Airties WAV-281

Supported since r20402

Is this device also known as ARV452CPW or ARV452CQW or ARV4520PW? Please leave a comment with sources which help to answer this question. Thanks! --- tmomas 2020/09/10 10:26

NOTE: Anything not included in model specific notes, or where a short comment couldn't be included on the notes.

The default proprietary bootloader only accepts signed images with a special header.

Accepted signatures are:

• BRNARV452
• BRNDA4WWL
• BRNDA1W
• BRNDA1WWL
• BRNDA4WWL1
• BRNDA4WWL2
• BRNDA4WWL3
• BRNDANUBE

Those images can be created by OpenWrt.

However the bootloader consumes quite lot's of space and there is an uboot port for this platform available.

I prepared a signed image (http://nanl.de/files/openwrt/airties/openwrt-lantiq-danube-ARV4520PW-BRNDANUBE-brnImage_signed_flash_uboot_and_combined) which - once flashed and started - replaces the original bootloader with uboot and flashes an OpenWrt image.

Images (kernel+rootfs) created by OpenWrt can be run by the proprietary bootloader as well as uboot as the kernel takes care about the used environment and choose a respective partition layout.

Uboot has an webserver integrated which gets activated by pressing the “WLAN”-button during power-on. Over its web interface you can now easily flash your actual firmware image of choice.

In short - using mentioned image above:

1. press RESET button on the back and power on device
2. connect to http://192.168.1.1/
3. upload image 'openwrt-lantiq-danube-ARV4520PW-BRNDANUBE-brnImage_signed_flash_uboot_and_combined' as 'Firmware'
4. “Processing, please wait........” will be shown, wait till you get back to the flashing interface
5. Press reboot / power cycle device
6. it will boot into the freshly flashed firmware which is gonna a) replace the current bootloader with uboot and b) flashes an OpenWrt squashfs image on the device (LEDs will indicate current status in a fancy way)
7. When LEDs (VoIP,Phone1,Phone2,ISDN) are not blinking anymore (but just glowing) the update process is finished
8. Voila - 192.168.1.1 should become alive again with a shiny luci webinterface!

The uboot port provides HTTP functionality for uploading Firmware images via your webbrowser. To connect to the bootloader via HTTP you require a direct Ethernet connection (no switch in between involved)!

If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.

If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

• Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
• Upload TRX file to LuCI
• Wait for reboot

• Login as root via SSH on 192.168.1.1
• Use the following commands to upgrade.

cd /tmp/
wget http://
mtd write /tmp/0 linux && reboot

Model Number

Front:

Photo of front

Back:

Photo of back

Note: This will void your warranty!

• To remove the cover simply do a/b/c.
• There are two screws holding the PCB to the bottom cover.

Main PCB

Photo of PCB

How to connect to Serial Port baudrate 115200 8N1 3,3V

 
---------------------LED-LED-LED-LED-LED-LED-LED----
/
|     
|  6  7  8  9  10
|  1 (2)(3) 4 (5)
|    RX TX    GND 
|

Not needed, you can recover it via serial. See Restore Uboot

The default network configuration is:

Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.

The analog phones (on the FXS and ISDN lines) are handled with the Infineon PEF 4268T SLIC DC/DC controller. Then it is possible to configure “Telefon 1(F)”, “Telefon 2(U)” and “Telefon 3(ISDN)”

Analog phones can be plugged on the TAE-Stecker and TAE-Buchsen phone socket on top of the device with the TAE-to-RJ11 adapters (details on the TAE-type sockets here : http://de.wikipedia.org/wiki/Telekommunikations-Anschluss-Einheit). ISDN phone can be plugged on the ISDN phone socket.

If you forgot your password, broken one of the startup scripts, firewalled yourself or corrupted the JFFS2 partition, you can get back in by using OpenWrt's failsafe mode.

The failsafe mode is only available via the serial connection with OpenWrt 12.09 (Codename “Attitude Adjustment”).

Later versions might work but I did not test that, yet. There are 3 different buttons: “WPS”, “WLAN on/off” and “RESET” which might trigger the failsafe mode in the later versions. If you press and hold the reset button when you switch the device on, then the uboot bootloader will go into failsafe mode and will make web server available under http://192.168.1.1/ (see below). If you want the OpenWrt failsafe mode (and not the uboot bootloader fail-safe mode) then you need to wait 4-5 seconds before you press and hold the reset button.

NOTE: The root file system in failsafe mode is the SquashFS partition mounted in readonly mode. To switch to the normal writable root file system run mount_root and make any changes. Run mount_root now.

1. Forgot/lost your password and you like to set a new one

passwd

1. Forgot the routers IP address

uci get network.lan.ipaddr

1. You accidentally run 'ipkg upgrade' or filled up the flash by installing to big packages (clean the JFFS2 partition and start over)

mtd -r erase rootfs_data If you are done with failsafe mode power cycle the router and boot in normal mode.

If you bricked your uboot you can load a functional one via uart. For that you need to bridge r64 (top) and r80 (bottom) with some solder. After that the soc boots up in UART mode. You can verfy that you are in UART-Mode if after powering up the device it writes the follwoing on the serial:

ROM VER: 1.0.3
CFG 04
Read EEPROMX
 X
UART

Now you can transfer your u-boot.asc through a serial connection:

cat u-boot.asc > /dev/ttyUSB0

There exist quite a few more Modes, that are accesible through briding empty pads as shown in this thread. But none other than default and UART-Mode seems to be usefull.

Link to Generic basic config secion

Purchase new blue LEDs from Radio Shack, and replace them with your existing ones.

flash map

---------------------------------------
    Area            Address      Length 
---------------------------------------
[0] Boot            0xB0000000     128K
[1] Configuration   0xB0020000     256K
[2] Web Image       0xB0060000    3648K
[3] Code Image      0xB0060000    3648K
[4] Boot Params     0xB03F0000      64K
[5] Flash Image     0xB0000000    4096K
---------------------------------------

How to add tags