- D-Link DSL-G604T
- Device Hardware Features
- Firmware ADAM2
- DSL-G604T hacking
- Creating a custom firmware
- Serial Console
- AR7 Devices
- Network address translation (NAT)
- Integrated 802.11g wireless access point
- 54Mbps data rate with auto fallback
- Detachable 2 dBi reverse SMA antenna
- WEP and WPA support
- Disable SSID
- Mac address filtering
- Support for wireless repeating (requires DWL-2100AP)
- Integrated ADSL modem - 1 x RJ11 connection
- 4 x 10/100Base-T auto MDi-MDIX RJ45 switched LAN ports
- NAT based firewallwith denial of service detection (DoS)
- Integrated DHCP server
- Virtual private network (VPN) pass-through
- UPnP enabled
- DMZ host and virtual server mapping (port forwarding)
Web-based & remote configuration
Linuxdevices.com Device review
Device Hardware Features
- Texas Instrument TNETD7300 AR7W MIPS 4KEc embedded microprocessor
- 16mb RAM module Hynix HY57V281620HCT
4mb Flash-based SquashFS file system. Atmel AT49BV322A
- TI C620x DSP-based ADSL
VLINQ WiFi card
IC Plus IP175A 5 port Fast Ethernet switch (4 external, 1 internal)
D-Link DSL-G604T firmware is based on MontaVista Linux 2.4.17.
Linux version 2.4.17_mvl21-malta-mips_fp_le (jordan@Jordan_Linux) Compiled by gcc version 2.95.3 20010315 (release/MontaVista) 18 14:13:34 CST 2004
# cat cpuinfo processor : 0 cpu model : MIPS 4KEc V4.8 BogoMIPS : 149.91 wait instruction : no microsecond timers : yes extra interrupt vector : yes hardware watchpoint : yes VCED exceptions : not available VCEI exceptions : not available
# cat meminfo total: used: free: shared: buffers: cached: Mem: 14974976 13090816 1884160 0 1540096 4857856 Swap: 0 0 0 MemTotal: 14624 kB MemFree: 1840 kB MemShared: 0 kB Buffers: 1504 kB Cached: 4744 kB SwapCached: 0 kB Active: 3260 kB Inactive: 4636 kB HighTotal: 0 kB HighFree: 0 kB LowTotal: 14624 kB LowFree: 1840 kB SwapTotal: 0 kB SwapFree: 0 kB
# cat mounts /dev/mtdblock/0 / squashfs ro 0 0 none /dev devfs rw 0 0 proc /proc proc rw 0 0 ramfs /var ramfs rw 0 0
#df Filesystem 1k-blocks Used Available Use% Mounted on /dev/mtdblock/0 1984 1984 0 100% /
D-Link DSL-G604T comes with ADAM2 firmware.
Read this article:
Creating a custom firmware
D-Link DSL-G604T firmware is based on the MontaVista Linux 2.4.17.
It consists of:
- 2.4.17 Linux Kernel
... MontaVista patches
- Texas Instrument AR7 specific code:
- Processor initialization,
- IRQ controller
- Texas Instrument device drivers: (GPL-ed sourcecode)
- tiatm DSL driver(source code in patch-knl file from Netgear DG834B V1.05 sources)
ACX111/VLYNQ WiFi driver (source code in Linksys WAG54Gv2-AU sources)
- GPIO LED
- ADAM2 interface
- Management software cm_* (no sourcecode available)
- Some auxiliary TI tools: tichksum (GPL-ed)
WiFi configuration utility (no sourcecode ?)
- bridge control utility (GPL)
BusyBox 0.61pre + patches (GPL)
uClibc 0.9.19 + patches (GPL)
thttpd 2.23beta1 + pathes (BSD)
- pppd 2.4.1 (GPL)
- iptables 1.2.6a (GPL)
Custom Firmware Distribution
There is success of AR7 port. SVN Kamikaze is work with 2.6.x kernel, Ethernet works, DSL works too, Wi-Fi is WIP. For more information see http://wiki.openwrt.org/OpenWrtDocs/Hardware/D-Link/DSL-G604T
Constructing the filesystem image
The filesystem image (mtd0) is a SquashFS compressed image containing all the binaries, www-interface, some Kernel modules etc. It has a maximum size of a 3392 (0x350000) kilobytes. Here's a layout of the most recent UK firmware's filesystem.
After modifying the filesystem layout you need to compress it back to squashfs image. The default kernel supports only version 1.x images. Using version 1.3r3 seems to work.
$ mksquashfs imgdir fs-new.img -noappend Creating little endian filesystem on fs-new.img, block size 32768. ...
After that you need to append a custom checksum to the image (at least while using the web interface for updating). This can be done with the supplied tool, TI-chksum-0.1. It's available in the D-Link's GPL tar ball.
$ tichksum NDLinkUK_DSL-G604T_fs_V1.00B02T02.UK.20041126 File already contains the checksum, verifying Calculated checksum is CFE70B86 Saved checksum is CFE70B86 Checksum validation successful! $ tichksum fs-new.img File doesn't contain the checksum, adding Calculated checksum is 41ABB510 Added successfully
After that the filesystem image can be updated with the usual methods.
Constructing the kernel image
The Linux Kernel image is an "ADAM2 application" as required for ADAM2's "go" command. The file format is described above.
It contains a LZMA or zlib compressed linux 2.4.17 Montavista kernel an self-decompressor piggyback. The GPL source code seems to have a big patch against the default 2.4.17-montavista. Looks like it even has the needed configuration files. With default zlib compression the kernel image quite often can't fit to the 576 kilobytes, so it's necessary either to move more stuff to modules or disable some unnecessary stuff.
The "Vanilla" Linux Kernel does not provide compressed Kernel image for non-i386 architectures. See: Linux Kernel 2.4 Internals but our processor is MIPS.
The patched montavista-2.4.17 kernel tree has a make ram_zimage and make ram_zimage_pad targets. This targets generates kernel images in a SREC format (vmlinux.srec). The linux-2.4.17_mvl21/arch/mips/mips-boards/ti_avalanche/inflater/srec2bin.c utility is a tool to make an "ADAM2 application" from this MIPS SREC.
Note that adding the TI checksum adds another 8 bytes to it...
The D-Link "GPL-ed source" provides a zlib decompressor only. Take a "GPL source" from the NetgearDG834G support page. This device is based on the same TI AR7 chip and has LZMA decompressor and build scripts.
Also note that Montavista has released a toolkit which includes 2.4.20 kernel, and 2.6.x might be available soon too.
Igor Mokrushin aka McMCC has published a detailed intsruction how to make a new firmware for this device (Big Thx!)
http://mcmcc.bat.ru/dlinkt/kernel/build_kernel_rus.txt (Build HOWTO in Russian)
http://mcmcc.bat.ru/dlinkt/FW_dsl-xxxt_README.eng.txt (Modified firmware revisions)
Pre-compiled firmware: http://mcmcc.bat.ru/dlinkt/
TI AR7 SoC has two serial UARTs (16550 compatible).
D-Link DSL-G604T has a 5-pin connector, attached to UART_A .
ATTENTION! Do not connect a RS-232 cable directly to the DSL-G604T console port! It uses LVTTL 3.3 volt level RS-232 and it will cause serious damage of the device. You need a LVTTL <--> RS-232 +-12V converter.
Unfortunately, this aspect of the TI AR7 isn't well documented.
UPD: Some of addresses are documented in the AR7-specific *.h files from the GPL-ed Linux distributive for this device.
Another source is a TI OMAP documentation. It seems, AR7 SoC peripherals is very similar to the OMAP16xx and OMAP730 application processors , but MIPS instead ARM9-based.
# cat /proc/tty/driver/serial serinfo:1.0 driver:5.05c revision:2001-07-08 0: uart:16550A port:A8610E00 irq:15 baud:2258 tx:4514 rx:0 RTS|DTR 1: uart:16550A port:A8610F00 irq:16 tx:0 rx:0 RTS|DTR
TI TMS320C62x is a fixed-poind Digital Signal Processor core. C62x is based on the VelociTI VLIW architecture developad by TI. C62x is a member of the TI C6000 family.
The TNETW1130 has several interfaces including VLYNQ, TI´s low power, low pin-count, high-speed serial interface. Through these interfaces, the TNETW1130 easily connects to TI´s OMAP1610, OMAP1611 and OMAP730 application processors and AR7 TNETD7300 communication processor.
VLYNQ is a serial communication interface that enables the extension of an internal bus segment to one or more external physical devices. The external devices are mapped into local, physical address space and appears as if they are on the internal bus. the external device must have a VLYNQ interface. The VLYNQ module serializes bus transactions in one device, transfers the serialized data via a VLYNQ port, and de-serializes the transaction in the external device. The VLYNQ interface is described in the TI SPRU768 document.
# cat /proc/tiwlan/gen_reg Usage : echo <reg base addr> <offset> <r/w> [<value>] > gen_reg VLYNQ base : 0xa8611800. Remote offset : 0x80 1130 mem base : 0xa4000000, reg base : 0xa4040000
TNETW1130 has integrated ARM CPU, and has support for the WPA (SSN), TKIP and AES (CCM) encryption (802.11i), and QoS (802.11e).
# cat /proc/iomem ... ... a8612800-a8612fff : eth0 #
http://www.seattlewireless.net/DlinkDslG604tConfiguration True router configuration!!!
DSL-302T demystified hacking (Italian language)
ActiontecGT701 is based on the same TI AR7 chip...
LinksysWAG54Gv2 is based on the same TI AR7 chip...
NetgearDG834G is based on the same TI AR7 chip...
- Zyxel Prestige 660HW is also based on TNETD 7300 (TI AR7) and TNETW 1130...
AVM Fritz!Box is based on the same TI AR7 chip (German language)
http://www.akk.org/~enrik/fbox/ A lot of tools for Fritz!Box hacking. Read "NEWS" file!
Texas Instrument AR7 ADSL Router
OpenWRT AR7 Port project
Siemens SX541 uses realtime OS (SOHO.BIN) and BRN Boot Loader from the Broad Net Technology, Inc.