Netgear DGN3500 and Netgear DGN3500B

OpenWrt support is possible, and currently being worked on. THIS IS WORK IN PROGRESS!

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

Supported Versions

Version/Model S/N Release Date OpenWrt Version Supported Model Specific Notes
DGN3500 - 2012-11 WIP Annex A
DGN3500B - 2012-11 WIP Annex B

OEM source code available at: http://kb.netgear.com/app/answers/detail/a_id/2649

Hardware Highlights

CPU Ram Flash Network USB Serial JTag Misc
Lantiq AR9 64MiB 16MiB 4 GigE, 1 WAN Yes, 2.0 Yes Yes integrated ADSL modem

Manufacturer's site: http://support.netgear.com/product/DGN3500

Forum: https://forum.openwrt.org/viewtopic.php?id=24195

Installation

Compile an image with ramdisk from trunk and boot it via tftp from uboot:

tftpboot
set bootargs boardarch=DGN3500B console=ttyLTQ1,115200
bootm

This works but, of course, is not permanent yet. The SPI driver should be improved before being able to use (and install) the flash.

Flash Layout

Overview

Netgear DGN3500 Flash Layout
Layer0 amazon_s-sflash 16384 KiB
Layer1 128KiB 192KiB mtd1 KFS 15360KiB mtd9 UILANG 64KiB mtd8 TM 64KiB mtd7 POT 64KiB
Layer2 mtd2/4 u-boot 64KiB mtd6 bootenv 64KiB mtd5 DPF 64KiB mtd3 NVRAM 64KiB ? 64KiB kernel? 1344KiB mtd0 rootfs 14016KiB 192KiB

Only mtd0 and mtd1 overlap on this one.

Netgear DGN3500B Flash Layout
Layer0 amazon_s-sflash 16384 KiB
Layer1 128KiB 192KiB mtd1 KFS 16000KiB mtd7 POT 64 KiB
Layer2 mtd2/4 u-boot 64KiB mtd6 bootenv 64KiB mtd5 DPF 64KiB mtd3 NVRAM 64 KiB ? 64 KiB kernel? 1216 KiB mtd0 rootfs 14848KiB

Note the overlap of mtd0, mtd1 and mtd7 with the kernel.

Details of the DGN3500

mtdX start end size description
mtd0 0x001A0000 0x00F50000 0x00DB0000 File-System (13.6875 MiB)
mtd1 0x00050000 0x00F50000 0x00F00000 KFS (15 MiB)
mtd2 0x00000000 0x00010000 0x00010000 U-Boot (64 KiB)
mtd3 0x00030000 0x00040000 0x00010000 NVRAM (64 KiB)
mtd4 0x00000000 0x00010000 0x00010000 U-Boot (64 KiB)
mtd5 0x00020000 0x00030000 0x00010000 DPF (64 KiB)
mtd6 0x00010000 0x00020000 0x00010000 BOOTENV (64 KiB)
mtd7 0x00FF0000 0x01000000 0x00010000 POT (64 KiB)
mtd8 0x00FD0000 0x00FF0000 0x00010000 TM (64 KiB)
mtd9 0x00F50000 0x00FD0000 0x00010000 UILANG (64 KiB)

Details of the DGN3500B

mtdX start end size description
mtd0 0x00180000 0x01000000 0x00E80000 File-System (14.5 MiB)
mtd1 0x00050000 0x00FF0000 0x00FA0000 KFS (15.625 MiB)
mtd2 0x00000000 0x00010000 0x00010000 U-Boot (64 KiB)
mtd3 0x00030000 0x00040000 0x00010000 NVRAM (64 KiB)
mtd4 0x00000000 0x00010000 0x00010000 U-Boot (64 KiB)
mtd5 0x00020000 0x00030000 0x00010000 DPF (64 KiB)
mtd6 0x00010000 0x00020000 0x00010000 BOOTENV (64 KiB)
mtd7 0x00FF0000 0x01000000 0x00010000 POT (64 KiB)

Hardware

Info

Instruction set: MIPS
Vendor: Lantiq
Bootloader: Das U-Boot
System-On-Chip: Lantiq XWAY ARX168
CPU @Frq FIXME
Flash size: 16 MB
Flash Chip: FIXME
RAM size: 64 MB
RAM Chip: EtronTech EM6AB160TSA-5G
Wireless No1: Atheros AR9223 w/ 2x2 MIMO antennas for 802.11b/g/n
Switch: Realtek RTL8366RB
Modem: xDSL
USB: Yes
Serial: Yes
JTAG: Yes

Photos

Front:

FIXME

Back:

FIXME

Opening the case

Note: This will void your warranty!

  • FIXME

Main PCB

FIXME

Serial

port.serial general information about the serial port, serial port cable, etc.

The pinout for the serial port is: GND, TX, 3.3V and RX (from left to right when looking the board with the DSL port on the top right). J41 is the serial port.

How to connect to the Serial Port of this specific device:

FIXME

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

FIXME

Debricking

generic.debrick

If you were able install the OpenWRT firmware and have problems with it, but still have it working at least with its U-Boot running and accepting a firmware via TFTP, then just follow the procedure to enter failsafe mode and upload a working firmware via tftp.

If the OpenWRT bootloader can't help, then you have to put the router in a "safe-recovery" condition, where it gets online in your LAN with IP 192.168.1.1 and offers a http page allowing you to upload a firmware file. If you brick it badly, the "U-Boot" of the router can't get to that point and you need to put your hands on it to recover the situation. To do so, you can either follow the so-called "Procedure 30-30-30" or go the brutal way.

30-30-30:

  1. with the router on (even if bricked), push the reset button for 30 seconds (use a pen or a sting)
  2. WITHOUT releasing the reset button, remove the power (or use the on/of button) and KEEP the reset pressed for 30 seconds
  3. STILL keep the reset pressed and power on, wait 30 seconds

You can now release the reset button. The router SHOULD have been cold-reset now. It didn't work for me. I had to go the brutal way:

brutal way:

  1. get the netgear firmware recovery tool for windows from your installation CD or download it from here
  2. the tool is *NOT* for your specific router model, but it will in any case do a good job.
  3. get the latest official firmware for your router, or just get any working one
  4. connect the router to your network card, remove all other net cables (including the ADSL one)
  5. power on the router while pushing the RESET button on the back
  6. release the button after few seconds, when the power led starts quickly blinking red and green: at this point your router is "online" but it doest not reply to PINGs; its IP is 192.168.1.1 but it only accepts UDP connections on the TFTP port
  7. FORGET about "manually" TFTP'ing the firmware to the router: it won't work, there are special timeouts to set and you can't know them
  8. run the tool to flash the router with the firmware at point 3. You need Windows XP 32bit, Windows 7 in "XP SP2 compatibility mode" or any virtual machine player which runs one of the supported Windows OSs, provided that the VM NIC is *BRIDGED* to the network card of your physical host, otherwise the tool can't get the MAC address of the router
  9. if the flashing starts but fails with an error, don't worry: just power off and on the router. You'll see the power led blinking again and you can access the "safe recovery" page at http://192.168.1.1, where a minimal web form allows you to upload the firmware at point 3: do it, this time it will work!

NOTE: (important!) The netgear recovery tool has a buggy GUI. The logic triggering the discovery of your router is bound to the selection of your NIC in a listbox, and won't work if you only have one NIC (because you can't "change" the selection: you just have one option, which is already selected). Therefore, install an additional FAKE NIC driver, no matter what, so that you can change the selection and trigger the logic. I have used "Microsoft Loopback Device", which didn't hurt.

Bootlogs

The uBoot Output (alongside with the uBoot environment) has been captured, as well as the boot log of the original Netgear firmware.

OEM bootlog

...

Tags

Back to top

toh/netgear/dgn3500b.txt · Last modified: 2014/08/17 18:02 by m3m3nt0