AVM FRITZ!Box 3490
Sourcecode: http://osp.avm.de/fritzbox/fritzbox-3490/
Supported Versions
Note Regarding Potential Hardware Versions
AVM supply has 3 different OEM firmware versions for the 3490. At this time, it is known that Germany use AnnexB, while international use AnnexA so at a minimum, there must be at least 2 hardware versions, but with the 3rd firmware image for Belgium there might even be 3 different hardware versions of this device. The bulk of the documentation below is based on the International version of the 3490 (which also had markings for AU/NZ included in few places).
If any other users can identify any clear hardware version differences between this documentation and their own device, please summarize and add the info to this section here. 
Hardware Highlights
Installation
Installation:
- Check which NAND the device has by using the following procedure with stock firmware:
- Go to to
http://192.168.178.1/support.luadownload the support data file and search for string “NAND device” to get the manufacturer kernel output. - Use Micron image if Micron is displayed otherwise the non-Micron image.
- Use the eva_ramboot.py script to boot the initramfs image. Follow the procedure to interrupt booting by ftp into 192.168.178.1 within 5 seconds after poweron.
- Then transfer the sysupgrade image to the device and run sysupgrade to flash it to the NAND.
- For making USB work, an renesas xhci firmware file (e.g. v2026) is needed and it should be copied to /lib/firmware/ (file name renesas_usb_fw.mem).
Flash Layout
Overview
Hardware
Info
| Instruction set | MIPS |
|---|---|
| Vendor | Lantiq |
| bootloader | EVA Revision: 1.1964 Version: 2964 |
| System-On-Chip | PSB 80920 EL |
| CPU @Frq | 2 CPU - MIPS 34Kc VR9 on 500MHz/250MHz/250MHz |
| Flash size | 8192 KiB + 524288 KiB / 512MiB |
| Flash Chip | 25L8035EM2I-10G MXIC + MACRONIX or Micron MT29F4G08ABADAWP |
| RAM size | 512 MiB |
| RAM Chip | 2x E1108AJBG-8E |
| Hardware Bridge | Xilinx Spartan XC3S100E |
| Wireless No1 | distinct Chip: Qualcomm-QCA9558-AT4A w/ 3×3 MIMO for 2.4GHz 802.11b/g/n |
| Wireless No1 RAM size | 128 MiB |
| Wireless No1 RAM Chip | Winbond W9751G6KB-25 |
| Wireless No2 | distinct Chip: Qualcomm-QCA9880 AR1A w/ 3×3 MIMO for 2.4/5GHz 802.11a/b/g/n/ac |
| Wireless antenna | 5x PCB, 1x Airgain N5X20SC (U.FL) |
| switch | 4x Gigabit Atheros 8035 |
| Modem | xDSL |
| Modem Chip | Lantiq XWAY v1.1 PSB 80190 |
| USB | distinct Chip: Renesas-µPD720202 w/ on the PCIe bus 2x USB 3.0 |
| DECT | NO |
| Serial | internal:GND/TXD/RXD/3.3V:115200 N 8 R |
| JTAG | Yes 2×14 |
Photos
Opening the case
Note: This will void your warranty!
Serial
→ port.serial general information about the serial port, serial port cable, etc.
The serial ports are located near the processing unit (with the heat sink on top): the serial port is the second row from left.
The PCB has 3 columns of pin headers, columns from left to right and rows from top to bottom: (when looking at the board with the DSL port on the top right).
serial port of Lantiq xRX200 soc.
/ Serial port of Qualcomm Atheros QCA9558 soc. for WASP
| /
column: 1 2 3
row:
1-GND-> O O O
2-TX-> O O O
3-RX-> O O O
4-3.3V-> O O O
| Serial connection parameters: 115200n8r (<baud><parity><bits><flow>) |
|---|
| Example using pyserial: pyserial-miniterm /dev/ttyUSB0 115200 --raw --eol CR |
More PCB photos photo taken from mikrocontroller.net
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
Bootloader
Uses EVA.
BootLogs
Flash Layout
Note: Somewhere between Fritz-OS version 6 and version 7 the reserved and regular partitions have been swapped!
Mem- Type MTD Start End Size Name FS ----------- ---- ---------- ---------- ---------- ------------------- --------------- nand0 0 0x0000000 0x00400000 0x00400000 kernel nand0 1 0x0400000 0x03400000 0x03000000 filesystem squasfs / yaffs2 nand0 2 0x3400000 0x03800000 0x00400000 reserved-kernel nand0 3 0x3800000 0x06800000 0x03000000 reserved-filesystem nand0 4 0x6800000 0x06a00000 0x00200000 config yaffs2 nand0 5 0x6a00000 0x20000000 0x19600000 nand-filesystem yaffs2 spi0 6 0x000000 0x040000 0x40000 urlader spi0 7 0x040000 0x0a0000 0x60000 tffs (1) tffs3 spi0 8 0x0a0000 0x100000 0x60000 tffs (2) tffs3
Flash Layout
Note: Somewhere between Fritz-OS version 6 and version 7 the reserved and regular partitions have been swapped!
Mem- Type MTD Start End Size Name FS ----------- ---- ---------- ---------- ---------- ------------------- --------------- nand0 0 0x0000000 0x00400000 0x00400000 reserved-kernel nand0 1 0x0400000 0x03400000 0x03000000 reserved-filesystem nand0 2 0x3400000 0x03800000 0x00400000 kernel nand0 3 0x3800000 0x06800000 0x03000000 filesystem squasfs / yaffs nand0 4 0x6800000 0x06a00000 0x00200000 config yaffs2 nand0 5 0x6a00000 0x20000000 0x19600000 nand-filesystem yaffs2 spi0 6 0x000000 0x040000 0x40000 urlader spi0 7 0x040000 0x0a0000 0x60000 tffs (1) tffs spi0 8 0x0a0000 0x100000 0x60000 tffs (2) tffs
Notes
- OEM source code available at: http://osp.avm.de/fritzbox/fritzbox-3490/
- Hardwareinfo: https://boxmatrix.info/wiki/FRITZ!Box_3490