Netgear DG834GT

WARNING: Do not confuse the DG834GT with the DG834G V4!
Also note that the Wifi chip for this router is the atheros AR2414 chip and not the broadcom.

Hardware Highlights

SoC Ram Flash LAN USB Serial JTag
Broadcom BCM6348@256MHz 16MiB 4MiB 4 x 1 USB 1.1 Host Yes Yes

Installation

The OEM firmware is Linux, you can reach it via telnet after opening the following web page of the router: http://your_router_ip_address_here/setup.cgi?todo=debug

The DG834GT became supported in OpenWrt release 10.03 'Backfire'. The image needed to flash onto a Broadcom 63xx-series board depends on the board, method you are using to flash, and, for web-based flash, on the version of the Broadcom code your router uses. The board name is 96348GW-10 and it has CFE codeversion 3.02. However, the quickest way to get OpenWRT on the device is using a precompiled image - the image file will be named openwrt-DG834GT_DG834PN-squashfs-cfe.bin. Take a look in Backfire 10.03.1-rc5

  • There is NO support for the ADSL modem currently!
  • The image file does NOT have support for WiFi, so you'll have to add it with
    opkg update
    then
    opkg install kmod-ath9k

There are three known methods to install OpenWRT on the DG834GT:

How to flash firmware using Linux

Convert an OpenWRT build (.bin file) to Netgear format (.img), and then use either NFTP or the router's web interface to flash the new image.

Create the image

  1. Download latest build image ( .bin ) from OpenWrt eg like http://downloads.openwrt.org/backfire/10.03.1-rc4/brcm63xx/ then either openwrt-DG834GT_DG834PN-jffs2-128k-cfe.bin OR openwrt-DG834GT_DG834PN-jffs2-64k-cfe.bin OR openwrt-DG834GT_DG834PN-squashfs-cfe.bin
  2. Get whole directory named DG834GT_V1.02.16_NA_src from ftp://downloads.netgear.com/files/GPL/DG834GT_V1.02.16_NA_src.zip unzip all etc.
  3. Get code for mkimage.sh file from post 424 on https://forum.openwrt.org/viewtopic.php?pid=89333#p89333 and compile etc. and put mkimage.sh in DG834GT_V1.02.16_NA_src directory
  4. put the openwrt image ( .bin ) named say,openwrt-DG834GT_DG834PN-squashfs-cfe.bin, in the DG834GT_V1.02.16_NA_src directory
  5. Execute something like "./mkimage.sh DG834GT_V1.02.16.img openwrt-96348gw-10-squashfs-cfe.bin openwrt-DG834GT-2.6.27.11.img" where first file is old netgear supplied image. second file is openwrt downloaded one and third file is whatever you wanna name the new image

Install using NFTF

  1. Get code for patched nftp program from here http://forum.kitz.co.uk/index.php/topic,5842.msg148308.html#msg1483088 then compile nftp to get a binary
  2. Put the newly created image eg named "openwrt-DG834GT-2.6.27.11.img" in this example in the same folder as the binary nftp file
  3. Put router in flashing mode by pull out plug and press reset button then insert power until leds flash alternatively then execute something like "sudo ./ntfp -u eth0 openwrt-DG834GT-2.6.27.11.img" where the last file is the new image created by mkimage.sh file earlier on etc.
  4. Reboot router again and say for like 3 times on and off by taking out plug to make sure it has initialized everything properly

ENJOY !!! This took me 3 hours to figure out.

Install using web interface

  1. For an easier upload method than messing around with nftp (constant fail for me, probably user error), once you have made the "openwrt-DG834GT-2.6.27.11.img" file, it can be uploaded thru the original web interface / flash upgrade router procedure. Wish I had known THAT 2 hours ago!
  2. I used the instructions above and loaded "Backfire (10.03.1-RC6, r28680)" (am posting this before going further)

NOTE : for users of a SKY DG834GT with the locked bootloader you still need to use NFTP to flash because the web interface will not work as the bootloader checks the image and it does not allow flashing. You still need to use NFTP and recovery mode to flash !

OEM installation on Windows using the Firmware recovery tool

On Windows you can use Netgear's supplied firmware recovery tool, but you need to make some alterations to the image file before it will be acceptable to the tool. You need to prepend the second stage bootloader to the image, then pad the image out to make it a multiple of 1024 bytes, and then ensure that the Netgear model and version information is present.

The first few parts of this are done based around the instructions found in this forum post. Roughly speaking the steps you'll need to follow are:

  • Start with an official firmware, and extract the first 65536 bytes. head -c 65536 <netgear-firmware.img> > 2bl.bin
  • Figure out how much padding is needed to make the file length a multiple of 1024 bytes. dd if=/dev/zero of=padding.bin bs=<bytesneeded> count=1
  • Prepend the extracted data to the beginning of the openwrt firmware and append the padding to the end. cat 2bl.bin openwrt.bin padding.bin >file_to_flash.img
  • Use the Broadcom Firmware Tool found from SkyUser Forum to add the Netgear information to the firmware file. This is done by loading the firmware image (file_to_flash.img) into the tool, selecting the Netgear/Sercomm tab, then adding "DG834GT" as the target platform and a version number as the "version ID". You can then "Save As", ensuring the file is saved as a "Netgear Firmware Image" rather than the default Broadcom Firmware Image".
  • Boot the DG834GT into recovery mode by holding the reset button down whilst powering it up. The power and status lights should flash alternately.
  • Ensure the new firmware file is in the same directory as the Netgear Firmware Recovery Tool (remove the existing firmware file to avoid confusion).
  • Use the Recovery Tool to flash the firmware on a 32bit Windows system.

If you are working on Windows, this author would strongly suggest having unix tools at your disposal to make life a little easier. This could be as simple as UnxUtils or as complex as Cygwin. Note that if you're using UnxUtils, you can't point dd at /dev/zero. Instead, point it at a real file, on the understanding that first few bytes (up to 1023) of the real file will turn up at the end of the image.

If you don't get the padding right, then the Firmware Recovery Tool will hang at 99%, and the power and status lights will flash quickly. Don't panic - the chances are that the firmware has flashed ok, but you'll need to power cycle the router.

The Netgear Firmware Recovery tool basically does the same as the NFTP tool, discovering the device using type 0x8888 Ethernet frames, and then communicating with the firmware using the same frame type. No TFTP is used by the Firmware Recovery tool or by NFTP.

TFTP and serial port method

WARNING: Some DG834GT devices appear to have problems with the bootloader and serial port. This may make the device's serial port effectively inaccessible!

The second method needs access to the device serial port. You will need a level shifter to connect an RS232 port, or alternatively you may be able to use one of the older USB to mobile phone serial connection cable, or even something like the BusPirate. The DG834GT operates at 3.3V, so whatever you use must be able to interface at this voltage. The UART connection is a row of four pads below the WiFi card connector, see below for pinout. You will need to solder either pins or wires to the pads.

  • Connect to the serial port on the DG834GT with the power off on the device.
  • Set your PC to have a static IP address in the 192.168.1.xxx/24 range.
  • Start a TFTP server on your PC, and put the OpenWrt firmware file in it's root directory. (E.G. openwrt-DG834GT_DG834PN-squashfs-cfe.bin)
  • Ensure you have your terminal software set to 115200 baud, 8N1.
  • Power the DG834GT up, and quickly hit any key on your terminal.
  • This should get you the CFE> prompt. If you just got random rubbish on the screen, you have a DG834GT that has problems with the serial port and bootloader. You may have to try using NFTP or the Netgear Firmware Recovery tool instead.
  • In the serial terminal, type
    flashimage [your_pc_ip_address]:openwrt-DG834GT_DG834PN-squashfs-cfe.bin

WiFi

Getting the wireless working when using the image that does not contain the driver requires the device to communicate with the internet. The image has a static IP address which may not be in the subnet of the network the DG834GT is plugged into. During the Installation of the wireless driver the device self-reboots. This works around that. The following assumes that you have left the default IP address on the DG834GT. The DG834GT is connected by ethernet to a Linux PC with two NIC (eg wireless and Ethernet). The PC wireless connects to the internet. The Linux PC forwards inet so the netgear can download via it.

Access the DG834GT

On the Linux PC configure the ethernet to the DG834GT with a static IP so you can telnet then ssh to it.

sudo ifconfig eth0 192.168.1.3 netmask 255.255.255.0

Configure DG834GT to use PC as internet provider

Modify '/etc/config/network' so the gateway is the laptop. Add the following 'gateway' line to the 'config interface lan' section.

config interface lan
        option type     bridge
        option ifname   eth1
	option gateway  192.168.1.3

Add to the 'System;Startup;Local Startup' post boot script (via web interface) so it appends an external nameserver to resolve.conf. Alternatively you could edit /etc/rc.local. 8.8.8.8 is a valid name server.

echo search lan > /etc/resolv.conf
echo nameserver 8.8.8.8 >> /etc/resolv.conf
exit 0

PC Forwarding

Configure the Linux PC to forward traffic from the ethernet to the internet with the following script. Tailor the interfaces to your environment.

#!/bin/bash
#assumes PC eth0 is connected to DG834GT and will have IP 192.168.1.3
#allow the netgear to get info from the inet via this laptop.

function verbose 
{
    echo $*
    $*
}

echo 1 > /proc/sys/net/ipv4/ip_forward

IP=192.168.1.3
#internal
INT=eth0
EXT=wlan0

#setup static IP on interface to the netgear
verbose ifconfig eth0 $IP netmask 255.255.255.0

#set up routing
verbose iptables -t nat -A POSTROUTING -o $EXT -j MASQUERADE
#allow router to connect out and remote servers to respond
verbose iptables -A FORWARD -i $INT -o $EXT -j ACCEPT
verbose iptables -A FORWARD -i $EXT -o $INT -m state    --state RELATED,ESTABLISHED -j ACCEPT
exit

Linux PC looses Internet

Occasionally the Linux PC may loose the internet. It might prioritise routeing traffic through the netgear rather than the interface to the internet. In the following replace 10.0.2.1 with your routers IP.

sudo route del default
sudo route add default gw 10.0.2.1

Download the driver

The Netgear can appear to hang as the files being downloaded and configured are large. Downloading the dependencies separately is unnecessary, but gives more feedback.

At the shell:

opkg update
opkg install kmod-ath
opkg install kmod-ath5k
NB the device may reboot between drivers

Verify Wireless Driver Ok

At a shell prompt, enter 'wifi detect'. If nothing is produced then you may need the ath9k driver instead.

To install the ath9k driver (this process took nearly an hour each). At the shell:

opkg update
opkg install kmod-ath9k-common 
opkg install kmod-ath9k

Configuring Wireless

Enter the command

wifi detect > /etc/config/wireless

vi /etc/config/wireless and comment out the line

option disabled 1
It will look like
#option disabled 1

Enter command 'reboot'.

Lastly for Wifi

The web interface will now have 'Network;Wifi' available.

Undo the changes to /etc/config/network and 'System;Startup;Local Startup'.

Hardware

Info

Architecture: MIPS big endian
Vendor: Broadcom
Bootloader: CFE
Board Id: 96348GW-10
System-On-Chip: BCM6348KPBG
CPU/Speed BMIPS3300 V0.7 / 256 MHz
Flash-Chip: MX 29LV320BTC-70G
Flash size: 4 MiB
RAM: IC42S32400
W9812G2DH-7
RAM size: 16 MiB (1Mx4x32bit)
Wireless: Atheros AR2414 MiniPCI (802.11bg)
Ethernet: BCM5325 w/ vlan support swconfig
Internet: ADSL2+
USB: Yes USB 1.1 unpopulated
Serial: Yes
JTAG: Yes

Serial

Serial console is J503, below the Wifi card connector. No pins are pre-soldered. Settings are: 115200, 8, n, 1.

pin signal
1 GND
2 TX
3 3V3
4 RX

JTAG

Jtag Port is J201 this port is verified.

Disposition on the board:

2 4 6 8 10 12
1 3 5 7 9 11

JTAG signals and pins

nTRST 1 2 GND
TDI 3 4 GND
TDO 5 6 GND
TMS 7 8 GND
TCK 9 10 GND
nSRST 11 12 GND

See port.jtag for more JTAG details.

Recovery

With access to Serial Console is possible to restore the firmware on the router from bootloader CFE. CFE can download the image with TFTP see the installation method 2.

Attention to use the command e for erase the whole flash when CFE can't read the tag it delete all flash also the CFE. For example if the flash is empty by dd if=/dev/zero of=/dev/mtd1 the tag not exist. When the CFE is erased the only method to restore it is the JTAG Port. Dump of the CFE with dd if=/dev/mtd2 is in format BigEndian, but the dump with JTag Cable is in format LittleEndian so for restore a CFE need convert the image file.

Without access to Serail Console, if you wish to restore the unit to OPENWRT's defaults, you can execute the command " mtd -r erase rootfs_data ", as a side note, DO NOT erase 'rootfs' or the device will be semi bricked, and your probably going to need to use a serial cable to recover it, as I do. I was hoping to trigger CFE to drop into a mode it might accept tftp, but instead Im pretty sure its stalling after the bootloader has finished, but cant find where to move onto next.

Hardware mods

USB port

There is an unpopulated USB port near right from reset button.

100_6268.jpg

If you want to use it you need to solder the USB connector and the following parts:

C515 Polarized capacitor, 470 uF
C516 Capacitor 100nF size: 0805
FB1 Resistor 0 Ohm size: 0805
C124 Capacitor 100nF size: 1210
U102 5 Volt voltage regulator SOT-223 package
J502 Simply short it with a wire

Warning!Be careful with the voltage regulator! If you want to use an USB device which is powered from the USB port (usb stick, webcamera, etc.), you should not use SOT-223 package regulator, because it could not dissipate the amount of power.

Let's calculate. The input voltage is 12 Volt (or a bit more) the output is 5 Volt. So the regulator will dissipate (12-5)*current power. For example my webcam need 100 mA power according to it's description. So the regulator in my case will dissipate 7 V *0,1A = 0,7 W power. This amount of power cannot be handled by an SOT-223 package. Regulators in TO-220 package will do it better. The best choice is a small switching mode DC-DC converter.

100_6269bc.jpg

Unfortunatelly there are some hardly solderable 0402 size parts are missing too.

R515, R514 between 16 and 44 Ohm
R516, R517 15 KOhm
C511, C512 47 or 50 pF

There is an other thing what is have to be done: You have to pull the BCM6348's USB_FLT pin to the 3V3. This pin is connected to a via located in the half way between C702 and C423.

usb_2_blog.jpg

Solder a thin Cuz wire to it and connect it to the 3V3. The easiest place to find the 3V3 is the serial connector (J503) third pin. Connect to it with an 2K resistor.

Power up your device, and do

cat /proc/bus/usb/devices
and you should see your olugged in usb devices details there.

SPI port

There is a place to an unpopulated footprint for an SPI flash: the U504 right to the main flash.

Pinout:

SPI_SSB (Chip select) 1 2 3V3
SPI_MISO 3 4 3V3
GND 5 6 SPI_CLK
GND 7 8 SPI_MOSI

This pinout is verified on a board with desoldered CPU using this pad layout which is generated from the CPU's BSDL file:

I think it is possible to attach SPI devices to it, but until this time I have not succeded with the spidevtest. The spi device file could be created with:

mknod /dev/spi0 c 153 0 

GPIOs

I have traced all the GPIO signals on my device. The connected means that there is a trace connected to the pad. The nc means the pad is not connected. Any placement notifications are mentioned in the LAN ports upper orientation.

GPIO BGA pad connected
GPIO_0 AB5 _ (Power LED)
GPIO_1 AC5 LED 2 (Orange Tick LED)
GPIO_2 AD1 connected (Orange ADSL LED)
GPIO_3 AD2 LED 4 (Wireless LED)
GPIO_4 AD4 connected reset
GPIO_5 AD3 LED 3 (Hidden LED)
GPIO_6 AE3 connected
GPIO_7 AD5 connected via left from the R514 label (Green ADSL LED)
GPIO_8 AE5 connected
GPIO_9 AE4 connected
GPIO_10 AF4 connected near the GPIO_13 via
GPIO_11 AF3 connected via under the BGA
GPIO_12 AB9 connected
GPIO_13 AF5 connected via at the C511 upper left corner
GPIO_14 AC9 connected
GPIO_15 AD9 connected
GPIO_16 H4 connected via near at the right upper corner of R204
GPIO_17 J2 connected the trace goes under the R617
GPIO_18 E1 NC
GPIO_19 J4 connected th the via near the J letter at the left side of the CPU
GPIO_20 E4 NC
GPIO_21 M3 NC
GPIO_22 AB4 NC
GPIO_23 AB3 NC
GPIO_24 Y5 NC
GPIO_25 AA3 NC
GPIO_26 AA4 NC
GPIO_27 AA5 NC
GPIO_28 AC4 NC
GPIO_29 AC3 connected
GPIO_30 AC2 NC
GPIO_31 AC1 NC
GPIO_32 AF9 connected
GPIO_33 Y24 NC
GPIO_34 Y25 NC
GPIO_35 W24 NC
GPIO_36 W25 NC

Tags

Back to top

toh/netgear/dg834gt.txt · Last modified: 2013/05/15 16:10 by danitool