User Tools

Site Tools


Pirelli DRG A125G

NOTE: The original company producing this device Pirelli Broadband Solutions S.p.A. Pirelli have been bought by ADB Broadband S.p.A. ADB. Because of this, it is hard find any other information about these devices.



Architecture: MIPS
Vendor: Broadcom
bootloader: cfe
Board ID: PirelliGateW2+
System-On-Chip: BCM6348KPBG
CPU/Speed BMIPS3300 V0.7 / 240 MHz
Flash Type (a) MX29LV320AB, id 0x22a8, size 4096KB
Flash Type (b) MX29LV320CBTC-90G , 32Mbit (4M x 8 / 2M x 16)
Flash size: 4 MiB
RAM-chip: Winbond W9812G6GH-6 / SDR-166
RAM size: 16 MiB
Wireless: Broadcom 4318 (onboard)
Ethernet: Broadcom BCM5325 w/ vlan support swconfig
Internet: ADSL2+
USB: possible with mod
Serial: Yes


Opening the case

Note: This will void your warranty!

The only screw that holds it all together is hidden under the label…

Photo of PCB

Top View Bottom View


This is a hardware hack. You need to make a serial cable and attach it to the circuit board, by following the instructions here: port.serial.

As can be seen on the detailed picture (below), the serial connector is located in the upper right-hand side of the router, close to the DSL connector. It is marked CON3 on the PCB. In order to connect the serial you also need to solder in the missing resistors; R106 and R157 as outlined. The value of these are (probably) 1 KΩ @ 1/16 W and of SMD type 0603. However, these are so small and close to the serial solder pads, that it is highly recommended to just put a solder blob to short circuit the resistor pads and then add two standard-sized resistors either directly to the Tx/Rx serial pads or as a part of your cable (note that those resistors are basically just short-circuit and overload protection). In addition, if you do decide to solder on the SMT resistors, make sure you either have a temperature controlled iron or a soldering iron of max 25W or you risk burning off the extremely fine copper-soldering pads, AND use solder flux!

The pins from left-to-right are:

Pin Function
1 Vcc (3.3 V)
2 Tx
3 Rx

It's worth noting that the baud rate for serial communication is 115200 here (and not the usual 9600).


This is a difficult & expert hardware hack. Please read port.jtag first!

If you don't already have a JTAG adaptor (connector/dongle), it is strongly recommended to get one that is both compatible with the free OpenOCD Open On-Chip Debugger software AND is a native “high-speed” (usually USB2) JTAG device, and not only “supported” or “full-speed”, as it may be excruciatingly slow for flashing devices with more than a megabyte of memory, considering flash speeds on the order of ~1 Kbps! Do the math!

A few recommended adapters are:

There is some additional very useful JTAG information and links including a practical example on: "Neuf Box 4 JTAG". (Although, mostly in French.)

The JTAG port is called J201 and is located near the SoC, on the right-hand-side of the router PCB, as shown in the detailed picture (above). It is unclear at this time, whether or not the empty, but outlined resistors (R86, R99, R231, R234 and possibly also R3) need to be soldered. This seem to be a MIPS standard EJTAG 2.5, 14 pin connector. The PCB solder pads as shown in the picture are as follows. Check These!

R3 and R99 not required others can be shorted ( 0 Ohm )

Pin Function Pin
9 TCK GND 10
11 nSRST 12
13 DINT Vref 14

Where pin 12 is often missing or not used, and 13 is often not used, but sometimes used for Debug Introduction (DINT).

CPU Chip ID: 00000110001101011000000101111111 (0635817F)

Note, when you flash from JTAG the BASE ADDRESS is 0x1E000000

Original Firmware Releases

These are non OpenWrt Releases!

NOTE: There is some confusion on “Firmware” versus “Software” versions as the router configuration messages show:

Software Version:	TEO_4.2.5.0008	 
Configuration Version:	TEO_4.2.5.0001
Firmware Version:	4.5.3

Lithuania: (TEO)

  • openrg-4.5.3.TEO_4.2.5.0008-DWR_96348.img (default/original TEO release)
  • openrg-4.5.3.TEO_4.2.5.0013-DWR_96348.rmt (updated, Note: RMT!)
  • openrg-4.5.3.TEO_4.2.5.0014-DWR_96348.rmt
  • openrg-4.5.3.TEO_4.2.5.0015-DWR_96348.rmt

Poland: ???

Serbia: ???

Italy: ???

Romania: ???

Router Login

There are several ways to access your router.

  • Ethernet/LAN/WLAN interface (telnet/http)
  • USB interface (requires to install Ethernet-USB driver on the connecting device)
  • Serial interface (hardware hack)
  • JTAG interface (hardware hack)

LAN Console Access

This is by far the easiest method to get direct access to your router. Just connect your Ethernet to one of the ports and use your favorite terminal program, such as: terminal, ssh or nc. The default router IP is But don't forget that these ports must me available through the router firewall.

# telnet
# ssh
# nc -vv 23

You will then be asked for a Username/Password combination. The factory default is usually Admin/Admin depending on your ISP. After success you'll be greeted by the Pirelli DRG A125G prompt.

DRG A125G>

To see the default configuration of the original compiled code:

DRG A125G> system shell

BusyBox v1.01 (2005.09.07-07:38+0000) Built-in shell (lash)
Enter 'help' for a list of built-in commands.

/ # print_config

...<long list>...

Flash Layout

FIXME I filled in the range, please check correct size!

What Type MaxSize Adress Range
CFE BOOT 64KB 0x00000000-0x00010000
1st Image IMAGE ~3.8MB 0x00010000-0x003D0000
1st Conf CONF ~64KB 0x003D0000-0x003E0000
2nd Conf CONF ~64KB 0x003E0000-0x003F0000
Factory Settings FACTORY 64KB 0x003F0000-0x00400000

* NOTE: This is the Maximal Allocated size.

More detailed information came from the discus command: DRG A125G> flash layout :

Section 00 Type BOOT       Range 0x00000000-0x00010000 MaxSize 0x00010000
        No more information.

Section 01 Type IMAGE      Range 0x00010000-0x003D0000 MaxSize 0x003BFF6C
        Size 0x003A60B0 Name 'IMAGE'
        Checksum 0x1CD6BF45 Counter 0x00000002 Start Offset 0x00000000

Section 02 Type CONF       Range 0x003D0000-0x003E0000 MaxSize 0x0000FF6C
        Size 0x00004B68 Name 'rg_conf'
        Checksum 0x002603D2 Counter 0x000044A3 Start Offset 0x00000000

Section 03 Type CONF       Range 0x003E0000-0x003F0000 MaxSize 0x0000FF6C
        Size 0x00004C3A Name 'rg_conf'
        Checksum 0x0026782E Counter 0x000044A1 Start Offset 0x00000000

Section 04 Type FACTORY    Range 0x003F0000-0x00400000 MaxSize 0x0000FF6C
        Size 0x0000052A Name 'rg_factory'
        Checksum 0x00012222 Counter 0x00000012 Start Offset 0x00000000

Total 5 sections found.

Installing OpenWrt

You will need a serial adapter to flash your Pirelli DRG A125G!

Don't even try to go further without a serial adapter!

The steps involved in getting OpenWrt on your router is as follows, and please follow!

  • Backup your original firmware
  • Install the OpenWrt firmware
  • (Fail!?) Restore your original firmware
  • Configure OpenWrt

Backup of original firmware

Build a RAMDISK openwrt firmware less than 4MB size, and run it from CFE, then just copy whole flash using netcat to your PC. FIXME

Restore original firmware (not tested!)

Load on your computer a small web server with firmware.bin in its root directory.

cd /tmp
wget http://IP/firmware.bin
mtd -r write firmware.bin linux

Installing OpenWrt

Disclaimer: DRG A125G is, to put it mildly, not a good OpenWrt box. It has only 4 MiB of flash, 16 MiB RAM and a single-core 240 MHz CPU. IMO you should forget about LAMP server or any “advanced” network services - you're essentially limited to LAN/WLAN/WAN routing here. Stock OEM firmware is good enough for that IMO (and it's also heavily optimized for the actual device AFAIR), so you're basically wasting your time if you're expecting any performance gain. Frankly, even 100Mbit routing may be a problem for this box when on OpenWrt (or at least it was in my case, YMMV). It's also hardware-limited to two USB 1.1 - one host/device and one device, and seemingly the actual physical connector present is attached to a device-only port (I've found no USB voltage on Vcc), meaning you actually won't be able to use it as a NAS, print server or anything similar effectively, without heavy hardware modding.

That being said…

You need to setup a TFTP server on some host to serve the firmware image to the router. Connect to the device using serial, press any key during the early boot to hit CFE prompt. Using the prompt, you should change the static Board IP of the router used for flashing (set it to match the subnet of your TFTP server) and the Host IP (IP of the TFTP server itself), both using command c. Also, if you don't want to recompile the kernel with a custom device Id support added, you should change the board Id to one of the generic ones (e.g. 96348GW-11) using command b.

Stock firmware images itself (you can use e.g. 96348R, 96348GW, 96348GW-10, 96348GW-11) will need a little tailoring for DRG A125G (I suggest using XVI32 & to do the heavy lifting). First, you'll have to change the tagId to string '8' (ASCII 0x38), and sig_2 string (2nd line of OEM identifier) to 'IMAGE', followed by zeroes. Also, you'll need to recalculate the kernel CRC (e.g. using analyzetag with ag306 parser) or any other similar tool, and replace the kernel CRC present in the image with the correct one. After that, recalc the CRC of the tagId, and update it accordingly. Note that the values are stored little-endian, so you'll need to reverse the byte order when inserting them.

Now you have to use the flashimage command to load the image, (DON'T USE THE f COMMAND UNLESS YOU REALLY KNOW WHAT YOU'RE DOING!). Note that if you configured hostip earlier, you can avoid it in the flashimage argument.

CFE> flashimage [hostip:]compressed_image_file_name

The device will automaticly reboot and, assuming everything went well, OpenWrt will boot.

Note 1: don't use the dev (snapshot) branch - use a stable one instead; dev branch caused weird kernel panics in my case, YMMV.

Note 2: since the generic images doesn't have the proper GPIO config (and may be missing a few things), you'd probably use the ImageBuilder if you really want to push your DRG A125G to the max.

Network configuration

I can suggest you to use Alice gate with the following network configuration using serial console:

For more info read switch config. FIXME To be reviewed

config interface loopback                                                       
        option ifname   lo                                                      
        option proto    static                                                  
        option ipaddr                                               
        option netmask                                               
config 'switch' 'eth1'                                                          
   option 'enable'      '1'                                                     
   option 'enable_vlan' '1'                                                     
   option 'reset'       '1'                                                     
config 'switch_vlan' 'vlan0'                                                    
   option 'vlan'       '0'                                                      
   option 'device'     'eth1'                                                   
   option 'ports'      '0 1 2 5*'                                               
config 'switch_vlan' 'vlan1'                                                    
   option 'vlan'       '1'                                                      
   option 'device'     'eth1'                                                   
   option 'ports'      '3 5t'                                                   
config interface lan                                                            
        option ifname   eth1.0 
        option type     bridge                                                 
        option proto    static                                                  
        option ipaddr                                             
        option netmask                                           
        option nat      1                                                       
config 'interface' wan 
    option 'ifname'  'eth1.1'                                                   
    option 'proto'   'dhcp'

Leds config

Inside /etc/config/system add:

config 'led'
	option 'sysfs'		'power:red'
	option 'trigger'	'heartbeat'

config 'led'
	option name		lan
	option 'sysfs'		'usr1:red'
	option trigger netdev
	option 'dev'	'eth1.0'
	option mode 'rx tx'

config 'led'
	option name		wan
	option 'sysfs'		'usr2:red'
	option trigger netdev
	option 'dev'	'eth1.1'
	option mode 'rx tx'

As a WAN router with original OpenRG firmware

A little known capability of A125G is the possibility of using it as a regular WANLAN router (with common NAT, DHCP, route tables etc) even with the original firmware. To do so:

  • configure one of the ETH ports on the “LAN Hardware Ethernet Switch” page in “Network Configuration” into VLAN port (e.g. PVID/VLAN 1, possibly isolated too)
  • create a new connection of type VLAN and bind it to the same VLAN number as used above
  • set the VLAN to network type WAN and to use DHCP to acquire IP & DNS
  • make sure than VLAN routing is set to NAPT and that it is the default route
  • remove the “LAN Hardware Ethernet Switch” from “LAN Bridge” device (because we can't have the packets from WAN to be directly switched into LAN)

Now you have a working WANWLAN/USB routing; to add a regular ethernet WANLAN routing, you just have to create another VLANs for your LAN needs and then add these other VLANs to the “LAN Bridge” device.

Note: Although not a strictly OpenWrt-related info, I'm supplying this here since it's extremely hard to get any tech support on A125G, and I've spend countless days to make this one working.



toh/pirelli/a125g.txt · Last modified: 2018/06/02 09:47 by tmomas