NOTE: The original company producing this device Pirelli Broadband Solutions S.p.A. Pirelli have been bought by ADB Broadband S.p.A. ADB. Because of this, it is hard find any other information about these devices.
|CPU/Speed||BMIPS3300 V0.7 / 240 MHz|
|Flash Type (a)||MX29LV320AB, id 0x22a8, size 4096KB|
|Flash Type (b)||MX29LV320CBTC-90G , 32Mbit (4M x 8 / 2M x 16)|
|Flash size:||4 MiB|
|RAM-chip:||Winbond W9812G6GH-6 / SDR-166|
|RAM size:||16 MiB|
|Wireless:||Broadcom 4318 (onboard)|
|Ethernet:||Broadcom BCM5325 w/ vlan support swconfig|
|USB:||possible with mod|
Note: This will void your warranty!
Photo of PCB
This is a hardware hack. You need to make a serial cable and attach it to the circuit board, by following the instructions here: port.serial.
As can be seen on the detailed picture (below), the serial connector is located in the upper right-hand side of the router, close to the DSL connector. It is marked CON3 on the PCB. In order to connect the serial you also need to solder in the missing resistors; R106 and R157 as outlined. The value of these are (probably) 1 KΩ @ 1/16 W and of SMD type 0603. However, these are so small and close to the serial solder pads, that it is highly recommended to just put a solder blob to short circuit the resistor pads and then add two standard-sized resistors either directly to the Tx/Rx serial pads or as a part of your cable (note that those resistors are basically just short-circuit and overload protection). In addition, if you do decide to solder on the SMT resistors, make sure you either have a temperature controlled iron or a soldering iron of max 25W or you risk burning off the extremely fine copper-soldering pads, AND use solder flux!
The pins from left-to-right are:
|1||Vcc (3.3 V)|
It's worth noting that the baud rate for serial communication is 115200 here (and not the usual 9600).
This is a difficult & expert hardware hack. Please read port.jtag first!
If you don't already have a JTAG adaptor (connector/dongle), it is strongly recommended to get one that is both compatible with the free OpenOCD Open On-Chip Debugger software AND is a native “high-speed” (usually USB2) JTAG device, and not only “supported” or “full-speed”, as it may be excruciatingly slow for flashing devices with more than a megabyte of memory, considering flash speeds on the order of ~1 Kbps! Do the math!
A few recommended adapters are:
There is some additional very useful JTAG information and links including a practical example on: "Neuf Box 4 JTAG". (Although, mostly in French.)
The JTAG port is called J201 and is located near the SoC, on the right-hand-side of the router PCB, as shown in the detailed picture (above). It is unclear at this time, whether or not the empty, but outlined resistors (R86,
R99, R231, R234 and possibly also R3) need to be soldered. This seem to be a MIPS standard EJTAG 2.5, 14 pin connector. The PCB solder pads as shown in the picture are as follows. Check These!
R3 and R99 not required others can be shorted ( 0 Ohm )
Where pin 12 is often missing or not used, and 13 is often not used, but sometimes used for Debug Introduction (DINT).
CPU Chip ID: 00000110001101011000000101111111 (0635817F)
Note, when you flash from JTAG the BASE ADDRESS is
These are non OpenWrt Releases!
NOTE: There is some confusion on “Firmware” versus “Software” versions as the router configuration messages show:
Software Version: TEO_4.2.5.0008 Configuration Version: TEO_4.2.5.0001 Firmware Version: 4.5.3
There are several ways to access your router.
This is by far the easiest method to get direct access to your router. Just connect your Ethernet to one of the ports and use your favorite terminal program, such as: terminal, ssh or nc. The default router IP is 192.168.1.254. But don't forget that these ports must me available through the router firewall.
# telnet 192.168.1.254 # ssh 192.168.1.254:23 # nc -vv 192.168.1.254 23
You will then be asked for a Username/Password combination. The factory default is usually Admin/Admin depending on your ISP. After success you'll be greeted by the Pirelli DRG A125G prompt.
To see the default configuration of the original compiled code:
DRG A125G> system shell BusyBox v1.01 (2005.09.07-07:38+0000) Built-in shell (lash) Enter 'help' for a list of built-in commands. / # print_config ...<long list>...
I filled in the range, please check correct size!
* NOTE: This is the Maximal Allocated size.
More detailed information came from the discus command: DRG A125G> flash layout :
Section 00 Type BOOT Range 0x00000000-0x00010000 MaxSize 0x00010000 No more information. Section 01 Type IMAGE Range 0x00010000-0x003D0000 MaxSize 0x003BFF6C Size 0x003A60B0 Name 'IMAGE' Checksum 0x1CD6BF45 Counter 0x00000002 Start Offset 0x00000000 Section 02 Type CONF Range 0x003D0000-0x003E0000 MaxSize 0x0000FF6C Size 0x00004B68 Name 'rg_conf' Checksum 0x002603D2 Counter 0x000044A3 Start Offset 0x00000000 Section 03 Type CONF Range 0x003E0000-0x003F0000 MaxSize 0x0000FF6C Size 0x00004C3A Name 'rg_conf' Checksum 0x0026782E Counter 0x000044A1 Start Offset 0x00000000 Section 04 Type FACTORY Range 0x003F0000-0x00400000 MaxSize 0x0000FF6C Size 0x0000052A Name 'rg_factory' Checksum 0x00012222 Counter 0x00000012 Start Offset 0x00000000 Total 5 sections found.
You will need a serial adapter to flash your Pirelli DRG A125G!
Don't even try to go further without a serial adapter!
The steps involved in getting OpenWrt on your router is as follows, and please follow!
Build a RAMDISK openwrt firmware less than 4MB size, and run it from CFE, then just copy whole flash using netcat to your PC.
Load on your computer a small web server with firmware.bin in its root directory.
cd /tmp wget http://IP/firmware.bin mtd -r write firmware.bin linux
Disclaimer: DRG A125G is, to put it mildly, not a good OpenWrt box. It has only 4 MiB of flash, 16 MiB RAM and a single-core 240 MHz CPU. IMO you should forget about LAMP server or any “advanced” network services - you're essentially limited to LAN/WLAN/WAN routing here. Stock OEM firmware is good enough for that IMO (and it's also heavily optimized for the actual device AFAIR), so you're basically wasting your time if you're expecting any performance gain. Frankly, even 100Mbit routing may be a problem for this box when on OpenWrt (or at least it was in my case, YMMV). It's also hardware-limited to two USB 1.1 - one host/device and one device, and seemingly the actual physical connector present is attached to a device-only port (I've found no USB voltage on Vcc), meaning you actually won't be able to use it as a NAS, print server or anything similar effectively, without heavy hardware modding.
That being said…
You need to setup a TFTP server on some host to serve the firmware image to the router. Connect to the device using serial, press any key during the early boot to hit CFE prompt. Using the prompt, you should change the static Board IP of the router used for flashing (set it to match the subnet of your TFTP server) and the Host IP (IP of the TFTP server itself), both using command c. Also, if you don't want to recompile the kernel with a custom device Id support added, you should change the board Id to one of the generic ones (e.g. 96348GW-11) using command b.
Stock firmware images itself (you can use e.g. 96348R, 96348GW, 96348GW-10, 96348GW-11) will need a little tailoring for DRG A125G (I suggest using XVI32 & https://dev.openwrt.org/attachment/ticket/5337/analyzetag.2.c to do the heavy lifting). First, you'll have to change the tagId to string '8' (ASCII 0x38), and sig_2 string (2nd line of OEM identifier) to 'IMAGE', followed by zeroes. Also, you'll need to recalculate the kernel CRC (e.g. using analyzetag with ag306 parser) or any other similar tool, and replace the kernel CRC present in the image with the correct one. After that, recalc the CRC of the tagId, and update it accordingly. Note that the values are stored little-endian, so you'll need to reverse the byte order when inserting them.
Now you have to use the flashimage command to load the image, (DON'T USE THE f COMMAND UNLESS YOU REALLY KNOW WHAT YOU'RE DOING!). Note that if you configured hostip earlier, you can avoid it in the flashimage argument.
CFE> flashimage [hostip:]compressed_image_file_name
The device will automaticly reboot and, assuming everything went well, OpenWrt will boot.
Note 1: don't use the dev (snapshot) branch - use a stable one instead; dev branch caused weird kernel panics in my case, YMMV.
Note 2: since the generic images doesn't have the proper GPIO config (and may be missing a few things), you'd probably use the ImageBuilder if you really want to push your DRG A125G to the max.
I can suggest you to use Alice gate with the following network configuration using serial console:
For more info read switch config. To be reviewed
config interface loopback option ifname lo option proto static option ipaddr 127.0.0.1 option netmask 255.0.0.0 config 'switch' 'eth1' option 'enable' '1' option 'enable_vlan' '1' option 'reset' '1' config 'switch_vlan' 'vlan0' option 'vlan' '0' option 'device' 'eth1' option 'ports' '0 1 2 5*' config 'switch_vlan' 'vlan1' option 'vlan' '1' option 'device' 'eth1' option 'ports' '3 5t' config interface lan option ifname eth1.0 option type bridge option proto static option ipaddr 192.168.5.1 option netmask 255.255.255.0 option nat 1 config 'interface' wan option 'ifname' 'eth1.1' option 'proto' 'dhcp'
Inside /etc/config/system add:
config 'led' option 'sysfs' 'power:red' option 'trigger' 'heartbeat' config 'led' option name lan option 'sysfs' 'usr1:red' option trigger netdev option 'dev' 'eth1.0' option mode 'rx tx' config 'led' option name wan option 'sysfs' 'usr2:red' option trigger netdev option 'dev' 'eth1.1' option mode 'rx tx'
A little known capability of A125G is the possibility of using it as a regular WAN→LAN router (with common NAT, DHCP, route tables etc) even with the original firmware. To do so:
Now you have a working WAN→WLAN/USB routing; to add a regular ethernet WAN→LAN routing, you just have to create another VLANs for your LAN needs and then add these other VLANs to the “LAN Bridge” device.
Note: Although not a strictly OpenWrt-related info, I'm supplying this here since it's extremely hard to get any tech support on A125G, and I've spend countless days to make this one working.