Support Fritzbox 7490

@gizah did you make any progress on this?
I recently bought a used Fritz!Box 3390 for cheap and I'm trying to port OpenWrt. After opening the box, I found a second Atheros SoC that is responsible for WiFi, very similar to yours.

I did the very same as you and tried to capture packets. On the 3390, there are two firmware stages / images for the Atheros SoC which seem to be transferred over different media: I tried to capture network traffic as well and could easily find the stage 2 firmware transfer in the dump. However, the stage 1 firmware might be transferred via a different mechanism - my current guess is that it is transferred directly over MDIO.

On the 3390, the liboffload files are not present. Instead, there are some kernel modules in a directory called "offload".

For now, I've only played around with the stock firmware, but I'll do the Lantiq port soon.

1 Like

Yep, stage 1 is transferred over MDIO: I created a freetz image with a custom kernel that has debug flags in the avmnet driver enabled. This prints all MDIO messages over the serial console and I can see how the registers are written. The console is too slow to process all messages, so initialization fails, but I now have a rough idea on how this works.

[   27.670000] [avmnet] {avmnet_phy_wasp_poll} powerup, link, Speed 2, fullduplex
[   27.670000] [avmnet] [avmnet_swi_7port_reg_read] addr 0x7  reg 0x700 -> 0x2
[   27.680000] [avmnet] [avmnet_swi_7port_reg_read] addr 0x7  reg 0x700 -> 0x2
[   27.690000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x702  data 0xbd00
[   27.690000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x704  data 0x3000
[   27.700000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x706  data 0x0
[   27.710000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x708  data 0x38e4
[   27.710000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x70a  data 0xbd00
[   27.730000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x70c  data 0x3000
[   27.740000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x700  data 0xc01
[   27.740000] [avmnet] [avmnet_swi_7port_reg_read] addr 0x7  reg 0x0 -> 0x2
[   27.750000] [avmnet] [avmnet_swi_7port_reg_read] addr 0x7  reg 0x700 -> 0x2
[   27.760000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x702  data 0x6a83
[   27.760000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x704  data 0xffc7
[   27.770000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x706  data 0x0
[   27.780000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x708  data 0x0
[   27.790000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x700  data 0x801
[   27.790000] [avmnet] [avmnet_swi_7port_reg_read] addr 0x7  reg 0x0 -> 0x2
[   27.800000] [avmnet] [avmnet_swi_7port_reg_read] addr 0x7  reg 0x700 -> 0x2
[   27.810000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x702  data 0x4080
[   27.820000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x704  data 0x0
[   27.820000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x706  data 0x4080
[   27.830000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x708  data 0x800
[   27.840000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x70a  data 0x4080
[   27.840000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x70c  data 0x1000
[   27.850000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x70e  data 0x4080
[   27.860000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x700  data 0xe01
[   27.870000] [avmnet] [avmnet_swi_7port_reg_read] addr 0x7  reg 0x0 -> 0x2
[   27.870000] [avmnet] [avmnet_swi_7port_reg_read] addr 0x7  reg 0x700 -> 0x2
[   27.880000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x702  data 0x1800
[   27.890000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x704  data 0x4080
[   27.900000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x706  data 0x2000
[   27.900000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x708  data 0x4080
[   27.910000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x70a  data 0x2800
[   27.920000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x70c  data 0x4080
[   27.930000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x70e  data 0x3000
[   27.930000] [avmnet] [avmnet_swi_7port_reg_write] addr 0x7  reg 0x700  data 0xe01
[   27.940000] [avmnet] [avmnet_swi_7port_reg_read] addr 0x7  reg 0x0 -> 0x2

Starting from 27.810000, I can see the raw values from my ath_tgt_fw1.fw file :slight_smile: I need to find a way to do a full dump, though, since I expect some sort of start command after a successful upload.

0x700 seems to be the command and status register, 0xe01 probably finishes the current write?

try reducing output char size, it might get you more prints.
e.g. instead of

[avmnet_swi_7port_reg_write] addr 0x7  reg 0x70c  data 0x1000

put
7w a 0x7 r 0x70c d 0x1000

Good idea - in the meantime, I've disabled serial output and dumped /proc/kmsg, this got me to the end of the process...

I just built an image, based on the information for the 7490 above. It boots, but doesn't detect a PHY at the wasp address. The avm_cpmac driver doesn't probe the PHYs, so I suppose a driver needs to be ported / implemented.

Some progress: I hacked together a fake PHY driver that exposes the needed registers to sysfs. I have now read/write access to the Atheros SoC :slight_smile: For anyone interested, I pushed this very experimental hack to github: https://github.com/andyboeh/openwrt/tree/avm_fritz3390

I'll now create a simple MDIO firmware uploader that can upload the stage 1 firmware.

2 Likes

I got everything together to fully support the 3390, see the progress in the separate thread Port to AVM FRITZ!Box 3390. I still think that a lot of this applies to the 7490 as well, although there is a different Atheros SoC. I do not have a 7490 to test, but IMHO it is worth a try.

EDIT: In the meantime, PRs for the 3390 have been created and I've been working on the 3490 (Port to AVM FRITZ!Box 3490). The 3490 looks very similar to the 7490 but lacks the telephony features. Apart from the USB controller, everything is working (fails to initialize devices).

I'd be interested in a 7490, in case somebody has a spare, drop me a line.

5 Likes

Ok cloned andyboeh:avm_fritz3490_wasp as a baseline..
Assuming subtarget XRX200
Using default profile

added extra support:
mdio-tool
upd72020x-load
wasp_downloader
wasp_uploader

let me see if I can get an image compiled..

avm_fritz3490_wasp contains support for an ath79 target for the WiFi CPU. You want the avm_fritz3490 branch which contains support for a Lantiq target.

I also spare you some extra effort:

  • mdio-tool does not work on this target, because the necessary ioctls are not implemented.
  • upd72020x-load does not work on this target, probably because of endianness-problems.
  • wasp_downloader is going to prevent boot on the Lantiq target, because it waits for a configuration file upload over Ethernet. It only makes sense on the ath79 target.

Thanks, ok i will switch targets.... DONE:
4449459 Feb 2 13:56 openwrt-lantiq-xrx200-avm_fritz3490-initramfs-kernel.bin
4537089 Feb 2 13:56 openwrt-lantiq-xrx200-avm_fritz3490-squashfs-sysupgrade.bin

Still one question though is there a way I can instruct EVA bootloader to run an image from network, maybe using tftp?
Or can i test these kernels without flashing?

This is my EVA printenv:

HWRevision            185
HWSubRevision         6
ProductID             Fritz_Box_HW185
SerialNumber          0000000000000000
annex                 A
autoload              yes
bootloaderVersion     1.1964
bootserport           tty0
country               031
cpufrequency          500000000
crash                 [0]2bcd04,a3e,7[1]0,0,0[2]0,0,0[3]0,0,0
firstfreeaddress      0x81116240
firmware_info         113.06.31
firmware_version      avme
flashsize             nor_size=0MB sflash_size=1024KB nand_size=512MB
language              en
linux_fs_start        1
maca                  38:10:xx
macb                  38:10:xx
macwlan               38:10:xx
macwlan2              38:10:xx
macdsl                38:10:xx
memsize               0x10000000
modetty0              38400,n,8,1,hw
modetty1              38400,n,8,1,hw
mtd0                  0x400000,0x3400000
mtd1                  0x0,0x400000
mtd2                  0x0,0x40000
mtd3                  0x40000,0xA0000
mtd4                  0xA0000,0x100000
mtd5                  0x0,0x200000
my_ipaddress          192.168.178.1
prompt                Eva_AVM
req_fullrate_freq     250000000
sysfrequency          250000000
tr069_passphrase      xx
tr069_serial          00040E-3810xx
urlader-version       2964
usb_board_mac         38:10:xx
usb_device_id         0x0000
usb_device_name       USB DSL Device
usb_manufacturer_name  AVM
usb_revision_id       0x0000
usb_rndis_mac         38:10:xx
wlan_key              xx

check out scripts/flashing/eva_ramboot.py

Almost there :slight_smile: :

$ scripts/flashing/eva_ramboot.py fritz-dsl.god.lan bin/targets/lantiq/xrx200/openwrt-lantiq-xrx200-avm_fritz3490-initramfs-kernel.bin
> SETENV memsize 0x07bc1000
< 200 SETENV command successful
> SETENV kernel_args_tmp mtdram1=0x87bc1000,0x88000000
< 200 SETENV command successful
> MEDIA SDRAM
< 200 Media set to MEDIA_SDRAM

Succes:

BusyBox v1.31.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r11874-730797a3d1
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# 
root@OpenWrt:/# uname -a
Linux OpenWrt 4.19.91 #0 SMP Wed Jan 22 21:11:18 2020 mips GNU/Linux
root@OpenWrt:/# 
root@OpenWrt:/# cat  /proc/cpuinfo
system type		: xRX200 rev 1.2
machine			: AVM FRITZ!Box 3490
processor		: 0
cpu model		: MIPS 34Kc V5.6
BogoMIPS		: 332.54
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 16
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp mt
Options implemented	: tlb 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc dc_aliases userlocal vint perf_cntr_intr_bit nan_legacy nan_2008 perf
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 0
VPE			: 0
VCED exceptions		: not available
VCEI exceptions		: not available

processor		: 1
cpu model		: MIPS 34Kc V5.6
BogoMIPS		: 333.82
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 16
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp mt
Options implemented	: tlb 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc dc_aliases userlocal vint perf_cntr_intr_bit nan_legacy nan_2008 perf
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 0
VPE			: 1
VCED exceptions		: not available
VCEI exceptions		: not available
3 Likes

So kernel is running :slight_smile:
First OpenWrt on 7490 maybe?

30 min break :slight_smile:

swconfig dev eth0
Port 1: => connected to LAN4
Port 0: => connected to LAN3
Port 2: => connected to LAN2
Port 4: => connected to LAN1

Port 5: => assuming maybe XDSL
Port 6: => assuming CPU

Before making too much assumptions, I suggest you read up on how the 3390 and 3490 work. Then it is clear that port 5 is connected to the WiFi SoC. A good start are the current PRs for the 3390, since there is a lot of background information included if you read through the comments.

If you read through this thread, you're going to find the previous efforts in porting OpenWrt to the device, including sources. Sorry to disappoint you, but it's definitely not the first OpenWrt on a 7490. Actually, my attempts on the 3390 are based on the efforts posted here.

For reference: Support Fritzbox 7490, https://github.com/openwrt/openwrt/pull/2662 and https://github.com/openwrt/openwrt/pull/2711. The second PR also explains the difference between 3390 and 3490.

Another good source are the AVM kernel sources. The avm_cpmac sources contain the port definitions, the .dts-files contain the GPIO definitions.

Added a pull request..

1 Like

bump!

any news?
I also have a 7490 unit to test, if needed!

1 Like

Any news?If there is a need to test something, I am available.

1 Like

Hi,

My 7490 is running 7.12 and gets boot loop. Do you know how to get the bootlog like the one shown in the page https://openwrt.org/toh/avm/fritzbox.7490? I tried the com port (TX, RX, GND , 115200 n81) with PUTTY but it displays garbage. Also if I connect the RX pin to my usb UART, it hangs with the power/dsl led flashing. Many thanks in advance.

Which avm lantiq development snapshot build (if any) can I try for 7490?
I am also happy to test work in progress images from developers.

2 Likes

I would also like to try, now I am using freetz but it is terrible.