@gizah did you make any progress on this?
I recently bought a used Fritz!Box 3390 for cheap and I'm trying to port OpenWrt. After opening the box, I found a second Atheros SoC that is responsible for WiFi, very similar to yours.
I did the very same as you and tried to capture packets. On the 3390, there are two firmware stages / images for the Atheros SoC which seem to be transferred over different media: I tried to capture network traffic as well and could easily find the stage 2 firmware transfer in the dump. However, the stage 1 firmware might be transferred via a different mechanism - my current guess is that it is transferred directly over MDIO.
On the 3390, the liboffload files are not present. Instead, there are some kernel modules in a directory called "offload".
For now, I've only played around with the stock firmware, but I'll do the Lantiq port soon.
Yep, stage 1 is transferred over MDIO: I created a freetz image with a custom kernel that has debug flags in the avmnet driver enabled. This prints all MDIO messages over the serial console and I can see how the registers are written. The console is too slow to process all messages, so initialization fails, but I now have a rough idea on how this works.
Starting from 27.810000, I can see the raw values from my ath_tgt_fw1.fw file I need to find a way to do a full dump, though, since I expect some sort of start command after a successful upload.
0x700 seems to be the command and status register, 0xe01 probably finishes the current write?
Good idea - in the meantime, I've disabled serial output and dumped /proc/kmsg, this got me to the end of the process...
I just built an image, based on the information for the 7490 above. It boots, but doesn't detect a PHY at the wasp address. The avm_cpmac driver doesn't probe the PHYs, so I suppose a driver needs to be ported / implemented.
Some progress: I hacked together a fake PHY driver that exposes the needed registers to sysfs. I have now read/write access to the Atheros SoC For anyone interested, I pushed this very experimental hack to github: https://github.com/andyboeh/openwrt/tree/avm_fritz3390
I'll now create a simple MDIO firmware uploader that can upload the stage 1 firmware.
I got everything together to fully support the 3390, see the progress in the separate thread Port to AVM FRITZ!Box 3390. I still think that a lot of this applies to the 7490 as well, although there is a different Atheros SoC. I do not have a 7490 to test, but IMHO it is worth a try.
EDIT: In the meantime, PRs for the 3390 have been created and I've been working on the 3490 (Port to AVM FRITZ!Box 3490). The 3490 looks very similar to the 7490 but lacks the telephony features. Apart from the USB controller, everything is working (fails to initialize devices).
I'd be interested in a 7490, in case somebody has a spare, drop me a line.
avm_fritz3490_wasp contains support for an ath79 target for the WiFi CPU. You want the avm_fritz3490 branch which contains support for a Lantiq target.
I also spare you some extra effort:
mdio-tool does not work on this target, because the necessary ioctls are not implemented.
upd72020x-load does not work on this target, probably because of endianness-problems.
wasp_downloader is going to prevent boot on the Lantiq target, because it waits for a configuration file upload over Ethernet. It only makes sense on the ath79 target.
Thanks, ok i will switch targets.... DONE:
4449459 Feb 2 13:56 openwrt-lantiq-xrx200-avm_fritz3490-initramfs-kernel.bin
4537089 Feb 2 13:56 openwrt-lantiq-xrx200-avm_fritz3490-squashfs-sysupgrade.bin
Still one question though is there a way I can instruct EVA bootloader to run an image from network, maybe using tftp?
Or can i test these kernels without flashing?
Before making too much assumptions, I suggest you read up on how the 3390 and 3490 work. Then it is clear that port 5 is connected to the WiFi SoC. A good start are the current PRs for the 3390, since there is a lot of background information included if you read through the comments.
If you read through this thread, you're going to find the previous efforts in porting OpenWrt to the device, including sources. Sorry to disappoint you, but it's definitely not the first OpenWrt on a 7490. Actually, my attempts on the 3390 are based on the efforts posted here.
My 7490 is running 7.12 and gets boot loop. Do you know how to get the bootlog like the one shown in the page https://openwrt.org/toh/avm/fritzbox.7490? I tried the com port (TX, RX, GND , 115200 n81) with PUTTY but it displays garbage. Also if I connect the RX pin to my usb UART, it hangs with the power/dsl led flashing. Many thanks in advance.