Pirelli DRG A125G

NOTE: The original company producing this device Pirelli Broadband Solutions S.p.A. Pirelli have been bought by ADB Broadband S.p.A. ADB. Because of this, it is hard find any other information about these devices.

At the moment, some of the information here was copied directly from the AliceGate page. So some of this still need to be edited,checked and filled in. For more info, please follow the A125G discussion at the Forum: https://forum.openwrt.org/viewtopic.php?id=28625

Hardware

Info

Architecture: MIPS
Vendor: Broadcom
Bootloader: CFE
Board ID: PirelliGateW2+
System-On-Chip: BCM6348KPBG
CPU/Speed BMIPS3300 V0.7 / 240 MHz
Flash Type (a) MX29LV320AB, id 0x22a8, size 4096KB
Flash Type (b) MX29LV320CBTC-90G , 32Mbit (4M x 8 / 2M x 16)
Flash size: 4 MiB
RAM-chip: Winbond W9812G6GH-6 / SDR-166
RAM size: 16 MiB
Wireless: Broadcom 4318 (onboard)
Ethernet: Broadcom BCM5325 w/ vlan support swconfig
Internet: ADSL2+
USB: possible with mod
Serial: Yes
JTAG: Yes

Photos

Opening the case

Note: This will void your warranty!

The only screw that holds it all together is hidden under the label…

Photo of PCB

Top View Bottom View

Serial

This is a hardware hack. You need to make a serial cable and attach it to the circuit board, by following the instructions here: http://wiki.openwrt.org/doc/hardware/port.serial .

As can be seen on the detailed picture (below), the serial connector is located in the upper right-hand side of the router, close to the DSL connector. It is marked CON3 on the PCB. In order to connect the serial you also need to solder in the missing resistors; R106 and R157 as outlined. The value of these are (probably) 1 KΩ @ 1/16 W and of SMD type 0603. However, these are so small and close to the serial solder pads, that it is highly recommended to just put a solder blob to short circuit the resistor pads and then add two standard-sized resistors either directly to the T/RX serial pads or as a part of your cable. In addition, if you do decide to solder on the SMT resistors, make sure you either have a temperature controlled iron or a soldering iron of max 25W or you risk burning off the extremely fine copper-soldering pads, AND use solder flux!

The pins from left-to-right are:

Pin Function
1 Vcc (3.3 V)
2 TX ?
3 RX ?
4 GND

JTAG

This is a difficult & expert hardware hack. Please read port.jtag first!

If you don't already have a JTAG adaptor (connector/dongle), it is strongly recommended to get one that is both compatible with the free OpenOCD Open On-Chip Debugger software AND is a native "high-speed" (usually USB2) JTAG device, and not only "supported" or "full-speed", as it may be excruciatingly slow for flashing devices with more than a megabyte of memory, considering flash speeds on the order of ~1 Kbps! Do the math!

A few recommended adapters are:

There is some additional very useful JTAG information and links including a practical example on: "Neuf Box 4 JTAG". (Although, mostly in French.)

The JTAG port is called J201 and is located near the SoC, on the right-hand-side of the router PCB, as shown in the detailed picture (above). It is unclear at this time, whether or not the empty, but outlined resistors (R86, R99, R231, R234 and possibly also R3) need to be soldered. This seem to be a MIPS standard EJTAG 2.5, 14 pin connector. The PCB solder pads as shown in the picture are as follows. Check These!

R3 and R99 not required others can be shorted ( 0 Ohm )

Pin Function Pin
1 nTRST GND 2
3 TDI GND 4
5 TDO GND 6
7 TMS GND 8
9 TCK GND 10
11 nSRST 12
13 DINT Vref 14

Where pin 12 is often missing or not used, and 13 is often not used, but sometimes used for Debug Introduction (DINT).

CPU Chip ID: 00000110001101011000000101111111 (0635817F)

Note, when you flash from JTAG the BASE ADDRESS is 0x1E000000

Original Firmware Releases

These are non OpenWrt Releases!

The firmware is based on Jungo's OpenRG development, which is released under GPL and LGPL. Thus in theory you should be able to ask for a copy of the source code from the 3rd party vendor at any time. At least according to Jungo's own pages. Please try this!

NOTE: There is some confusion on "Firmware" versus "Software" versions as the router configuration messages show:

Software Version:	TEO_4.2.5.0008	 
Configuration Version:	TEO_4.2.5.0001
Firmware Version:	4.5.3

Lithuania: (TEO)

  • openrg-4.5.3.TEO_4.2.5.0008-DWR_96348.img (default/original TEO release)
  • openrg-4.5.3.TEO_4.2.5.0013-DWR_96348.rmt (updated, Note: RMT!)
  • openrg-4.5.3.TEO_4.2.5.0014-DWR_96348.rmt
  • openrg-4.5.3.TEO_4.2.5.0015-DWR_96348.rmt

Poland: ???

Serbia: ???

Italy: ???

Romania: ???

Router Login

There are several ways to access your router.

  • By WEB interface
  • By Ethernet/LAN/WLAN interface
  • By USB interface (???)
  • By Serial interface (hardware hack)
  • By JTAG interface (hardware hack)

We will only focus on LAN access and then on serial access, which is needed for OpenWrt installation.

LAN Console Access

This is by far the easiest method to get direct access to your router. Just connect your Ethernet to one of the ports and use your favorite terminal program, such as: terminal, ssh or nc. The default router IP is 192.168.1.254. But don't forget that these ports must me available through the router firewall.

# telnet 192.168.1.254
# ssh 192.168.1.254:23
# nc -vv 192.168.1.254 23

You will then be asked for a Username/Password combination. The factory default is usually Admin/Admin depending on your ISP. After success you'll be greeted by the Pirelli DRG A125G prompt.

DRG A125G>

To see the default configuration of the original compiled code:

DRG A125G> system shell

BusyBox v1.01 (2005.09.07-07:38+0000) Built-in shell (lash)
Enter 'help' for a list of built-in commands.

/ # print_config

...<long list>...
 

Flash Layout

FIXME I filled in the range, please check correct size!

What Type MaxSize Adress Range
CFE BOOT 64KB 0x00000000-0x00010000
1st Image IMAGE ~3.8MB 0x00010000-0x003D0000
1st Conf CONF ~64KB 0x003D0000-0x003E0000
2nd Conf CONF ~64KB 0x003E0000-0x003F0000
Factory Settings FACTORY 64KB 0x003F0000-0x00400000

* NOTE: This is the Maximal Allocated size.

More detailed information came from the discus command: DRG A125G> flash layout :

Section 00 Type BOOT       Range 0x00000000-0x00010000 MaxSize 0x00010000
        No more information.

Section 01 Type IMAGE      Range 0x00010000-0x003D0000 MaxSize 0x003BFF6C
        Size 0x003A60B0 Name 'IMAGE'
        Checksum 0x1CD6BF45 Counter 0x00000002 Start Offset 0x00000000

Section 02 Type CONF       Range 0x003D0000-0x003E0000 MaxSize 0x0000FF6C
        Size 0x00004B68 Name 'rg_conf'
        Checksum 0x002603D2 Counter 0x000044A3 Start Offset 0x00000000

Section 03 Type CONF       Range 0x003E0000-0x003F0000 MaxSize 0x0000FF6C
        Size 0x00004C3A Name 'rg_conf'
        Checksum 0x0026782E Counter 0x000044A1 Start Offset 0x00000000

Section 04 Type FACTORY    Range 0x003F0000-0x00400000 MaxSize 0x0000FF6C
        Size 0x0000052A Name 'rg_factory'
        Checksum 0x00012222 Counter 0x00000012 Start Offset 0x00000000

Total 5 sections found.

Installing OpenWrt

You will need a serial adapter to flash your Pirelli DRG A125G!

Don't even try to go further without a serial adapter!

The steps involved in getting OpenWrt on your router is as follows, and please follow!

  • Backup your original firmware
  • Install the OpenWrt firmware
  • (Fail!?) Restore your original firmware
  • Configure OpenWrt

Backup of original firmware

Build a RAMDISK openwrt firmware less than 4MB size, and run it from CFE, then just copy whole flash using netcat to your PC. FIXME

Restore original firmware (not tested!)

Load on your computer a small web server with firmware.bin in its root directory.

cd /tmp
wget http://IP/firmware.bin
mtd -r write firmware.bin linux

Installing OpenWrt

You need to setup a tftp server on some host (I can suggest to use dnsmasq for this) to serve the firmware image to the router.

Now just download the image for AGV2+W from http://downloads.openwrt.org/snapshots/trunk/brcm63xx, skip the jffs2 with 64k erase block as the flash use 128k block, anyway using 64k should not give much problem, just some wasted space and some errors messages. Put the choose image in the right place (see your tftp server configuration), and go to the CFE prompt.

Now you have to use the flashimage command to load the openwrt image, please don't use the f command. If you configure (with command c) the host ip address you can avoid it in the flashimage argument.

CFE> flashimage

     eg. flashimage [hostip:]compressed_image_file_name

That's all, the device will automaticly reboot and openwrt will be there :-)

Using dnsmasq:

dnsmasq -d --enable-tftp --tftp-root=<dir>

As a WAN router

A little known capability of A125G is the possibility of using it as a regular WAN→LAN router (with common NAT, DHCP, route tables etc). To do so:

  • configure one of the ETH ports on the "LAN Hardware Ethernet Switch" page in "Network Configuration" into VLAN port (e.g. PVID/VLAN 1, possibly isolated too)
  • create a new connection of type VLAN and bind it to the same VLAN number as used above
  • set the VLAN to network type WAN and to use DHCP to acquire IP & DNS
  • make sure than VLAN routing is set to NAPT and that it is the default route
  • remove the "LAN Hardware Ethernet Switch" from "LAN Bridge" device (because we can't have the packets from WAN to be directly switched into LAN)

Now you have a working WAN→WLAN/USB routing; to add a regular ethernet WAN→LAN routing, you just have to create another VLANs for your LAN needs and then add these other VLANs to the "LAN Bridge" device.

I'm supplying this info here since it's extremely hard to get any tech support on A125G, and I've spend countless days to make this one working.

Network configuration

I can suggest you to use Alice gate with the following network configuration using serial console:

For more info read switch config. FIXME To be reviewed

config interface loopback                                                       
        option ifname   lo                                                      
        option proto    static                                                  
        option ipaddr   127.0.0.1                                               
        option netmask  255.0.0.0                                               
                                                                                
config 'switch' 'eth1'                                                          
   option 'enable'      '1'                                                     
   option 'enable_vlan' '1'                                                     
   option 'reset'       '1'                                                     
                                                                                
config 'switch_vlan' 'vlan0'                                                    
   option 'vlan'       '0'                                                      
   option 'device'     'eth1'                                                   
   option 'ports'      '0 1 2 5*'                                               
                                                                                
config 'switch_vlan' 'vlan1'                                                    
   option 'vlan'       '1'                                                      
   option 'device'     'eth1'                                                   
   option 'ports'      '3 5t'                                                   
                                                                                
config interface lan                                                            
        option ifname   eth1.0 
        option type     bridge                                                 
        option proto    static                                                  
        option ipaddr   192.168.5.1                                             
        option netmask  255.255.255.0                                           
        option nat      1                                                       
                                                                                
config 'interface' wan 
    option 'ifname'  'eth1.1'                                                   
    option 'proto'   'dhcp'

Leds config

Inside /etc/config/system add:

config 'led'
	option 'sysfs'		'power:red'
	option 'trigger'	'heartbeat'

config 'led'
	option name		lan
	option 'sysfs'		'usr1:red'
	option trigger netdev
	option 'dev'	'eth1.0'
	option mode 'rx tx'

config 'led'
	option name		wan
	option 'sysfs'		'usr2:red'
	option trigger netdev
	option 'dev'	'eth1.1'
	option mode 'rx tx'

Notes

Tags

Back to top

toh/pirelli/a125g.txt · Last modified: 2013/05/13 14:50 (external edit)