Failing Installation on FritzBox 7320

Moschdi · April 7, 2019, 4:01am

Hello all,

I'm facing some issues when trying to install OpenWrt on a FritzBox 7320. I've tried it now already several times and also with two different devices (same model) but unsuccessful so far.

After turning on the device I'm able to connect via FTP and execute the following:

ftp 192.168.178.1
User: adam2
Pwd: adam2
bin
passiv
quote MEDIA FLSH
put firmware.image mtd1
quote REBOOT
quit

as instructed here:
https://openwrt.org/toh/avm/avm_fritz_box_7320

However, afterwards the device is not booting anymore - either the red LED is blinking or they will all stay dark. Then, I managed to flash back the original kernel image (extracted from the OEM file). As a result the device is again booting in its usual, original way.

This tells me that the procedure I'm using is correct - but what is wrong then? Am I using the wrong file? I was using the ones that are listed here https://openwrt.org/toh/avm/avm_fritz_box_7320 and in the the table of hardware. Which one is the correct one?

It would be great if anybody could help me getting one step further.

Thanks a lot! Best,
Moschdi

Moschdi · May 4, 2019, 10:43pm

Nobody here that could help me, please?

lleachii · May 6, 2019, 7:57pm

It's kinda difficult when the device page notes that debricking has not been tested.

Do you have serial console access to see the terminal?

wfred101 · January 9, 2022, 7:00pm

I have exactly the same problem.

Deviceversion

<j:BoxInfo xmlns:j="http://jason.avm.de/updatecheck/">
<j:Name>FRITZ!Box Fon WLAN 7320</j:Name>
<j:HW>172</j:HW>
<j:Version>100.06.34</j:Version>
<j:Revision>38646</j:Revision>
<j:Serial>Cxxx</j:Serial>
<j:OEM>avm</j:OEM>
<j:Lang>de</j:Lang>
<j:Annex>B</j:Annex>
<j:Lab></j:Lab>
<j:Country>049</j:Country>
<j:Flag>crashreport</j:Flag>
<j:UpdateConfig>2</j:UpdateConfig></j:BoxInfo>

via ftp:

PS C:\WINDOWS\system32> ftp 192.168.178.1
connection succesful 192.168.178.1
220 ADAM2 FTP Server ready
530 not logged in
User (192.168.178.1:(none)): adam2
331 Password required for adam2
Password:
230 User adam2 successfully logged in
ftp> bin
200 Type set to BINARY
ftp> passiv
invalid command (the same for pasive or passive) l
ftp> quote MEDIA FLSH
200 Media set to MEDIA_FLASH
ftp> put d:\firmware.image MEDIA FLSH

The system is flashing . Afterwards bricked. Only Adam on serial is availlable and the AVM recovery fixes it

I'm using this file: openwrt-21.02.1-lantiq-xway-avm_fritz7320-initramfs-kernel.bin
(renamed to firmware.image) for ftp typing.

Observation: AVM Firmware is 14MB. OpenWRT only 4MB. Something seems not to be there ??

slh · January 9, 2022, 9:23pm

AFAIK The windows ftp client does not support passive mode, but you do need it there. Starting a Linux Live CD might be an alternative.

frollic · January 9, 2022, 10:33pm

... or grab ncftp for Windows.

wfred101 · January 13, 2022, 7:09pm

ncftp doesn't work. It initiates automatically a list command. The box doesn't know the command and closes connection.
ftp used from a Linux Mint Shell reacts exactly as described here:

ftp command promt comes back. REBOOT and quit works.

The result is however the same. The box is bricked again. ADAM is still there and complains about an illegal firmware configuration:

ROM VER: 1.1.3
CFG 01                                                                       [|]
(AVM) EVA Revision: 1.1109 Version: 2109
(C) Copyright 2005 AVM Date: Feb  2 2011 Time: 16:38:22 (0) 2 0x0-0x341D

[FLASH:] MACRONIX Uniform-Flash 16MB 64 Bytes WriteBuffer
[FLASH:](Eraseregion [0] 128 sectors a 128kB)
[SYSTEM:] AR9 on 393MHz/393MHz/196MHz

Infineon PHY11G detected
Infineon PHY11G detected

Eva_AVM >
<ERROR: FIRMWARE_ILLEGAL_CONFIG>

<ERROR: FIRMWARE_ILLEGAL_CONFIG >

I did not use the optional commands:
erase mtd3
erase mtd4
restart

camus · January 14, 2022, 12:48am

try flashing an older version of openwrt for that device and then upgrade from there to the latest.

wfred101 · January 15, 2022, 11:58am

I will try this one:
https://downloads.openwrt.org/releases/17.01.1/targets/lantiq/xway/lede-17.01.1-lantiq-xway-FRITZ7320-initramfs-kernel.bin
Then check if its working and if yes update by using this file.
https://downloads.openwrt.org/releases/21.02.1/targets/lantiq/xway/openwrt-21.02.1-lantiq-xway-avm_fritz7320-squashfs-sysupgrade.bin

I will post the result here.
I may try to check if via a ftp "get" command I can read mdt1 and compare then if both is the same (don't know if this can work ...).

Does anybody have a hex dump of the flash memory of a 7320 with a working openwrt for comparison (only a few blocks at the beginning to see if something is entirely incorrect)

camus · January 15, 2022, 1:16pm

@Moschdi why don't you try the 17.01 as you suggested; the less complication, the better

wfred101 · January 16, 2022, 3:12pm

I made some tries
Flashing the AVM kernel.image as decribed in the "unbrick" section works.

ROM VER: 1.1.3
CFG 01                                                                       [|]
(AVM) EVA Revision: 1.1109 Version: 2109
(C) Copyright 2005 AVM Date: Feb  2 2011 Time: 16:38:22 (1) 2 0x0-0x341D

[FLASH:] MACRONIX Uniform-Flash 16MB 64 Bytes WriteBuffer
[FLASH:](Eraseregion [0] 128 sectors a 128kB)
[SYSTEM:] AR9 on 393MHz/393MHz/196MHz
<create jffs2 from 0x90E80000 len 0x100000 jffs2_size 16>
Infineon PHY11G detected
Infineon PHY11G detected

Eva_AVM >..........................
Lantiq xDSL CPE AR9
[    0.000000] Linux version 2.6.32.61 (jpluschke@EmbeddedVM) (gcc version 4.8.1 (Buildroot 2013.05) ) #3 Mon Aug 12 18:06:25 CEST 2019
[    0.000000] phym = 04000000, mem = 04000000, max_pfn = 00004000
[    0.000000] Reserving memory for CP1 @0xa4000000, size 0x00000000

..... much more follows.

using 17.01.0 - it starts and shows the EVA prompt. Then nothing happens anymore
using lede-17.01.1-lantiq-xway-FRITZ7320-initramfs-kernel

ROM VER: 1.1.3
CFG 01                                                                       [|]
(AVM) EVA Revision: 1.1109 Version: 2109
(C) Copyright 2005 AVM Date: Feb  2 2011 Time: 16:38:22 (1) 2 0x0-0x341D

[FLASH:] MACRONIX Uniform-Flash 16MB 64 Bytes WriteBuffer
[FLASH:](Eraseregion [0] 128 sectors a 128kB)
[SYSTEM:] AR9 on 393MHz/393MHz/196MHz
<create jffs2 from 0x90E80000 len 0x100000 jffs2_size 16>
Infineon PHY11G detected
Infineon PHY11G detected

Eva_AVM >
CAUSE    = 0x00000008  No TLB Entry for Load
STATUS   = 0x11000006      EPC      = 0x8100645C
BADVADDR = 0xDE2BFB78      ERROREPC = 0x81000550

$ 0(zr):0x00000000  $ 8(t0):0x00000002  $16(s0):0xDE2BFB78  $24(t8):0x9E1A19BC
$ 1(at):0x80000000  $ 9(t1):0x00000010  $17(s1):0x90020000  $25(t9):0x81000410
$ 2(v0):0x90020018  $10(t2):0x0000003A  $18(s2):0x810CBEF8  $26(k0):0x00000000
$ 3(v1):0x73717368  $11(t3):0x00000020  $19(s3):0x810C0000  $27(k1):0x00000000
$ 4(a0):0x90F80000  $12(t4):0x0000002C  $20(s4):0x00000003  $28(gp):0x81018360
$ 5(a1):0x00F60000  $13(t5):0x00000000  $21(s5):0x810AAE80  $29(sp):0x810CBEA0
$ 6(a2):0x00000000  $14(t6):0x03000000  $22(s6):0x8104555C  $30(s8):0x810C0000
$ 7(a3):0x00290000  $15(t7):0x0000FF00  $23(s7):0x00002B21  $31(ra):0x810024C4

ROM VER: 1.1.3 ...

This repeats endless.
If erasing mtd3 and mtd4 I get again "illegal firmware".

If reflashing then with AVM kernel.image - It works again.

ftp log:
ftp> open 192.168.178.1
Connected to 192.168.178.1.
220 ADAM2 FTP Server ready
Name (192.168.178.1:mint): adam2
331 Password required for adam2
Password:
230 User adam2 successfully logged in
Remote system type is AVM.
ftp> bin
200 Type set to BINARY
ftp> passiv
Passive mode on.
ftp> quote MEDIA FLSH
200 Media set to MEDIA_FLASH
ftp> put /media/mint/A843-3ABB/lede-17.01.0-r3205-59508e3-lantiq-xway-FRITZ7320-initramfs-kernel.bin mtd1
local: /media/mint/A843-3ABB/lede-17.01.0-r3205-59508e3-lantiq-xway-FRITZ7320-initramfs-kernel.bin remote: mtd1
227 Entering Passive Mode (192,168,178,1,12,9)
150 Opening BINARY data connection
226 Transfer complete
3030184 bytes sent in 9.29 secs (318.6778 kB/s)
ftp> quote REBOOT
221 Thank you for using the FTP service on ADAM2
ftp> quit
221 Goodbye.

In case of the much larger AVM kernel

mint@mint:~$ ftp
ftp> open 192.168.178.1
Connected to 192.168.178.1.
220 ADAM2 FTP Server ready
Name (192.168.178.1:mint): adam2
331 Password required for adam2
Password:
230 User adam2 successfully logged in
Remote system type is AVM.
ftp> bin
200 Type set to BINARY
ftp> passiv
Passive mode on.
ftp> quote MEDIA FLSH
200 Media set to MEDIA_FLASH
ftp> put /media/mint/A843-3ABB/var/tmp/kernel.image mtd1
local: /media/mint/A843-3ABB/var/tmp/kernel.image remote: mtd1
227 Entering Passive Mode (192,168,178,1,12,14)
150 Opening BINARY data connection
226 Transfer complete
**14661294 bytes sent in 48.39 secs (295.8748 kB/s)**
ftp> quote REBOOT
221 Thank you for using the FTP service on ADAM2
ftp> quit
221 Goodbye.
mint@mint:~$

The only hint is:
CAUSE = 0x00000008 No TLB Entry for Load

I assume that I have maybe a 7320 which is different.
PCB Backside below LAN 5.40 554.773 REV01

af778998 · June 3, 2022, 7:06am

I have FritzbBox 7330 and had the same problem. Openwrt 17, 19, 21 did not work.
But Version 18 worked
Used the file
https://downloads.openwrt.org/releases/18.06.2/targets/lantiq/xway/openwrt-18.06.2-lantiq-xway-avm_fritz7320-squashfs-sysupgrade.bin