Hello.

I have Aztech DSL-600EW Adsl modem. It contains:

Texas Instrument AR7WRD TNETD7300AGDW
16MB SDRAM module ISSI IS42S16800A-7T
4MB Flash module Spansion S29GL032M90 TAIR4
Mini-PCI WLAN module TNETW1130GVF
Marvell M88E6060-RCJ 5 port Fast Ethernet switch
USB port

Does anyone know if OpenWRT for any other AR7
(Actiontec GT701, Dlink DSL-G604T or Netgear DG834G)
devices work in Aztech? If it does not work what changes
are needed to make it work?

The source code of the firmware is not made public by aztech.

you can edit the root file system if you follow the instructions on

http://www.beyondlogic.org/nb5/

the NB5plus4W = aztech dsl600EW.

I did it myself and it does work, but what you do is limited by the lack of free memory (RAM), which is not much.
I copied a few tools from the netgear DG834G firmware to the aztech firmware. They work, but the most important one nvram cannot find the nvram block MTD3, which contains the raw config.xml. I hoped I could edit the nvram like on the Linksys wrt54g, but no go.

In the next few weeks I will try to set up a proper cvs for openwrt to test it. But because there is no access to the nvram there is no proper way to config this aztech beast with openwrt.

Some  person on whirlpool claims he has the source code of the firmware for the NB5plus4W. I emailed this person, but did not get a reply yet.
I emailed aztech many months ago for the source code, but never got a reply.

There are many builds of the firmware on the aztech ftp site. I tried a few and I am running a 66.2.3-001 firmware now.

Netcomm has released source code for NB5plus4W:

http://forums.whirlpool.net.au/forum-re … m?t=387115

Hi,

I got myself a USB to serial cable with a CR2101 chip from silaps ( www.silaps.com) and connected it to the console header.

I flashed openwrt to my aztech dsl600ew and got the following result.

ADAM2 Revision 0.22.02
(C) Copyright 1996-2003 Texas Instruments Inc. All Rights Reserved.
(C) Copyright 2003 Telogy Networks, Inc.
Usage: setmfreq [-d] [-s sys_freq, in MHz] [cpu_freq, in MHz]
Memory optimization Complete!

Adam2_AR7WRD >
Press any key to abort OS load, or wait 5 seconds for OS to boot...
Launching kernel decompressor.
Kernel decompressor was successful ... launching kernel.

LINUX started...
CPU revision is: 00018448
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 4-way, linesize 16 bytes.
Linux version 2.4.30 (nbd@ux-2y01) (gcc version 3.4.4) #1 Tue Oct 18 01:53:07 CEST 2005
Determined physical RAM map:
memory: 14000000 @ 00000000 (reserved)
memory: 00020000 @ 14000000 (ROM data)
memory: 00fe0000 @ 14020000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,38400
the pacing pre-scalar has been set as 600.
calculating r4koff... 000b71b0(750000)
CPU frequency 150.00 MHz
Calibrating delay loop... 149.91 BogoMIPS
Memory: 14304k/0k available (1336k kernel code, 0k reserved, 92k data, 68k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  available.
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
Squashfs 2.2 (released 2005/07/03) (C) 2002-2004, 2005 Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0xa8610e00 (irq = 15) is a 16550A
ttyS01 at 0xa8610f00 (irq = 16) is a 16550A
Vlynq CONFIG_AR7_VLYNQ_PORTS=2
Vlynq Device vlynq0 registered with minor no 63 as misc device. Result=0
Vlynq instance:0 Link UP
Vlynq Device vlynq1 registered with minor no 62 as misc device. Result=0
VLYNQ 1 : init failed
Software Watchdog Timer: 0.05, timer margin: 60 sec
ar7 flash device: 0x400000 at 0x10000000.
Amd/Fujitsu Extended Query Table v1.3 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Parsing ADAM2 partition map...
Looking for mtd device :mtd0:
Found a mtd0 image (0xd0000), with size (0x320000).
Assuming default rootfs offset of 0xd0000
Looking for mtd device :mtd1:
Found a mtd1 image (0x10000), with size (0xc0000).
Looking for mtd device :mtd2:
Found a mtd2 image (0x0), with size (0x10000).
Assuming adam2 size of 0x10000
Looking for mtd device :mtd3:
Found a mtd3 image (0x3f0000), with size (0x10000).
Looking for mtd device :mtd4:
Found a mtd4 image (0x10000), with size (0x3e0000).
Setting new rootfs offset to 00084c25
Unknown filesystem. Moving rootfs partition to next erase block<5>Creating 4 MTD partitions on "Physically mapped flash":
0x00000000-0x00010000 : "adam2"
0x00010000-0x003f0000 : "linux"
0x00090000-0x003f0000 : "rootfs"
0x003f0000-0x00400000 : "config"
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
ip_conntrack version 2.1 (5953 buckets, 5953 max) - 320 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (jffs2 filesystem) readonly.
mount_devfs_fs(): unable to mount devfs, err: -2
Freeing unused kernel memory: 68k freed
Warning: unable to open an initial console.
Kernel panic: No init found.  Try passing init= option to kernel.

Any suggestions what to do ?

-----------------------------------
Other matters : the source code for the NB5plus4W seems complete including source for cm_cli and webinterface. All TI stuff is bin, but that was to be expected. No toolchain. I have to set it up to get try to compile a firmware.

I recently got a Aztech DSL-600EW and I'm very interested in getting openwrt running on it.
Has anyone made any progress with it?

For those who are interested......

ADAM2 Revision 0.22.02
(C) Copyright 1996-2003 Texas Instruments Inc. All Rights Reserved.
(C) Copyright 2003 Telogy Networks, Inc.
Usage: setmfreq [-d] [-s sys_freq, in MHz] [cpu_freq, in MHz]
Memory optimization Complete!

Adam2_AR7WRD >
Press any key to abort OS load, or wait 5 seconds for OS to boot...
Launching kernel decompressor.
Kernel decompressor was successful ... launching kernel.

LINUX started...
CPU revision is: 00018448
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 4-way, linesize 16 bytes.
Linux version 2.4.32 (nbd@ux-2y01) (gcc version 3.4.4) #1 Sat Nov 19 04:43:08 CET 2005
Determined physical RAM map:
memory: 00020000 @ 14000000 (ROM data)
memory: 00fe0000 @ 14020000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,38400
the pacing pre-scalar has been set as 600.
Using 75.000 MHz high precision timer.
Calibrating delay loop... 149.91 BogoMIPS
Memory: 14308k/16384k available (1335k kernel code, 2076k reserved, 92k data, 72k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  available.
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
Squashfs 2.2 (released 2005/07/03) (C) 2002-2004, 2005 Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0xa8610e00 (irq = 15) is a 16550A
ttyS01 at 0xa8610f00 (irq = 16) is a 16550A
Vlynq CONFIG_AR7_VLYNQ_PORTS=2
Vlynq Device vlynq0 registered with minor no 63 as misc device. Result=0
Vlynq instance:0 Link UP
Vlynq Device vlynq1 registered with minor no 62 as misc device. Result=0
VLYNQ 1 : init failed
ar7_wdt: last system reset initiated by SW0 software reset
ar7_wdt: timer margin 59 seconds (prescale 65535, change 57180, freq 62500000)
ar7 flash device: 0x400000 at 0x10000000.
Amd/Fujitsu Extended Query Table v1.3 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Parsing ADAM2 partition map...
Looking for mtd device :mtd0:
Found a mtd0 image (0xd0000), with size (0x320000).
Assuming default rootfs offset of 0xd0000
Looking for mtd device :mtd1:
Found a mtd1 image (0x10000), with size (0xc0000).
Looking for mtd device :mtd2:
Found a mtd2 image (0x0), with size (0x10000).
Assuming adam2 size of 0x10000
Looking for mtd device :mtd3:
Found a mtd3 image (0x3f0000), with size (0x10000).
Looking for mtd device :mtd4:
Found a mtd4 image (0x10000), with size (0x3e0000).
Setting new rootfs offset to 00084ba7
Squashfs detected (size = 0x000fa2d4)
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00010000 : "adam2"
0x00010000-0x003f0000 : "linux"
0x00084ba7-0x00180000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "config"
0x00180000-0x003f0000 : "OpenWrt"
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
ip_conntrack version 2.1 (5953 buckets, 5953 max) - 352 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Preserving ADAM2 memory.
Freeing unused kernel memory: 72k freed
Algorithmics/MIPS FPU Emulator v1.5
insmod: diag.o: no module by that name found
Unlocking OpenWrt ...
umount: /rom/dev: Device or resource busy
init started:  BusyBox v1.01 (2005.11.19-17:52+0000) multi-call binary

Please press Enter to activate this console. jffs2.bbc: SIZE compression mode activated.
Using the MAC with external PHY
Cpmac driver is allocating buffer memory at init time.
Using the MAC with external PHY
Cpmac driver Disable TX complete interrupt setting threshold to 20.
registered device TI Avalanche SAR
Initializing DSL interface
size=10120
size=38720
size=46432
size=45312
dsl modulation = MMODE
Texas Instruments ATM driver: version:[4.02.04.00]
device eth0 entered promiscuous mode
br0: port 1(eth0) entering learning state
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating

BusyBox v1.01 (2005.11.19-17:52+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 
         bleeding edge, r2536
root@OpenWrt:/# uname -a
Linux OpenWrt 2.4.32 #1 Sat Nov 19 04:43:08 CET 2005 mips unknown
root@OpenWrt:/# DSL in Sync

root@OpenWrt:/# ifconfig
br0       Link encap:Ethernet  HWaddr 00:30:0A:28:19:EB 
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:240 errors:0 dropped:0 overruns:0 frame:0
          TX packets:115 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:13186 (12.8 KiB)  TX bytes:11026 (10.7 KiB)

eth0      Link encap:Ethernet  HWaddr 00:30:0A:28:19:EB 
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:242 errors:0 dropped:0 overruns:0 frame:0
          TX packets:100 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:16674 (16.2 KiB)  TX bytes:9676 (9.4 KiB)
          Base address:0x2800

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

root@OpenWrt:/# free
              total         used         free       shared      buffers
  Mem:        14380         7236         7144            0          864
Swap:            0            0            0
Total:        14380         7236         7144
root@OpenWrt:/# lsmod
Module                  Size  Used by    Tainted: P 
tiatm                 114660   0 (unused)
atm                    36176   0 [tiatm]
avalanche_cpmac        67928   1
root@OpenWrt:/#

If you got nothing better to do, you can do this...

flashing the dlink dsl604T firmware to aztech dsl-600EW

The leds work but do not correspond with their actions. DSL led offline, but flashes when receiving data. Status led is red.

The firmware of the WAG54gv2 gives a wrong endian error at boot. To bad.

The firmware the solwise dsl600ew seems newer than the aztech firmware. (http://www.solwise.co.uk/adsl-sar600ew.htm)

Found it....the password for the cli on the Aztech 66 series firmware is Admin ( with capital A)

so after logging in with ssh or telnet

cli > enable 5
password Admin

I flashed the zyxel 660HW, 3com 3CRWDR100A-72 and the Netgear D834G to the aztech...all give the same error at boot WRONG ENDIAN.

Well it is possible...I have the firmware of the Netgear D384G running on my Aztech DSL600EW.

I used Hex Workshop to get the kernel and the filesystem from the GD834_V2.10.22.img. I then flashed the kernel to mtd1 and the filesystem to mtd0. And then Go in adam.

Because I did not have the password to the netgear webinterface which is at 192.168.0.1 I wanted to do quick reflash with the aztech firmware and then adam said SHIT.
ALL mtd settings were gone. So no more mtd0,1,2,3,4. Adam ip had changed from 192.168.1.1 to 169.254.87.1. And the mac adresses had changed too. Adam still working. Luckely the aztech firmware contains extra files for setting the mtd environment. I added them manually with adam and got the aztech firmware flashed again and working. Lots of errors but ok.

Got the password of the netgear website (which is password btw) and then flashed again the Netgear firmware to the Aztech. Lot's of errors regarding mtd4, which is not set by me for now.
First boot is dog slow including the webinterface. But after setting the adsl settings, everything seems to be ok and running smooth.

Later I will extract the Linksys wag54g kernel and filesystem and try that too.

Can somebody post the layout of a 4mb wag54g MTD. Just in case mtd2 means something else then adam on the wag54g.

This is not for the fainted. So if you want to try is , know what you are doing and expect the worsed.

ps . this is posted while running on the d834g firmware.

Yes, the wag54g version 2 firmware runs also on the aztech DSL600EW.

The trick seems to be to cut and paste from the original firmware the kernel and filesystem in 2 seperate files and then flash the kernel to mtd1 and the filesystem to mtd0.

Adam does not complain.

Oke I am going to bed, posted from a aztech dsl600ew running the linksys wag54g v2 firmware.

Hi there yellow. I'm using the dsl-600ew with 66.1.2 -001 now. Could you point me to where you got that firmware for the dlink dsl-g604t that you installed please? I got mine from the Aussie website and its a bin file. Can't load it using the aztech web gui and adam doesnt work as well. I'm suspecting that I got the upgrade file rather than the full firmware.

I've tried the solwise firmware but got a crc error when I tried to flash it.

Thanks mate.

edit: I got a new set of firmware for the dsl-g604t from the UK website. I tried flashing it using the web gui and it gave me a cannot write to mtd.

(Last edited by tbcheese on 1 Mar 2006, 03:11)

well I got the kernel and source from the bin file. I used an hexeditor to open the bin file, and then cut and past the kernel and filesystem in separate files.

The linksys wag54g v2, netgear dg834g and the dlink dsl-G604T all are single file firmwares. The upgrade program of their respective routers breaks it into seperate files.

The first part is adam2, the second the mtd settings, then the kernel and last the filesystem ( most of the time) When you open the firmware into a hexeditor, you can clearly see what belongs to what by following the 00 or ff.  So a big chunk of data is followed by a large chunk of 00 of ff, so cut the data part and save it to a new file.

But I recommand against it. I did it many time now and must conclude that the wifi of the ar7 does not get it's settings from the mtd's, but are stored inside the nvram of the wifi mini pci card. The linksys firmware is a nasty one and replaced the nvram with it's own.
Now my wifi only works with the linksys firmware and no longer with the original aztech or the netgear's one. Apart from that ,the wifi is unstable and appears and dissappears at will.
I then tested the mini pci card inside my laptop and works without problems. 

The netgear firmware (2. x ) contains a cli to access the nvram of the mini pci card. But there are hundreds of settings and I have no idea where to start, what it means or whatever. Basicly the wifi is useless now.

Wow this is risky stuff. I don't think I'll try it then. Thanks for your advice.

yellownotblack:

How are you able to ascertain the kernel and config.xml from the image file?  Supposedly the image file is a concatenation of the kernel, filesystem, and the config.xml file so I assume when you mention 'source' you're referring to the embedded squash filesystem that you can mount using the offset location of the hsqs magic.  However i'm curious as to how you are able to recognize the delimiters for the kernel and/or the config.xml file and where they are respectively?  My guess is that the kernel is first, then the squash filesystem, with the xml last.  So what magic provides the kernel and the xml?  I see what you're referring to with regards to the large chunks/blocks of FF, but there must be magic before and after that you're following in order to know what chunks are what?

yes my mistake...source = filesystem...

Well I had some help. I have an aztech dsl600-ew and aztech distributes it's firmware in a very convinient format. Everything is seperated. So the adam2 bootloader (adam2_amd_ext.AR7WRD) is a file, the kernel( ram_zimage.ar7xxx.nsp.squashfs) is a file and the filesystem( nsp.annexA.img) is a file and config.xml ( config.bin in binary format) is a file. But is also ditributes the all in one file firmware ( single.annexA.img)

So one day I opened those files in a hexeditor(winhex and hex worhshop) and found out that adam2 was inside single.annexA.img
Then I checked the kernel and looked inside single.annexA.img and found it too. Because I have the kernel, etc I can compare to the bit what is whatl inside the singel.annexA.img.
With this reference I started to open the firmware of the dlink/linksys/netgear/solwise, etc and found the same structure inside their "all in one firmware" then started to cut and past to seperate files. Bypassing signatures and other strange things. I then used a TI program called pc_app to flash those files to my router and it worked with those files. You can use ftp too.

So now the nasty part, when for example the dlink firmware boots on my aztech it erases mtd3 and replaced it with defaults of it's own. This can be remedied. But  I also found out that the linksys firmware erases the nvram of the mini pci card and put's it's own settings there. Now the wifi refuses to work with any firmware but the linksys and only with wep dis- or enabled. WPA does not work anymore. It is also unstable.
I suspect this happend as I used a US firmware, while my mini pci card is set to EU. ( sticker on the card states EU firmware). So most likely some nvram settings contradict each other and therefore the card refused to work.

Back to your question, all thise was done in Windows XP. A long time ago I used linux with squashfs and lzma support to get those separate files. With mc I looked up the hex address and would set the offset with mount....
But I found out that with some firmwares, it simply did not work.  Mount errors, squashfs not recognised, lzma errors. Filesystem unknow, etc , etc ,etc....I finally I gave up and only use window xp to do this.

Great job on this!  Although what would be really helpful is if you could describe what the similar 'structures' were that you recognized in the 'all in one' firmware in order to provide others with a roadmap to build off of your hard work!    I'll download the files you mentioned and see here I can pick up the similarities that you did in decronstructing (and reconstructing) image files as this is VERY useful information that is universally applicable and transcends one particular type of hardware or firmware.  Thanks for the tip on the where to find the seperate parts/pieces!

What I would do is make a copy of the original mtd3 so that you can either copy it back after loading the dlink firmware, or deconstruct the mtd3 image to figure out what the specific settings are in the original and then set them manually after doing the firmware upgrade.

You mentioned that there are hundreds of settings and you're not sure what to make of since linksys replaces the nvram of the acx wifi card.  Perhaps you could post these variables to the wiki somewhere as I'm sure it could be useful and I'm sure others more familiar with wifi nvram variables specificaly for the TI acx1xx chips might provide some guidance to you on how to set it.

Uhm.. just short question.. i own a zyxel 660hw-67.. same hardware as listed on first posting.. any chance to get openwrt running?