Astoria networks ARV7518PW

r01a version

• ADSL modem is working with both Annex A & Annex B supported.
• WiFi is working out of the box with trunk. (ath9k)
• FXS works and can be used with owsip daemon or danube-voip.
• USB works (kmod-usb-dwc-otg or kmod-ltq-hcd-danube)

For general information take a look at:

1. → downloads
2. → Install OpenWrt (generic explanation) gives you general information but those examples don't apply to this model. It is just for orientation, attempting to blindly follow that guide will result in a brick.

Please read the following links for ARV4518. They will give you another point of view of the process:

• @aiayua post ARV4518 for Dummies (Step 9 works only if you have Pteridium u-boot, because it requires tftp. U-boots compiled by cienti or openwrt.org don't have tftp working)
• @aiayua post Enable UART mode (Recover bricked/malfunction router)
• Flashing OpenWrt image using loady

And buy the usb to ttl conversor suggested by pippolippi or build one yourself:

• The cheapest option: https://forum.openwrt.org/viewtopic.php?pid=172146#p172146
• Build it yourself: https://forum.openwrt.org/viewtopic.php?pid=178898#p178898

Please check out the article flash.layout. It contains an example and a couple of explanations.

Connect your serial adapter to the router as indicated above, link. There is no need to make any soldering for now, just enter to the default serial mode(UART is not needed). You can use any program, these are the settings:

1. Speed: 115200 baud
2. Data bits: 8
3. Stop bits: 1
4. Parity: None
5. Flow control: None (No hardware and no software flow control)

Cutecom: In Cutecom, a gui for serial console, set “No Line End” and the device is /dev/ttyUSB0 if you are using a usb serial adapter.

Minicom: If you want to use minicom run as root:

# minicom -s --device /dev/ttyUSB0

Then select “Serial port setup” configure it and select “exit” to quit from the configuration panel.

Turn on the router and you will see this

ROM VER: 1.0.3
CFG 01
Read
ROM VER: 1.0.3
CFG 01
Read EEPROMX
 X



=======================================================================
Wireless ADSL Gateway DANUBE Loader 64M-V0.02 build Apr 24 2008 16:12:25
                    Arcadyan Technology Corporation
=======================================================================
MXIC MX29LV320ABTC bottom boot 16-bit mode found

Copying boot params.....DONE


Press Space Bar 3 times to enter command mode ...

Press repeatedly the spacebar to enter command mode, be quick. Once in command mode press “!” to access administrator mode.

This is the brnboot, the stock bootloader that we want to substitute with u-boot as it can't boot OpenWrt.

This step is crucial. Backup your router twice and compare the results to ensure you have a correct backup. Use brntool from https://github.com/rvalles/brntool.

Make sure that your router is in administrator mode and close your serial connection program(without powering off your router or unpluging your cable). Check that you have python installed and then run this command(Takes about 2 hours):

./brntool.py --serial=/dev/ttyUSB0 --read=AR7518PW_whole.dump --addr=0xB0000000 --verbose --size=0x800000

Once finished do another backup:

./brntool.py --serial=/dev/ttyUSB0 --read=AR7518PW_whole2.dump --addr=0xB0000000 --verbose --size=0x800000

Then do a checksum and make sure both hashes match:

md5sum AR7518PW_whole.dump AR7518PW_whole2.dump

Save your backup in a safe place

Also make a backup of just wifi calibration data partition, which if lost would make your wifi unusable(takes a few minutes only).

./brntool.py --serial=/dev/ttyUSB0 --read=AR7518PW_calibration.dump --addr=0xB07f0000 --verbose --size=0x00010000

Once finished do another backup:

./brntool.py --serial=/dev/ttyUSB0 --read=AR7518PW_calibration2.dump --addr=0xB07f0000 --verbose --size=0x00010000

Then do a checksum and make sure both hashes match:

md5sum AR7518PW_calibration.dump AR7518PW_calibration2.dump

Finally save your backup in a safe place

U-boot images for this router must be 64kb(or 128kb if u-boot environment is included). There are mainly 3 u-boot from which you have to choose one. Here is a brief description of each one.

Download u-boot compiled by cienti in binary format from here. It works well even though it is for arv4518. The command prompt of this u-boot is “ARV4518 ⇒” instead of “ARV7518 ⇒”

When using this centi u-boot, httpd and tftp don't work but it has loady and loadb and both work which makes possible to upload binaries over a serial connection.

Pteridium uboot(the one in the folder uboot-lantiq-arv7518PW_flash)(also see this post) for this router, arv7518, has both httpd and tftp working which makes uploading a OpenWrt image very easy, but it doesn't have loady or loadb. However if you wanted to upload binaries over serial it should still be possible using ubootwrite.py(not tested by me).

Whatever your choice is, u-boots compiled by openwrt.org are the worst because they don't have loady/loadb and most of the features like httpd and tfpt don't work. It is not recommended that you install them, if you have done so already and want to install another one see Recover u-boot using UART

Continuing from Step 3, reopen the serial connection. You should be in command mode, press “!” to access administrator mode and press “u” followed by “0” to upload the new bootloader. Confirm by pressing “Y”, then you should see someting like this:

Starting XModem download...(press Enter to abort)
CCCCC

Now upload the u-boot binary using the XModem protocol. In minicom press “ctrl+a” and then “s” to upload a file.

Once uploaded, reboot your router. You should see this:

ROM VER: 1.0.3
CFG 01
Readü
ROM VER: 1.0.3
CFG 01
Read EEPROMX
X 

U-Boot 2010.03 (May 16 2012 - 05:51:08)
Board: ARV4518PW
SoC: Danube/Twinpass/Vinax-VE V1.5, DDR Speed 166 MHz, CPU Speed 333 MHz
DRAM: 64 MB
Flash: 8 MB
*** Warning - bad CRC, using default environment 

Net: searching for rtl8306 switch ...
no known switch found ...
lq_cpe_eth

Hit any key to stop autoboot: 0
Wrong Image Format for bootm command
ERROR: can't get kernel image!
ARV4518 =>

When prompted “Hit any key to stop autoboot” hit any key to enter command mode in u-boot.

If you want to protect u-boot partition from mistakes run in u-boot command prompt:

ARV4518 => protect on 0xb0000000 +10000

Also if you want to protect calibration partition from mistakes run:

ARV4518 => protect on 0xb07f0000 +10000

Bear in mind that sometimes programs do not check/care if flash memory is set as writeable or not and still can overwrite it. Be careful

Addresses are in hex format even when they are not prefixed with “0x”. Check that your address variables are set correctly

ARV7518PW => printenv kernel_addr ram_addr                                      
kernel_addr=0xb0020000                                                          
ram_addr=0x80500000

You can run just “printenv” to list all variables and their values. Some variables like “filesize” should be automatically set when you upload a file, while others are already set.

Download an OpenWrt image. For example this one. See downloads.

You have to unprotect the linux partition if it wasn't already. When finished installing, leave it also unprotected. Run in u-boot command prompt:

ARV4518 => protect off 0xb0020000 +7D0000

There are several methods of installation depending on which u-boot you have flashed.

Enter command mode in u-boot and request to upload a openwrt image via YModem to the router's ram:

ARV4518 => loady 0x80500000

In cutecom choose “YModem”, press “Send file...” and choose the file you've downloaded. In minicom press “ctrl+a” and then “s” and select “YModem”.

It takes about 10 mins to upload the image.

Do a checksum and make sure it matches the checksum of the image in your computer.

ARV4518 => crc32 ${ram_addr} ${filesize}

Now install the image in the flash memory, you have to erase the flash portion before you copy the image to flash:

ARV4518 => era ${kernel_addr} +${filesize}

............................................. done
Erased 45 sectors
ARV4518 => cp.b ${ram_addr} ${kernel_addr} ${filesize}
Copy to Flash... 9....8....7....6....5....4....3....2....1....done

Finally restart

ARV4518 => run flash_flash

You have a log of the full loading process in https://forum.openwrt.org/viewtopic.php?pid=181952#p181952

OpenWrt is installed and running. Time to configure it.

This hasn't be fully tested by me and may have things to complete

Restart your router and u-boot will automatically detect that you don't have any working images and will automatically run httpd for you. But if you suspect it doesn't, enter u-boot command mode and run:

ARV7518 => httpd

Connect your computer directly to the router by ethernet and change your network settings in your computer to this:

1. Gateway: 192.168.1.1
2. Netmask: 255.255.255.0
3. IP address: 192.168.1.2

Now go to http://192.168.1.1 and upload OpenWrt image

This hasn't been fully tested by me and may have things to complete

You should have a tftp server running in your computer and correctly configured. Put the image you want to flash in the tftp folder.

Connect your computer directly to the router by ethernet and change your network settings in your computer to this:

1. Gateway: 192.168.1.1
2. Netmask: 255.255.255.0
3. IP address: 192.168.1.2

On the router configure u-boot for tftp:

ARV7518 => setenv ipaddr 192.168.1.1
ARV7518 => setenv serverip 192.168.1.2
ARV7518 => setenv bootfile name_of_openwrt_image

Then from the router download the image from the tftp server to ram

ARV7518 => tftpboot 0x80500000 name_of_openwrt_image

It takes about 10 mins to upload the image.

Now open a serial connection to the router and do a checksum to check that the image transferred matches the image in your computer.

ARV7518 => crc32 ${ram_addr} ${filesize}

It could be the case that the variable filesize wasn't set. Then you should get and error, run “printenv filesize” to check it. Solution: TODO

Now install the image in the flash memory, you have to erase the flash portion before you copy the image to flash:

ARV7518 => era ${kernel_addr} +${filesize}

............................................. done
Erased 45 sectors
ARV7518 => cp.b ${ram_addr} ${kernel_addr} ${filesize}
Copy to Flash... 9....8....7....6....5....4....3....2....1....done

Finally restart

ARV7518 => run flash_flash

TODO. Not tested

Download ubootwrite.py and enter command mode in u-boot. Close the serial connection program and run:

ubootwrite.py --serial=/dev/ttyUSB0 --write=name_of_OpenWrt_image --addr=0x80500000

It takes about 10 mins to upload the image.

Now open a serial connection to the router and do a checksum to check that the image transferred matches the image in your computer.

ARV7518 => crc32 ${ram_addr} ${filesize}

It could be the case that the variable filesize wasn't set. Then you should get and error, run “printenv filesize” to check it. Solution: TODO

Now install the image in the flash memory, you have to erase the flash portion before you copy the image to flash:

ARV7518 => era ${kernel_addr} +${filesize}

............................................. done
Erased 45 sectors
ARV7518 => cp.b ${ram_addr} ${kernel_addr} ${filesize}
Copy to Flash... 9....8....7....6....5....4....3....2....1....done

Finally restart

ARV7518 => run flash_flash

You have a log of the full loading process in https://forum.openwrt.org/viewtopic.php?pid=181952#p181952

OpenWrt is installed and running. Time to configure it.

Steps:

1. (about 2h) Backup your router twice and compare the results to ensure you have a correct backup. Use brntool from https://github.com/rvalles/brntool. Command: “./brntool.py --serial=/dev/ttyUSB0 --read=AR4518PW_whole2.dump --addr=0xB0000000 --verbose --size=0x800000”
2. download uboot for arv4518 (the one for 7518 has bug in its last versions, does not work for http/tftp and has no loady support) from http://www.cienti.com/arv4518pw/u-boot-flash-20120511.zip. (If you need to enable UART for recovery purposes, not now, the asc file is in http://www.cienti.com/arv4518pw/u-boot-asc-20120429.zip )
3. I use cutecom, a gui for serial console. First step is to tell it that the device is /dev/ttyUSB0 and set “No Line End”
   1. Speed: 115200 baud
   2. Data bits: 8
   3. Stop bits: 1
   4. Parity: None
   5. Flow control: None
4. Next step is very well explained in step 8 in https://forum.openwrt.org/viewtopic.php?pid=167584#p167584. Follow it step by step using file “u-boot-flash-20120511.zip” you downloaded before.
5. Step 9 in https://forum.openwrt.org/viewtopic.php?pid=167584#p167584 is not completely valid because tftp/http does not work, so you cannot use “run update_openwrt”. The correct steps instead of that one are shown in https://forum.openwrt.org/viewtopic.php?pid=181952#p181952, but first you have to download an image. In http://downloads.openwrt.org/attitude_adjustment/12.09-beta2/lantiq/danube/ there is no image for arv7518 today(31/10/2012) but there is one in http://downloads.openwrt.org/attitude_adjustment/12.09-beta/lantiq/danube/, http://downloads.openwrt.org/attitude_adjustment/12.09-beta/lantiq/danube/openwrt-lantiq-danube-ARV7518PW-squashfs.image. Download it. Now do:
   1. request to upload via YModem: “ARV4518 ⇒ loady 0x80500000”
   2. choose in cutecom “YModem”, press “Send file...” and choose the file you've download. It takes about 10 mins. The steps after uploading are:

ARV4518 => era ${kernel_addr} +${filesize}

............................................. done
Erased 45 sectors
ARV4518 => cp.b ${ram_addr} ${kernel_addr} ${filesize}
Copy to Flash... 9....8....7....6....5....4....3....2....1....done

Now reboot

ARV4518 => run flash_flash

You have a log of the full loading process in https://forum.openwrt.org/viewtopic.php?pid=181952#p181952.

OpenWrt is installed and running. Time to configure it.

CPU info:

system type: Danube rev 1.5
processor: 0
cpu model: MIPS 24KEc V4.1
BogoMIPS: 221.18
wait instruction: yes
microsecond timers: yes
tlb_entries: 16
extra interrupt vector: yes
hardware watchpoint: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
ASEs implemented: mips16 dsp
shadow register sets: 1
kscratch registers: 0
core: 0
VCED exceptions: not available
VCEI exceptions: not available

PCB:

Note: This will void your warranty!

To get to the board you need:

• unscrew 2 Phillips screws underneath the cover,
• pull the upper cover which is connected by click.

→ port.serial.

Board voltage is 3.3V so can use usb to serial adapters.
Pinout:

Don't connect Vcc if your serial adapter already has power(which is most of the cases) or it won't work

→ port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

Bootstrap pin funcion table:

Value 1 = 3.3v is connected to that pin
Value 0 = Pin is connected to digital GND

boot_sel2, boot_sel0 pins location:

Note: boot_sel2 and boot_sel1 are by default on 0 and boot_sel0 is on 1.

UART mode is not necessary to install u-boot or openwrt, however it is the only way to recover from a bootloader error

To enable uart mode, short pins at boot_sel2 (shortcut R80 pins, picture above) and connect boot_sel0 to 3.3V(Connect left R65 pin to serial port vcc on the motherboard from below), see picture above.

UART mode looks like this:

ROM VER: 1.0.3
CFG 04
Read EEPROMX
 X
UART

In UART mode you can send an u-boot in ascii format(download here) to serial port, which will be automatically loaded in the ram(it will be lost when you poweroff)

For example if your serial port is ttyUSB0 than do: “cat u-boot.asc > /dev/ttyUSB0”

When it finishes run:

# minicom -s --device /dev/ttyUSB0

Then select “Serial port setup” configure it and select “exit” to quit from the configuration panel. Now you should get a command prompt.

If you want to install it in flash memory permanently, download u-boot in binary format from here however you can install any u-boot you want, see Step 4: u-boot. Now lets load it to ram:

ARV4518 => loady 0x80500000

Now you have to send the u-boot.bin using ymodem protocol. If you are using minicom press “ctrl+a” and then “s”

ARV4518 => crc32 ${ram_addr} ${filesize}

Make sure that the checksum matches that of the file that you just transferred from your computer, otherwise it could brick your router. If it matches install it to flash.

ARV4518 => protect off 0xb0000000 0xb0020000
ARV4518 => era 0xb0000000 +${filesize}
ARV4518 => cp.b ${ram_addr} 0xb0000000 ${filesize}

Now reboot, if everything is alright you should boot into the u-boot you installed. If you want to protect u-boot from mistakes run:

ARV4518 => protect on 0xb0000000 +10000

Bear in mind that sometimes programs do not check/care if flash memory is set as writeable or not and still can overwrite it. Be careful

→ as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

The board has exposed the SPI pins on the board at a place for a Si3050 chip (not soldered). It's possible to use these pins for connecting an external SPI NOR flash chip, for additional storage or programming.

For making it work, some patching is required, and making a custom firmware.

For LEDE 17.01 use this patch:

diff --git a/target/linux/lantiq/dts/ARV7518PW.dts b/target/linux/lantiq/dts/ARV7518PW.dts
index a054437..0c37df9 100644
--- a/target/linux/lantiq/dts/ARV7518PW.dts
+++ b/target/linux/lantiq/dts/ARV7518PW.dts
@@ -119,6 +119,18 @@
 					lantiq,open-drain = <1>;
 				};
 			};
+			pins_spi_default: pins_spi_default {
+				spi_in {
+					lantiq,groups = "spi_di";
+					lantiq,function = "spi";
+				};
+				spi_out {
+					lantiq,groups = "spi_do", "spi_clk",
+						"spi_cs2";
+					lantiq,function = "spi";
+					lantiq,output = <1>;
+				};
+			};
 		};
 
 		etop@E180000 {
@@ -229,3 +241,29 @@
 		mtd-mac-address-increment = <1>;
 	};
 };
+
+&spi {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pins_spi_default>;
+
+	status = "ok";
+
+	m25p80@2 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "jedec,spi-nor";
+		reg = <2 0>;
+		spi-max-frequency = <20000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				reg = <0x0 0x800000>;
+				label = "spiflash";
+			};
+		};
+	};
+};
\ No newline at end of file
diff --git a/target/linux/lantiq/dts/danube.dtsi b/target/linux/lantiq/dts/danube.dtsi
index 83e85c3..5e05afb 100644
--- a/target/linux/lantiq/dts/danube.dtsi
+++ b/target/linux/lantiq/dts/danube.dtsi
@@ -94,7 +94,17 @@
 		compatible = "lantiq,fpi", "simple-bus";
 		ranges = <0x0 0x10000000 0xEEFFFFF>;
 		reg = <0x10000000 0xEF00000>;
-
+		spi: spi@E100800 {
+			compatible = "lantiq,xrx100-spi";
+			reg = <0xE100800 0x100>;
+			interrupt-parent = <&icu0>;
+			interrupts = <22 23 24>;
+			interrupt-names = "spi_rx", "spi_tx", "spi_err",
+					"spi_frm";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			status = "disabled";
+		};
 		localbus@0 {
 			#address-cells = <2>;
 			#size-cells = <1>;
diff --git a/target/linux/lantiq/patches-4.4/0044-pinctrl-lantiq-introduce-new-dedicated-devicetree-bi.patch b/target/linux/lantiq/patches-4.4/0044-pinctrl-lantiq-introduce-new-dedicated-devicetree-bi.patch
index b27cb0b..2ece7c9 100644
--- a/target/linux/lantiq/patches-4.4/0044-pinctrl-lantiq-introduce-new-dedicated-devicetree-bi.patch
+++ b/target/linux/lantiq/patches-4.4/0044-pinctrl-lantiq-introduce-new-dedicated-devicetree-bi.patch
@@ -476,7 +476,7 @@ Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
 +static const unsigned danube_pins_spi_do[] = {GPIO17};
 +static const unsigned danube_pins_spi_clk[] = {GPIO18};
 +static const unsigned danube_pins_spi_cs1[] = {GPIO15};
-+static const unsigned danube_pins_spi_cs2[] = {GPIO21};
++static const unsigned danube_pins_spi_cs2[] = {GPIO22};
 +static const unsigned danube_pins_spi_cs3[] = {GPIO13};
 +static const unsigned danube_pins_spi_cs4[] = {GPIO10};
 +static const unsigned danube_pins_spi_cs5[] = {GPIO9};

→ lede-17.0.1_spi-nor_flash.patch.tar.gz

After installing the custom firmware with the SPI flash chip connnected you should see these kernel messages

[ 0.535192] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.540052] Amd/Fujitsu Extended Query version 1.1. [ 0.544916] number of CFI chips: 1 [ 0.548178] 4 ofpart partitions found on MTD device ltq_nor [ 0.553616] Creating 4 MTD partitions on “ltq_nor”: [ 0.558353] 0x000000000000-0x000000010000 : “uboot” [ 0.569362] 0x000000010000-0x000000020000 : “uboot_env” [ 0.576931] 0x000000020000-0x0000007f0000 : “firmware” [ 0.625619] 2 uimage-fw partitions found on MTD device firmware [ 0.630074] 0x000000020000-0x00000017c46a : “kernel” [ 0.637929] 0x00000017c46a-0x0000007f0000 : “rootfs” [ 0.645256] mtd: device 4 (rootfs) set to be root filesystem [ 0.649565] 1 squashfs-split partitions found on MTD device rootfs [ 0.655455] 0x0000006a0000-0x0000007f0000 : “rootfs_data” [ 0.664404] 0x0000007f0000-0x000000800000 : “boardconfig” [ 0.677874] m25p80 spi0.2: s25fl064k (8192 Kbytes) [ 0.681255] 1 ofpart partitions found on MTD device spi0.2 [ 0.686532] Creating 1 MTD partitions on “spi0.2”: [ 0.691189] 0x000000000000-0x000000800000 : “spiflash” [ 0.699504] spi-lantiq 1e100800.spi: Lantiq SPI controller (TXFS 8, RXFS 8, DMA 32)

How to add tags