Netgear MBRN3000

The Netgear MBRN3000 is a 3G+ wireless N300 router. It has a 4-port fast ethernet switch and two antennae. It has no DSL interface.

This hardware is currently unsupported in OpenWRT

The manufacturer provided support for the Huawei E398 modem in a later firmware (1.0.0.72) so maybe this router will connect to a 4G LTE network. However, the power supply is rated at 1A max, which may impact the top speed obtained. This limitation could also apply if OpenWRT was loaded. Alternative solutions would be a larger power supply or a USB hub with its own power supply.

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
v1 2010-07 - - derived from DGN2200v1 hardware; supercedes MBR624GU
- - - -
- - - -

NOTE: See also various comments in notes.

Hardware Highlights

CPU Ram Flash Network USB Serial JTag
Broadcom BCM6358@300MHz 32MiB 8MiB 4 x 1 Yes Yes Yes

Installation

Flash Layout

See the example →Flash Layout to understand how to obtain the information.

The information below is taken from the OEM boot log.

Creating 12 MTD partitions on "physmap-flash.0": 0x00010100-0x00770000 : "rootfs" mtd: partition "rootfs" doesn't start on an erase block boundary – force read-only 0x00010000-0x00770000 : "fw_upgrade" 0x00770000-0x00780000 : "ML3" 0x00780000-0x00790000 : "ML4" 0x00790000-0x007a0000 : "ML1" 0x007a0000-0x007b0000 : "ML2" 0x007b0000-0x007c0000 : "T_Meter1" 0x007c0000-0x007d0000 : "T_Meter2" 0x007d0000-0x007e0000 : "POT" 0x007e0000-0x007f0000 : "board_data" 0x007f0000-0x00800000 : "nvram" 0x00000000-0x00800000 : "whole_flash"

With the router booted to Linux… / # cat /proc/mtd dev: size erasesize name mtd0: 0075ff00 00010000 "rootfs" mtd1: 00760000 00010000 "fw_upgrade" mtd2: 00010000 00010000 "ML3" mtd3: 00010000 00010000 "ML4" mtd4: 00010000 00010000 "ML1" mtd5: 00010000 00010000 "ML2" mtd6: 00010000 00010000 "T_Meter1" mtd7: 00010000 00010000 "T_Meter2" mtd8: 00010000 00010000 "POT" mtd9: 00010000 00010000 "board_data" mtd10: 00010000 00010000 "nvram" mtd11: 00800000 00010000 "whole_flash"

Netgear MBRN3000 Flash Layout
Layer0 mtd11 whole_flash
Size 8192KiB
Layer1 CFE mtd1 fw_upgrade mtd2 ML3 mtd3 ML4 mtd4 ML1 mtd5 ML2 mtd6 T_Meter1 mtd7 T_Meter2 mtd8 POT mtd9 board_data mtd10 nvram
Size in KiB 64 7552 64 64 64 64 64 64 64 64 64
Layer2 n/a mtd0 rootfs
Size in KiB 0.25 7551.75
mountpoint n/a /?
filesystem n/a SquashFS?

Note that 0.25 KB (256 bytes) are set aside between the bootloader and the rootfs partition. Also note the comment above (taken from the boot log) about the rootfs being forced into Read-Only status as a consequence of it's offset not being located on a 64KB boundary.

The boot log shows that the physical mapping of the flash chip in memory is 0xbe000000, executable code begins at 0xbe100000 and that the file system is at address 0xbe010100.

OEM easy installation

OEM installation using the TFTP method

Upgrading OpenWrt

Bootlogs

The CFE version is 1.0.37-102.9

OEM bootlog

DGN2200 Boot Code V1.0.5 CFE version 1.0.37-102.9 for BCM96358 (32bit,SP,BE) Build Date: Wed Oct 7 14:22:12 CST 2009 (neil@dev2) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29DL800B, id 0x22cb, size 8192KB CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz CPU running TP0 Total memory: 33554432 bytes (32MB) Boot Address 0xbe000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-5) : 96358VW Number of MAC Addresses (1-32) : 11 Base MAC Address : XX:XX:XX:XX:XX:XX PSI Size (1-64) KBytes : 48 Main Thread Number [0|1] : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 Booting from only image (0xbe010000) ... Code Address: 0x80010000, Entry Address: 0x80299000 Decompression OK! Entry at 0x80299000 Closing network. Closing DMA Channels. Starting program at 0x80299000 Linux version 2.6.21.5 (caelia@localhost.localdomain) (gcc version 4.2.3) #1 Fri Sep 30 16:06:18 CST 2011 Parallel flash device: name AM29DL800B, id 0x22cb, size 8192KB 96358VW prom init CPU revision is: 0002a010 Determined physical RAM map: memory: 01fa0000 @ 00000000 (usable) On node 0 totalpages: 8096 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 31 pages used for memmap Normal zone: 3969 pages, LIFO batch:0 Built 1 zonelists. Total pages: 8033 Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200 brcm mips: enabling icache and dcache... Primary instruction cache 32kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 16kB, 2-way, linesize 16 bytes. Synthesized TLB refill handler (21 instructions). Synthesized TLB load handler fastpath (33 instructions). Synthesized TLB store handler fastpath (33 instructions). Synthesized TLB modify handler fastpath (32 instructions). PID hash table entries: 128 (order: 7, 512 bytes) Using 150.000 MHz high precision timer. Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 29228k/32384k available (2127k kernel code, 3156k reserved, 464k data, 96k init, 0k highmem) KLOB Pool 1 Initialized: 1048576 bytes <0x80300000 ... 0x80400000> Calibrating delay loop... 296.96 BogoMIPS (lpj=148480) Mount-cache hash table entries: 512 NET: Registered protocol family 16 Total Flash size: 8192K with 135 sectors File system address: 0xbe010100 registering PCI controller with io_map_base unset SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb BLOG v1.0 Initialized NET: Registered protocol family 8 NET: Registered protocol family 20 Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro fuse init (API version 7.8) io scheduler noop registered (default) PPP generic driver version 2.4.2 NET: Registered protocol family 24 physmap platform flash device: 00800000 at be000000 physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. cmdlinepart partition parsing not available RedBoot partition parsing not available Using physmap partition information Creating 12 MTD partitions on "physmap-flash.0": 0x00010100-0x00770000 : "rootfs" mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only 0x00010000-0x00770000 : "fw_upgrade" 0x00770000-0x00780000 : "ML3" 0x00780000-0x00790000 : "ML4" 0x00790000-0x007a0000 : "ML1" 0x007a0000-0x007b0000 : "ML2" 0x007b0000-0x007c0000 : "T_Meter1" 0x007c0000-0x007d0000 : "T_Meter2" 0x007d0000-0x007e0000 : "POT" 0x007e0000-0x007f0000 : "board_data" 0x007f0000-0x00800000 : "nvram" 0x00000000-0x00800000 : "whole_flash" PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0: EHCI Host Controller ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1 ehci_hcd 0000:00:0a.0: irq 18, io mem 0xfffe1300 ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00, driver 10 Dec 2004 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver hub 1-0:1.0: over-current change on port 2 PCI: Enabling device 0000:00:09.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: OHCI Host Controller ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2 ohci_hcd 0000:00:09.0: irq 13, io mem 0xfffe1400 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected usbcore: registered new interface driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. usbcore: registered new interface driver cdc_ether usbcore: registered new interface driver mbm usbcore: registered new interface driver usbserial drivers/usb/serial/usb-serial.c: USB Serial support registered for generic usbcore: registered new interface driver usbserial_generic drivers/usb/serial/usb-serial.c: USB Serial Driver core brcmboard: brcm_board_init entry Serial: BCM63XX driver $Revision: 3.00 $ ttyS0 at MMIO 0xfffe0100 (irq = 10) is a BCM63XX ttyS1 at MMIO 0xfffe0120 (irq = 11) is a BCM63XX bcmxtmrt: Broadcom BCM6358A1 ATM Network Device v0.1 Sep 30 2011 16:05:05 netem: version 1.2 u32 classifier TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 96k freed init started: BusyBox v1.00 (2011.09.30-08:11+0000) multi-call binary BusyBox v1.00 (2011.09.30-08:11+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... bcmxtmcfg: module license 'Proprietary' taints kernel. bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6358A1 Ethernet Network Device v0.3 Sep 30 2011 16:04:57 Config Ethernet Switch Through MDIO Pseudo PHY Interface ethsw: found bcm5325e! dgasp: kerSysRegisterDyingGaspHandler: eth0 registered eth0: MAC Address: XX:XX:XX:XX:XX:XX KLOB extended to 2 pools PCI: Enabling device 0000:00:01.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:01.0 to 64 wl: srom not detected, using main memory mapped srom info (wombo board) wl0: wlc_attach: MAC addr from system pool. id:0x776c0000 wl0: MAC Address: XX:XX:XX:XX:XX:XX wl0: Broadcom BCMa8d6 802.11 Wireless Controller 5.10.120.0.cpe4.402.4 dgasp: kerSysRegisterDyingGaspHandler: wl0 registered sh: cannot create /proc/sys/net/ipv4/neigh/br0/base_reachable_time: Directory nonexistent Reading board data... WSC UUID: 0xe13edeb714b787e43d6d5fe9284d2b2d wps_uuid=0xe13edeb714b787e43d6d5fe9284d2b2d drivers/usb/serial/usb-serial.c: USB Serial support registered for Sierra USB modem usbcore: registered new interface driver sierra drivers/usb/serial/sierra.c: USB Driver for Sierra Wireless USB modems: v.1.2.7 hso: drivers/usb/serial/hso.c: 1.2 Option Wireless hso: Registering procfs usbcore: registered new interface driver hso drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1-port) usbcore: registered new interface driver option drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1 usbcore: registered new interface driver cdc_acm drivers/usb/class/cdc-acm.c: v0.25:USB Abstract Control Model driver for USB modems and ISDN adapters usbcore: registered new interface driver kalmia usbcore: registered new interface driver asix device wl0 entered promiscuous mode device eth0 entered promiscuous mode ioctl down: No such device wl0.1: No such device interface wl0.1 does not exist! ioctl down: No such device wl0.2: No such device interface wl0.2 does not exist! ioctl down: No such device wl0.3: No such device interface wl0.3 dbr0: port 2(eth0) entering learning state oes not exist! sh: arping: not found info, udhcp server (v0.9.8) started error, unable to parse 'option wins ' error, unable to parse 'option domain ' br0: topology change detected, propagating br0: port 2(eth0) entering forwarding state Can't find handler for ASP command: wlg_sec_profile_get_security_type(2); Can't find handler for ASP command: wlg_sec_profile_get_security_type(3); Can't find handler for ASP command: wlg_sec_profile_get_security_type(4); POT integrity check OK. POT time is up. KLOB extended to 3 pools ioctl down: No such device Info: No FWPT default policies. SIOCSIFMTU: No such device Setting SSID "ssssss" Setting SSID "NETGEAR-Guest" usbModem_mount(214) read_write_devices(180):count=936 Setting SSID "NETGEAR-Guest2" Setting SSID "NETGEAR-Guest3" maybe_fork(57) xdslctl: devCtl_akerSysDeregisterDyingGaspHandler: dsl0 is deregistering dslConnectionStokerSysDeregisterDyingGaspHandler: dsl0 not (de)registered p error xdslctl: devCtl_adslUninitialize error / #

OpenWrt bootlog

PUT HERE YOUR BOOTLOG

Basic configuration

UNDER REVIEW

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

Specific Configuration

Interfaces

UNDER REVIEW

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi 192.168.1.1/24
vlan0 (eth0.0) LAN ports (1 to 4) None
vlan1 (eth0.1) WAN port DHCP
wl0 WiFi Disabled

Switch Ports (for VLANs)

UNDER REVIEW

Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.

Port Switch port
Internet (WAN) 4
LAN 1 3
LAN 2 2
LAN 3 1
LAN 4 0

Failsafe mode

Buttons

UNDER REVIEW

hardware.button on howto use and configure the hardware button(s).

The Linksys WRT54GL has two buttons. They are Reset and Secure Easy Setup. Here, we merely name the buttons, so we can use them in the above Howto:

BUTTON Event
Reset reset
Secure Easy Setup ses

Hardware

Info

Architecture: MIPS
Vendor: Broadcom
Bootloader: CFE
System-On-Chip: BCM6358 (MIPS32)
CPU/Speed VIPER / 300 MHz
Flash-Chip: MX 29LV640EBTI-70G
Flash size: 8 MiB
RAM: 32 MiB
Wireless: Broadcom BCM4322 802.11abgn
Ethernet: Broadcom BCM5325E fast ethernet
Internet: 3G
USB: Yes 1 x 2.0
Serial: Yes
JTAG: Yes

Note: the OEM boot log reports the flash chip to be AM29DL800B (8192 KB).

Photos

Model Number

Front:

Photo of front of the casing

Back:

Photo of back of the casing

Opening the case

Note: This will void your warranty!

  • To remove the cover first remove the four rubber feet
  • undo the screws (Torx 9 screwdriver)
  • holding everything together turn it over and then raise the lid as well as the clear plastic strip

Main PCB

Photo of PCB

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Photo of PCB with markings netgear_mbrn3000_pcb_a.jpg

The serial console gives you full access to the bootloader and a root shell once the factory firmware is booted.

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

Debricking

Bootloader Mods

  1. you could read about bootloader in general

Hardware mods

  1. as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

128MiB RAM Mod

I²C GPIO Mod

I²C Tiny-USB Mod

Notes

On the wikidevi page for the Netgear DGN2200 v1 it states that the same hardware was used on the MBRN3000. http://www.wikidevi.com/wiki/Netgear_DGN2200v1

This seems to be confirmed on the following site which has photos of the serial and jtag connectors. It also has the pin configurations. http://www.hwupgrade.it/forum/showthread.php?t=2250489

Some notes regarding the memory chips:

  • The flash memory chip on the PCB of the DGN2200v1 displayed is the same as on the MBRN3000.
  • On the wikidevi site for DGN2200v1 the information re flash memory chip should be treated with caution.
  • The RAM chip on the DGN2200v1 is not the same as on the MBRN3000. The DGN2200v1 has a Samsung chip and at least one MBRN3000 has Winbond

Some comments on the serial port pins shown on the hwupgrade site:

  • the unpopulated header is designated J5 (see second photo on the thread)
  • pin 1 is to the right-hand side and is labelled 1
  • the reported pin-out is Gnd : RX : — : — : TX : VCC (commencing with pin 6 and ending with pin 1)
  • however, note that the router will be transmitting on pin 5, so that's where you connect the PC's RX line (assuming a voltage level changer in between as well)
  • from the router perspective the J5 pin-out is Gnd : TX : — : — : RX : VCC (commencing with pin 6 and ending with pin 1)

The OpenWRT documentation for the Broadcom BCM63xx range of CPUs is here : http://wiki.openwrt.org/doc/hardware/soc/soc.broadcom.bcm63xx

On this page it states that working drivers are available for ethernet and usb.

In theory it will be possible to run OpenWRT on the MBRN3000.

Hidden page

In the default firmware (which is based on Linux), there is a hidden wifi configuration page that can be accessed by visiting http://www.routerlogin.net/WiFi_HiddenPage.htm

For more details see netgear forum thread.

Tags

For some Help with the Tags, please have a look here: tags

Back to top

toh/netgear/mbrn3000.txt · Last modified: 2014/04/20 21:41 by jeq