User Tools

Site Tools


toh:arcadyan:vrv9510kwac23

Arcadyan VRV9510KWAC23 (AKA Livebox Next)

Not Supported

Supported Versions

Hardware Highlights

Installation

Install OpenWrt (generic explanation)

FIXME This is for the Livebox 2.1, the procedure maybe similar for the Livebox Next

1. Prerequisites

  1. USB to UART adapter to setup serial console conection (Its posible to use Raspberry Pi and it's UART I/O port)
  2. Terminal software with xmodem support (Linux: picocom, lrzsz, Windows: Putty) to comunicate to router serial console.
  3. TFTP Server to send files to router.

2. Prepare the serial console

  1. Prepare the serial console: see serial

3. Make full Flash backup

  1. Make a full flash backup before continue: see Flash backup

4. Replace bootloader with U-boot

  1. Launch picocom
    picocom -b 115200 /dev/ttyUSB0
  2. Power on the device
  3. Inmediatelly press 3 times the space bar. You will see the message
    Enter command mode …123 Key=
  4. Paste the password: Oh!123Go
    The bootloader will enter into the command mode
    Yes, Enter command mode … [VR9 Boot]:
  5. Press the key: !
    Now you're into administrator mode
  6. Press the key: U
  7. Press the key: 0
  8. Press the key: Y
    Now the router is awaiting file transmited vía Xmodem protocol from picocom
  9. Press the key ctrl+a, and then ctrl+s, next type in the file to transmit to router (tipical uboot.bin that is located on linux machine)
  10. Hit enter and transmission of file will start. You will see a lot of messages, wait until it finishes. It will take a couple of minutes.
    Xmodem sectors/kbytes sent: 2533/316kRetry 0: NAK on sector Retry 0: NAK on sector Retry 0: No ACK on EOT Transfer complete

After a while (2-3 minutes) you should see
* exit status: 0 *

At this point, new U-Boot bootloader was flashed. If all is correct, you could restart the router and see new U-Boot bootloader running. Note: If you are not sure it went well, don't reboot or power off the router, just restart the flashing steps starting from 'administrator mode', press ! key again.

5. Flash new OpenWRT firmware

  1. Setup an TFTP server, put firmware file o the TFTP Server, this example assume the file is named: 'lede-arv7519rw22.bin'
  2. Setup a network connection between router (192.168.1.1) and TFTP Server (192.168.1.2)
  3. Power on router with U-Boot bootloader. The bootloader should looks like this:

ROM VER: 1.1.4 CFG 01 U-Boot 2013.10-openwrt5-dirty (Jan 07 2014 - 10:29:58) arv7519rw Board: Lantiq ARV7519RW VRX200 Family Board SoC: Lantiq VRX288 v1.2 CPU: 500 MHz IO: 250 MHz BUS: 250 MHz BOOT: NOR DRAM: 128 MiB Flash: 32 MiB *** Warning - bad CRC, using default environment In: serial Out: serial Err: serial Net: ltq-eth Hit any key to stop autoboot: 0 Wrong Image Format for bootm command ERROR: can't get kernel image!

Type the following commands on U-Boot environment:
setenv write-openwrt 'tftpboot lede-arv7519rw22.bin && protect off 0xB0080000 +$filesize && erase 0xB0080000 +$filesize && cp.b $fileaddr 0xB0080000 $filesize' setenv kernel_addr 0xB0080000 saveenv run write-openwrt

After a while, you should get something like this:

ltq_phy: addr 0, link 0, speed 10, duplex 0 ltq_phy: addr 17, link 1, speed 100, duplex 1 ltq_phy: addr 18, link 0, speed 10, duplex 0 ltq_phy: addr 19, link 0, speed 10, duplex 0 ltq_phy: addr 20, link 0, speed 10, duplex 0 Using ltq-eth device TFTP from server 192.168.1.2; our IP address is 192.168.1.1 Filename 'lede-arv7519rw22.bin'. Load address: 0x81000000 Loading: T ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ########## 1.0 MiB/s done Bytes transferred = 4456651 (4400CB hex) ..................................................... done Un-Protected 53 sectors ..................................................... done Erased 53 sectors Copy to Flash... 10....9....8....7....6....5....4....3....2....1....done arv7519rw #

Reboot device, it should boot the brand new firmware.

Flash backup

FIXME This is for the Livebox 2.1, password is not the same.

a. Using the OEM hidden OpenWrt (fast):

  1. Prepare the serial console: see serial
  2. Power on the device
  3. Inmediatelly press 3 times the space bar. You will see the message
    Enter command mode …123 Key=
  4. Paste the password: Oh!123Go
    The bootloader will enter into the command mode
    Yes, Enter command mode … [VR9 Boot]:
  5. Press the key: !
    Now you're into administrator mode
  6. Press the key: j
    Now it will load the hidden OpenWrt firmware. Wait until it finish
  7. Plug a pendrive to the USB port
  8. Backup all partitions executing the command
    for i in `seq 0 9`;do dd if=/dev/mtd$i of=/tmp/usb/a1/mtd$i.bin;sync;done
  9. Unmount the pendrive executing the command
    umount /tmp/usb/a1
  10. Now you can safely extract the pendrive, with the backups, from the USB port. You can repeat the process to be safe that all copied partitions are OK (i.e checking md5 sums)

Note: with this procedure it seems the mtd4 backup is not always identical FIXME

b. Using the brntool (slow):

  1. Prepare the serial console: see serial
  2. Power on the device
  3. Inmediatelly press 3 times the space bar. You will see the message
    Enter command mode …123 Key=
  4. Paste the password: Oh!123Go
    The bootloader will enter into the command mode
    Yes, Enter command mode … [VR9 Boot]:
  5. Close the serial console software and execute brntool:
    python2 brntool.py --read=ARV7519RW22_whole.bin --addr=0xB0000000 --verbose --size=0x2000000

    and wait until it finish

It will take some hours to complete the whole backup with this procedure.

Hardware

Info

Architecture MIPS
Vendor Lantiq
bootloader BRNBoot
System-On-Chip Lantiq VRX288 (MIPS, PSB 80920 EL)
CPU/Speed 34Kc 500 MHz
Flash-Chip ZENTEL A5U1GA31ATS 8G (NAND)
Flash size 128 MiB
RAM 2x NANYA NT5TU128M8HE-AC DDR2 x8
RAM size 256 MiB
Modem VDSL/ADSL2+ XWAY VRX208
Wireless 1 Broadcom BCM43222KFBG 802.11b/g/b MIMO 2T2R
Wireless 2 Broadcom BCM4360KMLG 802.11ac MIMO 3T3R
Ethernet 3x Lantiq PEF7071V
Ethernet ports 5x RJ45 Gigabit ethernet
Phone Lantiq PEF 42068 V XWAY SLIC120
USB Yes 2 x 2.0
Serial Yes
JTAG No

Photos

Casing

FIXME

Board

FIXME

Serial

Warning: Don't connect the Vcc pin of the serial port to a TTL-to-USB adapter. While doing this, some people damaged the board. There's no need to connect it, communication works without Vcc.

Serial connection parameters
for VRV9510KWAC23
115200, 8N1, 3.3V

Maybe TX and RX are backwards, but no damage can be done to the device wiring TX and RX wrong with each other.

Bootstrap / UART mode

Bridge R141 to enter UART mode:

- boot_sel2 is currently unknown. - boot_sel0 is at R141. Short circuit R141 and boot_sel0 enters CFG 04 UART mode. - boot_sel1 is currently unknown.

GPIOs

FIXME

Bootloader Mods

  1. you could read about bootloader in general

This board uses the brnboot bootloader.

Bootlogs

OEM bootlog

ROM VER: 1.1.4 CFG 06 NAND NAND Read OK ROM VER: 1.1.4 CFG 06 NAND NAND Read OK DDR PARAM flash addr 1700000 DDR PARAM: 88888888 00142304 00142304 00566504 00566604 00000300 Rev 0.3d DDR check ok... start booting... END TUNE DDR Start booting........... ======================================================================= Wireless ADSL IAD VR9 Loader v1.00.13 build Apr 25 2014 13:12:00 Arcadyan Technology Corporation ======================================================================= A2x VR9 0xbe22ff1c : 97b41c5f 0xBf203014 : 70380000 EON/Zentel NAND 128MB 3,3V 8-bit found ----------------------------- NAND page size : 2048 NAND oob size : 64 NAND block size : 131072 NAND page/block : 64 NAND block/chip : 1024 NAND chip size : 0x8000000 NAND page shift : 11 NAND page mask : 0xFFFF NAND block shift : 17 ----------------------------- Scan BAD Block ... BAD Block [1023] : 0x07FE0000 data: 0x00 1 Bad Block(s) Copying boot params.....DONE Enter command mode ... Get Primary to 1.....Image Check from FLASH_AREA_IMAGE_1 : Unzipping firmware at 0x80002000 ... with nAREA[2][ZIP 3] [ZIP 1] done Ready to run firmware --> [is_power_on_reboot] reset_status = 0x70380000 Enable UART TX Disable UART TX Enable UART TX Disable UART TX Enable UART TX RFPI before chk 02 d5 9e 76 f0 Disable UART TX Enable UART TX Turn off COSIC function now...48500 1 Disable UART TX Enable UART TX usb_explore_task() COSIC is ready. time=48883 Disable UART TX


UART mode bootlog

ROM VER: 1.1.4 CFG 04 EEPROM Data OK UART


Tags

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
toh/arcadyan/vrv9510kwac23.txt · Last modified: 2020/04/05 18:56 by tmomas