Install U-Boot and OpenWRT on ARV4518PWWARNING: I take no responsabilities about breaking/briking the router, all you do or will do is under your own risk. I can help your problems, but are not mine. These are the steps I follow to install OpenWRT and U-Boot as the only bootloader. This router is almost un-brickable but if you think you bricked, try to follow my previous post steps (UART mode)
LINKS: All the files i work with here are linked at the end of this post so please, read before, then download and try.
1. Level converterComputer serial port works at higher voltage than board serial port (+12v/-12v against 0/+3.3v). Therefore you need a level converter (MAX3232 based). I use an old C25/C35 GSM cable and works perfect.
2. Hardware COM port vs USB-Serial COM portI'm using my PC serial port, if you don't have and/or you're using a USB-Serial ensure it works before think all is broken or nothing works.
3. Serial pinout
[
Download full res image]
4. Connecting to serial portSerial is working? You need to configure your terminal with:
- Speed: 115200 baud
- Data bits: 8
- Stop bits: 1
- Parity: None
- Flow control: None
I use PuTTY 99% time and HyperTerminal 1% time (follow reading)
And to know if it's working connect the serial port<->level converter<->board, start PuTTY, configure it and lights the router. You'll se something like this:
ROM VER: 1.0.3
CFG 01
Readà
ROM VER: 1.0.3
CFG 01
Read EEPROMX
X
=======================================================================
Wireless ADSL Gateway DANUBE Loader 64M-V0.02 build Apr 24 2008 16:12:25
Arcadyan Technology Corporation
=======================================================================
MXIC MX29LV320ABTC bottom boot 16-bit mode found
Copying boot params.....DONE
Press Space Bar 3 times to enter command mode ...And more stuff we don't like anymore.
It's working now
Power-off the router
5. Entering command modeAs you see the step before, we receive
Press Space Bar 3 times to enter command mode ... therefore ... press it 3 times and you'll receive:
Press Space Bar 3 times to enter command mode ...123
Yes, Enter command mode ...
[DANUBE Boot]:Now we are in command mode, press
? to get available help
[DANUBE Boot]:?
======================
[u] Upload to Flash
[E] Erase Flash
[G] Run Runtime Code
[A] Set MAC Address
[#] Set Serial Number
[V] Set Board Version
[H] Set Options
[P] Print Boot Params
[0] Use Normal Firmware
[1] Use ART-Testing Firmware
======================
[DANUBE Boot]:But ... this is useless for us, we need Administrator mode, so here press
![DANUBE Boot]:!
Enter Administrator Mode !
======================
[u] Upload to Flash
[E] Erase Flash
[G] Run Runtime Code
[M] Upload to Memory
[R] Read from Memory
[W] Write to Memory
[T] Memory Test
[Y] Go to Memory
[A] Set MAC Address
[#] Set Serial Number
[V] Set Board Version
[H] Set Options
[P] Print Boot Params
[0] Use Normal Firmware
[1] Use ART-Testing Firmware
======================
[DANUBE Boot]:Now we're ready to mess with this machine
6. Backup your data !!!! Backup your data !!!! BACKUP YOUR DATA !!!!You can erase all you want, but never, never, NEVER overwrite last 64kb of data ... We have 4Mb so please, forget the last only, tiny and ridiculous 64kb of data. You overwrite/erase it without backup, and forget your wifi works again, so please ... Backup your data !!!!
How? We need brndumper (by pippolippi). Download it, and configure it following pippolippi instructions. My shortcut looks like:
As we are now in Administrator mode, close PuTTY without powering off the router, and start brndumper (you need to close your terminal, or brndumper won't open com port because is already opened)
Now choose:
6.1. Backup full flash data: With this you can recover your router to initial state without problems, always you want. You need to get data from 0xb0000000 to 0xb0400000.
Click dump, choose the file you want to save your dump, and start.
6.2. Backup board configuration data only: You're brave! With this, you will only recover the last 64kb of data, in case you erased by mistake ... You'll never loose your wifi. You need to get data from 0xb03f0000 to 0xb0000000.
Click dump, choose the file you want to save your dump, and start.
TROUBLESHOOTING: Backups sometimes fails to me if I work with some programs at same time so, to avoid this, once dump starts, stay away from computer and let the magic works. Windows is not the serial port best friend.
7. Backup your data again and compare itIf there is no differences, continue. If there is, backup again. Your "time waste" now can be your lifeguard later. I use HxD hex editor to work with this files (read, modify and compare)
Now you're safe ...
8. Upload U-BootTROUBLESHOOTING: PuTTY don't work sending files via Xmodem, HyperTerminal do.
To ensure all, power-off router, and follow previous steps to get Administrator mode. Now we need to send a working U-Boot, so if you're on PuTTY, close it and open HyperTerminal (remember to configure it!). Press
! to ensure we are in Administrator mode.
Why 'Working U-Boot'? Today (2012/05/17) Official Trunk build U-Boot is broken. I don't know why, but if U-Boot is HTTPD enabled, both HTTPD and TFTP stop working. So please, use my compiled one (link below). It's httpd disabled and loady, loadb, tftp enabled. And it's working perfect.
Press
u (
Upload to Flash). Select 0 area ([0] Boot 0xB0000000 128K). Press Y to start (uppercase Y).
Select "Transfer" from top menu, select your file (uboot-bootstrap bin), select 'Xmodem protocol' and wait to upload finish
Upload area 0. Are you sure? (Y/n) Yes
Starting XModem download...(press Enter to abort)
CCCCC
XModem download Done.
erase from location B0000000 done
erase from location B0002000 done
erase from location B0004000 done
erase from location B0006000 done
erase from location B0008000 done
erase from location B000A000 done
erase from location B000C000 done
erase from location B000E000 done
erase from location B0010000 done
Starting to write flash ...write length 0x00010000
0123
Start checking: flash area 0 length 65536 ...Done.
[DANUBE Boot]:Now we have a working u-boot bootloader
Close hyperterminal, power-off router, open again PuTTY and power-on router
9. Installing OpenWRTWe now receive something like this
ROM VER: 1.0.3
CFG 01
Readü
ROM VER: 1.0.3
CFG 01
Read EEPROMX
X
U-Boot 2010.03 (May 16 2012 - 05:51:08)
Board: ARV4518PW
SoC: Danube/Twinpass/Vinax-VE V1.5, DDR Speed 166 MHz, CPU Speed 333 MHz
DRAM: 64 MB
Flash: 4 MB
*** Warning - bad CRC, using default environment
Net:
searching for rtl8306 switch ... found
lq_cpe_eth
Hit any key to stop autoboot: 0
Wrong Image Format for bootm command
ERROR: can't get kernel image!
ARV4518 =>PERFECT! What do we need now? First, as we will flash official trunk image, it have a little configuration problem. U-Boot stores config at 0xB0010000 and OpenWRT thinks is stored at 0xB0020000 so ... OpenWRT expect to be flashed at 0xB0030000 .... but U-Boot expect OpenWRT at 0xB0020000 ..... fuzzy? Easy as hell, keep reading.
Warning: this environment variable is only for very old OpenWRT revisions. In Attitude Adjustment and Barrier Breaker, 0xB0020000 is the right kernel load address.First, set environment variable kernel_addr to 0xb0030000ARV4518 => setenv kernel_addr 0xb0030000Now, check typing 'printenv', and save environment to flash typing 'saveenv'
ARV4518 => saveenv
Saving Environment to Flash...
Un-Protected 1 sectors
Erasing Flash...
. done
Erased 1 sectors
Writing to Flash... 9....8....7....6....5....4....3....2....1....done
Protected 1 sectorsPerfect, we have U-Boot and it's environment saved and working.
Now, we need to set a TFTP server. This is needed because no HTTPD connection is possible, and we don't want to send it slowwwwwwwly via serial port. I use 'Tftpd32 by Ph. Jounin'. Download, configure, and put in the tftpd folder our trunk 'openwrt-lantiq-danube-ARV4518PW-squashfs.image' renamed to '
ARV4518PW-squashfs.image' (it's not needed, but it's easier later)
Now check (with printenv) your computer IP address is the same as 'serverip' u-boot environment variable. Isn't? -> 'setenv serverip your.computer.ip.address', check with printenv, save with 'saveenv' and continue.
All connected, let's fun!
type
run update_openwrtARV4518 => run update_openwrt
Using lq_cpe_eth device
TFTP from server 192.168.144.100; our IP address is 192.168.144.99
Filename 'ARV4518PW-squashfs.image'.
Load address: 0x80500000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######
done
Bytes transferred = 2359300 (240004 hex)
..................................... done
Erased 37 sectors
Copy to Flash... 9....8....7....6....5....4....3....2....1....done10. Restart. You're a new OpenWRT user. Enjoy!
First boot bootlog
ROM VER: 1.0.3
CFG 01
Readü
ROM VER: 1.0.3
CFG 01
Read EEPROMX
X
U-Boot 2010.03 (May 16 2012 - 05:51:08)
Board: ARV4518PW
SoC: Danube/Twinpass/Vinax-VE V1.5, DDR Speed 166 MHz, CPU Speed 333 MHz
DRAM: 64 MB
Flash: 4 MB
Net:
searching for rtl8306 switch ... found
lq_cpe_eth
Hit any key to stop autoboot: 0
## Booting kernel from Legacy Image at b0030000 ...
Image Name: MIPS OpenWrt Linux-3.3.5
Created: 2012-05-15 22:02:35 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1096555 Bytes = 1 MB
Load Address: 80002000
Entry Point: 80002000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 3.3.5 (openwrt@huchra) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Tue May 15 15:02:17 PDT 2012
[ 0.000000] SoC: Danube rev 1.5
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 00019641 (MIPS 24KEc)
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone PFN ranges:
[ 0.000000] Normal 0x00000000 -> 0x00004000
[ 0.000000] Movable zone start PFN for each node
[ 0.000000] Early memory PFN ranges
[ 0.000000] 0: 0x00000000 -> 0x00004000
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
[ 0.000000] Kernel command line: console=ttyLTQ1,115200 rootfstype=squashfs,jffs2 machtype=ARV4518PW
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Primary instruction cache 16kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
[ 0.000000] Writing ErrCtl register=00056eb8
[ 0.000000] Readback ErrCtl register=00056eb8
[ 0.000000] Memory: 61664k/65536k available (2421k kernel code, 3872k reserved, 564k data, 176k init, 0k highmem)
[ 0.000000] NR_IRQS:256
[ 0.000000] CPU Clock: 333MHz
[ 0.000000] Calibrating delay loop... 221.18 BogoMIPS (lpj=442368)
[ 0.040000] pid_max: default: 32768 minimum: 301
[ 0.044000] Mount-cache hash table entries: 512
[ 0.052000] NET: Registered protocol family 16
[ 0.060000] gpiochip_add: registered GPIOs 0 to 15 on device: ltq_gpio
[ 0.064000] gpiochip_add: registered GPIOs 16 to 31 on device: ltq_gpio
[ 0.068000] MIPS: machine is ARV4518PW - SMC7908A-ISP, Airties WAV-221
[ 0.072000] gpiochip_add: registered GPIOs 100 to 115 on device: ltq_ebu
[ 0.100000] bio: create slab <bio-0> at 0
[ 0.108000] PCI host bridge to bus 0000:00
[ 0.112000] pci_bus 0000:00: root bus resource [mem 0x18000000-0x19ffffff]
[ 0.116000] pci_bus 0000:00: root bus resource [io 0x1ae00000-0x1affffff]
[ 0.120000] pci 0000:00:0e.0: unsupported PM cap regs version (4)
[ 0.124000] pci 0000:00:0e.0: BAR 0: assigned [mem 0x18000000-0x1800ffff]
[ 0.128000] pci 0000:00:0e.0: SLOT:14 PIN:1 IRQ:30
[ 0.132000] Switching to clocksource MIPS
[ 0.140000] NET: Registered protocol family 2
[ 0.148000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.152000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.160000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.168000] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.172000] TCP reno registered
[ 0.176000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.184000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.188000] NET: Registered protocol family 1
[ 0.196000] gptu: totally 6 16-bit timers/counters
[ 0.200000] gptu: misc_register on minor 63
[ 0.204000] gptu: succeeded to request irq 126
[ 0.208000] gptu: succeeded to request irq 127
[ 0.212000] gptu: succeeded to request irq 128
[ 0.216000] gptu: succeeded to request irq 129
[ 0.224000] gptu: succeeded to request irq 130
[ 0.228000] gptu: succeeded to request irq 131
[ 0.236000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.240000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.252000] msgmni has been set to 120
[ 0.256000] io scheduler noop registered
[ 0.260000] io scheduler deadline registered (default)
[ 0.264000] ltq_asc.1: ttyLTQ1 at MMIO 0x1e100c00 (irq = 112) is a ltq_asc
[ 0.272000] console [ttyLTQ1] enabled, bootconsole disabled
[ 0.272000] console [ttyLTQ1] enabled, bootconsole disabled
[ 0.288000] ltq_nor: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022a8
[ 0.296000] Amd/Fujitsu Extended Query Table at 0x0040
[ 0.300000] Amd/Fujitsu Extended Query version 1.1.
[ 0.304000] number of CFI chips: 1
[ 0.308000] Creating 4 MTD partitions on "ltq_nor":
[ 0.312000] 0x000000000000-0x000000020000 : "uboot"
[ 0.320000] 0x000000020000-0x000000030000 : "uboot_env"
[ 0.328000] 0x000000030000-0x0000003f0000 : "linux"
[ 0.336000] found squashfs behind kernel
[ 0.336000] Creating 2 MTD partitions on "ltq_nor":
[ 0.340000] 0x000000030000-0x00000013bbab : "kernel"
[ 0.348000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[ 0.360000] 0x00000013bbab-0x0000003f0000 : "rootfs"
[ 0.364000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[ 0.380000] mtd: partition "rootfs" set to be root filesystem
[ 0.384000] mtd: partition "rootfs_data" created automatically, ofs=250000, len=1A0000
[ 0.392000] 0x000000250000-0x0000003f0000 : "rootfs_data"
[ 0.400000] 0x0000003f0000-0x000000400000 : "board_config"
[ 0.424000] ltq_mii: probed
[ 0.456000] Registering RTL8306SD switch with Chip ID: 0x5988, version: 0x0000
[ 0.464000] eth0: attached PHY [Realtek RTL8306S] (phy_addr=ltq_etop-fffffff:00, irq=-1)
[ 0.484000] TCP westwood registered
[ 0.488000] NET: Registered protocol family 17
[ 0.492000] Bridge firewalling registered
[ 0.496000] 8021q: 802.1Q VLAN Support v1.8
[ 0.500000] drivers/rtc/hctosys.c: unable to open rtc devi[ 0.520000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[ 0.528000] Freeing unused kernel memory: 176k freed
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
jffs2 not ready yet; using ramdisk
- init -
Please press Enter to activate this console. [ 7.864000] NET: Registered protocol family 8
[ 7.868000] NET: Registered protocol family 20
[ 7.908000] Button Hotplug driver version 0.4.1
[ 8.264000] PPP generic driver version 2.4.2
[ 8.544000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 8.724000] NET: Registered protocol family 24
[ 8.768000] nf_conntrack version 0.5.0 (966 buckets, 3864 max)
[ 9.036000] IFX MEI Version 5.00.00
[ 9.064000]
[ 9.064000] Infineon CPE API Driver version: DSL CPE API V3.24.4.4
[ 9.100000] ATM (A1) firmware version 1.0.19
[ 9.100000] ifxmips_atm: ATM init succeed
[ 9.124000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled/input/input0
[ 15.052000] device eth0 entered promiscuous mode
[ 15.060000] br-lan: port 1(eth0) entered forwarding state
[ 15.064000] br-lan: port 1(eth0) entered forwarding state
[ 17.068000] br-lan: port 1(eth0) entered forwarding state
[ 28.604000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[ 28.620000] jffs2_build_filesystem(): unlocking the mtd device... done.
[ 28.624000] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
[ 47.656000] JFFS2 notice: (1380) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
BusyBox v1.19.4 (2012-05-15 00:44:30 PDT) built-in shell (ash)
Enter 'help' for a list of built-in commands.
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
ATTITUDE ADJUSTMENT (Bleeding Edge, r31732)
-----------------------------------------------------
* 1/4 oz Vodka Pour all ingredients into mixing
* 1/4 oz Gin tin with ice, strain into glass.
* 1/4 oz Amaretto
* 1/4 oz Triple sec
* 1/4 oz Peach schnapps
* 1/4 oz Sour mix
* 1 splash Cranberry juice
-----------------------------------------------------
root@OpenWrt:/#LINKSPuTTY:
Download PuTTYbrndumper by pippolippi (thanks for sharing!):
brndumper officialHxD freeware Hex Editor:
HxD OfficialTFTPD32:
Download TFTPD32Working U-Boot:
U-Boot +tftp,loady,loadb -httpd (It's preconfigured to run at 192.168.144.99, and expect TFTPD at 192.168.144.100 ... please change it for your network)
Trunk OpenWRT image:
OpenWRT image. This is 2012/05/17 downloaded image, but I upload to my server just for future use. I know this one works, but i don't know if future ones will. You have the option, run my copy or download&run official one
Enjoy!
