Linksys ADSL2MUE is an ADSL2/2+ capable router/modem based on the Texas Instruments AR7 architecture. Marketed in the United Kingdom, France, Australia and a few other countries not including the United States of America.
If you are looking for a modem this might not be what you are looking for. Although advertised as a modem, it is actually a router with some sort of bridging capabilities.
Based on Texas Instruments AR7 architecture it includes a few other chips on board, such as ethernet and ADSL transformers. TI does not provide with much information about the architecture and answers with a "this is for OEM eyes only" when asked for more information.
This device provides ADSL, ethernet and USB conectivity only.
- Ethernet: One on-chip fast ethernet 10/100 port attached to a transformer from Delta Electronics labeled LF8505 DELTA 0448W).
- USB: One USB 1.1 port.
- ADSL: One on-chip adsl port attached to an ADSL2 transformer from Linkcomm Manufacturing labeled LAL0671 LINKCOM 0450. Advertised explicitly as AR7 compatible.
- On-board RAM memory: One chip of synchronous SDRAM formatted as 1Mx32x4bank module makeing up 128Mbit (16Mbytes) of RAM space. Manufactured by Glink and labeled as GLT51280L16-6TC 412 9P3030902.
- On-board Flash memory: Four MBytes of memory on a single chip from Macronix Incorporated. Its part numbers is MX29LV320ABTC-90G and the chip is labeled as MX E042469 29LV320ABTC-90G 2K085800A1 TAIWAN.
- Microcontroller: Texas Instruments AR7RD labeled TNETD7300AGDW 49ZND69 with uilt-in ADSL and Ethernet interfaces.
- Serial ports: Two serial ports. One of them used as system console at 38400,8,N,1 wired to J1 as described below on this page. Another serial port is present and configured but is unused and looks unwired to any of the pins close to J1.
- EJTAG interface: EJTAG v2.6 with 14 pins. (Info from epitools debug intefaces and cables). Not sure, but it might be wired to JP1 connector, that is the fourteen pins port right by leds side.
Flash memory addressing
This info might prove useless, but not all addresing range available for flash is used.
- mtd2 block: from 0x90000000 to 0x90010000 contains on 64 KBytes the PSPBoot binary.
- mtd3 block: from 0x90010000 to 0x90020000 contains 64KBytes of NVRAM configuration and environment.
- mtd1 block: from 0x90020000 to 0x900a0000 contains 512 Kbytes of kernel
- mtd0 block: from 0x900a0000 to 0x90400000 contains 3456 KBytes of squashfs
Addresing the flash requires the first seven bits to be 1011 000x, the next tree are meaningless and the other 22 bits walk along the full flash chip (2^22 equals 4MB of Flash mem).
1011 000x xxmm mmmm mmmm mmmm mmmm mmmm
where 1011 000 is the "chip select" for flash mem, x represents any value in binary and m represents a single bit within the real flash address.
Further info from software commands
(psbl) version PSPBoot 18.104.22.168 Compiled gcc rev: 2.95.3 20010315 (release/MontaVista) [Aug 6 2004 17:48:48] Built for AR7RD board in Little Endian mode. Optional modules included (+) or not (-): +tibinary -elf -gzip -ffs -tftp -ftp +dhcp +pcapp (psbl)
cli> product-info GLOBAL: Product Info command Product Information: ---------------------- Model Number: AR7RD HW Revision: Unknown Serial Number: none USB PID: 0x000f USB VID: 0x13b1 Ethernet MAC: N/A DSL MAC: N/A USB MAC: N/A USB Host MAC: N/A Software Versions: ------------------ Gateway: 3.5.0 ATM Driver: 4.02.11.00 DSL HAL: 3.01.02.00 DSL Datapump: 3.01.02.00 Annex A SAR HAL: 01.07.02 PDSP Firmware: 0.49 Boot loader: 22.214.171.124 cli> shell Starting /bin/sh Type exit to return to the CLI BusyBox v0.61.pre (2004.10.19-18:15+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. # cat proc/tty/driver/serial serinfo:1.0 driver:5.05c revision:2001-07-08 0: uart:16550A port:A8610E00 irq:15 baud:2258 tx:15520 rx:323 RTS|DTR 1: uart:16550A port:A8610F00 irq:16 tx:0 rx:0 RTS|DTR # cat proc/ticfg/env bootloaderVersion 126.96.36.199 ProductID AR7RD HWRevision Unknown SerialNumber none MEMSZ 0x01000000 FLASHSZ 0x00400000 CPUFREQ 150000000 SYSFREQ 125000000 IPA 192.168.1.1 MODETTY0 38400,n,8,1,hw MODETTY1 38400,n,8,1,hw MAC_PORT 0 mtd0 0x900a0000,0x90400000 mtd1 0x90020000,0x900a0000 mtd2 0x90000000,0x90010000 mtd3 0x90010000,0x90020000 autoload 1 BOOTCFG m:f:"mtd1" USB_VID 0x0451 USB_PID 0x6060 HWA_RNDIS 00:E0:A6:66:41:EB HWA_HRNDIS 00:E0:A6:66:41:E1 usb_vid 0x13b1 usb_pid 0x000f usb_prod Linksys RNDIS Network Adapter connection0 0 HWA_0 00:12:17:79:8C:D8 PROMPT (psbl) #
__________________________________________ | | | Pin 4: GND ----> @ | | Pin 3: TX ----> @ | | Pin 2: RX ----> @ | | Pin 1: +3.3 volts ----> @ | | | Front of ADSL2MUE | | | led | led | led | led | led |_________________________________________|
The console is located on the same edge that the leds are, that is, front-right side of the board. It is labeled J1 and an arrow points to pin 1 on the left, that is, the closest pin to the leds. Voltage reference is 3.3 volts and it is set by default at 38400,8,N,1. Mine already had a connector soldered just like to ones we usually see on computer boards as CPU/NB fan connector.
This firmware is based on the MontaVista Linux.
Linux version 2.4.17_mvl21-malta-mips_fp_le (firstname.lastname@example.org) (gcc version 2.95.3 20010315 (release/MontaVista)) #49 Thu Sep 9 18:13:08 EDT 2004
CPU + Memory
# cat /proc/cpuinfo processor : 0 cpu model : MIPS 4KEc V4.8 BogoMIPS : 149.91 wait instruction : no microsecond timers : yes extra interrupt vector : yes hardware watchpoint : yes VCED exceptions : not available VCEI exceptions : not available
# cat proc/iomem 00000000-13ffffff : reserved 14000000-1401ffff : System RAM 14020000-14ffffff : System RAM 14020000-1418ba07 : Kernel code 1419a300-141b2fff : Kernel data a8610000-a86107ff : eth0 #
Filesystems and partitioning
# cat proc/mounts /dev/mtdblock/0 / squashfs ro 0 0 none /dev devfs rw 0 0 proc /proc proc rw 0 0 ramfs /var ramfs rw 0 0 # cat /proc/mtd dev: size erasesize name mtd0: 00360000 00010000 "mtd0" mtd1: 00080000 00010000 "mtd1" mtd2: 00010000 00002000 "mtd2" mtd3: 00010000 00010000 "mtd3"
Partially GPL'd software can be downloaded from the UK office of Linkys at the GPL link show at the Linksys GPL code center.
As many AR7 based devices do, Linksys ADSL2MUE violates GPL license because only partial sources are released. Visit GPL Violations web site for more information on this.
With the default oficial firmware this device has four modes of operation:
- Router with PPPoA over the WAN
- Router with PPPoE over the WAN
- Router with RFC1483/RFC2684 bridged over the WAN
- Bridge with RFC1483/RFC2684 bridged over the WAN
All three router modes NAT support is fair enough for outgoing purposes but will not let you do any port forwarding to the inside.
The only modem capabilities the device shows is called brige mode. This mode interconnects a native ethernet network or an ethernet over USB network with a RFC1484 bridge mode network (ethernet switched over ATM/ADSL).
Hidden software features
Oficial firmware includes a comand line interface that allows for a few more modes of operation. The standard web based GUI allows you to configure RFC2684 bridged mode with LLC or VC encapsulation only, but the CLI allows you to configure RFC2684 routed mode also.
I got into the CLI through the console and after enabling privileges (CLI enable password matches web password) you can configure the WAN interface as statically managed and set RFC2684 routed as the interface type.
Keep in mind that this hidden feature allows you to use this piece of hardware as a router connected to a routed mode RFC2684 ATM/DSL connection. Still work needs to be done on OpenWrt AR7 port to let this hardware become the modem it claims to be.