Installing OpenWRT On The GT-704WG September 17, 2009
I recently picked up an ActionTec GT-704WG DSL router from the thrift store ($15) and wanted to flash it with OpenWRT. Checking out Google and the OpenWRT Wiki, some work has been done on the GT-701WG, but specific information for flashing the GT-704 was scarce. The GT-704 hardware is based on the AR7 from Texas Instruments, and is nearly identical in specifications to the GT-701:
Platform: Texas Instruments AR7, 150MHz
Flash: 4MB
RAM: 16MB
Ethernet: 4 Ports
Wireless: TI ACX111, 802.11b/g
The firmware install is pretty straightforward, once you get the commands right. The process is very similar to that documented for generic AR7 devices, but not exactly the same. It helps to have a terminal connected to the JP603 serial port (ttys0, 38400, 8N1)during this process as well, but it is not necessary:
The serial port on the right (JP603) is ttys0
The pinout for the serial port is, as pictured, from bottom to top: ground, transmit, receive, unknown, Vcc, unknown.
In order to flash the firmware, you’ll need to get access to the Adam2 bootloader. The easiest way to do this is to turn off the router, hold down the reset button, and turn the router back on. Keep holding the reset button until you see the Power and Internet LEDs stay on; this indicates that the router has dropped into the Adam2 shell prompt.
The prompt can be accessed via the serial connection, or via FTP. To connect via FTP, simply FTP to the router and login with the user name of ‘adam2′ and password ‘adam2′. The default adam2 IP address is 192.168.0.1. If this IP address does not work, you will have to connect via the serial connection and issue the following command:
printenv
Look for the variable named ‘my_ipaddress’, which will list the Adam2 IP.
Once you have access to Adam2 (either via FTP or serial), you will have to set a couple of environment variables. First, you need to create a partition to install OpenWRT to. The existing partitions can be viewed by issuing the printenv command at the serial console. They are:
mtd2 0×90000000,0×90010000
mtd1 0×90010000,0x900d0000
mtd0 0x900d0000,0x903e0000
mtd4 0x903e0000,0x903f0000
mtd3 0x903f0000,0×90400000
Since the OpenWRT image contains both the kernel and the file system, your new partition should cover both the existing kernel and file system partitions (mtd1 and mtd0, respectively). To create the partition via the serial console, run:
setenv mtd5,0×90010000,0x903f0000
Or via the FTP connection:
quote SETENV mtd5,0×90010000,0x903f0000
You will also have to set the MAC_PORT environment variable in order to enable the internal ethernet port. From the serial console:
setenv MAC_PORT,0
Or from FTP:
quote SETENV MAC_PORT,0
With that done, you’re ready to FTP your new firmware to the router; other reports on the GT-701 and GT-704 have noted that the ActionTec recovery utility sends a message to UDP port 5035 (actually, two messages in the case of the GT-704). However this appears to be simply for discovery of the router’s IP address and is not necessary for loading firmware onto the router.
Go to OpenWRT’s download page, and get the latest release of openwrt-ar7-squashfs.bin (currently Kamikaze 8.09.1). If you haven’t already, FTP to the router and login with the previously described credentials. You will need to issue the following commands:
ftp> binary
200 Type set to I.
ftp> quote MEDIA FLSH
200 Media set to FLSH
ftp> quote STOR openwrt-ar7-squashfs.bin mtd5
226 Transfer complete
ftp> quote REBOOT
It will take the router a minute or two to clear the flash and load the firmware. Note that you do NOT want to enter passive mode for the file transfer; doing so will slow the file transfer significantly (it would have taken about a week by my estimation). You can monitor the router’s progress via the serial console, or by watching the file transfer in Wireshark. Once the firmware transfer is complete, the reboot command will reboot the router, and you should have a working OpenWRT install:
Please press Enter to activate this console.
BusyBox v1.11.2 (2009-05-28 18:22:45 UTC) built-in shell (ash)
Enter 'help' for a list of built-in commands.
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
KAMIKAZE (8.09.1, r16278) ----------------------------
* 10 oz Vodka Shake well with ice and strain
* 10 oz Triple sec mixture into 10 shot glasses.
* 10 oz lime juice Salute!
---------------------------------------------------
root@OpenWrt:/#
So far everything checks out OK using the generic firmware image; ethernet and wireless works, opkg updates and installs packages fine. The only downside is that the wireless doesn’t seem to support WPA, possibly due to the poor open source support from TI. I haven’t tested the USB port, but it appears to be a client-only USB device, so it’s of limited use.
Final, Somebody did it!!!!
Great work!
Thanks Bobby! It actually wasn’t very difficult, so I’m looking at working on a couple other ActionTec routers in the near future.
Hopefully someone can help me out on this…
I was trying to put OpenWRT on my GT704WG router. I’ve never tried hacking a router before, so I’m new to all this, but this was an extra one lying around, so I don’t really care if I brick it.
I was following the steps in the blog post, but I left out:
quote SETENV MAC_PORT,0
So I started over, running that command this time, and when I got to:
quote STOR openwrt-ar7-squashfs.bin mtd5
it gave me an error:
550 Data Socket not ready.
So I tried the command listed in the 701WG’s instructions on openwrt.org:
put “openwrt-ar7-2.4-squashfs.bin” “openwrt-ar7-2.4-squashfs.bin mtdX”
Now the response I got was:
200 Port command successful
150 Opening BINARY mode data connection for file transfer
And it just hung there. I quit the transfer several hours later, and it said about 100K had been transfered, which I’m guessing means it was in passive mode according to the blog – although I’m not sure what that means.
I’ve tried many times now to see if I could get this to work, and now, I’m convinced it’s beyond hope. But I can still access the adam2 bootloader, so if anyone has any ideas for me to try, I’m all ears. Thanks.
In case I confused anyone, I did use mtd5 in the put command and not mtdX
Your FTP client is likely going into passive mode by default; adam2, for whatever reason, doesn’t like this. Make sure your FTP client is not in passive mode before you upload the file to adam2.
Also, I noticed that the local file names you used for the STOR and PUT commands were different; try using the STOR command, but instead of “openwrt-ar7-squashfs.bin”, use “openwrt-ar7-2.4-squashfs.bin” (or whatever the file is named on your hard drive). The STOR command *should* work.
I’m seeing the same issues as John. Over FTP the STOR command returns the “550 Data Socket not ready” response. Using PUT results in a REALLY slow transfer, even if I ensure that PASSIVE is turned off before the PUT command.
On a serial console I can see that a section of the flash is erased immediately after the PUT command is issued. When the erase completes, the FTP client shows that the binary transfer started. I can also use “dm” from the serial console to see how much of the mtd5 memory area has been written so far, and it goes very, very slowly.
Based on some settings I found in one of the update tools available on the web I used the serial console to “setenv StaticBuffer 128″, which seemed to speed things up quite a bit, but it still looks like it would take several days to finish.
What FTP clients have been used successfully to use the STOR command?
I was finally able to get OpenWRT flashed to my GT-704WG. From monitoring the serial console I was able to determine that the FTP transfer would start at a good speed, but then slow to a crawl. Sometimes it would transfer quite a bit before it slowed down (evidenced by many dots on the console showing progress of the flash process). By using “dm” to see how far the flash had made it before slowing down I was able to break up my transfer, starting the next stage after the last chunk that was already in flash. I created a new mtd6 variable using “setenv” and gave it a range beginning where the transfer had ended (rounded down to the prior block boundary, i.e. 0x90XX0000), then rebooted the router into adam2 and restarted the FTP connection. I would then put the remaining chuck of the openwrt image using ‘put openwrt-partx.bin “fs mtd6″‘, and see how far that made it. If I didn’t get at least 4 dots before it slowed down, I would reboot the router and try again. After many restarts and a total of 5 seperate uploads the last chunk made it to the router. I then cleaned up the mtd6 variable and rebooted the router, and OpenWRT came up.
Whew!
This command did the trick…
quote SETENV mtd5,0×90010000,0x903e0000
and this…
put “openwrt-ar7-squashfs.bin” “openwrt-ar7-squashfs.bin mtd5”
If you are experiencing a problem with connection terminated by remote host, you need to add this key to the registry and reboot your computer:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\
TcpMaxDataRetransmissions = 40 (DWORD, value in HEX)
Anyone have any pointers to get PPPoE working? It seems to be assigning the lan MAC to the wan.