User Tools

Site Tools


toh:arcadyan:vrv9510kwac23

Arcadyan VRV9510KWAC23 (AKA Livebox Next)

Not Supported

Supported Versions

Hardware Highlights

Installation

Install OpenWrt (generic explanation)

FIXME This is for the Livebox 2.1, the procedure maybe similar for the Livebox Next

1. Prerequisites

  1. USB to UART adapter to setup serial console conection (Its posible to use Raspberry Pi and it's UART I/O port)
  2. Terminal software with xmodem support (Linux: picocom, lrzsz, Windows: Putty) to comunicate to router serial console.
  3. TFTP Server to send files to router.

2. Prepare the serial console

  1. Prepare the serial console: see serial

3. Make full Flash backup

  1. Make a full flash backup before continue: see Flash backup

4. Replace bootloader with U-boot

  1. Launch picocom
    picocom -b 115200 /dev/ttyUSB0
  2. Power on the device
  3. Inmediatelly press 3 times the space bar. You will see the message
    Enter command mode …123 Key=
  4. Paste the password: Oh!123Go
    The bootloader will enter into the command mode
    Yes, Enter command mode … [VR9 Boot]:
  5. Press the key: !
    Now you're into administrator mode
  6. Press the key: U
  7. Press the key: 0
  8. Press the key: Y
    Now the router is awaiting file transmited vía Xmodem protocol from picocom
  9. Press the key ctrl+a, and then ctrl+s, next type in the file to transmit to router (tipical uboot.bin that is located on linux machine)
  10. Hit enter and transmission of file will start. You will see a lot of messages, wait until it finishes. It will take a couple of minutes.
    Xmodem sectors/kbytes sent: 2533/316kRetry 0: NAK on sector Retry 0: NAK on sector Retry 0: No ACK on EOT Transfer complete

After a while (2-3 minutes) you should see
* exit status: 0 *

At this point, new U-Boot bootloader was flashed. If all is correct, you could restart the router and see new U-Boot bootloader running. Note: If you are not sure it went well, don't reboot or power off the router, just restart the flashing steps starting from 'administrator mode', press ! key again.

5. Flash new OpenWRT firmware

  1. Setup an TFTP server, put firmware file o the TFTP Server, this example assume the file is named: 'lede-arv7519rw22.bin'
  2. Setup a network connection between router (192.168.1.1) and TFTP Server (192.168.1.2)
  3. Power on router with U-Boot bootloader. The bootloader should looks like this:

ROM VER: 1.1.4 CFG 01 U-Boot 2013.10-openwrt5-dirty (Jan 07 2014 - 10:29:58) arv7519rw Board: Lantiq ARV7519RW VRX200 Family Board SoC: Lantiq VRX288 v1.2 CPU: 500 MHz IO: 250 MHz BUS: 250 MHz BOOT: NOR DRAM: 128 MiB Flash: 32 MiB *** Warning - bad CRC, using default environment In: serial Out: serial Err: serial Net: ltq-eth Hit any key to stop autoboot: 0 Wrong Image Format for bootm command ERROR: can't get kernel image!

Type the following commands on U-Boot environment:
setenv write-openwrt 'tftpboot lede-arv7519rw22.bin && protect off 0xB0080000 +$filesize && erase 0xB0080000 +$filesize && cp.b $fileaddr 0xB0080000 $filesize' setenv kernel_addr 0xB0080000 saveenv run write-openwrt

After a while, you should get something like this:

ltq_phy: addr 0, link 0, speed 10, duplex 0 ltq_phy: addr 17, link 1, speed 100, duplex 1 ltq_phy: addr 18, link 0, speed 10, duplex 0 ltq_phy: addr 19, link 0, speed 10, duplex 0 ltq_phy: addr 20, link 0, speed 10, duplex 0 Using ltq-eth device TFTP from server 192.168.1.2; our IP address is 192.168.1.1 Filename 'lede-arv7519rw22.bin'. Load address: 0x81000000 Loading: T ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ########## 1.0 MiB/s done Bytes transferred = 4456651 (4400CB hex) ..................................................... done Un-Protected 53 sectors ..................................................... done Erased 53 sectors Copy to Flash... 10....9....8....7....6....5....4....3....2....1....done arv7519rw #

Reboot device, it should boot the brand new firmware.

Flash backup

FIXME This is for the Livebox 2.1

a. Using the OEM hidden OpenWrt (fast):

  1. Prepare the serial console: see serial
  2. Power on the device
  3. Inmediatelly press 3 times the space bar. You will see the message
    Enter command mode …123 Key=
  4. Paste the password: Oh!123Go
    The bootloader will enter into the command mode
    Yes, Enter command mode … [VR9 Boot]:
  5. Press the key: !
    Now you're into administrator mode
  6. Press the key: j
    Now it will load the hidden OpenWrt firmware. Wait until it finish
  7. Plug a pendrive to the USB port
  8. Backup all partitions executing the command
    for i in `seq 0 9`;do dd if=/dev/mtd$i of=/tmp/usb/a1/mtd$i.bin;sync;done
  9. Unmount the pendrive executing the command
    umount /tmp/usb/a1
  10. Now you can safely extract the pendrive, with the backups, from the USB port. You can repeat the process to be safe that all copied partitions are OK (i.e checking md5 sums)

Note: with this procedure it seems the mtd4 backup is not always identical FIXME

b. Using the brntool (slow):

  1. Prepare the serial console: see serial
  2. Power on the device
  3. Inmediatelly press 3 times the space bar. You will see the message
    Enter command mode …123 Key=
  4. Paste the password: Oh!123Go
    The bootloader will enter into the command mode
    Yes, Enter command mode … [VR9 Boot]:
  5. Close the serial console software and execute brntool:
    python2 brntool.py --read=ARV7519RW22_whole.bin --addr=0xB0000000 --verbose --size=0x2000000

    and wait until it finish

It will take some hours to complete the whole backup with this procedure.

Hardware

Info

Architecture MIPS
Vendor Lantiq
bootloader BRNBoot
System-On-Chip Lantiq VRX288 (MIPS, PSB 80920 EL)
CPU/Speed 34Kc 500 MHz
Flash-Chip ZENTEL A501GA31ATS 8G (NAND)
Flash size 128 MiB
RAM 2x NANYA NT5TU128M8HE-AC DDR2 x8
RAM size 256 MiB
Modem VDSL/ADSL2+ XWAY VRX208
Wireless 1 Broadcom BCM43222KFBG 802.11b/g/b MIMO 2T2R
Wireless 2 Broadcom BCM4360KMLG 802.11ac MIMO 3T3R
Ethernet 3x Lantiq PEF7071V
Ethernet ports 5x RJ45 Gigabit ethernet
Phone Lantiq PEF 42068 V XWAY SLIC120
USB Yes 2 x 2.0
Serial Yes
JTAG No

Photos

Casing

FIXME

Board

FIXME

Serial

FIXME

Warning!!: Don't connect the Vcc pin of the serial port to a TTL-to-USB adapter. While doing this, some people damaged the board. There's no need to connect it, communication works without Vcc.

Baud rate: 115200

Bootloader hack

FIXME This is for the Livebox 2.1

To access different Bootloader “mode” short pin when bootloader checks images integrity like the picture below and remove it after:

Image Check from FLASH_AREA_IMAGE_0 : Failed.
Image Check from FLASH_AREA_IMAGE_1 : Failed.
To access Bootloader web page recovery tool (192.168.1.1 no DHCP) pass code: “Oh!123Go”.

Image Check from FLASH_AREA_IMAGE_0 : Failed.
Image Check from FLASH_AREA_IMAGE_1 : Failed.
Flash Checking Again - fw/ui… Failed.
Unzipping Tiny Kernel at 0x80002000 … failed : 4 !!
To access Bootloader prompt

click to enlarge

It's possible now to run a second loader (u-boot) and boot ramfs images or launch OpenWrt backfire image at flash 0xB00A0000 (jffs2 filesystem). (0 and J keys).

Bootstrap / Uart mode

FIXME This is for the Livebox 2.1

click to enlarge

- boot_sel2 is at R148. Short circuit activates CFG 05 mode. (SPI flash boot). - boot_sel0 is at R155. Short circuit boot_sel2 and boot_sel0 enters CFG 04 UART mode. - boot_sel1 is currently unknown. - It seems there is a boot_sel3 pin at R147 ¿?.

GPIOs

FIXME

Bootloader Mods

  1. you could read about bootloader in general

This board uses Uboot bootloader.

FIXME

Bootlogs

OEM bootlog

FIXME


OEM OpenWrt bootlog

FIXME


Tags

toh/arcadyan/vrv9510kwac23.txt · Last modified: 2018/12/31 15:17 by danitool