User Tools

Site Tools


toh:pirelli:a125g

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Previous revision
toh:pirelli:a125g [2013/05/13 14:15]
toh:pirelli:a125g [2016/05/23 15:45] (current)
vaxquis [Installing OpenWrt]
Line 1: Line 1:
 +====== Pirelli DRG A125G ======
  
 +**NOTE:** //The original company producing this device **Pirelli Broadband Solutions S.p.A.** [[http://​www.pirellibroadband.com/​|Pirelli]] have been bought by **ADB Broadband S.p.A.** [[http://​broadband.adbglobal.com/​|ADB]]. Because of this, it is hard find any other information about these devices.//
 +
 +===== Hardware =====
 +==== Info ====
 +| **[[wp>​Instruction set|Architecture]]:​** ​  | [[wp>​MIPS architecture|MIPS]] ​       |
 +| **Vendor:​** ​                               | [[wp>​Broadcom]] ​                     |
 +| **[[doc:​techref:​Bootloader]]:​** ​           | [[doc:​techref:​bootloader:​CFE]] ​      |
 +| **Board ID:**                              | PirelliGateW2+ ​                      |
 +| **[[doc:​hardware:​soc|System-On-Chip]]:​** ​  | {{:​media:​datasheets:​bcm6348_product_brief.pdf|BCM6348KPBG}} ​                          |
 +| **[[doc:​hardware:​cpu|CPU]]/​Speed** ​        | BMIPS3300 V0.7 / 240 MHz             |
 +| **Flash Type (a)**                         | MX29LV320AB,​ id 0x22a8, size 4096KB ​ |
 +| **Flash Type (b)**                         | [[http://​html.alldatasheet.com/​html-pdf/​143147/​MCNIX/​MX29LV320CBTC-90G/​160/​1/​MX29LV320CBTC-90G.html|MX29LV320CBTC-90G ]], 32Mbit (4M x 8 / 2M x 16) |
 +| **Flash size:​** ​                           | 4 MiB |
 +| **RAM-chip:​** ​                             | Winbond [[http://​www.alldatasheet.com/​datasheet-pdf/​pdf/​207175/​WINBOND/​W9812G6GH-6.html|W9812G6GH-6 ]]  / SDR-166 |
 +| **RAM size:​** ​                             | 16 MiB                   |
 +| **Wireless:​** ​                             | Broadcom 4318 (onboard) ​ |
 +| **Ethernet:​** ​                             | Broadcom ​ {{:​media:​datasheets:​bcm5325_datasheet.pdf|BCM5325}} w/ vlan support [[doc:​uci:​network#​swconfig]] |
 +| **Internet:​** ​                             | ADSL2+ ​            |
 +| **USB:​** ​                                  | possible with mod  |
 +| **[[doc:​hardware:​port.serial|Serial]]:​** ​  | [[#​Serial|Yes]] ​   |
 +| **[[doc:​hardware:​port.jtag|JTAG]]:​** ​      | [[#​JTAG|Yes]] ​     |
 +
 +==== Photos ====
 +=== Opening the case ===
 +**Note:** This will void your warranty!
 +
 +The only screw that holds it all together is hidden under the label...\\
 +{{:​media:​pirelli:​a125g_outside.jpg?​400|}}
 +
 +**Photo of PCB**\\
 +
 +^ Top View ^ Bottom View ^
 +|  {{:​media:​pirelli:​a125g_inside_front.jpg?​400x300|}} ​ | {{:​media:​pirelli:​a125g_inside_back.jpg?​400x300|}} |
 +
 +==== Serial ====
 +This is a hardware hack. You need to make a serial cable and attach it to the circuit board, by following the instructions here: [[doc:​hardware:​port.serial]].
 +
 +As can be seen on the detailed picture (below), the serial connector is located in the upper right-hand side of the router, close to the DSL connector. It is marked **CON3** on the PCB. In order to connect the serial you also need to solder in the missing resistors; **R106** and **R157** as outlined. The value of these are (probably) 1 KΩ @ 1/16 W and of SMD type 0603. However, these are so small and close to the serial solder pads, that it is highly recommended to just put a solder blob to short circuit the resistor pads and then add two standard-sized resistors either directly to the Tx/Rx serial pads or as a part of your cable (note that those resistors are basically just short-circuit and overload protection). In addition, if you do decide to solder on the SMT resistors, make sure you either have a temperature controlled iron or a soldering iron of max 25W or you risk burning off the extremely fine copper-soldering pads, AND use solder flux!
 +
 +The pins from left-to-right are:
 +
 +^ Pin   ^ Function ​     ^
 +| 1     | Vcc (3.3 V)   |
 +| 2     | Tx            |
 +| 3     | Rx            |
 +| 4     | GND           |
 +
 +{{:​media:​pirelli:​a125g_inside_detail.jpg?​400|}}
 +
 +It's worth noting that the baud rate for serial communication is 115200 here (and not the usual 9600).
 +
 +==== JTAG ====
 +This is a difficult & expert hardware hack. Please read [[:​doc:​hardware:​port.jtag
 +|port.jtag]] first!
 +
 +If you don't already have a JTAG adaptor (connector/​dongle),​ it is strongly recommended to get one that is both compatible with the free //OpenOCD// [[http://​openocd.berlios.de/​web/​|Open On-Chip Debugger]] software **AND** is a native "​high-speed"​ (usually USB2) JTAG device, and not only "​supported"​ or "​full-speed",​ as it may be excruciatingly slow for flashing devices with more than a megabyte of memory, considering flash speeds on the order of ~1 Kbps! Do the math!
 +
 +A few recommended adapters are:
 +  * [[http://​www.amontec.com/​jtagkey-tiny.shtml|Amontec JTAGkey-Tiny]]
 +  * [[http://​www.embedded-projects.net/​index.php?​module=artikel&​action=gruppe&​id=16|OpenOCD USB Adapter Kit (+Cabelset)]]
 +  * [[http://​www.embedded-projects.net/​index.php?​page_id=135|USBprog v3.0]]
 +  * [[http://​www.seeedstudio.com/​depot/​bus-blaster-v2-jtag-debugger-p-807.html|Bus Blaster v2]]
 +
 +There is some additional very useful JTAG information and links including a practical example on: [[http://​www.neufbox4.org/​wiki/​index.php?​title=Interface_JTAG|"​Neuf Box 4 JTAG"​]]. ​
 +(Although, mostly in French.)
 +
 +The JTAG port is called **J201** and is located near the SoC, on the right-hand-side of the router PCB, as shown in the detailed picture (above). It is unclear at this time, whether or not the empty, but outlined resistors (**R86, <​del>​R99,</​del>​ R231, R234** and possibly also <​del>​**R3**</​del>​) need to be soldered. This seem to be a MIPS standard EJTAG 2.5, 14 pin connector. The PCB solder pads as shown in the picture are as follows. ​ **Check These!**
 +
 +**R3 and R99** not required others can be shorted ( 0 Ohm )
 +
 +^ Pin  ^  Function ​      ^^ Pin  ^
 +|  1   | nTRST   | GND    | 2    |
 +|  3   | TDI     | GND    | 4    |
 +|  5   | TDO     | GND    | 6    |
 +|  7   | TMS     | GND    | 8    |
 +|  9   | TCK     | GND    | 10   |
 +|  11   | nSRST   | --     | 12   |
 +|  13   | DINT    | Vref   | 14   |
 +
 +Where pin **12** is often missing or not used, and **13** is often not used, but sometimes used for Debug Introduction (DINT).
 +
 +<​del>​CPU Chip ID: 00000110001101011000000101111111 (0635817F)</​del>​
 +
 +Note, when you flash from JTAG the BASE ADDRESS is <​del>​0x1E000000</​del>​
 +
 +
 +===== Original Firmware Releases =====
 +These are non OpenWrt Releases!
 +
 +**NOTE:** There is some confusion on "​Firmware"​ versus "​Software"​ versions as the router configuration messages show:
 +
 +<​code>​
 +Software Version:​ TEO_4.2.5.0008  ​
 +Configuration Version:​ TEO_4.2.5.0001
 +Firmware Version:​ 4.5.3
 +</​code> ​
 +
 +Lithuania: (TEO)
 +
 +  * openrg-4.5.3.TEO_4.2.5.0008-DWR_96348.img ​ (default/​original TEO release)
 +  * openrg-4.5.3.TEO_4.2.5.0013-DWR_96348.rmt ​ (updated, Note: RMT!)
 +  * openrg-4.5.3.TEO_4.2.5.0014-DWR_96348.rmt
 +  * openrg-4.5.3.TEO_4.2.5.0015-DWR_96348.rmt
 +
 +Poland: ???
 +
 +Serbia: ​ ???
 +
 +Italy: ???
 +
 +Romania: ???
 +
 +===== Router Login =====
 +There are several ways to access your router.
 +
 +  * Ethernet/​LAN/​WLAN interface (telnet/​http)
 +  * USB interface (requires to install Ethernet-USB driver on the connecting device)
 +  * Serial interface (hardware hack)
 +  * JTAG interface (hardware hack)
 +
 +
 +==== LAN Console Access ====
 +This is by far the easiest method to get direct access to your router. Just connect your Ethernet to one of the ports and use your favorite terminal program, such as: //terminal, ssh// or //nc//. The default router IP is 192.168.1.254. But don't forget that these ports must me available through the router firewall.
 +
 +<​code>​
 +# telnet 192.168.1.254
 +# ssh 192.168.1.254:​23
 +# nc -vv 192.168.1.254 23
 +</​code>​
 +
 +You will then be asked for a Username/​Password combination. The factory default is usually //​Admin/​Admin//​ depending on your ISP. After success you'll be greeted by the //Pirelli DRG A125G// prompt. ​
 +
 +''​DRG A125G>''​
 +
 +To see the default configuration of the original compiled code:
 +
 +<​code>​
 +DRG A125G> system shell
 +
 +BusyBox v1.01 (2005.09.07-07:​38+0000) Built-in shell (lash)
 +Enter '​help'​ for a list of built-in commands.
 +
 +/ # print_config
 +
 +...<long list>...
 + </​code>​
 +
 +
 +===== Flash Layout =====
 +
 +FIXME I filled in the range, please check correct size! 
 +^ What               ^ Type      ^   ​MaxSize ^ Adress Range            ^
 +| CFE                | BOOT      |      64KB | 0x00000000-0x00010000 ​  |
 +| 1st Image          | IMAGE     ​| ​   ~3.8MB | 0x00010000-0x003D0000 ​  |
 +| 1st Conf           | CONF      |     ~64KB | 0x003D0000-0x003E0000 ​  |
 +| 2nd Conf           | CONF      |     ~64KB | 0x003E0000-0x003F0000 ​  |
 +| Factory Settings ​  | FACTORY ​  ​| ​     64KB | 0x003F0000-0x00400000 ​  |
 +
 +* NOTE: This is the Maximal Allocated size.
 +
 +
 +More detailed information came from the discus command: //DRG A125G> flash layout// :
 +<​code>​
 +Section 00 Type BOOT       Range 0x00000000-0x00010000 MaxSize 0x00010000
 +        No more information.
 +
 +Section 01 Type IMAGE      Range 0x00010000-0x003D0000 MaxSize 0x003BFF6C
 +        Size 0x003A60B0 Name '​IMAGE'​
 +        Checksum 0x1CD6BF45 Counter 0x00000002 Start Offset 0x00000000
 +
 +Section 02 Type CONF       Range 0x003D0000-0x003E0000 MaxSize 0x0000FF6C
 +        Size 0x00004B68 Name '​rg_conf'​
 +        Checksum 0x002603D2 Counter 0x000044A3 Start Offset 0x00000000
 +
 +Section 03 Type CONF       Range 0x003E0000-0x003F0000 MaxSize 0x0000FF6C
 +        Size 0x00004C3A Name '​rg_conf'​
 +        Checksum 0x0026782E Counter 0x000044A1 Start Offset 0x00000000
 +
 +Section 04 Type FACTORY ​   Range 0x003F0000-0x00400000 MaxSize 0x0000FF6C
 +        Size 0x0000052A Name '​rg_factory'​
 +        Checksum 0x00012222 Counter 0x00000012 Start Offset 0x00000000
 +
 +Total 5 sections found.
 +</​code>​
 +
 +===== Installing OpenWrt =====
 +
 +You will need a serial adapter to flash your Pirelli DRG A125G!
 +
 +**Don'​t even try to go further without a serial adapter!**
 +
 +The steps involved in getting OpenWrt on your router is as follows, and please follow!
 +
 +  * Backup your original firmware
 +  * Install the OpenWrt firmware
 +  * (Fail!?) Restore your original firmware
 +  * Configure OpenWrt
 +
 +==== Backup of original firmware ====
 +Build a RAMDISK openwrt firmware less than 4MB size, and run it from CFE, then just copy whole flash using netcat to your PC. FIXME
 +
 +==== Restore original firmware (not tested!) ====
 +Load on your computer a small web server with firmware.bin in its root directory.
 +<​code>​cd /tmp
 +wget http://​IP/​firmware.bin
 +mtd -r write firmware.bin linux</​code>​
 +
 +==== Installing OpenWrt ====
 +**Disclaimer:​** DRG A125G is, to put it mildly, not a good OpenWrt box. It has only 4 MiB of flash, 16 MiB RAM and a single-core 240 MHz CPU. IMO you should forget about LAMP server or any "​advanced"​ network services - you're essentially limited to LAN/​WLAN/​WAN routing here. Stock OEM firmware is good enough for that IMO (and it's also heavily optimized for the actual device AFAIR), so you're basically wasting your time if you're expecting any performance gain. Frankly, even 100Mbit routing may be a problem for this box when on OpenWrt (or at least it was in my case, YMMV). It's also hardware-limited to two USB 1.1 - one host/device and one device, and seemingly the actual physical connector present is attached to a device-only port (I've found no USB voltage on Vcc), meaning you actually won't be able to use it as a NAS, print server or anything similar effectively,​ without **heavy** hardware modding.
 +
 +That being said...
 +
 +You need to setup a TFTP server on some host to serve the firmware image to the router. Connect to the device using serial, press any key during the early boot to hit CFE prompt. Using the prompt, you should change the static Board IP of the router used for flashing (set it to match the subnet of your TFTP server) and the Host IP (IP of the TFTP server itself), both using command //c//. Also, if you don't want to recompile the kernel with a custom device Id support added, you should change the board Id to one of the generic ones (e.g. 96348GW-11) using command //b//.
 +
 +Stock firmware images itself (you can use e.g. 96348R, 96348GW, 96348GW-10, 96348GW-11) will need a little tailoring for DRG A125G (I suggest using XVI32 & https://​dev.openwrt.org/​attachment/​ticket/​5337/​analyzetag.2.c to do the heavy lifting). First, you'll have to change the tagId to string '​8'​ (ASCII 0x38), and sig_2 string (2nd line of OEM identifier) to '​IMAGE',​ followed by zeroes. Also, you'll need to recalculate the kernel CRC (e.g. using analyzetag with ag306 parser) or any other similar tool, and replace the kernel CRC present in the image with the correct one. After that, recalc the CRC of the tagId, and update it accordingly. Note that the values are stored little-endian,​ so you'll need to reverse the byte order when inserting them.
 +
 +Now you have to use the //​flashimage//​ command to load the image, (DON'T USE THE //f// COMMAND UNLESS YOU REALLY KNOW WHAT YOU'RE DOING!). Note that if you configured hostip earlier, you can avoid it in the //​flashimage//​ argument.
 +<​code>​
 +CFE> flashimage [hostip:​]compressed_image_file_name
 +</​code>​
 +
 +The device will automaticly reboot and, assuming everything went well, OpenWrt will boot.
 +
 +Note 1: don't use the dev (snapshot) branch - use a stable one instead; dev branch caused weird kernel panics in my case, YMMV.
 +
 +Note 2: since the generic images doesn'​t have the proper GPIO config (and may be missing a few things), you'd probably use the ImageBuilder if you **really** want to push your DRG A125G to the max.
 +===== Network configuration =====
 +I can suggest you to use Alice gate with the following network configuration using serial console:
 +
 +For more info read [[doc:​hardware:​switch]] config.
 +FIXME To be reviewed
 +<​code>​
 +config interface loopback ​                                                      
 +        option ifname ​  ​lo ​                                                     ​
 +        option proto    static ​                                                 ​
 +        option ipaddr ​  ​127.0.0.1 ​                                              
 +        option netmask ​ 255.0.0.0 ​                                              
 +                                                                                ​
 +config '​switch'​ '​eth1' ​                                                         ​
 +   ​option '​enable' ​     '​1' ​                                                    
 +   ​option '​enable_vlan'​ '​1' ​                                                    
 +   ​option '​reset' ​      '​1' ​                                                    
 +                                                                                ​
 +config '​switch_vlan'​ '​vlan0' ​                                                   ​
 +   ​option '​vlan' ​      '​0' ​                                                     ​
 +   ​option '​device' ​    '​eth1' ​                                                  
 +   ​option '​ports' ​     '0 1 2 5*' ​                                              
 +                                                                                ​
 +config '​switch_vlan'​ '​vlan1' ​                                                   ​
 +   ​option '​vlan' ​      '​1' ​                                                     ​
 +   ​option '​device' ​    '​eth1' ​                                                  
 +   ​option '​ports' ​     '3 5t' ​                                                  
 +                                                                                ​
 +config interface lan                                                            ​
 +        option ifname ​  ​eth1.0 ​
 +        option type     ​bridge ​                                                
 +        option proto    static ​                                                 ​
 +        option ipaddr ​  ​192.168.5.1 ​                                            
 +        option netmask ​ 255.255.255.0 ​                                          
 +        option nat      1                                                       
 +                                                                                ​
 +config '​interface'​ wan 
 +    option '​ifname' ​ '​eth1.1' ​                                                  
 +    option '​proto' ​  '​dhcp'​
 +</​code>​
 +
 +===== Leds config =====
 +Inside /​etc/​config/​system add:
 +<​code>​
 +config '​led'​
 + option '​sysfs'​ '​power:​red'​
 + option '​trigger'​ '​heartbeat'​
 +
 +config '​led'​
 + option name lan
 + option '​sysfs'​ '​usr1:​red'​
 + option trigger netdev
 + option '​dev'​ '​eth1.0'​
 + option mode 'rx tx'
 +
 +config '​led'​
 + option name wan
 + option '​sysfs'​ '​usr2:​red'​
 + option trigger netdev
 + option '​dev'​ '​eth1.1'​
 + option mode 'rx tx'
 +</​code>​
 +
 +===== As a WAN router with original OpenRG firmware =====
 +A little known capability of A125G is the possibility of using it as a regular WAN->LAN router (with common NAT, DHCP, route tables etc) even with the original firmware. To do so:
 +
 +  * configure one of the ETH ports on the "LAN Hardware Ethernet Switch"​ page in "​Network Configuration"​ into VLAN port (e.g. PVID/VLAN 1, possibly isolated too)
 +  * create a new connection of type VLAN and bind it to the same VLAN number as used above
 +  * set the VLAN to network type WAN and to use DHCP to acquire IP & DNS
 +  * make sure than VLAN routing is set to NAPT and that it is the default route
 +  * remove the "LAN Hardware Ethernet Switch"​ from "LAN Bridge"​ device (because we can't have the packets from WAN to be directly switched into LAN)
 +
 +Now you have a working WAN->​WLAN/​USB routing; to add a regular ethernet WAN->LAN routing, you just have to create another VLANs for your LAN needs and then add these other VLANs to the "LAN Bridge"​ device.
 +
 +Note: Although not a strictly OpenWrt-related info, I'm supplying this here since it's extremely hard to get any tech support on A125G, and I've spend countless days to make this one working.
 +
 +===== Notes =====
 +  * [[https://​forum.openwrt.org/​viewtopic.php?​id=28625]] ​
 +  * [[https://​forum.openwrt.org/​viewtopic.php?​id=25153]] ​
 +  * [[https://​forum.openwrt.org/​viewtopic.php?​id=29344]]
 +  * [[http://​wiki.ninux.org/​Hackalicegate]]
 +
 +===== Tags =====
 +[[meta:​tags|How to add tags]]
 +{{tag> bcm63xx bcm6348 4flash 16ram}}