

I saw now it does the byte swapping, but it takes the original address as a parameter, and since I don't want to move U-Boot, I have to swap it before.
I am however having problems with passing the MAC with your patches, but a random MAC is good enough for now.

trndr wrote:

I saw now it does the byte swapping, but it takes the original address as a parameter, and since I don't want to move U-Boot, I have to swap it before.
I am however having problems with passing the MAC with your patches, but a random MAC is good enough for now.

To make it possible to pass arguments from U-Boot to kernel, in target/linux/lantiq/image/Makefile, change line

xway_cmdline=-console=ttyLTQ1,115200 rootfstype=squashfs,jffs2

to

xway_cmdline=console=ttyLTQ1,115200 rootfstype=squashfs,jffs2

Also, I suggest you copy the EEPROM data to the otherwise empty last partition (fe0000 onwards), and point arv_register_ath5k there.

snk wrote:

Also, I suggest you copy the EEPROM data to the otherwise empty last partition (fe0000 onwards), and point arv_register_ath5k there.

Makes sense.
BTW is there a reason for the 7510pw image using 0x6000 for kernel instead of 0x4000?
Edit: doesn't matter, found out.

(Last edited by trndr on 18 Apr 2013, 16:18)

I will give it a try for flushing the ARV4510PW-A-LF-L3 with the exploid method described for the 7510.
Correct me if I am wrong, but does the Bewan router have two banks for the flash?
I noticed it when I saw that it keeps the current and the previous information of the orginal firmwares when we give the command "fwburn -i".

So is it possible to upload the openWRT image on the first bank and if anything goes wrong, we can rollback to the original firmware stored on the second bank using the brnboot (pressing the reset button while powering up the router) ? If so, should we change any commands to the exploit method , to specify the bank ?

stud1118 wrote:

I will give it a try for flushing the ARV4510PW-A-LF-L3 with the exploid method described for the 7510.
Correct me if I am wrong, but does the Bewan router have two banks for the flash?

It has one flash chip, which is partitioned into "OldFirmware" and "Firmware". The bootloader boots from "Firmware".

So is it possible to upload the openWRT image on the first bank and if anything goes wrong, we can rollback to the original firmware stored on the second bank using the brnboot (pressing the reset button while powering up the router) ? If so, should we change any commands to the exploit method , to specify the bank ?

In principle it is possible, but I don't know whether you can boot OpenWrt with brnboot directly. You could also use U-Boot as a second stage bootloader, but I don't know how well that works. In any case you would need to modify the flash layout in OpenWrt and compile it yourself.

stud1118 wrote:

I will give it a try for flushing the ARV4510PW-A-LF-L3 with the exploid method described for the 7510.
Correct me if I am wrong, but does the Bewan router have two banks for the flash?
I noticed it when I saw that it keeps the current and the previous information of the orginal firmwares when we give the command "fwburn -i".

So is it possible to upload the openWRT image on the first bank and if anything goes wrong, we can rollback to the original firmware stored on the second bank using the brnboot (pressing the reset button while powering up the router) ? If so, should we change any commands to the exploit method , to specify the bank ?

In principle it should be possible, but the problem is that there is a checksum in the original images, and if it's incorrect it won't boot.
I tried reverse engineering the original firmware, but I couldn't figure out how the checksum was calculated.
Also something you should keep in mind is the method described in the wiki doesn't have working on board wifi, I'm still considering the right approach to fix it.

Could you post the hexdump of the first 8bytes of your backup, so I can see if your boot loader has the same branch instruction as mine?

snk wrote:

You could also use U-Boot as a second stage bootloader, but I don't know how well that works. In any case you would need to modify the flash layout in OpenWrt and compile it yourself.

I don't know how wise it would be using U-Boot as second stage, since it would mean wasting extra space (U-Boot + 11360 bytes of brnboot verification).
Stabilizing U-Boot network and enabling net-console, would probably be cleaner if people prefer not opening the box, and still have reduced chance of semi-bricking.

(Last edited by trndr on 20 Apr 2013, 10:01)

hi,

is there any possibility to flash the ARV4518pw without a serial cable connection?

and another question...if only adsl annex A is supported, does that means that only 12 Mbit/ download and 1,3 MBit/s upload speed are supported? Is there any hope that annex M will be supported in the future under openwrt? is the adsl driver stable?

thanks in advance for your help and for your work porting openwrt to this device.

(Last edited by esplinter on 21 Apr 2013, 20:08)

Hi, I have been searching for ages: is there any working build for the arv4519 ? By working I mean ADSL2+,WiFi,ethernet and usb printer server

trndr wrote:

Could you post the hexdump of the first 8bytes of your backup, so I can see if your boot loader has the same branch instruction as mine?

I did a typical backup file using the web interface.  here is what I got from opening a file with a hex editor:

00 64 20 2f 99 5e 9c 43

stud1118 wrote:
trndr wrote:

Could you post the hexdump of the first 8bytes of your backup, so I can see if your boot loader has the same branch instruction as mine?

I did a typical backup file using the web interface.  here is what I got from opening a file with a hex editor:

00 64 20 2f 99 5e 9c 43

Sorry I probably should have explained better. I meant firmware backup made by telneting into the router and using "dd if=/dev/mtd/0 of=<location to backup to>/backup"
Not the settings backup.

Ok I am using version 17359 which is the last version for Vodafone Vox 4510. After that they only developed the firmware for the 7510 model (with WiFi N).

The first 8 bytes of this firmware are:
43 6f 70 79 72 69 67 68

I didn't use your approach. I have this firmware version as a file, so I just opened it with the hex editor. Let me know if you want me to send it to you !

stud1118 wrote:

The first 8 bytes of this firmware are:
43 6f 70 79 72 69 67 68

I didn't use your approach. I have this firmware version as a file, so I just opened it with the hex editor. Let me know if you want me to send it to you !

Ah you're looking at the firmware not the bootloader.
I wasn't able to create a new valid firmware due to me not knowing m5d well enough.
But the gist of the original firmware structure is:

0x0                       Copyright notice
0x50                      Platform
0xA0                      Product code
0xA8                      Filename
0xF8                      Date
0x110                     Firmware version
0x418                     SVN version
0xFF0                     MD5 (I think)
0x2C60                    uImage header, header size: 64 bytes, image name: "Lin
0x2CA0                    LZMA compressed data
0xC3000                   Squashfs filesystem, big endian, version 2.1
Zero filler so file size is of size n*4kB

But I don't think I need the first 8 bytes of the loader anyway, since I'm getting close to create a hybrid bootloader between openwrt compiled U-Boot and the default loader (seems like a form of U-Boot)

This might be a bit of a stupid question, but it seems that the kernel on the image for ARV7510PW linked in the wiki article is not compatible with the kernel modules in the openwrt repositories. How should I go about resolving this? I have looked into building a new up to date image but, it looks like some of the patches in the article are already in the git/svn repository while some aren't and some of them don't seem to be compatible with current trunk.

tkln wrote:

This might be a bit of a stupid question, but it seems that the kernel on the image for ARV7510PW linked in the wiki article is not compatible with the kernel modules in the openwrt repositories. How should I go about resolving this? I have looked into building a new up to date image but, it looks like some of the patches in the article are already in the git/svn repository while some aren't and some of them don't seem to be compatible with current trunk.

Only the U-Boot patch apply against trunk, the rest apply against Attitude Adjustment