Netgear DGND3700 v1 / DGND3800B

N600 Netgear Series. Simultaneous Dual Band DSL Modem/Router. DGND3700 is the Annex A version, supporting only ADSL2+, while the Annex B version DGND3800B also supports VDSL. Apart from that they are the same device.

In theory the N600 Netgear routers can reach 600 Mbps over the wifi, but divided into the two radios 300+300. A unusual feature in this router is that both wifi radios are in the same miniPCI card.

OpenWrt Support

This device is not officially supported by OpenWrt. However you can test a prebuilt firmware, patches included for building your own:

Also available in this git repo (only for compiling):
https://github.com/openwrt-es/barrier-breaker-openwrt/commits/barrier-breaker_14.04

git clone git://github.com/openwrt-es/barrier-breaker-openwrt.git -b barrier-breaker_14.04

Note xDSL isn't supported in OpenWrt for bcm63xx boards like this one, and never will.

Versions

FCC ID: PY310100129 (v1) - External Link

FCC ID: PY311400180 (v2) - External Link

Version/Model Launch Date S/N (3) OpenWrt Special info Box symbol(different chargers) T/A "board_data" Board ID Model Specific Notes
v1 2012-01 2KBxxxxxxxxxx - world wide (Annex A) *DGND3700-100UKS*, PES, NAS 100-15281-01R16 U12L144T01_NETGEAR_NEWLED both wifis on a miniPCI card
3800B 2012-01 2TCxxxxxxxxxx - German market (Annex B, VDSL support) DGND3800B-100GRS 100-16055-01R9 U12L144T11_NETGEAR_NEWLED
v2 ? 2TXxxxxxxxxxx 2TWxxxxxxxxx - ? same with v1 NAS- (USA), PES(EU), UKS(UK) 100-16335-01R1x ? one wifi integrated in SoC, the other connected through miniPCIe

Known routers sharing the same CFE Board ID (96368MVWG), the firmware should be interchangeable between these routers, but this isn't true:

Hardware Highlights

Version/Model SoC CPU Speed Ram NOR Flash NAND Flash Network USB Serial JTag
v1
3800b
BCM6368 400MHz 128MiB 32MiB 128MiB 5 gigE 2x v2.0 Yes ?
v2 BCM6361 400MHz(1) 64MiB(2) 32MiB ??? 5 gigE 2x v2.0 Yes ?

Installation

Backup/restore netgear data partitions

WARNING: It's a good idea to backup the partitions, especially "board_data" (/dev/mtd14), it contains hardware MAC adresses specific for your device, serial number and other info. If you destroy it accidentally, it will be difficult to restore otherwise

To backup the Netgear data partitions:

  • Download the firmware dgnd3700v1_3800b_backport_12.09.zip and install it. Telnet into openwrt
    telnet 192.168.1.1
  • Plug an USB pendrive in the router and mount it with the following command
    mount /dev/sda1 /mnt
  • cd into the mounted pendrive and backup the partitions
    cd /mnt
    dd if=/dev/mtd4 of=netgear_partitions.bin
  • umount the the pendrive and extract it
    cd /
    umount /mnt

Now you have the file netgear_partitions.bin (it contains partitions mtd2 to mtd14). If you want to restore it later (might be if you deleted them accidentally) use again the dgnd3700v1_3800b_backport_12.09.zip firmware and this command

mtd write netgear_partitions.bin netgear_parts

You may also want to backup the CFE bootloader using the same procedure

dd if=/dev/mtd0 of=CFE-dgnd3700v1.bin

OEM flash layout

The operating system and bootloader are stored in the NOR flash

32 MB NOR flash
Offsets Name Partition
0x00000000-0x00020000 CFE n/a
0x00020000-0x00020100 firmware tag n/a
0x00020100-0x01e40000 "rootfs" mtd0
0x00020000-0x01e40000 "fw_upgrade" mtd1
0x01e40000-0x01e60000 "SP" mtd2
0x01e60000-0x01e80000 "MISC" mtd3
0x01e80000-0x01ea0000 "DPF" mtd4
0x01ea0000-0x01ec0000 "T_Meter1" mtd5
0x01ec0000-0x01ee0000 "T_Meter2" mtd6
0x01ee0000-0x01f00000 "ST_Turkey" mtd7
0x01f00000-0x01f20000 "ST_Russian" mtd8
0x01f20000-0x01f40000 "POT" mtd9
0x01f40000-0x01f60000 "ST_German" mtd10
0x01f60000-0x01f80000 "ST_Other" mtd11
0x01f80000-0x01fa0000 "ST_English" mtd12
0x01fa0000-0x01fc0000 "ST_Portuguese" mtd13
0x01fc0000-0x01fe0000 "board_data" mtd14
0x01fe0000-0x02000000 "nvram" mtd15
0x00000000-0x02000000 "whole_flash" mtd16

The "board_data" partition stores some info used by the OEM firmware

"board_data" /dev/mtd14
offsets info example
0x000-0x018 Board ID U12L144T01_NETGEAR_NEWLED
0x040-0x045 LAN MAC adress 00904C1B0007
0x046-0x04B WAN MAC adress 00904C1B00A7
0x04c-0x058 serial number 2KB11B7200F94
0x06c-0x073 WSC PIN 30912472

The NAND flash maybe used for additional storage. But probably used for nothing. It is mounted at /tmp/mnt/storage subdirectory.

128 MB NAND flash
Offsets Name Partition
0x00000000-0x08000000 "storage" mtd18

OEM easy installation

This section deals with how you install OpenWrt from a device freshly opened. First get the OpenWrt .chk firmware for your model:

  • openwrt-DGND3700v1-squashfs-factory.chk
  • openwrt-DGND3800B-squashfs-factory.chk

Open the browser in the Netgear administration web interface, look for "upgrade firmware" and proceed. Wait some minutes until it finish and telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.

Installation using the TFTP method

Serial TTL cable adapter required.

WARNING: Do NOT use openwrt-96368MVWG-generic-squashfs-cfe.bin for flashing this router. This image is for another different router and not compatible. Use openwrt-DGND3700v1_3800B-squashfs-cfe.bin instead.

Method 1 (.bin firmwares)

  1. Set the IP at your pc to 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.
  2. Connect the serial TTL cable, turn on the router and break into CFE pressing any key.
  3. Start a TFTP server in your PC. Copy openwrt-DGND3700v1_3800B-squashfs-cfe.bin firmware to the server.
  4. Exectute the comand f 192.168.1.35:openwrt-DGND3700v1_3800B-squashfs-cfe.bin in the CFE console.

This is a session of flashing via TFTP:

DGND3700 Boot Code V1.0.8 CFE version 1.0.37-104.4 for BCM96368 (32bit,SP,BE) Build Date: Mon Feb 21 17:59:46 CST 2011 (finerain@moonlight) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201 size 32768KB Total Flash size: 32768K with 256 sectors ethsw: found bcm53115! Chip ID: BCM6368B2, MIPS: 400MHz Main Thread: TP1 Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-11) : 96368MVWG Number of MAC Addresses (1-32) : 10 Base MAC Address : 20:4e:7f:c0:b5:4c PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 1 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1\0x081\0x081 CFE> CFE> f 192.168.1.35:openwrt-DGND3700v1_3800B-squashfs-cfe.bin Loading 192.168.1.35:openwrt-DGND3700v1_3800B-squashfs-cfe.bin ... Finished loading 3211268 bytes Flashing root file system and kernel at 0xb8020000: ......................... . *** Image flash done *** ! Resetting board...

Method 2 (.chk firmwares)

  1. Set the IP at your pc to 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.
  2. Connect the serial TTL cable, turn on the router and break into CFE pressing any key.
  3. Exectute the comand tftpd in the CFE console.
  4. Use a tftp client to send the firmware to the router, and wait until it finish.
    • Linux
      tftp 192.168.1.1
      tftp> binary
      tftp> trace
      tftp> put DGND3700-V1.0.0.17.chk
    • Windows
      tftp -i 192.168.1.1 PUT DGND3700-V1.0.0.17.chk 

This is a session of flashing via TFTP:

DGND3700 Boot Code V1.0.8 CFE version 1.0.37-104.4 for BCM96368 (32bit,SP,BE) Build Date: Mon Feb 21 17:59:46 CST 2011 (finerain@moonlight) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201 size 32768KB Total Flash size: 32768K with 256 sectors ethsw: found bcm53115! Chip ID: BCM6368B2, MIPS: 400MHz Main Thread: TP1 Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-11) : 96368MVWG Number of MAC Addresses (1-32) : 10 Base MAC Address : 20:4e:7f:c0:b5:4c PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 1 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 111 CFE> CFE> tftpd Start TFTP server Loading : ... Finished loading 8234291 bytes Loading ............................................................................................. ............................................................... Resetting board...

Restoring OEM firmware

It can be done with the Method 2 described here.

Or from OpenWrt web interface:

  1. Download the Netgear firmware, and rename it to netgear-firmware.chk
  2. Remove the Netgear firmware header (first 65 bytes)
    dd if=netgear-firmware.chk bs=65 skip=1 of=netgear-firmware_noheader.bin
  3. Now you are ready to flash netgear-firmware_noheader.bin via luci, mtd, flashcp or any other method used by OpenWrt to flash a firmware.
  4. Once the flashing procedure finished you are back again with the netgear original firmware.

Failsafe mode

generic.failsafe

Openwrt failsafe: Turn on the router, press/release the button Restore Factory Settings, at the bottom of the router, several times until the green power led starts blinking very fast, then you can access via telnet to OpenWrt.

CFE failsafe: This is for entering in the bootloader command line. Use a serial cable and press any key while loading CFE.
The reset button for entering CFE failsafe doesn't work in this router, however if the router doesn't find any valid firmware in the flash memory, it enters failsafe itself loading the tftpd server, and then you can upload a firmware using a tftp client → see Method 2 point 4

Hardware

Info

Architecture: MIPS
Vendor: Broadcom
Bootloader: CFE
Board ID: 96368MVWG (wrong layout)
System-On-Chip: Broadcom BCM6368
CPU/Speed BMIPS4350 V3.1 / 400 MHz BMIPS Dual Core
NOR Flash-Chip: Spansion S29GL256P10TFI01 / 128KB Sector size x 256 sectors
NOR Flash size: 32 MiB
NAND Flash-Chip: Samsung K9F1G08U0D-SCB0
NAND Flash size: 128 MiB
RAM-Chips: Samsung K4H511638J-LCCC / DDR-400
RAM size: 128 MiB
Wireless: 2x BCM43222 (MiniPCI) BCM4351 802.11b/g/n
BCM4350 802.11a/b/g/n
Ethernet: Broadcom BCM53115 w/ vlan support swconfig
USB yes
Antenna 4x PCB internal
Power Adapter 12V DC 2.5A / Netgear P030WB120B
Serial: Yes
JTAG: ?

Photos

Photo of front and back of the casing:

Photo of PCB

Versions

NOR Chip RAM Chips NAND Chip
SoC WiFi Switch

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Use a serial TTL adapter to connect your PC with the router. Only connect TX, RX and GND.

Settings:

  • Baudrate: 115200
  • Data bits: 8
  • Parity: None
  • Stop bits: 1

The serial port is located at the Jumper J2 on the board:

11 9 7 5 3 1
- - - - - -
GND TX - - RX -
12 10 8 6 4 2

Serial flashing how-to: External Link

GPIOs

The SoC has 38 GPIOs. Some of them used for leds (outputs) and buttons (inputs).

LEDS

System configuration: Leds

Name Color GPIO
power red 22
green 24
lan green 23
usb-back green 14
wifi2g green 26
wifi5g blue 27
dsl green 2
inet red 4
green 5
usb-front green 13
wps green 11

Buttons

hardware.button

Label GPIO
reset 12
wps 35
wlan 10

Switch

This board unlike others BCM6368 boards uses a dedicated BCM53115 Gigabit switch (other boards use the internal fast ethernet switch at the SoC). Here a typical/right configuration:

CFE Bootloader

  1. you could read about bootloader in general

With a serial console we can get some interesting info

About the version and build:

DGND3700 Boot Code V1.0.8
CFE version 1.0.37-104.4 for BCM96368 (32bit,SP,BE)
Build Date: Mon Feb 21 17:59:46 CST 2011 (finerain@moonlight)

And about the possible boards compatible with this CFE:

CFE> 
b

Press:  <enter> to use current value

        '-' to go previous 
parameter

        '.' to clear the current value

        'x' to exit this command

96368VVW         ------- 0 
96368MVWG        ------- 1 
96368SV2         ------- 2 
96368MBG         ------- 3 
96368NTR         ------- 4 
96368MBG6b       ------- 5 
96368VVWB        ------- 6 
96368MVWGB       ------- 7 
96368MNG         ------- 8 
96368MBG6302     ------- 9 
96368MVWGJ       ------- 10
96367AVNG        ------- 11
Board Id (0-11)                   :  1  

Bootlogs

OEM Bootlog

DGND3700 Boot Code V1.0.8 CFE version 1.0.37-104.4 for BCM96368 (32bit,SP,BE) Build Date: Mon Feb 21 17:59:46 CST 2011 (finerain@moonlight) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201 size 32768KB Total Flash size: 32768K with 256 sectors ethsw: found bcm53115! Chip ID: BCM6368B2, MIPS: 400MHz Main Thread: TP0 Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-11) : 96368MVWG Number of MAC Addresses (1-32) : 10 Base MAC Address : 20:4e:7f:c0:b5:4c PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 110 Booting from only image (0xb8020000) ... Code Address: 0x80010000, Entry Address: 0x80298000 Decompression OK! Entry at 0x80298000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 0 buffers found. Closing DMA Channels. Starting program at 0x80298000 Linux version 2.6.21.5 (finerain@sunshine) (gcc version 4.2.3) #1 Fri Oct 21 08:04:47 CST 2011 Parallel flash device: name AM29LV320MT, id 0x2201 size 32768KB 96368MVWG prom init CPU revision is: 0002a031 Determined physical RAM map: memory: 07f00000 @ 00000000 (usable) On node 0 totalpages: 32512 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 222 pages used for memmap Normal zone: 28194 pages, LIFO batch:7 Built 1 zonelists. Total pages: 32258 Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200 brcm mips: enabling icache and dcache... Primary instruction cache 64kB, physically tagged, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, linesize 16 bytes. Synthesized TLB refill handler (21 instructions). Synthesized TLB load handler fastpath (33 instructions). Synthesized TLB store handler fastpath (33 instructions). Synthesized TLB modify handler fastpath (32 instructions). PID hash table entries: 512 (order: 9, 2048 bytes) Using 200.000 MHz high precision timer. Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 126012k/130048k available (2097k kernel code, 4012k reserved, 490k data, 92k init, 0k highmem) KLOB Pool 1 Initialized: 1048576 bytes <0x80300000 ... 0x80400000> Calibrating delay loop... 398.95 BogoMIPS (lpj=997376) Mount-cache hash table entries: 512 wait instruction: enabled NET: Registered protocol family 16 Total Flash size: 32768K with 256 sectors registering PCI controller with io_map_base unset SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb BLOG v2.1 Initialized NET: Registered protocol family 8 NET: Registered protocol family 20 Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc. fuse init (API version 7.8) io scheduler noop registered (default) PPP generic driver version 2.4.2 NET: Registered protocol family 24 physmap platform flash device: 02000000 at b8000000 physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 physmap-flash.0: CFI does not contain boot bank location. Assuming top. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. cmdlinepart partition parsing not available RedBoot partition parsing not available Using physmap partition information Creating 17 MTD partitions on "physmap-flash.0": 0x00020100-0x01e40000 : "rootfs" mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only 0x00020000-0x01e40000 : "fw_upgrade" 0x01e40000-0x01e60000 : "SP" 0x01e60000-0x01e80000 : "MISC" 0x01e80000-0x01ea0000 : "DPF" 0x01ea0000-0x01ec0000 : "T_Meter1" 0x01ec0000-0x01ee0000 : "T_Meter2" 0x01ee0000-0x01f00000 : "T_Meter3" 0x01f00000-0x01f20000 : "T_Meter4" 0x01f20000-0x01f40000 : "POT" 0x01f40000-0x01f60000 : "Reserved1" 0x01f60000-0x01f80000 : "Reserved2" 0x01f80000-0x01fa0000 : "Reserved3" 0x01fa0000-0x01fc0000 : "Reserved4" 0x01fc0000-0x01fe0000 : "board_data" 0x01fe0000-0x02000000 : "nvram" 0x00000000-0x02000000 : "whole_flash" bcm963xx_mtd driver v1.0 File system address: 0xb8020100 Broadcom DSL NAND controller (BrcmNand Controller) i=0, CS[0] = 0 brcmnand_probe: CS0: dev_id=ecf10095 NAND Config: Reg=55042200, chipSize=128 MB, blockSize=128K, erase_shift=11 busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff timing1 not adjusted: 5363444f timing2 not adjusted: 00000fc6 BrcmNAND mfg ec f1 Samsung K9F1G08U0A 128MB Found NAND: ACC=d3000000, cfg=55042200, flashId=ecf10095, tim1=5363444f, tim2=00000fc6 BrcmNAND version = 0x0201 128MB @00000000 brcmnand_probe: CS0: dev_id=ecf10095 1. Found NAND chip on Chip Select 0, chipSize=128MB, usable size=128MB, base=0x00000000 brcmnand_scan: B4 nand_select = 40000002 brcmnand_scan: After nand_select = 40000002 page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17 Brcm NAND controller version = 2.1 NAND flash size 128MB @16000000 brcmnand_scan: mtd->oobsize=64 brcmnand_scan: oobavail=50, eccsize=512, writesize=2048 brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=15, eccbytes=3 brcmnand_default_bbt: bbt_td = bbt_main_descr Bad block table found at page 65472, version 0xFF Bad block table found at page 65408, version 0xFF nand_read_bbt: Bad block at 0x05f00000 numchips=1, size=8000000 Creating 1 MTD partitions on "bcm63xx-nand.0": 0x00000000-0x08000000 : "storage" PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0: EHCI Host Controller ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1 ehci_hcd 0000:00:0a.0: irq 15, io mem 0x10001500 ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00, driver 10 Dec 2004 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver PCI: Enabling device 0000:00:09.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: OHCI Host Controller ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2 ohci_hcd 0000:00:09.0: irq 13, io mem 0x10001600 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected usbcore: registered new interface driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. brcmboard: brcm_board_init entry ===>brcm_board_init: GPIO->GPIOBaseMode=0x3b000 ===>brcm_board_init: GPIO->GPIOMode=0x1f0003 Serial: BCM63XX driver $Revision: 3.00 $ ttyS0 at MMIO 0xb0000100 (irq = 10) is a BCM63XX ttyS1 at MMIO 0xb0000120 (irq = 11) is a BCM63XX bcmxtmrt: Broadcom BCM6368B2 ATM/PTM Network Device v0.3 Oct 21 2011 08:03:27 netem: version 1.2 u32 classifier TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 92k freed init started: BusyBox v1.00 (2011.10.21-00:18+0000) multi-call binary BusyBox v1.00 (2011.10.21-00:18+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... pktflow: module license 'Proprietary' taints kernel. Broadcom Packet Flow Cache Char Driver v2.1 Nov 20 2009 22:08:08 Registered<242> NBUFF v1.0 Initialized Broadcom Packet Flow Cache learning via BLOG enabled. Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Constructed Broadcom Packet Flow Cache v2.1 Nov 20 2009 22:08:06 Broadcom Packet CMF (Experimental) Char Driver v0.1 Nov 20 2009 22:08:03 Registered<232> Broadcom Packet CMF (Experimental) [6368-B2] v0.1 Nov 20 2009 22:08:02 Loaded bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6368B2 Ethernet Network Device v0.1 Oct 21 2011 08:03:17 KLOB extended to 2 pools KLOB extended to 3 pools KLOB extended to 4 pools Config Switch Through SPI Slave Select 1 ethsw: found bcm53115! dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered Broadcom Packet CMF (Experimental) SWC RESET. Broadcom Packet CMF (Experimental) SWC INITIALIZED. KLOB extended to 5 pools KLOB extended to 6 pools KLOB extended to 7 pools KLOB extended to 8 pools Broadcom Packet CMF (Experimental) Forwarder Net Device 0 v0.1 Nov 20 2009 22:08:03 Registered Broadcom Packet CMF (Experimental) Forwarder Net Device 0 v0.1 Nov 20 2009 22:08:03 Registered Broadcom Packet CMF (Experimental) ENABLED. eth0: MAC Address: 20:4E:7F:C0:B5:4D eth1: MAC Address: 20:4E:7F:C0:B5:4C eth2: MAC Address: 20:4E:7F:C0:B5:4C eth3: MAC Address: 20:4E:7F:C0:B5:4C eth4: MAC Address: 20:4E:7F:C0:B5:4C eth0 Link DOWN. eth1 Link DOWN. eth2 Link DOWN. eth3 Link DOWN. eth4 Link DOWN. PCI: Enabling device 0000:00:01.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:01.0 to 64 wl0: Broadcom BCM4351 802.11 Wireless Controller 5.10.120.0.cpe4.404.8 dgasp: kerSysRegisterDyingGaspHandler: wl0 registered PCI: Enabling device 0000:00:02.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:02.0 to 64 wl1: Broadcom BCM4350 802.11 Wireless Controller 5.10.120.0.cpe4.404.8 dgasp: kerSysRegisterDyingGaspHandler: wl1 registered p8021ag: p8021ag_init entry Broadcom Packet Flow Cache learning via BLOG disabled. sh: cannot create /proc/sys/net/ipv4/neigh/br0/base_reachable_time: Directory nonexistent Reading board data... PIN number not found! WSC UUID: 0xd1c9a172b5f7b72f35bb4cf0531b0ec8 wps_uuid=0xd1c9a172b5f7b72f35bb4cf0531b0ec8 klips_info:ipsec_init: KLIPS startup, Openswan KLIPS IPsec stack version: 2.4.9 NET: Registered protocol family 15 klips_info:ipsec_alg_init: KLIPS alg v=0.8.1-0 (EALG_MAX=255, AALG_MAX=251) klips_info:ipsec_alg_init: calling ipsec_alg_static_init() ipsec_3des_init(alg_type=15 alg_id=3 name=3des): ret=0 <6>KLIPS cryptoapi interface: alg_type=15 alg_id=12 name=cbc(aes) keyminbits=128 keymaxbits=256, found(0) KLIPS: lookup for ciphername=cbc(twofish): not found KLIPS: lookup for ciphername=cbc(serpent): not found KLIPS: lookup for ciphername=cbc(cast5): not found KLIPS: lookup for ciphername=cbc(blowfish): not found <6>KLIPS cryptoapi interface: alg_type=15 alg_id=3 name=cbc(des3_ede) keyminbits=192 keymaxbits=192, found(0) <6>KLIPS cryptoapi interface: alg_type=15 alg_id=2 name=cbc(des) keyminbits=64 keymaxbits=64, found(0) ln: /dev/random: File exists device eth1 entered promiscuous mode device eth2 entered promiscuous mode device eth3 entered promiscuous mode device eth4 entered promiscuous mode device wl0 entered promiscuous mode eth3 Link UP 1000 mbps full duplex device wl1 entered promiscuous mode br0: port 6(wl1) entering learning state br0: port 5(wl0) entering learning state br0: port 3(eth3) entering learning state sh: arping: not found xtm command is xtm operate conn --createnetdev 1.8.35 atm0 bcmxtmrt: MAC address: 20 4e 7f c0 b5 4e DSL mode command is xdslctl start --bitswap on --sra off --lpair i --mod dlt2pem --up BcmAdsl_Initialize=0xC010EA10, g_pFnNotifyCallback=0xC0142FD4 Clocks for QPROC and AFE are being aligned with step through ... AFE is aligned, i = 051, PhaseValue = -050, PhaseCntl = 0x3FCD0000 QPROC is aligned, i = 029, PhaseValue = 0050, PhaseCntl = 0x3FCD401D Clocks for QPROC and AFE are aligned with syn_status AFE = 0x70, QPROC = 0x78 AFE phase control reg @0xb0f570f8 default actual = 0x0021C38F, exp = 0x0021c38f QPRC phase control reg @0xb0f5f0c0 default actual = 0x0421C38F, exp = 0x0421c38f pSdramPHY=0xA7FFFFF8, 0xFFFFE2B4 0xFFFFBEEF *** XfaceOffset: 0x5FF90 => 0x5FF90 *** br0: topology change detected, propagating br0: port 6(wl1) entering forwarding state br0: topology change detected, propagating br0: port 5(wl0) entering forwarding state br0: topology change detected, propagating br0: port 3(eth3) entering forwarding state *** PhySdramSize got adjusted: 0xC6F58 => 0xFD610 *** AdslCoreSharedMemInit: shareMemAvailable=10704 AdslCoreHwReset: pLocSbSta=872d8000 bkupThreshold=3072 AdslCoreHwReset: AdslOemDataAddr = 0xA7FBC6D8 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered DSL mode command is xdslctl configure --phycfg 0 0 0 0 0 0x00000002 0x00000000 info, udhcp server (v0.9.8) started error, unable to parse 'option wins ' error, unable to parse 'option domain ' save_router_stats(721): port=2 POT signature check failed. 192.168.0.1 c0a80001 automount: get SIGUSR1. killall: minidlna.exe: no process killed IOCTL_AG_REGION_SET: English Info: No FWPT default policies. httpd: socket bound in 0.0.0.0:80. / # Setting SSID "NETGEAR" Setting SSID "NETGEAR-2" Setting SSID "NETGEAR-3" Setting SSID "NETGEAR-4" br0: port 5(wl0) entering disabled state Chanspec set to 0x2b08 The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. device wl0 is already a member of a bridge; can't enslave it to bridge br0. device wl0.1 entered promiscuous mode device wl0.2 entered promiscuous mode device wl0.3 entered promiscuous mode br0: port 5(wl0) entering learning state Reaped 762 UPnP daemon is ready to run br0: topology change detected, propagating br0: port 5(wl0) entering forwarding state Couldn't open the directory : No such file or directory ftpRestart: killall: bftpd: no process killed Start WPS !! killall: bftpd: no process killed http_d: got signal Setting SSID "NETGEAR-5G" Setting SSID "NETGEAR-5G-2" Setting SSID "NETGEAR-5G-3" Setting SSID "NETGEAR-5G-4" br0: port 6(wl1) entering disabled state Chanspec set to 0x1d26 The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. device wl1 is already a member of a bridge; can't enslave it to bridge br0. device wl1.1 entered promiscuous mode device wl1.2 entered promiscuous mode device wl1.3 entered promiscuous mode br0: port 6(wl1) entering learning state Reaped 1369 UPnP daemon is ready to run br0: topology change detected, propagating br0: port 6(wl1) entering forwarding state Start WPS !!

OpenWrt Bootlog

DGND3700 Boot Code V1.0.8 CFE version 1.0.37-104.4 for BCM96368 (32bit,SP,BE) Build Date: Mon Feb 21 17:59:46 CST 2011 (finerain@moonlight) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201 size 32768KB Total Flash size: 32768K with 256 sectors ethsw: found bcm53115! Chip ID: BCM6368B2, MIPS: 400MHz Main Thread: TP1 Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-11) : 96368MVWG Number of MAC Addresses (1-32) : 10 Base MAC Address : 20:4e:7f:c0:b5:4c PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 1 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1\0x081\0x080 Booting from only image (0xb8020000) ... Code Address: 0x80010000, Entry Address: 0x80010000 LZMA: Prossible old LZMA format, trying to decompress.. Decompression OK! Entry at 0x80010000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 3 buffers found. Closing DMA Channels. Starting program at 0x80010000 [ 0.000000] Linux version 3.3.8 (dani@tool) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #11 Thu Dec 26 19:43:06 CET 2013 [ 0.000000] Detected Broadcom 0x6368 CPU revision b2 [ 0.000000] CPU frequency is 400 MHz [ 0.000000] 128MB of RAM installed [ 0.000000] registering 38 GPIOs [ 0.000000] gpiochip_add: registered GPIOs 0 to 37 on device: bcm63xx-gpio [ 0.000000] board_bcm963xx: Boot address 0xb8000000 [ 0.000000] board_bcm963xx: CFE version: 1.0.37-104.4 [ 0.000000] Overriding boardid with 'DGND3700_3800B' [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 0002a031 (Broadcom BMIPS4350) [ 0.000000] board_bcm963xx: board name: DGND3700_3800B [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000000 -> 0x00008000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] Early memory PFN ranges [ 0.000000] 0: 0x00000000 -> 0x00008000 [ 0.000000] Reserving 0MB of memory at 0MB for crashkernel [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] Memory: 126740k/131072k available (2242k kernel code, 4332k reserved, 405k data, 164k init, 0k highmem) [ 0.000000] NR_IRQS:128 [ 0.000000] Calibrating delay loop... 397.82 BogoMIPS (lpj=795648) [ 0.032000] pid_max: default: 32768 minimum: 301 [ 0.036000] Mount-cache hash table entries: 512 [ 0.044000] NET: Registered protocol family 16 [ 0.052000] registering PCI controller with io_map_base unset [ 0.060000] bio: create slab at 0 [ 0.064000] PCI host bridge to bus 0000:00 [ 0.068000] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff] [ 0.072000] pci_bus 0000:00: root bus resource [io 0x8000000-0x800ffff] [ 0.104000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x30003fff] [ 0.108000] pci 0000:00:02.0: BAR 0: assigned [mem 0x30004000-0x30007fff] [ 0.112000] Switching to clocksource MIPS [ 0.120000] NET: Registered protocol family 2 [ 0.124000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.132000] TCP established hash table entries: 4096 (order: 3, 32768 bytes) [ 0.140000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes) [ 0.144000] TCP: Hash tables configured (established 4096 bind 4096) [ 0.152000] TCP reno registered [ 0.156000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.160000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.168000] NET: Registered protocol family 1 [ 0.176000] audit: initializing netlink socket (disabled) [ 0.180000] type=2000 audit(0.180:1): initialized [ 0.188000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.192000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.204000] msgmni has been set to 247 [ 0.208000] io scheduler noop registered [ 0.212000] io scheduler deadline registered (default) [ 0.216000] bcm63xx_uart.0: ttyS0 at MMIO 0xb0000100 (irq = 10) is a bcm63xx_uart [ 0.224000] console [ttyS0] enabled, bootconsole disabled [ 0.224000] console [ttyS0] enabled, bootconsole disabled [ 0.236000] bcm63xx-rng bcm63xx-rng: registered RNG driver [ 0.244000] physmap platform flash device: 08000000 at 18000000 [ 0.252000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x002201 [ 0.264000] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.268000] Amd/Fujitsu Extended Query version 1.3. [ 0.272000] number of CFI chips: 1 [ 0.276000] bcm63xxpart: CFE boot tag found with version 6 and board type 96368MVWG [ 0.284000] bcm63xxpart: Partition 0 is CFE offset 0 and length 20000 [ 0.292000] bcm63xxpart: Partition 1 is kernel offset 20100 and length fff00 [ 0.296000] bcm63xxpart: Partition 2 is rootfs offset 120000 and length 1d20000 [ 0.304000] bcm63xxpart: Partition 3 is netgear_parts offset 1e40000 and length 1a0000 [ 0.312000] bcm63xxpart: Partition 4 is nvram offset 1fe0000 and length 20000 [ 0.320000] bcm63xxpart: Partition 5 is linux offset 20000 and length 1e20000 [ 0.328000] bcm63xxpart: Spare partition is offset 3e0004 and length 1a5fffc [ 0.336000] 6 bcm63xxpart partitions found on MTD device physmap-flash.0 [ 0.344000] Creating 6 MTD partitions on "physmap-flash.0": [ 0.348000] 0x000000000000-0x000000020000 : "CFE" [ 0.356000] 0x000000020100-0x000000120000 : "kernel" [ 0.360000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.376000] 0x000000120000-0x000001e40000 : "rootfs" [ 0.380000] mtd: partition "rootfs" set to be root filesystem [ 0.388000] mtd: partition "rootfs_data" created automatically, ofs=3E0000, len=1A60000 [ 0.396000] 0x0000003e0000-0x000001e40000 : "rootfs_data" [ 0.404000] 0x000001e40000-0x000001fe0000 : "netgear_parts" [ 0.412000] 0x000001fe0000-0x000002000000 : "nvram" [ 0.420000] 0x000000020000-0x000001e40000 : "linux" [ 0.428000] bcm63xx-spi bcm63xx-spi: at 0xb0000800 (irq 9, FIFOs size 542) v0.1.2 [ 0.516000] b53_common: found switch: BCM53115, rev 8 [ 0.560000] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.568000] TCP cubic registered [ 0.572000] NET: Registered protocol family 17 [ 0.576000] 8021q: 802.1Q VLAN Support v1.8 [ 0.588000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.596000] Freeing unused kernel memory: 164k freed awk: /proc/cpuinfo: No such file or directory [ 4.564000] Button Hotplug driver version 0.4.1 [ 4.584000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled.0/input/input0 - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - jffs2 not ready yet; using ramdisk - init - Please press Enter to activate this console. [ 10.068000] SCSI subsystem initialized [ 10.252000] usbcore: registered new interface driver usbfs [ 10.256000] usbcore: registered new interface driver hub [ 10.264000] usbcore: registered new device driver usb [ 11.308000] wl: module license 'unspecified' taints kernel. [ 11.312000] Disabling lock debugging due to kernel taint [ 11.392000] SSB/BCMA glue driver successfully attached [ 11.400000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002) [ 11.452000] wl0: Broadcom BCM4351 802.11 Wireless Controller 5.10.56.27 [ 11.456000] PCI: Enabling device 0000:00:02.0 (0000 -> 0002) [ 11.512000] wl1: Broadcom BCM4350 802.11 Wireless Controller 5.10.56.27 [ 12.332000] SGI XFS with security attributes, large block/inode numbers, no debug enabled [ 12.372000] PPP generic driver version 2.4.2 [ 12.636000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 12.892000] NET: Registered protocol family 24 [ 13.052000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 13.164000] bcm63xx_ehci bcm63xx_ehci.0: BCM63XX integrated EHCI controller [ 13.168000] bcm63xx_ehci bcm63xx_ehci.0: new USB bus registered, assigned bus number 1 [ 13.200000] bcm63xx_ehci bcm63xx_ehci.0: irq 15, io mem 0xb0001500 [ 13.216000] bcm63xx_ehci bcm63xx_ehci.0: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 13.224000] hub 1-0:1.0: USB hub found [ 13.228000] hub 1-0:1.0: 2 ports detected [ 13.256000] nf_conntrack version 0.5.0 (1982 buckets, 7928 max) [ 13.928000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 14.040000] bcm63xx_ohci bcm63xx_ohci.0: BCM63XX integrated OHCI controller [ 14.044000] bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered, assigned bus number 2 [ 14.052000] bcm63xx_ohci bcm63xx_ohci.0: irq 13, io mem 0xb0001600 [ 14.120000] hub 2-0:1.0: USB hub found [ 14.124000] hub 2-0:1.0: 2 ports detected [ 14.152000] Initializing USB Mass Storage driver... [ 14.160000] usbcore: registered new interface driver usb-storage [ 14.164000] USB Mass Storage support registered. [ 19.636000] device eth0.1 entered promiscuous mode [ 19.640000] device eth0 entered promiscuous mode [ 19.644000] br-lan: port 1(eth0.1) entered forwarding state [ 19.652000] br-lan: port 1(eth0.1) entered forwarding state [ 21.656000] br-lan: port 1(eth0.1) entered forwarding state [ 25.264000] device wl0 entered promiscuous mode [ 25.268000] br-lan: port 2(wl0) entered forwarding state [ 25.276000] br-lan: port 2(wl0) entered forwarding state [ 26.352000] device wl1 entered promiscuous mode [ 26.356000] br-lan: port 3(wl1) entered forwarding state [ 26.360000] br-lan: port 3(wl1) entered forwarding state [ 27.280000] br-lan: port 2(wl0) entered forwarding state [ 28.364000] br-lan: port 3(wl1) entered forwarding state [ 35.216000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0 [ 35.232000] jffs2_build_filesystem(): unlocking the mtd device... done. [ 35.236000] jffs2_build_filesystem(): erasing all blocks after the end marker... done. [ 170.656000] JFFS2 notice: (1125) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. BusyBox v1.19.4 (2013-12-25 00:21:11 CET) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- ATTITUDE ADJUSTMENT (Attitude Adjustment, r36422) ----------------------------------------------------- * 1/4 oz Vodka Pour all ingredients into mixing * 1/4 oz Gin tin with ice, strain into glass. * 1/4 oz Amaretto * 1/4 oz Triple sec * 1/4 oz Peach schnapps * 1/4 oz Sour mix * 1 splash Cranberry juice ----------------------------------------------------- root@OpenWrt:/#

Resources

Source code available at DGND3700_V1.0.0.17_1.0.17_src_full.zip. Toolchain is shared with the Netgear EVG2000 and is available at "gpl-open-source-code-for-programmers"

OEM Firmwares:

DGND3700v1 AnnexA driver has been reported to work on DGND3800B. (ref. Netgear DGND3700 discussion forum)

Tags

Back to top

toh/netgear/dgnd3700.txt · Last modified: 2014/10/09 13:49 by theoradicus