Linux/OpenWrt on the AVM FRITZ!Box 3490

After working on the 3390, I bought a used 3490 which is more capable (twice the RAM, Flash and more WiFi bandwidth). Currently, I'm experiencing problems with the xhci controller, but apart from that, it's working fine.

The approach is similar to the 3390: You get a VDSL router/modem (Lantiq target) and a separate WiFi access point (ath79 target) on one PCB.

The FRITZ!Box 3490 actually contains two SoCs, one Lantiq with no WiFi and one QCA558 with 5GHz and 2.4GHz WiFi (via QCA9880). Only the Lantiq has access to the flash memory, the QCA runs fully from RAM.

• Lantiq 500 MHz
• 256MiB RAM
• 512MiB NAND
• 8MBit Flash
• QCA9558 720MHz and 2.4GHz WiFi
• QCA9880 (5GHz only)
• 128MiB RAM

Since you've basically got two devices in one, you need two separate builds of OpenWrt and a few files from the original firmware. First, you need to prepare your environment to be able to compile OpenWrt. Follow the instructions on the OpenWrt Wiki to setup a build environment: https://openwrt.org/docs/guide-developer/build-system/install-buildsystem

Follow the tutorial, but don't download the sources - you need a different source that includes the necessary patches for the FRITZ!3490.

The first system that you need to build and install is the Lantiq target. This brings up the VDSL modem and prepares everything to be able to boot the ath79 target (the WiFi system).

Prepare the sources, switch to the required branch and fetch the package feeds:

git clone https://github.com/andyboeh/openwrt openwrt_lantiq
cd openwrt_lantiq
git checkout avm_fritz3490
./scripts/feeds update -a
./scripts/feeds install -a

Then, you can configure the build using make menuconfig. Select “Lantiq” and “AVM FRITZ!Box 3490” as target. Do not touch any other configuration options. Then, compile with the following (replace -j5 by the number of cores you have +1, so -j5 is for my quad-core system).

make defconfig
make -j5

If everything goes fine, you can start OpenWrt on your box using the initramfs image (this is not permanent and does not modify your device). Power off your router and connect it via an Ethernet cable to your computer. Configure your computer statically to 192.168.178.100. Then, power on your router and run the following command as soon as the network connection is established:

./scripts/flashing/eva_ramboot.py 192.168.178.1 bin/targets/lantiq/xrx200/openwrt-lantiq-xrx200-avm_fritz3490-initramfs-kernel.bin

This will load the initramfs image to the router and boot it. After boot up succeeds, you can reset your network interface to DHCP. You should get an IP address in the 192.168.1.xxx range.

If you are satisifed with it, you can permanently install OpenWrt on the flash. Transfer the sysupgrade file to the router:

scp -o UserKnownHostsFiles=/dev/null bin/targets/lantiq/xrx200/openwrt-lantiq-xrx200-avm_fritz3490-squashfs-sysupgrade.bin root@192.168.1.1:/tmp

Then, connect to your router and run sysupgrade:

ssh -o UserKnownHostsFile=dev/null root@192.168.1.1
# ....once connection is established, run on the OpenWrt device:
sysupgrade /tmp/openwrt-lantiq-xrx200-avm_fritz3490-squashfs-sysupgrade.bin

Your router should reboot and OpenWrt for the Lantiq target is successfully installed.

For the WiFi part, you need a separate OpenWrt installation that is booted from RAM. We need one file from an original AVM firmware in order to be able to boot the second instance (the stage 1 firmware). The stage 2 firmware is replaced by OpenWrt.

Run the following to extract it from an OEM firmware and transfer it to your box:

NOTE: unsquashfs4-avm-be is part of http://freetz.org/. You have to checkout the freetz source and build the tools (make tools) to get the binary. NOTE: p7zip version 15.09 or newer is required to extract the images.

wget https://download.avm.de/fritzbox/fritzbox-3490/deutschland/fritz.os/FRITZ.Box_3490-07.12.image
7z e FRITZ.Box_3490-07.12.image -r filesystem.image
7z e filesystem.image filesystem_core.squashfs
unsquashfs4-avm-be filesystem_core.squashfs -e lib/firmware/ath_tgt_fw1.fw
scp squashfs-root/lib/firmware/ath_tgt_fw1.fw root@192.168.1.1:/opt/wasp

Assuming you have already built the Lantiq target, you need to prepare a second OpenWrt build:

Prepare the sources, switch to the required branch and fetch the package feeds:

git clone https://github.com/andyboeh/openwrt openwrt_ath79
cd openwrt_ath79
git checkout avm_fritz3490_wasp
./scripts/feeds update -a
./scripts/feeds install -a

Then, you can configure the build using make menuconfig. Select “ath79” and “AVM FRITZ!Box 3490 WASP” as target. Do not touch any other configuration options. Then, compile with the following (replace -j5 by the number of cores you have +1, so -j5 is for my quad-core system).

make defconfig
make -j5

If everything goes fine, you can transfer the resulting build to the FRITZ!Box:

scp bin/targets/ath79/openwrt-ath79-generic-avm_fritz3490_wasp-initramfs-kernel.bin root@192.168.1.1:/opt/wasp

Then, connect to your FRITZ!Box via SSH and start the WiFi system:

ssh root@192.168.1.1
# ....once connection is established, run on the OpenWrt device:
/opt/wasp/upload-wasp.sh

If the script succeeds, you have another OpenWrt instance ready at 192.168.1.2. This is a separate instance with access to the WiFi modules but no persistent storage, thus configuration within this target is not persistent. To overcome this limitation, the Lantiq stores the configuration files in /opt/wasp/files. The WiFi configuration is thus in /opt/wasp/files/etc/config/wireless, the network in /opt/wasp/files/etc/config/network. If you change any configuration file, you need to delete the file /opt/wasp/config.tar.gz and re-run /opt/wasp/upload-wasp.sh.

The file /opt/wasp/config.tar.gz serves as an overlay that is extracted on the ath79 target to the root filesystem (→ configuration files). Additionally, it contains a script /opt/wasp/files/usr/bin/wasp_script that is executed during the ath79 boot. By default, it disables the DHCP server on the ath79 target which makes no sense.

By default, the ath79 target uses a static IP address of 192.168.1.2, it can be changed in /opt/wasp/files/etc/config/network.

Upon first start of /opt/wasp/upload-wasp.sh all configuration files are created! I suggest to start with the default configuration for the first time and then continue with configuring the device.

If you want to install additional packages on the ath79 target, you need to place all its files on the lantiq target into /opt/wasp/files and re-create the config.tar.gz file - as it will be extracted to the root folder without further checks, it can contain binaries as well.

Technically, the ath79 target has a boot hook that waits for the upload of the file config.tar.gz by the stage 2 firmware upload.

If you want to bring up WiFi on boot, you can add the script to the auto start file:

ssh root@192.168.1.1
# ....once connection is established, run on the OpenWrt device:
echo '/opt/wasp/upload-wasp.sh' >> /etc/rc.local