NETGEAR DGND3700 v1 / DGND3800B

N600 Netgear Series. Simultaneous Dual Band DSL Modem/Router. DGND3700v1 ships with the Annex A DSL driver, which is limited by the stock firmware user interface up to ADSL2+. DGND3800B ships with the Annex B DSL driver, and the stock firmware also allows enabling VDSL2 (17a). Apart from that they are the same device.

In theory the N600 Netgear routers can reach 600 Mbps over the Wi-Fi, but divided into the two radios 300+300. An unusual feature in this router is that both wifi radios are in the same miniPCI card.

The DGND3700v2 is a totally different router, not covered in this page.

DSL will not work at all on devices with BCM63xx DSL chipset (due to unavailability of FLOSS driver for Broadcom chips). Consider this when choosing a device to buy, or when deciding to flash OpenWrt on your device because it is listed as supported.
See Broadcom DSL, Unsupported: DSL modem and Broadcom BCM63xx for details.

Devices with Broadcom WiFi chipsets have limited OpenWrt supportability (due to limited FLOSS driver availability for Broadcom chips). Consider this when choosing a device to buy, or when deciding to flash OpenWrt on your device because it is listed as supported. See Broadcom WiFi for details.

  • NAND flash supported since r13327
Version/Model FCC ID Launch Date S/N (3) Special info Box symbol(different chargers) T/A “board_data” Board ID Model Specific Notes
DGND3700v1 PY310100129 2012-01 2KBxxxxxxxxxx world wide (Annex A) *DGND3700-100UKS*, PES, NAS 100-15281-01R16 U12L144T01_NETGEAR_NEWLED both wifis on the same miniPCI card
DGND3800B 2012-01 2TCxxxxxxxxxx German market (Annex B, VDSL support) DGND3800B-100GRS 100-16055-01R9 U12L144T11_NETGEAR_NEWLED
DGND3700v2 PY311400180 ? 2TXxxxxxxxxxx 2TWxxxxxxxxx ? same with v1 NAS- (USA), PES(EU), UKS(UK) 100-16335-01R1x ? one wifi integrated in SoC, the other connected through miniPCIe

Spite the CFE Board ID is 96368MVWG, the firmware from other routers using this Board ID isn't compatible.

Old firmwares

Old firmwares

Version Release date firmware download link notes Tested
LEDE Reboot 17.01.4 2017-10-18 http://downloads.lede-project.org/releases/17.01.4/targets/brcm63xx/smp/ SMP. b43 wifi drivers installed
Chaos Calmer 15.05.1 2016-09-11 http://downloads.openwrt.org/chaos_calmer/15.05.1/brcm63xx/smp/ Warning!! this firmware will brick the router
Chaos Calmer 15.05 2015-09-14 http://archive.openwrt.org/chaos_calmer/15.05/brcm63xx/smp/ SMP, b43 wifi drivers installed
Barrier Breaker 2014-10-02 dgnd3700v1_3800b_openwrt-14.07-SMP-wl.zip SMP, wl wifi drivers, plus extra stuff. Unofficial backport
Attitude Adjustment 2013-04-25 dgnd3700v1_3800b_backport_12.09.zip BCM53 backport, wl drivers. Unofficial backport
dgnd3700v1_3800b_backport_12.09_SMP.zip SMP, BCM53 backport, kernel modules not compatible with online repositories. Unofficial backport

In latest OpenWrt versions the b43 wifi driver is installed by default, therefore N mode isn't available, and sometimes when configuring wifi interfaces, one radio gets disabled by itself (restart is required to make it work again) → see https://forum.openwrt.org/viewtopic.php?pid=302218

It's also possible to use the wl propietary drivers, for providing the N mode, but they are buggy. It's recommended to replace the miniPCI wifi card by another better supported like Atheros (i.e ath9k), or Ralink

Install OpenWrt (generic explanation)

This section deals with how you install OpenWrt from a device freshly opened. First get the OpenWrt -factory.chk firmware for your model as shown above.

Open the browser in the Netgear administration web interface, default IP and credentials are:

look for “upgrade firmware” and proceed. Wait some minutes until it finish. Once Openwrt is installed, telnet/ssh to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.

A small number of users, reported unsuccessful flashing of DGND3800B from stock FW 3.0.0.16 by .chk image. See this topic. If this is your case, first use the custom Barrier Breaker factory build:

dgnd3700v1_3800b_openwrt-14.07-SMP-wl.zip

Once you installed this Openwrt firmware, upgrade to the latest stable version using the sysupgrade.bin image as shown above.

Serial TTL cable adapter required.

WARNING: Do NOT use openwrt-96368MVWG-generic-squashfs-cfe.bin for flashing this router. This image is for another different router and not compatible. Use openwrt-DGND3700v1_3800B-squashfs-cfe.bin instead.

Method 1 (.bin firmwares)

  1. Set the IP at your pc to 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.
  2. Connect the serial TTL cable, turn on the router and break into CFE pressing any key.
  3. Start a TFTP server in your PC. Copy openwrt-DGND3700v1_3800B-squashfs-cfe.bin firmware to the server.
  4. Execute the comand f 192.168.1.35:openwrt-DGND3700v1_3800B-squashfs-cfe.bin in the CFE console.

This is a session of flashing via TFTP:

DGND3700 Boot Code V1.0.8 CFE version 1.0.37-104.4 for BCM96368 (32bit,SP,BE) Build Date: Mon Feb 21 17:59:46 CST 2011 (finerain@moonlight) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201 size 32768KB Total Flash size: 32768K with 256 sectors ethsw: found bcm53115! Chip ID: BCM6368B2, MIPS: 400MHz Main Thread: TP1 Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-11) : 96368MVWG Number of MAC Addresses (1-32) : 10 Base MAC Address : 20:4e:7f:c0:b5:4c PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 1 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1\0x081\0x081 CFE> CFE> f 192.168.1.35:openwrt-DGND3700v1_3800B-squashfs-cfe.bin Loading 192.168.1.35:openwrt-DGND3700v1_3800B-squashfs-cfe.bin ... Finished loading 3211268 bytes Flashing root file system and kernel at 0xb8020000: ......................... . *** Image flash done *** ! Resetting board...


Method 2 (.chk firmwares)

  1. Set the IP at your pc to 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.
  2. Connect the serial TTL cable, turn on the router and break into CFE pressing any key.
  3. Execute the comand tftpd in the CFE console.
  4. Use a tftp client to send the firmware to the router, and wait until it finish.
    • Linux
      tftp 192.168.1.1
      tftp> binary
      tftp> trace
      tftp> put DGND3700-V1.0.0.17.chk
    • Windows
      tftp -i 192.168.1.1 PUT DGND3700-V1.0.0.17.chk 

This is a session of flashing via TFTP:

DGND3700 Boot Code V1.0.8 CFE version 1.0.37-104.4 for BCM96368 (32bit,SP,BE) Build Date: Mon Feb 21 17:59:46 CST 2011 (finerain@moonlight) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201 size 32768KB Total Flash size: 32768K with 256 sectors ethsw: found bcm53115! Chip ID: BCM6368B2, MIPS: 400MHz Main Thread: TP1 Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-11) : 96368MVWG Number of MAC Addresses (1-32) : 10 Base MAC Address : 20:4e:7f:c0:b5:4c PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 1 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 111 CFE> CFE> tftpd Start TFTP server Loading : ... Finished loading 8234291 bytes Loading ............................................................................................. ............................................................... Resetting board...


It can be done with the Method 2 described here.

Or from OpenWrt web interface:

  1. Download the Netgear firmware, and rename it to netgear-firmware.chk
  2. Remove the Netgear firmware header (first 65 bytes)
    dd if=netgear-firmware.chk bs=65 skip=1 of=netgear-firmware_noheader.bin
  3. Now you are ready to flash netgear-firmware_noheader.bin via luci, mtd, flashcp or any other method used by OpenWrt to flash a firmware.
  4. Once the flashing procedure finished you are back again with the netgear original firmware.

failsafe_and_factory_reset

Openwrt failsafe: Turn on the router, press/release the button Restore Factory Settings, at the bottom of the router, several times until the green power led starts blinking very fast, then you can access via telnet to OpenWrt.

CFE failsafe: This is for entering in the bootloader command line. Use a serial cable and press any key while loading CFE.
The reset button for entering CFE failsafe doesn't work in this router, however if the router doesn't find any valid firmware in the flash memory, it enters failsafe itself loading the tftpd server, and then you can upload a firmware using a tftp client → see Method 2 point 4

Architecture MIPS
Vendor Broadcom
bootloader cfe
Board ID 96368MVWG (wrong layout)
System-On-Chip Broadcom BCM6368
CPU/Speed BMIPS4350 V3.1 / 400 MHz BMIPS Dual Core
NOR Flash-Chip Spansion S29GL256P10TFI01 / 128KB Sector size x 256 sectors
NOR Flash size 32 MiB
NAND Flash-Chip Samsung K9F1G08U0D-SCB0
NAND Flash size 128 MiB
RAM-Chips Samsung K4H511638J-LCCC / DDR-400
RAM size 128 MiB
Wireless 2x BCM43222 (both in the same MiniPCI) BCM4351 802.11b/g/n
BCM4350 802.11a/b/g/n
Ethernet Broadcom BCM53115 5x1GbE switch w/ vlan support swconfig
Modem xDSL, up to VDSL2 (17a)
USB yes
Antenna 4x PCB internal attached via UFL connector
Power Adapter 12V DC 2.5A / Netgear P030WB120B
Serial Yes
JTAG ?

CASING
dgnd3700v1_case1.jpg dgnd3700v1_case2.jpg

BOARD
dgnd3800b_pcb-top-with-serial-pins.jpg

NOR Chip RAM Chips NAND Chip
ASCII ASCII ASCII
SoC WiFi Switch
ASCII ASCII ASCII

This router uses an internal detachable miniPCI wifi card. It's dual band, with two BCM43222 radios. The first radio operates at 2.4GHz band, the second operates at 5GHz band but also capable of working in 2GHz band. Unfortunatelly Broadcom's wifi are bad supported under Linux caused by the lack of specifications/FLOSS drivers. Also the wl propietary drivers are buggy.

wl dumps from the OEM firmware:

/ # wlctl -i wl0 revinfo vendorid 0x14e4 deviceid 0x4351 radiorev 0x62056000 chipnum 0xa8d6 chiprev 0x0 corerev 0x10 boardid 0x4d4 boardvendor 0x14e4 boardrev P302 driverrev 0x50a7800 ucoderev 0x1fc0095 bus 0x1 phytype 0x4 phyrev 0x6 anarev 0x8 / # wlctl -i wl0 srdump srom[000]: 0x2001 0x0000 0x04d4 0x14e4 0x4351 0x8000 0x0002 0x0000 srom[008]: 0x1730 0x1800 0x0000 0x0000 0xffff 0xffff 0xffff 0xffff srom[016]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[024]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[032]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[040]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[048]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[056]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[064]: 0x5372 0x1302 0x0200 0x0000 0x3402 0x0000 0x0090 0x4c1b srom[072]: 0x0007 0x0000 0x0000 0xffff 0xffff 0xffff 0x0303 0x0202 srom[080]: 0xffff 0x0033 0xffff 0xffff 0xffff 0xffff 0xffff 0x0325 srom[088]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[096]: 0x204e 0xfeb1 0x171b 0xfa7f 0x3e46 0x4646 0xffff 0xffff srom[104]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[112]: 0x204e 0xfea9 0x1650 0xfaab 0x3e46 0x4646 0xffff 0xffff srom[120]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[128]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[136]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[144]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[152]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[160]: 0x0000 0x0000 0x6422 0x0000 0x6420 0x0000 0x6420 0x0000 srom[168]: 0x6420 0x0000 0x6422 0x2222 0x8644 0x5555 0x8655 0x5555 srom[176]: 0xa866 0x0000 0x6420 0x0000 0x6420 0x0000 0x7420 0x0000 srom[184]: 0x8642 0x0000 0x6420 0x0000 0x6420 0x0000 0x7420 0x0000 srom[192]: 0x8642 0x2222 0x6420 0x2222 0x7420 0x2222 0x7420 0x2222 srom[200]: 0x8642 0x0000 0x0000 0x0000 0x0000 0xffff 0xffff 0xffff srom[208]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[216]: 0xffff 0xffff 0xffff 0xfd08 / # wlctl -i wl0 perm_etheraddr perm_etheraddr 00:90:4C:1B:00:07 # wlctl -i wl0 nvram_dump sromrev=8 boardrev=0x1302 boardflags=0x200 boardflags2=0x3402 boardtype=0x4d4 boardnum=7 regrev=0 pa0b0=0xfeb1 pa0b1=0x171b pa0b2=0xfa7f pa0itssit=32 pa0maxpwr=78 opo=0 aa2g=3 aa5g=3 ag0=2 ag1=2 ag2=255 ag3=255 pa1b0=0xffff pa1b1=0xffff pa1b2=0xffff pa1lob0=0xffff pa1lob1=0xffff pa1lob2=0xffff pa1hib0=0xffff pa1hib1=0xffff pa1hib2=0xffff pa1itssit=62 pa1maxpwr=70 pa1lomaxpwr=70 pa1himaxpwr=70 bxa2g=3 rssisav2g=7 rssismc2g=15 rssismf2g=15 bxa5g=3 rssisav5g=7 rssismc5g=15 rssismf5g=15 tri2g=255 tri5g=255 tri5gl=255 tri5gh=255 rxpo2g=-1 rxpo5g=-1 txchain=3 rxchain=3 antswitch=0 tssipos2g=1 extpagain2g=2 pdetrange2g=4 triso2g=3 antswctl2g=0 tssipos5g=1 extpagain5g=3 pdetrange5g=31 triso5g=7 antswctl5g=31 tempthresh=255 tempoffset=255 cck2gpo=0 ofdm2gpo=1679949824 ofdm5gpo=1679818752 ofdm5glpo=1679818752 ofdm5ghpo=1679818752 mcs2gpo0=0 mcs2gpo1=25634 mcs2gpo2=8738 mcs2gpo3=34372 mcs2gpo4=21845 mcs2gpo5=34389 mcs2gpo6=21845 mcs2gpo7=43110 mcs5gpo0=0 mcs5gpo1=25632 mcs5gpo2=0 mcs5gpo3=25632 mcs5gpo4=0 mcs5gpo5=29728 mcs5gpo6=0 mcs5gpo7=34370 mcs5glpo0=0 mcs5glpo1=25632 mcs5glpo2=0 mcs5glpo3=25632 mcs5glpo4=0 mcs5glpo5=29728 mcs5glpo6=0 mcs5glpo7=34370 mcs5ghpo0=8738 mcs5ghpo1=25632 mcs5ghpo2=8738 mcs5ghpo3=29728 mcs5ghpo4=8738 mcs5ghpo5=29728 mcs5ghpo6=8738 mcs5ghpo7=34370 cddpo=0 stbcpo=0 bw40po=0 bwduppo=0 ccode= macaddr=00:90:4c:1b:00:07 maxp2ga0=78 itt2ga0=32 itt5ga0=62 pa2gw0a0=0xfeb1 pa2gw1a0=0x171b pa2gw2a0=0xfa7f maxp5ga0=70 maxp5gha0=70 maxp5gla0=70 pa5gw0a0=0xffff pa5gw1a0=0xffff pa5gw2a0=0xffff pa5glw0a0=0xffff pa5glw1a0=0xffff pa5glw2a0=0xffff pa5ghw0a0=0xffff pa5ghw1a0=0xffff pa5ghw2a0=0xffff maxp2ga1=78 itt2ga1=32 itt5ga1=62 pa2gw0a1=0xfea9 pa2gw1a1=0x1650 pa2gw2a1=0xfaab maxp5ga1=70 maxp5gha1=70 maxp5gla1=70 pa5gw0a1=0xffff pa5gw1a1=0xffff pa5gw2a1=0xffff pa5glw0a1=0xffff pa5glw1a1=0xffff pa5glw2a1=0xffff pa5ghw0a1=0xffff pa5ghw1a1=0xffff pa5ghw2a1=0xffff maxp2ga2=255 itt2ga2=255 itt5ga2=255 pa2gw0a2=0xffff pa2gw1a2=0xffff pa2gw2a2=0xffff maxp5ga2=255 maxp5gha2=255 maxp5gla2=255 pa5gw0a2=0xffff pa5gw1a2=0xffff pa5gw2a2=0xffff pa5glw0a2=0xffff pa5glw1a2=0xffff pa5glw2a2=0xffff pa5ghw0a2=0xffff pa5ghw1a2=0xffff pa5ghw2a2=0xffff maxp2ga3=255 itt2ga3=255 itt5ga3=255 pa2gw0a3=0xffff pa2gw1a3=0xffff pa2gw2a3=0xffff maxp5ga3=255 maxp5gha3=255 maxp5gla3=255 pa5gw0a3=0xffff pa5gw1a3=0xffff pa5gw2a3=0xffff pa5glw0a3=0xffff pa5glw1a3=0xffff pa5glw2a3=0xffff pa5ghw0a3=0xffff pa5ghw1a3=0xffff pa5ghw2a3=0xffff devid=0x4351 / # wlctl -i wl1 revinfo vendorid 0x14e4 deviceid 0x4350 radiorev 0x62056000 chipnum 0xa8d6 chiprev 0x0 corerev 0x10 boardid 0x4d2 boardvendor 0x14e4 boardrev P311 driverrev 0x50a7800 ucoderev 0x1fc0095 bus 0x1 phytype 0x4 phyrev 0x6 anarev 0x8 / # wlctl -i wl1 srdump srom[000]: 0x2001 0x0000 0x04d2 0x14e4 0x4350 0x8000 0x0002 0x0000 srom[008]: 0x1730 0x1800 0x0000 0x0000 0xffff 0xffff 0xffff 0xffff srom[016]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[024]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[032]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[040]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[048]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[056]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[064]: 0x5372 0x1311 0x0200 0x0000 0x0000 0x0000 0x0090 0x4c19 srom[072]: 0x0005 0x0000 0x0000 0xffff 0xffff 0xffff 0x0303 0x0202 srom[080]: 0xffff 0x0033 0xffff 0xffff 0xffff 0xffff 0xffff 0x0325 srom[088]: 0x0325 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[096]: 0x204e 0xffff 0xffff 0xffff 0x3e46 0x4646 0xfebc 0x153b srom[104]: 0xfad2 0xfebc 0x153b 0xfad2 0xfed9 0x1552 0xfb00 0x0000 srom[112]: 0x204e 0xffff 0xffff 0xffff 0x3e46 0x4646 0xfee1 0x151d srom[120]: 0xfafc 0xfee1 0x151d 0xfafc 0xfeda 0x1567 0xfaf0 0x0000 srom[128]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[136]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[144]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[152]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[160]: 0x0000 0x0000 0x6422 0x0000 0x6420 0x0000 0x6420 0x0000 srom[168]: 0x6420 0x0000 0x6422 0x2222 0x8644 0x5555 0x8655 0x5555 srom[176]: 0xa866 0x0000 0x6420 0x0000 0x6420 0x0000 0x7420 0x0000 srom[184]: 0x8642 0x0000 0x6420 0x0000 0x6420 0x0000 0x7420 0x0000 srom[192]: 0x8642 0x2222 0x6420 0x2222 0x7420 0x2222 0x7420 0x2222 srom[200]: 0x8642 0x0000 0x0000 0x0000 0x0000 0xffff 0xffff 0xffff srom[208]: 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff 0xffff srom[216]: 0xffff 0xffff 0xffff 0xbe08 / # wlctl -i wl1 perm_etheraddr perm_etheraddr 00:90:4C:19:00:05 / # wlctl -i wl1 nvram_dump sromrev=8 boardrev=0x1311 boardflags=0x200 boardflags2=0x0 boardtype=0x4d2 boardnum=5 regrev=0 pa0b0=0xffff pa0b1=0xffff pa0b2=0xffff pa0itssit=32 pa0maxpwr=78 opo=0 aa2g=3 aa5g=3 ag0=2 ag1=2 ag2=255 ag3=255 pa1b0=0xfebc pa1b1=0x153b pa1b2=0xfad2 pa1lob0=0xfebc pa1lob1=0x153b pa1lob2=0xfad2 pa1hib0=0xfed9 pa1hib1=0x1552 pa1hib2=0xfb00 pa1itssit=62 pa1maxpwr=70 pa1lomaxpwr=70 pa1himaxpwr=70 bxa2g=3 rssisav2g=7 rssismc2g=15 rssismf2g=15 bxa5g=3 rssisav5g=7 rssismc5g=15 rssismf5g=15 tri2g=255 tri5g=255 tri5gl=255 tri5gh=255 rxpo2g=-1 rxpo5g=-1 txchain=3 rxchain=3 antswitch=0 tssipos2g=1 extpagain2g=2 pdetrange2g=4 triso2g=3 antswctl2g=0 tssipos5g=1 extpagain5g=2 pdetrange5g=4 triso5g=3 antswctl5g=0 tempthresh=255 tempoffset=255 cck2gpo=0 ofdm2gpo=1679949824 ofdm5gpo=1679818752 ofdm5glpo=1679818752 ofdm5ghpo=1679818752 mcs2gpo0=0 mcs2gpo1=25634 mcs2gpo2=8738 mcs2gpo3=34372 mcs2gpo4=21845 mcs2gpo5=34389 mcs2gpo6=21845 mcs2gpo7=43110 mcs5gpo0=0 mcs5gpo1=25632 mcs5gpo2=0 mcs5gpo3=25632 mcs5gpo4=0 mcs5gpo5=29728 mcs5gpo6=0 mcs5gpo7=34370 mcs5glpo0=0 mcs5glpo1=25632 mcs5glpo2=0 mcs5glpo3=25632 mcs5glpo4=0 mcs5glpo5=29728 mcs5glpo6=0 mcs5glpo7=34370 mcs5ghpo0=8738 mcs5ghpo1=25632 mcs5ghpo2=8738 mcs5ghpo3=29728 mcs5ghpo4=8738 mcs5ghpo5=29728 mcs5ghpo6=8738 mcs5ghpo7=34370 cddpo=0 stbcpo=0 bw40po=0 bwduppo=0 ccode= macaddr=00:90:4c:19:00:05 maxp2ga0=78 itt2ga0=32 itt5ga0=62 pa2gw0a0=0xffff pa2gw1a0=0xffff pa2gw2a0=0xffff maxp5ga0=70 maxp5gha0=70 maxp5gla0=70 pa5gw0a0=0xfebc pa5gw1a0=0x153b pa5gw2a0=0xfad2 pa5glw0a0=0xfebc pa5glw1a0=0x153b pa5glw2a0=0xfad2 pa5ghw0a0=0xfed9 pa5ghw1a0=0x1552 pa5ghw2a0=0xfb00 maxp2ga1=78 itt2ga1=32 itt5ga1=62 pa2gw0a1=0xffff pa2gw1a1=0xffff pa2gw2a1=0xffff maxp5ga1=70 maxp5gha1=70 maxp5gla1=70 pa5gw0a1=0xfee1 pa5gw1a1=0x151d pa5gw2a1=0xfafc pa5glw0a1=0xfee1 pa5glw1a1=0x151d pa5glw2a1=0xfafc pa5ghw0a1=0xfeda pa5ghw1a1=0x1567 pa5ghw2a1=0xfaf0 maxp2ga2=255 itt2ga2=255 itt5ga2=255 pa2gw0a2=0xffff pa2gw1a2=0xffff pa2gw2a2=0xffff maxp5ga2=255 maxp5gha2=255 maxp5gla2=255 pa5gw0a2=0xffff pa5gw1a2=0xffff pa5gw2a2=0xffff pa5glw0a2=0xffff pa5glw1a2=0xffff pa5glw2a2=0xffff pa5ghw0a2=0xffff pa5ghw1a2=0xffff pa5ghw2a2=0xffff maxp2ga3=255 itt2ga3=255 itt5ga3=255 pa2gw0a3=0xffff pa2gw1a3=0xffff pa2gw2a3=0xffff maxp5ga3=255 maxp5gha3=255 maxp5gla3=255 pa5gw0a3=0xffff pa5gw1a3=0xffff pa5gw2a3=0xffff pa5glw0a3=0xffff pa5glw1a3=0xffff pa5glw2a3=0xffff pa5ghw0a3=0xffff pa5ghw1a3=0xffff pa5ghw2a3=0xffff devid=0x4350


It's recommended to replace this Broadcom wifi by another well supported, like Atheros 9k.

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Use a serial TTL adapter to connect your PC with the router. Only connect TX, RX and GND.

Settings:

  • Baudrate: 115200
  • Data bits: 8
  • Parity: None
  • Stop bits: 1

The serial port is located at the Jumper J2 on the board:

GND TX RX 11 9 7 5 3 1 J2 12 10 8 6 4 2

If you're using an RPi Prolific adapter; connect black to GND, White to TX and Green to RX

Serial flashing how-to: External Link

Serial Peripheral Interface

The BCM6368 SoC has a SPI controller. On this board the pins are exposed, at the place for probably a VoIP Legerity chip which isn't soldered. We can use this SPI interface for connecting our own SPI stuff, but we need to build the kernel with the drivers and proper platform data code for registering the SPI device. This is the pinout:

Kernel code example for spidev kernel module (board_bcm963xx.c), the added code is diff highlighted:

static struct spi_board_info DGND3700v1_3800B_spi_devices[] = {
+	{
+		.bus_num	= 0,
+		.chip_select	= 0,
+		.mode		= 0,
+		.max_speed_hz	= 20000000,
+		.modalias	= "spidev",
+	},
	{
		.modalias = "b53-switch",
		.max_speed_hz = 781000,
		.bus_num = 0,
		.chip_select = 1,
		.platform_data = &DGND3700v1_3800B_b53_pdata,
	},
};
 
static struct board_info __initdata board_DGND3700v1_3800B = {
	.name				= "DGND3700v1_3800B",
	.expected_cpu_id		= 0x6368,
 
	.has_uart0			= 1,
	.has_pci			= 1,
	.has_ohci0			= 1,
	.has_ehci0			= 1,
	.num_usbh_ports			= 2,
 
	.has_enetsw			= 1,
	.enetsw = {
		.used_ports = {
			[5] = {
				.used  = 1,
				.phy_id  = 0xff,
				.bypass_link = 1,
				.force_speed = 1000,
				.force_duplex_full = 1,
				.name  = "RGMII",
			},
		},
	},
 
	.spis = DGND3700v1_3800B_spi_devices,
	.num_spis = ARRAY_SIZE(DGND3700v1_3800B_spi_devices),
};

Or we can use the dts file (bcm6368-netgear-dgnd3700-v1.dts) instead:

&lsspi {
+	spidev@0 {
+		compatible = "lwn,bk4";
+		spi-max-frequency = <20000000>;
+		reg = <0>;
+	};
 
        switch@1 {
		compatible = "brcm,bcm53115";
		reg = <1>;
		spi-max-frequency = <781000>;
 
		lede,alias = "eth0";
 
		ports {
			#address-cells = <1>;
			#size-cells = <0>;
 
			wan@0 {
				reg = <0>;

The SoC has 38 GPIOs. Some of them used for leds (outputs) and buttons (inputs).

LEDS

System configuration: Leds

Name Color GPIO
power red 22
green 24
lan green 23
usb-back green 14
wifi2g green 26
wifi5g blue 27
dsl green 2
inet red 4
green 5
usb-front green 13
wps green 11

Buttons

hardware.button

Label GPIO
reset 12
wps 35
wlan 10

This board unlike others BCM6368 boards uses a dedicated BCM53115 Gigabit switch (other boards use the internal fast ethernet switch at the SoC). Here a typical/right configuration:

  1. you could read about bootloader in general

With a serial console we can get some interesting info

About the version and build:

DGND3700 Boot Code V1.0.8
CFE version 1.0.37-104.4 for BCM96368 (32bit,SP,BE)
Build Date: Mon Feb 21 17:59:46 CST 2011 (finerain@moonlight)

And about the possible boards compatible with this CFE:

CFE> 
b

Press:  <enter> to use current value

        '-' to go previous 
parameter

        '.' to clear the current value

        'x' to exit this command

96368VVW         ------- 0 
96368MVWG        ------- 1 
96368SV2         ------- 2 
96368MBG         ------- 3 
96368NTR         ------- 4 
96368MBG6b       ------- 5 
96368VVWB        ------- 6 
96368MVWGB       ------- 7 
96368MNG         ------- 8 
96368MBG6302     ------- 9 
96368MVWGJ       ------- 10
96367AVNG        ------- 11
Board Id (0-11)                   :  1  

→ as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

As default the CPU is configured to operate at 400 MHz. Soldering a 4,7 kohm resistor at R77, R78, R79 the CPU will be configured to operate at 533 MHz

DGND3700 Boot Code V1.0.8 CFE version 1.0.37-104.4 for BCM96368 (32bit,SP,BE) Build Date: Mon Feb 21 17:59:46 CST 2011 (finerain@moonlight) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201 size 32768KB Total Flash size: 32768K with 256 sectors ethsw: found bcm53115! Chip ID: BCM6368B2, MIPS: 400MHz Main Thread: TP0 Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-11) : 96368MVWG Number of MAC Addresses (1-32) : 10 Base MAC Address : 20:4e:7f:c0:b5:4c PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 110 Booting from only image (0xb8020000) ... Code Address: 0x80010000, Entry Address: 0x80298000 Decompression OK! Entry at 0x80298000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 0 buffers found. Closing DMA Channels. Starting program at 0x80298000 Linux version 2.6.21.5 (finerain@sunshine) (gcc version 4.2.3) #1 Fri Oct 21 08:04:47 CST 2011 Parallel flash device: name AM29LV320MT, id 0x2201 size 32768KB 96368MVWG prom init CPU revision is: 0002a031 Determined physical RAM map: memory: 07f00000 @ 00000000 (usable) On node 0 totalpages: 32512 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 222 pages used for memmap Normal zone: 28194 pages, LIFO batch:7 Built 1 zonelists. Total pages: 32258 Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200 brcm mips: enabling icache and dcache... Primary instruction cache 64kB, physically tagged, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, linesize 16 bytes. Synthesized TLB refill handler (21 instructions). Synthesized TLB load handler fastpath (33 instructions). Synthesized TLB store handler fastpath (33 instructions). Synthesized TLB modify handler fastpath (32 instructions). PID hash table entries: 512 (order: 9, 2048 bytes) Using 200.000 MHz high precision timer. Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 126012k/130048k available (2097k kernel code, 4012k reserved, 490k data, 92k init, 0k highmem) KLOB Pool 1 Initialized: 1048576 bytes <0x80300000 ... 0x80400000> Calibrating delay loop... 398.95 BogoMIPS (lpj=997376) Mount-cache hash table entries: 512 wait instruction: enabled NET: Registered protocol family 16 Total Flash size: 32768K with 256 sectors registering PCI controller with io_map_base unset SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb BLOG v2.1 Initialized NET: Registered protocol family 8 NET: Registered protocol family 20 Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc. fuse init (API version 7.8) io scheduler noop registered (default) PPP generic driver version 2.4.2 NET: Registered protocol family 24 physmap platform flash device: 02000000 at b8000000 physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 physmap-flash.0: CFI does not contain boot bank location. Assuming top. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. cmdlinepart partition parsing not available RedBoot partition parsing not available Using physmap partition information Creating 17 MTD partitions on "physmap-flash.0": 0x00020100-0x01e40000 : "rootfs" mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only 0x00020000-0x01e40000 : "fw_upgrade" 0x01e40000-0x01e60000 : "SP" 0x01e60000-0x01e80000 : "MISC" 0x01e80000-0x01ea0000 : "DPF" 0x01ea0000-0x01ec0000 : "T_Meter1" 0x01ec0000-0x01ee0000 : "T_Meter2" 0x01ee0000-0x01f00000 : "T_Meter3" 0x01f00000-0x01f20000 : "T_Meter4" 0x01f20000-0x01f40000 : "POT" 0x01f40000-0x01f60000 : "Reserved1" 0x01f60000-0x01f80000 : "Reserved2" 0x01f80000-0x01fa0000 : "Reserved3" 0x01fa0000-0x01fc0000 : "Reserved4" 0x01fc0000-0x01fe0000 : "board_data" 0x01fe0000-0x02000000 : "nvram" 0x00000000-0x02000000 : "whole_flash" bcm963xx_mtd driver v1.0 File system address: 0xb8020100 Broadcom DSL NAND controller (BrcmNand Controller) i=0, CS[0] = 0 brcmnand_probe: CS0: dev_id=ecf10095 NAND Config: Reg=55042200, chipSize=128 MB, blockSize=128K, erase_shift=11 busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff timing1 not adjusted: 5363444f timing2 not adjusted: 00000fc6 BrcmNAND mfg ec f1 Samsung K9F1G08U0A 128MB Found NAND: ACC=d3000000, cfg=55042200, flashId=ecf10095, tim1=5363444f, tim2=00000fc6 BrcmNAND version = 0x0201 128MB @00000000 brcmnand_probe: CS0: dev_id=ecf10095 1. Found NAND chip on Chip Select 0, chipSize=128MB, usable size=128MB, base=0x00000000 brcmnand_scan: B4 nand_select = 40000002 brcmnand_scan: After nand_select = 40000002 page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17 Brcm NAND controller version = 2.1 NAND flash size 128MB @16000000 brcmnand_scan: mtd->oobsize=64 brcmnand_scan: oobavail=50, eccsize=512, writesize=2048 brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=15, eccbytes=3 brcmnand_default_bbt: bbt_td = bbt_main_descr Bad block table found at page 65472, version 0xFF Bad block table found at page 65408, version 0xFF nand_read_bbt: Bad block at 0x05f00000 numchips=1, size=8000000 Creating 1 MTD partitions on "bcm63xx-nand.0": 0x00000000-0x08000000 : "storage" PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0: EHCI Host Controller ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1 ehci_hcd 0000:00:0a.0: irq 15, io mem 0x10001500 ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00, driver 10 Dec 2004 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver PCI: Enabling device 0000:00:09.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: OHCI Host Controller ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2 ohci_hcd 0000:00:09.0: irq 13, io mem 0x10001600 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected usbcore: registered new interface driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. brcmboard: brcm_board_init entry ===>brcm_board_init: GPIO->GPIOBaseMode=0x3b000 ===>brcm_board_init: GPIO->GPIOMode=0x1f0003 Serial: BCM63XX driver $Revision: 3.00 $ ttyS0 at MMIO 0xb0000100 (irq = 10) is a BCM63XX ttyS1 at MMIO 0xb0000120 (irq = 11) is a BCM63XX bcmxtmrt: Broadcom BCM6368B2 ATM/PTM Network Device v0.3 Oct 21 2011 08:03:27 netem: version 1.2 u32 classifier TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 92k freed init started: BusyBox v1.00 (2011.10.21-00:18+0000) multi-call binary BusyBox v1.00 (2011.10.21-00:18+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... pktflow: module license 'Proprietary' taints kernel. Broadcom Packet Flow Cache Char Driver v2.1 Nov 20 2009 22:08:08 Registered<242> NBUFF v1.0 Initialized Broadcom Packet Flow Cache learning via BLOG enabled. Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Constructed Broadcom Packet Flow Cache v2.1 Nov 20 2009 22:08:06 Broadcom Packet CMF (Experimental) Char Driver v0.1 Nov 20 2009 22:08:03 Registered<232> Broadcom Packet CMF (Experimental) [6368-B2] v0.1 Nov 20 2009 22:08:02 Loaded bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6368B2 Ethernet Network Device v0.1 Oct 21 2011 08:03:17 KLOB extended to 2 pools KLOB extended to 3 pools KLOB extended to 4 pools Config Switch Through SPI Slave Select 1 ethsw: found bcm53115! dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered Broadcom Packet CMF (Experimental) SWC RESET. Broadcom Packet CMF (Experimental) SWC INITIALIZED. KLOB extended to 5 pools KLOB extended to 6 pools KLOB extended to 7 pools KLOB extended to 8 pools Broadcom Packet CMF (Experimental) Forwarder Net Device 0 v0.1 Nov 20 2009 22:08:03 Registered Broadcom Packet CMF (Experimental) Forwarder Net Device 0 v0.1 Nov 20 2009 22:08:03 Registered Broadcom Packet CMF (Experimental) ENABLED. eth0: MAC Address: 20:4E:7F:C0:B5:4D eth1: MAC Address: 20:4E:7F:C0:B5:4C eth2: MAC Address: 20:4E:7F:C0:B5:4C eth3: MAC Address: 20:4E:7F:C0:B5:4C eth4: MAC Address: 20:4E:7F:C0:B5:4C eth0 Link DOWN. eth1 Link DOWN. eth2 Link DOWN. eth3 Link DOWN. eth4 Link DOWN. PCI: Enabling device 0000:00:01.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:01.0 to 64 wl0: Broadcom BCM4351 802.11 Wireless Controller 5.10.120.0.cpe4.404.8 dgasp: kerSysRegisterDyingGaspHandler: wl0 registered PCI: Enabling device 0000:00:02.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:02.0 to 64 wl1: Broadcom BCM4350 802.11 Wireless Controller 5.10.120.0.cpe4.404.8 dgasp: kerSysRegisterDyingGaspHandler: wl1 registered p8021ag: p8021ag_init entry Broadcom Packet Flow Cache learning via BLOG disabled. sh: cannot create /proc/sys/net/ipv4/neigh/br0/base_reachable_time: Directory nonexistent Reading board data... PIN number not found! WSC UUID: 0xd1c9a172b5f7b72f35bb4cf0531b0ec8 wps_uuid=0xd1c9a172b5f7b72f35bb4cf0531b0ec8 klips_info:ipsec_init: KLIPS startup, Openswan KLIPS IPsec stack version: 2.4.9 NET: Registered protocol family 15 klips_info:ipsec_alg_init: KLIPS alg v=0.8.1-0 (EALG_MAX=255, AALG_MAX=251) klips_info:ipsec_alg_init: calling ipsec_alg_static_init() ipsec_3des_init(alg_type=15 alg_id=3 name=3des): ret=0 <6>KLIPS cryptoapi interface: alg_type=15 alg_id=12 name=cbc(aes) keyminbits=128 keymaxbits=256, found(0) KLIPS: lookup for ciphername=cbc(twofish): not found KLIPS: lookup for ciphername=cbc(serpent): not found KLIPS: lookup for ciphername=cbc(cast5): not found KLIPS: lookup for ciphername=cbc(blowfish): not found <6>KLIPS cryptoapi interface: alg_type=15 alg_id=3 name=cbc(des3_ede) keyminbits=192 keymaxbits=192, found(0) <6>KLIPS cryptoapi interface: alg_type=15 alg_id=2 name=cbc(des) keyminbits=64 keymaxbits=64, found(0) ln: /dev/random: File exists device eth1 entered promiscuous mode device eth2 entered promiscuous mode device eth3 entered promiscuous mode device eth4 entered promiscuous mode device wl0 entered promiscuous mode eth3 Link UP 1000 mbps full duplex device wl1 entered promiscuous mode br0: port 6(wl1) entering learning state br0: port 5(wl0) entering learning state br0: port 3(eth3) entering learning state sh: arping: not found xtm command is xtm operate conn --createnetdev 1.8.35 atm0 bcmxtmrt: MAC address: 20 4e 7f c0 b5 4e DSL mode command is xdslctl start --bitswap on --sra off --lpair i --mod dlt2pem --up BcmAdsl_Initialize=0xC010EA10, g_pFnNotifyCallback=0xC0142FD4 Clocks for QPROC and AFE are being aligned with step through ... AFE is aligned, i = 051, PhaseValue = -050, PhaseCntl = 0x3FCD0000 QPROC is aligned, i = 029, PhaseValue = 0050, PhaseCntl = 0x3FCD401D Clocks for QPROC and AFE are aligned with syn_status AFE = 0x70, QPROC = 0x78 AFE phase control reg @0xb0f570f8 default actual = 0x0021C38F, exp = 0x0021c38f QPRC phase control reg @0xb0f5f0c0 default actual = 0x0421C38F, exp = 0x0421c38f pSdramPHY=0xA7FFFFF8, 0xFFFFE2B4 0xFFFFBEEF *** XfaceOffset: 0x5FF90 => 0x5FF90 *** br0: topology change detected, propagating br0: port 6(wl1) entering forwarding state br0: topology change detected, propagating br0: port 5(wl0) entering forwarding state br0: topology change detected, propagating br0: port 3(eth3) entering forwarding state *** PhySdramSize got adjusted: 0xC6F58 => 0xFD610 *** AdslCoreSharedMemInit: shareMemAvailable=10704 AdslCoreHwReset: pLocSbSta=872d8000 bkupThreshold=3072 AdslCoreHwReset: AdslOemDataAddr = 0xA7FBC6D8 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered DSL mode command is xdslctl configure --phycfg 0 0 0 0 0 0x00000002 0x00000000 info, udhcp server (v0.9.8) started error, unable to parse 'option wins ' error, unable to parse 'option domain ' save_router_stats(721): port=2 POT signature check failed. 192.168.0.1 c0a80001 automount: get SIGUSR1. killall: minidlna.exe: no process killed IOCTL_AG_REGION_SET: English Info: No FWPT default policies. httpd: socket bound in 0.0.0.0:80. / # Setting SSID "NETGEAR" Setting SSID "NETGEAR-2" Setting SSID "NETGEAR-3" Setting SSID "NETGEAR-4" br0: port 5(wl0) entering disabled state Chanspec set to 0x2b08 The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. device wl0 is already a member of a bridge; can't enslave it to bridge br0. device wl0.1 entered promiscuous mode device wl0.2 entered promiscuous mode device wl0.3 entered promiscuous mode br0: port 5(wl0) entering learning state Reaped 762 UPnP daemon is ready to run br0: topology change detected, propagating br0: port 5(wl0) entering forwarding state Couldn't open the directory : No such file or directory ftpRestart: killall: bftpd: no process killed Start WPS !! killall: bftpd: no process killed http_d: got signal Setting SSID "NETGEAR-5G" Setting SSID "NETGEAR-5G-2" Setting SSID "NETGEAR-5G-3" Setting SSID "NETGEAR-5G-4" br0: port 6(wl1) entering disabled state Chanspec set to 0x1d26 The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. The kernel doesn't support the ebtables nat table. device wl1 is already a member of a bridge; can't enslave it to bridge br0. device wl1.1 entered promiscuous mode device wl1.2 entered promiscuous mode device wl1.3 entered promiscuous mode br0: port 6(wl1) entering learning state Reaped 1369 UPnP daemon is ready to run br0: topology change detected, propagating br0: port 6(wl1) entering forwarding state Start WPS !!


DGND3700 Boot Code V1.0.8 CFE version 1.0.37-104.4 for BCM96368 (32bit,SP,BE) Build Date: Mon Feb 21 17:59:46 CST 2011 (finerain@moonlight) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201 size 32768KB Total Flash size: 32768K with 256 sectors ethsw: found bcm53115! Chip ID: BCM6368B2, MIPS: 400MHz Main Thread: TP1 Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-11) : 96368MVWG Number of MAC Addresses (1-32) : 10 Base MAC Address : 20:4e:7f:c0:b5:4c PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 1 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1\0x081\0x080 Booting from only image (0xb8020000) ... Code Address: 0x80010000, Entry Address: 0x80010000 LZMA: Prossible old LZMA format, trying to decompress.. Decompression OK! Entry at 0x80010000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 3 buffers found. Closing DMA Channels. Starting program at 0x80010000 [ 0.000000] Linux version 3.3.8 (dani@tool) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #11 Thu Dec 26 19:43:06 CET 2013 [ 0.000000] Detected Broadcom 0x6368 CPU revision b2 [ 0.000000] CPU frequency is 400 MHz [ 0.000000] 128MB of RAM installed [ 0.000000] registering 38 GPIOs [ 0.000000] gpiochip_add: registered GPIOs 0 to 37 on device: bcm63xx-gpio [ 0.000000] board_bcm963xx: Boot address 0xb8000000 [ 0.000000] board_bcm963xx: CFE version: 1.0.37-104.4 [ 0.000000] Overriding boardid with 'DGND3700_3800B' [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 0002a031 (Broadcom BMIPS4350) [ 0.000000] board_bcm963xx: board name: DGND3700_3800B [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000000 -> 0x00008000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] Early memory PFN ranges [ 0.000000] 0: 0x00000000 -> 0x00008000 [ 0.000000] Reserving 0MB of memory at 0MB for crashkernel [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] Memory: 126740k/131072k available (2242k kernel code, 4332k reserved, 405k data, 164k init, 0k highmem) [ 0.000000] NR_IRQS:128 [ 0.000000] Calibrating delay loop... 397.82 BogoMIPS (lpj=795648) [ 0.032000] pid_max: default: 32768 minimum: 301 [ 0.036000] Mount-cache hash table entries: 512 [ 0.044000] NET: Registered protocol family 16 [ 0.052000] registering PCI controller with io_map_base unset [ 0.060000] bio: create slab <bio-0> at 0 [ 0.064000] PCI host bridge to bus 0000:00 [ 0.068000] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff] [ 0.072000] pci_bus 0000:00: root bus resource [io 0x8000000-0x800ffff] [ 0.104000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x30003fff] [ 0.108000] pci 0000:00:02.0: BAR 0: assigned [mem 0x30004000-0x30007fff] [ 0.112000] Switching to clocksource MIPS [ 0.120000] NET: Registered protocol family 2 [ 0.124000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.132000] TCP established hash table entries: 4096 (order: 3, 32768 bytes) [ 0.140000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes) [ 0.144000] TCP: Hash tables configured (established 4096 bind 4096) [ 0.152000] TCP reno registered [ 0.156000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.160000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.168000] NET: Registered protocol family 1 [ 0.176000] audit: initializing netlink socket (disabled) [ 0.180000] type=2000 audit(0.180:1): initialized [ 0.188000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.192000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.204000] msgmni has been set to 247 [ 0.208000] io scheduler noop registered [ 0.212000] io scheduler deadline registered (default) [ 0.216000] bcm63xx_uart.0: ttyS0 at MMIO 0xb0000100 (irq = 10) is a bcm63xx_uart [ 0.224000] console [ttyS0] enabled, bootconsole disabled [ 0.224000] console [ttyS0] enabled, bootconsole disabled [ 0.236000] bcm63xx-rng bcm63xx-rng: registered RNG driver [ 0.244000] physmap platform flash device: 08000000 at 18000000 [ 0.252000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x002201 [ 0.264000] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.268000] Amd/Fujitsu Extended Query version 1.3. [ 0.272000] number of CFI chips: 1 [ 0.276000] bcm63xxpart: CFE boot tag found with version 6 and board type 96368MVWG [ 0.284000] bcm63xxpart: Partition 0 is CFE offset 0 and length 20000 [ 0.292000] bcm63xxpart: Partition 1 is kernel offset 20100 and length fff00 [ 0.296000] bcm63xxpart: Partition 2 is rootfs offset 120000 and length 1d20000 [ 0.304000] bcm63xxpart: Partition 3 is netgear_parts offset 1e40000 and length 1a0000 [ 0.312000] bcm63xxpart: Partition 4 is nvram offset 1fe0000 and length 20000 [ 0.320000] bcm63xxpart: Partition 5 is linux offset 20000 and length 1e20000 [ 0.328000] bcm63xxpart: Spare partition is offset 3e0004 and length 1a5fffc [ 0.336000] 6 bcm63xxpart partitions found on MTD device physmap-flash.0 [ 0.344000] Creating 6 MTD partitions on "physmap-flash.0": [ 0.348000] 0x000000000000-0x000000020000 : "CFE" [ 0.356000] 0x000000020100-0x000000120000 : "kernel" [ 0.360000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.376000] 0x000000120000-0x000001e40000 : "rootfs" [ 0.380000] mtd: partition "rootfs" set to be root filesystem [ 0.388000] mtd: partition "rootfs_data" created automatically, ofs=3E0000, len=1A60000 [ 0.396000] 0x0000003e0000-0x000001e40000 : "rootfs_data" [ 0.404000] 0x000001e40000-0x000001fe0000 : "netgear_parts" [ 0.412000] 0x000001fe0000-0x000002000000 : "nvram" [ 0.420000] 0x000000020000-0x000001e40000 : "linux" [ 0.428000] bcm63xx-spi bcm63xx-spi: at 0xb0000800 (irq 9, FIFOs size 542) v0.1.2 [ 0.516000] b53_common: found switch: BCM53115, rev 8 [ 0.560000] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.568000] TCP cubic registered [ 0.572000] NET: Registered protocol family 17 [ 0.576000] 8021q: 802.1Q VLAN Support v1.8 [ 0.588000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.596000] Freeing unused kernel memory: 164k freed awk: /proc/cpuinfo: No such file or directory [ 4.564000] Button Hotplug driver version 0.4.1 [ 4.584000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled.0/input/input0 - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - jffs2 not ready yet; using ramdisk - init - Please press Enter to activate this console. [ 10.068000] SCSI subsystem initialized [ 10.252000] usbcore: registered new interface driver usbfs [ 10.256000] usbcore: registered new interface driver hub [ 10.264000] usbcore: registered new device driver usb [ 11.308000] wl: module license 'unspecified' taints kernel. [ 11.312000] Disabling lock debugging due to kernel taint [ 11.392000] SSB/BCMA glue driver successfully attached [ 11.400000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002) [ 11.452000] wl0: Broadcom BCM4351 802.11 Wireless Controller 5.10.56.27 [ 11.456000] PCI: Enabling device 0000:00:02.0 (0000 -> 0002) [ 11.512000] wl1: Broadcom BCM4350 802.11 Wireless Controller 5.10.56.27 [ 12.332000] SGI XFS with security attributes, large block/inode numbers, no debug enabled [ 12.372000] PPP generic driver version 2.4.2 [ 12.636000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 12.892000] NET: Registered protocol family 24 [ 13.052000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 13.164000] bcm63xx_ehci bcm63xx_ehci.0: BCM63XX integrated EHCI controller [ 13.168000] bcm63xx_ehci bcm63xx_ehci.0: new USB bus registered, assigned bus number 1 [ 13.200000] bcm63xx_ehci bcm63xx_ehci.0: irq 15, io mem 0xb0001500 [ 13.216000] bcm63xx_ehci bcm63xx_ehci.0: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 13.224000] hub 1-0:1.0: USB hub found [ 13.228000] hub 1-0:1.0: 2 ports detected [ 13.256000] nf_conntrack version 0.5.0 (1982 buckets, 7928 max) [ 13.928000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 14.040000] bcm63xx_ohci bcm63xx_ohci.0: BCM63XX integrated OHCI controller [ 14.044000] bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered, assigned bus number 2 [ 14.052000] bcm63xx_ohci bcm63xx_ohci.0: irq 13, io mem 0xb0001600 [ 14.120000] hub 2-0:1.0: USB hub found [ 14.124000] hub 2-0:1.0: 2 ports detected [ 14.152000] Initializing USB Mass Storage driver... [ 14.160000] usbcore: registered new interface driver usb-storage [ 14.164000] USB Mass Storage support registered. [ 19.636000] device eth0.1 entered promiscuous mode [ 19.640000] device eth0 entered promiscuous mode [ 19.644000] br-lan: port 1(eth0.1) entered forwarding state [ 19.652000] br-lan: port 1(eth0.1) entered forwarding state [ 21.656000] br-lan: port 1(eth0.1) entered forwarding state [ 25.264000] device wl0 entered promiscuous mode [ 25.268000] br-lan: port 2(wl0) entered forwarding state [ 25.276000] br-lan: port 2(wl0) entered forwarding state [ 26.352000] device wl1 entered promiscuous mode [ 26.356000] br-lan: port 3(wl1) entered forwarding state [ 26.360000] br-lan: port 3(wl1) entered forwarding state [ 27.280000] br-lan: port 2(wl0) entered forwarding state [ 28.364000] br-lan: port 3(wl1) entered forwarding state [ 35.216000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0 [ 35.232000] jffs2_build_filesystem(): unlocking the mtd device... done. [ 35.236000] jffs2_build_filesystem(): erasing all blocks after the end marker... done. [ 170.656000] JFFS2 notice: (1125) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. BusyBox v1.19.4 (2013-12-25 00:21:11 CET) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- ATTITUDE ADJUSTMENT (Attitude Adjustment, r36422) ----------------------------------------------------- * 1/4 oz Vodka Pour all ingredients into mixing * 1/4 oz Gin tin with ice, strain into glass. * 1/4 oz Amaretto * 1/4 oz Triple sec * 1/4 oz Peach schnapps * 1/4 oz Sour mix * 1 splash Cranberry juice ----------------------------------------------------- root@OpenWrt:/#


LEDE Trunk Notes, Before installing please take a look at the bug report system here https://bugs.lede-project.org/?string=DGND3700 & https://git.openwrt.org/?p=openwrt/openwrt.git&a=search&h=HEAD&st=commit&s=DGND3700 to rule out any reported bugs, Also keep in mind there is no LuCi/Web GUI but can be installed by following this infomation https://lede-project.org/docs/guide-quick-start/developmentinstallation#optional_next_steps

It's a good idea to backup the partitions, especially “board_data” (/dev/mtd14), it contains hardware MAC adresses specific for your device, serial number and other info. If you destroy it accidentally, it will be difficult to restore otherwise

To backup the Netgear data partitions:

  • Download the firmware dgnd3700v1_3800b_backport_12.09.zip and install it. Telnet into openwrt
    telnet 192.168.1.1
  • Plug an USB pendrive in the router and mount it with the following command
    mount /dev/sda1 /mnt
  • cd into the mounted pendrive and backup the partitions
    cd /mnt
    dd if=/dev/mtd4 of=netgear_partitions.bin
  • umount the the pendrive and extract it
    cd /
    umount /mnt

Now you have the file netgear_partitions.bin (it contains partitions mtd2 to mtd14). If you want to restore it later (might be if you deleted them accidentally) use again the dgnd3700v1_3800b_backport_12.09.zip firmware and this command

mtd write netgear_partitions.bin netgear_parts

You may also want to backup the CFE bootloader using the same procedure

dd if=/dev/mtd0 of=CFE-dgnd3700v1.bin

The operating system and bootloader are stored in the NOR flash

32 MB NOR flash
Offsets Name Partition
0x00000000-0x00020000 CFE n/a
0x00020000-0x00020100 firmware tag n/a
0x00020100-0x01e40000 “rootfs” mtd0
0x00020000-0x01e40000 “fw_upgrade” mtd1
0x01e40000-0x01e60000 “SP” mtd2
0x01e60000-0x01e80000 “MISC” mtd3
0x01e80000-0x01ea0000 “DPF” mtd4
0x01ea0000-0x01ec0000 “T_Meter1” mtd5
0x01ec0000-0x01ee0000 “T_Meter2” mtd6
0x01ee0000-0x01f00000 “ST_Turkey” mtd7
0x01f00000-0x01f20000 “ST_Russian” mtd8
0x01f20000-0x01f40000 “POT” mtd9
0x01f40000-0x01f60000 “ST_German” mtd10
0x01f60000-0x01f80000 “ST_Other” mtd11
0x01f80000-0x01fa0000 “ST_English” mtd12
0x01fa0000-0x01fc0000 “ST_Portuguese” mtd13
0x01fc0000-0x01fe0000 “board_data” mtd14
0x01fe0000-0x02000000 “nvram” mtd15
0x00000000-0x02000000 “whole_flash” mtd16

The “board_data” partition stores some info used by the OEM firmware

“board_data” /dev/mtd14
offsets info example
0x000-0x018 Board ID U12L144T01_NETGEAR_NEWLED
0x040-0x045 LAN MAC adress 00904C1B0007
0x046-0x04B WAN MAC adress 00904C1B00A7
0x04c-0x058 serial number 2KB11B7200F94
0x06c-0x073 WSC PIN 30912472

The NAND flash maybe used for additional storage. But probably used for nothing. It is mounted at /tmp/mnt/storage subdirectory.

128 MB NAND flash
Offsets Name Partition
0x00000000-0x08000000 “storage” mtd18

Source code available at DGND3700_V1.0.0.17_1.0.17_src_full.zip. Toolchain is shared with the Netgear EVG2000 and is available at “gpl-open-source-code-for-programmers”

OEM Firmwares:

DGND3700v1 AnnexA driver has been reported to work on DGND3800B. (ref. Netgear DGND3700 discussion forum)

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by 127.0.0.1