Actiontec GT701

The device is based on Texas Instrument AR7. It uses the target ar7 in OpenWrt. Kamikaze (8.09.2) seems to work (10.03 seems to not work).

Basic POST completed...     Success.
Last reset cause: Hardware reset (Power-on reset)

PSPBoot3.3 rev: 3.3.7.15
(c) Copyright 2002-2008 Texas Instruments, Inc. All Rights Reserved.

Press ESC for monitor...

reboot            version           fa                printenv
setenv            unsetenv          defragenv         fmt
boot              oclk              help

BUILD_OPS       0x301
MAC_PORT        0
MEMSZ   0x01000000
FLASHSZ 0x00400000
CPUFREQ 211968000
MIPSFREQ        211968000
SYSFREQ 105984000
PROMPT  (psbl)
BOOTCFG m:f:"mtd1"
vcc_encaps0     0.0
vcc_encaps1     0.0
vcc_encaps2     0.0
vcc_encaps3     0.0
vcc_encaps4     0.0
vcc_encaps5     0.0
vcc_encaps6     0.0
vcc_encaps7     0.0
bootloaderVersion       3.3.7.15
AEIBootVersion  3.0
DSL_FEATURE_CNTL_0      0x00000000
DSL_PHY_CNTL_0  0x00100800
MODETTY0        38400,n,8,1,hw
MODETTY1        38400,n,8,1,hw
modulation      1
mtd2    0x90000000,0x90010000
mtd3    0x90010000,0x90020000
mtd1    0x90020000,0x900c0000
mtd4    0x903f0000,0x90400000
StaticBuffer    384
ProductID       GT701D
HWRevision      4A
usb_vid 0x1668
usb_pid 0x6010
IPA     192.168.0.1
SerialNumber    none
HWA_RNDIS       00:15:05:12:34:00
HWA_HRNDIS      00:15:05:12:34:01
connection0     0x3204

mtd0    0x900c0000,0x903c0000
mtd5    0x903c0000,0x903f0000
HWA_0   00:18:01:xx:xx:xx
HWA_3   00:18:01:xx:xx:xx
MANUSN  
defaults  

Note the IP address changed to 169.254.87.1. ADAM2 still responds at this address and recovery is possible without connecting to the serial port (opening the product is not required). You will need to quote SETENV a long list of environment variables to fully return the product to normal operating state.

BUILD_OPS       0x301
bootloaderVersion       3.3.7.15
ProductID       AR7DB
HWRevision      Unknown
SerialNumber    none
IPA             169.254.87.1
MAC_PORT        0
MEMSZ           0x01000000
FLASHSZ         0x00400000
MODETTY0        9600,n,8,1,hw
MODETTY1        9600,n,8,1,hw
CPUFREQ         141312000
MIPSFREQ        141312000
SYSFREQ         70656000
AEIBootVersion  3.0
BOOTCFG         m:f:"mtd1"
PROMPT          (psbl)

Basic POST completed...     Success.
Last reset cause: Hardware reset (Power-on reset)

PSPBoot3.3 rev: 3.3.7.15
(c) Copyright 2002-2008 Texas Instruments, Inc. All Rights Reserved.

Press ESC for monitor... 3321

(psbl) 
-----argv[0]=mtd1, argc=1

Booting...
Launching kernel decompressor.
Starting LZMA Uncompression Algorithm.
Copyright (C) 2003 Texas Instruments Incorporated; Copyright (C) 1999-2003 Igor Pavlov.
Compressed file is LZMA format.
Kernel decompressor was successful ... launching kernel.

LINUX started...

section :   PSBL, base : 0xb0000000, size :      64816 bytes
section :    ENV, base : 0xb0010000, size :      65535 bytes
unallocated Space Start: 0xb0020000
unallocated Space End  : 0xb0400000

Compiled gcc rev: 2.95.3 20010315 (release/MontaVista) [Apr  8 2008 23:53:47]
Built for AR7DB board in Little Endian mode.

Note: This will void your warranty! The recommended flash procedure is to use the adam2 FTP server.

$ ftp 192.168.0.1
Connected to 192.168.0.1.
220 ADAM2 FTP Server ready.
Name (192.168.0.1:user): adam2
530 Please login with USER and PASS.
331 Password required for adam2.
Password: adam2
230 User adam2 successfully logged in.
ftp> binary
200 Type set to I.
ftp> quote MEDIA FLSH
200 Media set to FLSH.
ftp> quote UNSETENV mtd1
200 UNSETENV command successful
ftp> quote UNSETENV mtd0
200 UNSETENV command successful
ftp> quote UNSETENV mtd5
200 UNSETENV command successful
ftp> quote SETENV mtd1,0x90020000,0x903f0000
200 SETENV command successful
ftp> put openwrt-ar7-jffs2-64k.bin "openwrt-ar7-jffs2-64k.bin mtd1"
200 Port command successful.
120 service ready in 32 seconds.
150 Opening BINARY mode data connection for file transfer.
ftp: 3801092 bytes sent in 82.82Seconds 45.90Kbytes/sec.
ftp> quote REBOOT
221-Thank you for using the FTP service on ADAM2.
221 Goodbye.
Connection closed by remote host.
ftp> quit

Note: on my device, and others, the upload (PUT command) may fail. If you are watching the serial console at the time, just watch out for the dots not appearing for a few seconds. if you are only using the FTP, then you have to wait more than 4min to assume it failed. Starting over by rebooting the modem seems to do the trick. Mine worked out on the 3rd time only.

3.3V serial is available on J5 with the following pin out: Pin 1 is the closest to J5 in the top left corner.

pin 1 : GND
pin 2 : TX
pin 3 : RX
pin 4 : NC
pin 5 : 3.3V
pin 6 : NC

How to connect to JTAG interface, and how to reflash the device with JTAG tools.
See port.jtag for more JTAG details.

JTAG is available connecting to:

RESET : R106
TRST : R112
TDI : R110
TDO : R109
TMS : R108
TCK : R107

Other hardware versions use this pinout:

RESET : ?
TRST : ?
TDI : TP2
TDO : TP3
TMS : TP4
TCK : TP5

Device must be powered on. All unused pins should be pulled up to 3.3V. Device ID is 0x0000100F.

Remove the Phillips screw under the label and then pry open via the front (where the leds are) the two latches. Push the top cover outwards.

For some help with the tags, please have a look here: tags