The ARV752DPW is a combined ADSL/VOIP/SIP/UMTS/3G-enabled WLAN router and home PBX device, primarily sold as "Easybox 802" by Vodafone Germany. It was also sold in the past by German fixed-line phone company Arcor, prior to the aquisition of Arcor by Vodafone.

In the so called "open" or user-defined configuration mode whith the firmware by Vodafone, the device can suit as a standalone UMTS/3G network router in combination with a compatible UMTS/3G USB modem, with any 3G network, the APN can be configured without any restrictions.

BAUSTELLE The Device is not thorougly tested with OpenWrt. Do not follow the Informations here if you don't have a backup router inplace, you may end up with a bricked device… you've been warned.

This site here is Work in Progress. Please help if you have some usefull Informations, any help is welcome!

Installation is directly possible with the uboot installation on this page

BusyBox v1.23.2 (2016-01-02 17:47:23 CET) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 CHAOS CALMER (15.05.1, r48532)
 -----------------------------------------------------

root@OpenWrt:~# cat /proc/cpuinfo
system type             : Danube rev 1.3
machine                 : ARV752DPW - Arcor 802
processor               : 0
cpu model               : MIPS 24KEc V4.1
BogoMIPS                : 221.18
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 16
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00010000 00002000 "uboot"
mtd1: 00010000 00010000 "uboot_env"
mtd2: 007d0000 00010000 "firmware"
mtd3: 001759b3 00010000 "kernel"
mtd4: 0065a64d 00010000 "rootfs"
mtd5: 00350000 00010000 "rootfs_data"
mtd6: 00010000 00010000 "board_config"

root@OpenWrt:~#  df -h
Filesystem                Size      Used Available Use% Mounted on
rootfs                    3.3M    280.0K      3.0M   8% /
/dev/root                 3.0M      3.0M         0 100% /rom
tmpfs                    29.4M    640.0K     28.8M   2% /tmp
/dev/mtdblock5            3.3M    280.0K      3.0M   8% /overlay
overlayfs:/overlay        3.3M    280.0K      3.0M   8% /
tmpfs                   512.0K         0    512.0K   0% /dev

root@OpenWrt:~# lspci -v
00:0e.0 Network controller: Ralink corp. RT2800 802.11n PCI
        Subsystem: Ralink corp. Device 2860
        Flags: bus master, 66MHz, slow devsel, latency 64, IRQ 135
        Memory at 18000000 (32-bit, non-prefetchable) [size=64K]
        Memory at <unassigned> (32-bit, non-prefetchable) [size=2]
        Memory at <unassigned> (32-bit, non-prefetchable) [size=2]
        Memory at <unassigned> (32-bit, non-prefetchable) [size=2]
        Memory at <unassigned> (32-bit, non-prefetchable) [size=2]
        Memory at <unassigned> (32-bit, non-prefetchable) [size=2]
        Expansion ROM at <unassigned> [disabled] [size=2]
        Capabilities: [40] Power Management version 3
        Kernel driver in use: rt2800pci
lspci: Unable to load libkmod resources: error -12

root@OpenWrt:~# lsusb -t
/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=ifxusb_hcd/1p, 480M
    |__ Port 1: Dev 2, If 0, Class=Hub, Driver=hub/4p, 480M

root@OpenWrt:~# lsusb
Bus 001 Device 002: ID 0424:2514 Standard Microsystems Corp. USB 2.0 Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

root@OpenWrt:~# swconfig dev switch0 show
Global attributes:
        enable_vlan: 0
        trunk: 0
        trunk_sel: 0
Port 0:
        pvid: 0
        link: port:0 link:down
Port 1:
        pvid: 1
        link: port:1 link:up speed:100baseT full-duplex auto
Port 2:
        pvid: 2
        link: port:2 link:down
Port 3:
        pvid: 3
        link: port:3 link:down
Port 4:
        pvid: 4
        link: port:4 link:down
Port 5:
        pvid: 5
        link: port:5 link:up speed:100baseT full-duplex
VLAN 0:
        vid: 0
        ports: 0 5t
VLAN 1:
        vid: 1
        ports: 1 5t
VLAN 2:
        vid: 2
        ports: 2 5t
VLAN 3:
        vid: 3
        ports: 3 5t
VLAN 4:
        vid: 4
        ports: 4 5t
VLAN 5:
        vid: 5
        ports: 0 1 2 3 4

Ports 1-4 are the ports on the back of the router.

root@OpenWrt:~# iwinfo wlan0 info
wlan0     ESSID: "testnetzwerk"
          Access Point: 00:0C:43:28:60:00
          Mode: Master  Channel: 1 (2.412 GHz)
          Tx-Power: 20 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: unknown
          Bit Rate: unknown
          Encryption: WPA2 PSK (CCMP)
          Type: nl80211  HW Mode(s): 802.11bgn
          Hardware: 1814:0601 1814:2860 [Generic MAC80211]
          TX power offset: unknown
          Frequency offset: unknown
          Supports VAPs: yes  PHY name: phy0

Wifi is not working at the moment, these tickets refer to the problem:

• #19856 - Lantiq ARV752DPW wifi broken
• #12313 - RT305X Dir-300B1 rt2x00queue_write_tx_frame: Error
• #20997 - PCI support is broken for Danube Lantiq

• Random pictures of Arcadyan ARV752DPW (google picture search)
• Serial console connectors in the middle of the mainboard: The serial cable is the selfmade black thick one, connected with 3 Pins to the serial port. The thinner gray cable (4 pin) in the downer right is one of three usb-connectors of this board)

 6  7  8  9  10
[ ][ ][ ][ ][ ]
[ ]Rx Tx [ ]Gnd
 1  2  3  4  5

Pin 1 is marked with an small arrow on the motherboard, speed is 115200 8N1

After connect and power on the device you should see something like this:

  [root@localhost]# screen /dev/ttyUSB0 115200

ROM VER: 1.0.3
CFG 01
Read EEPROMX
 X

========================================================================
Wireless ADSL Gateway DANUBE Loader V1.00.01 build Sep 24 2008 10:11:06
                    Arcadyan Technology Corporation
========================================================================
MXIC MX29LV640BB bottom boot 16-bit mode found

Copying boot params.....DONE

Press Space Bar 3 times to enter command mode ...123
Yes, Enter command mode ...

[DANUBE Boot]:

If you select "[E] Erase Flash" in the bootloader you can see the original flash layout:

[DANUBE Boot]:E ERASE Flash ————————————— Area Address Length ————————————— [0] Boot 0xB0000000 128K [1] Configuration 0xB0020000 256K [2] None 0xB0060000 64K [3] Special Area 0xB0070000 64K [4] Primary Setting 0xB0080000 64K [5] Code Image 0 0xB0090000 3776K [6] Code Image 1 0xB0440000 3776K [7] Boot Params 0xB07F0000 64K [8] Flash Image 0xB0000000 8192K ————————————— Enter area to ERASE: ESC pressed ERROR: Not a valid area.

There are three ways to get U-Boot running on the device. Each approach requires different uboot images. At the moment trunk snapshot does not contain those images. See Downloads for copies.

In case your u-boot supports loady, you can upload everything you need via YModem Transfer. If loady is not supported, the user pgid69 has written a nice python script to easily write data to your router:

Is this router based on the infineon danube?

Temporarily load U-Boot as second stage bootloader from within the vendor Bootloader (brnboot) Requires: uboot-lantiq-arv752DPW_brnboot

(taken and tested from ARV752DPW22 Wiki Article

1. download uboot-lantiq-arv752DPW_brnboot version for u-boot ( see Downloads )
2. get into administrative mode of bootloader (hit exclamation mark "!")
3. choose
   [M] Upload to Memory
   at default address 0x80002000
4. exit terminal (screen: Ctrl-a-k , minicom: ctrl-a-z )
5. send u-boot.bin via XMODEM protocoll:
   sx u-boot.bin </dev/ttyUSB0 >/dev/ttyUSB0 — What is u-boot.bin? is it bin/lantiq/uboot-lantiq-arv752dpw_brn/openwrt-lantiq-arv752dpw_brn-u-boot.img ? — JPT1 2016/05/03 17:52
6. get to the console via terminal again & type [Return]
7. choose
   [Y] Go to Memory
   to default address 0x80002000

u-boot starts like this:

[DANUBE Boot]:Y

Go to Memory Address: (default:0x80002000) : 0x
Jump to address 0x80002000 ...

U-Boot 2013.10-openwrt4 (May 03 2016 - 16:56:57) ARV752DPW

Board: Arcadyan ARV752DPW
SoC:   Lantiq Danube-S v1.5
CPU:   333.333 MHz
IO:    166.667 MHz
BUS:   83.333 MHz
BOOT:  NOR
DRAM:  64 MiB
Flash: 8 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Board Net Initialization Failed
ltq-eth
Hit any key to stop autoboot:  0 

Updated above log with recent output. If I let autoboot run it just stops. If I stop autoboot I have the uboot shell. But what now? — JPT1 2016/05/03 17:52

You can hit [Ctrl] + [C] to get to the command line or hitting a key at the requested time.

Use this image when you want to put the u-boot permanently on the flash. Requires: uboot-lantiq-arv752DPW_flash

From a running u-boot (see instructions above)

1. copy flash image to ram (see steps 2-6 from above with 0x80500000 as address before executing the u-boot at address 0x80002000, download u-boot.bin, see Downloads )

2. unprotect the sector where the U-BOOT config is being stored.

protect off 0xb0010000 0xb001FFFF

2. erase the flash

erase 0xb0000000 0xb001FFFF

3. write the uploaded u-boot.bin to flash (here; 0x80500000 is the RAM adress, where i've uploaded my file)

cp.b 0x80500000 0xb0000000 10000

4. protect the config sector

protect on 0xb0010000 0xb001FFFF

5. reboot device and hope for the best :)

reset

* If kernel ignores parameters from u-boot, remove the preceding - in linux's hardcoded cmdline

PANIC! i flashed U-Boot, now TFTP/HTTP in U-BOOT is not working anymore

calm down, you can upload everything you need via your serial connection.

Hand over the u-boot directly to the cpu with UART, this requires soldering and is intended for rescue purposes. Requires: uboot-lantiq-arv752DPW_ramboot

You need to shortcut R80 and bring +3.3V on the left side of R65, see picture.

If you power on the device you will see this on serial console:

ROM VER: 1.0.3
CFG 04
Read EEPROMX
 X
UART

Jumpstart your Device by getting a suitable u-boot.asc File ( uboot-lantiq-arv752DPW_ramboot ). see Downloads

send this file via your serial connection to the router.

cat u-boot.asc > /dev/ttyUSB0

or by using cutecom, send file - plain

after the file is transmitted, uboot should load. Beware, u-boot is being currently loaded only in the ram. powering off your router will kill your u-boot, you will need to start again with this procedure.

To restore u-boot completely, upload u-boot via your serial connection and write it back to flash using the u-boot functions (see 2. FLASH)

There are some parts for telephony on the PCB. This parts are currently not supported.

Sip client for infineon danube based routers running openwrt: http://code.google.com/p/danube-voip/

Some research on university of freiburg germany (german): http://lab.ks.uni-freiburg.de/issues/515

A "map" of the PCB: http://lab.ks.uni-freiburg.de/attachments/download/431/baugruppen.jpg

ISDN

• XHFC-2SU ISDN 3409 or XHFC-2SU ISDN 3109
• http://www.colognechip.com/isdn/controllers/frame-xhfc-2su.htm (Datasheet/Linux driver)

NTBA

• PEF80902

POTS

• Si3011
• Si3050

Please Backup your original firmware!

• https://github.com/rvalles/brntool
• http://code.google.com/p/brndumper/

I will use brntool to explain the backup here. As an alternative you could use brndumper to save the original firmware. (if you prefer a grafical interface brndumper may be better for you)

You have to download the small Python tool. You also need the packages python and phyton-Serial(Debian and clones) or pyserial(Redhat and clones) to run brntool.

Acording to the readme of brntool: "A successful flash block read will output '.' while a botched one (a byte or more gets lost in the serial port) will output '!' and retry. Even so, unless in a hurry, I'd recommend to at least dump twice and compare the dumps, just to be on the safe side."

A dump of the firmware is done in ~~1 hour. to dump twice as recomended by the autor of brntool you have to plan 2 hours to backup your device. First you have to enter the "Administrator Mode" in DANUBE Boot. Just fire up your serial terminal (screen /dev/ttyUSB0 115200), power on the device, hurry press 3x space bar. You will see the bootloader prompt: [DANUBE Boot]:. Then type a exclamation mark (!) to enter the administration mode in the DANUBE bootloader. You will see this output:

Press Space Bar 3 times to enter command mode …123 Yes, Enter command mode … [DANUBE Boot]:! Enter Administrator Mode ! ====================== [#] Set Serial Number [2] Use Normal Firmware [3] Use ART-Testing Firmware [9] Taggle ART Firmware Enable/Disable [A] Set MAC Address [E] Erase Flash [G] Run Runtime Code [H] Set Options [M] Upload to Memory [P] Print Boot Params [R] Read from Memory [T] Memory Test [U] Upload to Flash [V] Set Board Version [W] Write to Memory [Y] Go to Memory [Z] Dump DDR Ram Register [0] Primary = Image 0 [1] Primary = Image 1 ====================== [DANUBE Boot]:

Kill your serial terminal (screen: "ctrl+a, k" and confirm exit with "y"). Now you are able to dump the original firmware as shown below.

[root@localhost]# time ./brntool.py –read=ARV752DPW_whole.dump –addr=0xB0000000 –verbose –size=0x800000 Waiting for a prompt… Ok. ………………..!…!…………!…. [abbreviated version, you will see many more dots and exclamation marks] real 61m27.738s user 1m18.327s sys 0m47.164s

Powercycle the router, enter the "Admin Mode" of the bootloader and dump the firmware again:

[root@localhost]# ./brntool.py –read=ARV752DPW_whole2.dump –addr=0xB0000000 –verbose –size=0x800000

Compare the files. If everything is ok you will end with 2 identical files:

[root@localhost]# ls -l ARV752DPW_whole*.dump -rw-r–r–. 1 root root 8388608 12. Feb 23:32 ARV752DPW_whole2.dump -rw-r–r–. 1 root root 8388608 13. Feb 00:58 ARV752DPW_whole.dump [root@localhost]# diff ARV752DPW_whole.dump ARV752DPW_whole2.dump [root@localhost]# cmp ARV752DPW_whole.dump ARV752DPW_whole2.dump [root@localhost]# md5sum ARV752DPW_whole* b245fc54da24db7a81bb915e968453f8 ARV752DPW_whole2.dump b245fc54da24db7a81bb915e968453f8 ARV752DPW_whole.dump

As you see, the two files are the same. If you compare your own output with this example you probably note the md5sums differ, thats ok: You have to end with md5sums different like shown here in this example, because my MAC Adress/Serial No./configuration its also saved in this dump.

This information is very old. But it is still posible to boot to the Recovery Mode.

Tested on similar device - Arcadyam ARV752DPW22 (EasyBox 803)

WIP: DO NOT FOLLOW THIS INFORMATIONS AT THE MOMENT: SIGNED FIRMWARE IS NOT WORKING (uboot can't find the ethernet devices, a bugreport is opened, stay tuned, we are working on this issue)

• download a prebuild, signed firmware image from http://nanl.de/todo.. (alternative download location: https://belug.de/~lutz/pub/todo..)
• press and hold the "reset"-button: use a toothpick or paper clip to press and hold the button
• power on the device (hold the reset button while power on the device)
• release the reset-Button 3 seconds after power on
• use an ethernet cable that forms a direct connection between the router and your computer or notebook (you MUST NOT use a switch, you will need a direct cabled connection. WLAN will also not work at this state)
• configure your ethernet device to a static ip address 192.168.2.100, netmask is 255.255.255.0 (/24)
• open a browser and navigate to http://192.168.2.1
• you will see the "Recovering Tool" user interface shown in the picture below:

• select "Firmware" as upgrade target, pick up the previously downloaded firmware file, and press the "APPLY" button
• confirm the messages: the firmware will be uploaded and flashed onto the device

DO NOT POWER OFF THE DEVICE! Drink some coffee, tea… simply do nothing, just wait. The first reboot will take some time, because the device will be flashed with new firmware. AGAIN: DO NOT POWER OFF THE DEVICE! The LED in front of the device will show you the status and success of the process:

1. a permanent white glowing of the "Power" LED (approximately 50 sec)
2. flashing (approximately 1 flash per second) of the "Power" LED (white light, approximately 30 sec)

• reload/refresh your browser, if you see the power LED flashing for ~30 seconds: you will see the "Recovering Tool" user interface again
• select reboot from the "Recovering Tool" user interface

Drink more tea now… wait, and do not power off the device. The second reboot will take a bit longer, compared with the first one. The LED in front of the device will show you the current state of the process again:

1. a permanent red glowing of the "Power" LED (approximately 3 sec)
2. all lights are off (approximately 40 sec)
3. a permanent blue glowing of the "internet" LED (approximately 2 sec)
4. all lights are off

Power off the device now, its bricked :)

Just kidding… powercycle your device now.

• reconfigure your ethernet device to a static ip 192.168.1.100, netmask 255.255.255.0
• navigate in your browser from http://192.168.2.1 to http://192.168.1.1

Congratulations: you will see the failsafe interface of uboot:

Working DSL setup

config atm-bridge 'atm'
        option vpi '1'
        option vci '32'
        option encaps 'llc'
        option payload 'bridged'

config interface 'wan'
        option ifname 'nas0'
        option proto 'pppoe'
        option username '24235@eveundeve.de'
        option password '7046107807'
        option ipv6 '0'
        option pppd_options 'debug kdebug 2 lcp-max-terminate 0 ipcp-max-terminate 0'
        option keepalive 0
        option mtu 1500

config interface 'wan6'
        option ifname '@wan'
        option proto 'dhcpv6'

config adsl 'dsl'
        option annex 'b'
        option firmware '/lib/firmware/adsl.bin'

Successfully flashed and tested Attitude Adjustment image (bootloader is still missing here!) :

• http://downloads.openwrt.org/attitude_adjustment/12.09/lantiq/danube/openwrt-lantiq-danube-ARV752DPW-squashfs.image

Chaos Calmer also without bootloader, working except wifi and isdn.

• https://downloads.openwrt.org/chaos_calmer/15.05.1/lantiq/xway/openwrt-15.05.1-lantiq-xway-ARV752DPW-squashfs.image

U-Boot snapshots are broken at the moment (August 2013), here is a backup for some working images:

• uboot-lantiq-arv752DPW_ramboot : http://www.galax.is/files/802/u-boot.asc
• uboot-lantiq-arv752DPW_flash : http://www.galax.is/files/802/flash-uboot.bin
• uboot-lantiq-arv752DPW_brnboot : http://www.galax.is/files/802/brnboot-uboot.bin

Also, 12.09-rc1 still contains some automatically built images:

• http://downloads.openwrt.org/attitude_adjustment/12.09-rc1/lantiq/danube/

The lantiq snapshot repo may contain some useful images:

• http://downloads.openwrt.org/snapshots/trunk/lantiq/

Alternatively, try this repo to build u-boot yourself:

• https://github.com/Pteridium/U-boot_Lantiq_Danube

Python script to transfer over serial:

• http://www.galax.is/files/802/write-to-uboot.py

(original source: https://forum.openwrt.org/viewtopic.php?pid=183315#p183315 )

I am new to openwrt and want to build the firmware for this device. There are no build instructions yet so I will add them here while I am experimenting with build. — JPT1 2016/04/29 15:16

• Follow this https://wiki.openwrt.org/doc/howto/buildroot.exigence but probably fetch 15.5 branch: git clone git:git.openwrt.org/15.05/openwrt.git
• when running make menuconfig select the following
  • Target System: lantiq
  • Target Profile: Easybox 802 - ARV752DPW
  • optional: usb-2.0 drivers, printer and usb-storage?
  • optional: filesystem drivers?
  • Ralink RT2860 PCI is reported not to work in 15.5 (see above). wireless drivers are already selected, firmware is available. so this seems to be a runtime problem. maybe this helps in trouble shooting: https://wireless.wiki.kernel.org/en/users/drivers/rt2800pci
  • Boot Loaders: uboot-lantiq-arv752dpw_brn or other formats depending on how you are gonna install the firmware (see above)
• make
• find your firmware images in bin/lantiq

How to add tags