Adding support for Netgear LG2200D

For Developers
1

I'm trying to port OpenWrt to a Netgear LG2200D. It has a BCM5357 chipset (bcm47xx/bcm947xx) with a BCM4347 Wi-Fi chip.

I've been trying to find a failsafe in case I brick it. The serial port doesn't work (I used an Arduino to test it out, because I don't have a USBTTL adapter). I saw on some forum that the router might be using an RS-232 interface because one of the pins (RX I think) oscillates between +/- 4V. I haven't had any luck with flashing through tftp either (the router just boots up).

Can anybody help me figure out how to at least flash with tftp.

2

was there a question somewhere, hidden in the text, about this (likely forever) unsupported device ?

if not, ok ....

1 Like
3

Yeah, thanks for the reply. I edited the the post.

On the other hand, if anybody can help me figure out if the router's CFE supports tftp flashing, I'd appreciate it.

4

tried 5v instead of 3.3 ?
obviously without connecting the Vcc pin, ever.

the serial header you've tried, is the one next to the modem, right ?

https://fccid.io/PY313400244

5

Yeah that's the one. I used this sketch that someone wrote to identify the pinout. This is what I got.

20250108_113741
20250108_1137411064×798 152 KB

The VCC pin was never identified, so I'm not sure if the script worked right. The pin closest to the modem is the one that was alternating.

6

then it's the Tx :slight_smile:

have you tried shortening the Tx and Rx pins on your Arduino, to check if you can see your own writing in the serial term app you use ?

7

You asked if I tried 5V... I thought I wasn't supposed to connect the VCC pin? I connected TX, RX and GND instead but got nothing. I even tried shorting the Arduino's RST to GND but got nothing. I'm using the Serial mac app.

I'll swap the TX and RX connections and get back to you.

8

Tx signal level would be different too ?

that, and short them, on the Arduino side, to test if it works.

9

I got it working yesterday. You were right, RX and TX were connected in reverse. Here's some serial output:

Decompressing...done
Decompressing...done


CFE for MBR1000v4 version: v1.0.9
Build Date: Mon Aug 12 13:10:50 CST 2013 
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
NFLASH Boot partition size = 524288(0x80000)
flash_size=0x8000000,134217728,max_image_size=0xD00000
left flash_size=0x6000000,100663296,max_image_size=0xD00000
flash_init 969 image_pointer=0,fx_flash_size=0x8000000
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.100.138.2009
CPU type 0x19749: 530MHz
Tot mem: 65536 KBytes
....
10

I have a new problem. I built OpenWrt and flashed it but the kernel doesn't start. It hangs at "Starting Program":

trx_failed=0 at <nflash1.trx>
the_image=0 trx_name=nflash1.trx os_name=nflash0.os, osaddr=0x80001000 bufsize=0x6FF000
boot -raw -z -addr=0x80001000 -max=0x6ff000 nflash0.os:
Got the Linux image 0
Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: ........... 7335936 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000

So far I've tried enabling EARLY_PRINTK, but it still hangs. I also tried manually building a trx file using the stock firmware trx and lzma but still no luck.

EDIT:
In order to keep the forum organized, I'll take this new question to the "For Developers" category.

11

This device seems to have the same hardware (and maybe based on?) as WNDR3400-V1.

system type             : Broadcom BCM5357 chip rev 2
processor               : 0
cpu model               : MIPS 74K V4.9
BogoMIPS                : 264.60
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : no
hardware watchpoint     : yes
ASEs implemented        : mips16 dsp
VCED exceptions         : not available
VCEI exceptions         : not available

unaligned_instructions  : 32
dcache hits             : 2147483648
dcache misses           : 8388791
icache hits             : 2147483648
icache misses           : 4236697502
instructions            : 2147483648

I added the the hardware definitions to OpenWrt and successfully built and flashed it. However, it looks like the kernel never starts. It goes silent at "Starting Program":

Decompressing...done
Decompressing...done


CFE for MBR1000v4 version: v1.0.9
Build Date: Mon Aug 12 13:10:50 CST 2013 
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
NFLASH Boot partition size = 524288(0x80000)
flash_size=0x8000000,134217728,max_image_size=0xD00000
left flash_size=0x6000000,100663296,max_image_size=0xD00000
flash_init 969 image_pointer=0,fx_flash_size=0x8000000
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.100.138.2009
CPU type 0x19749: 530MHz
Tot mem: 65536 KBytes

restore_defaults=0
Device eth0:  hwaddr 00-FF-20-0C-C8-13, ipaddr 192.168.0.1, mask 255.255.255.0
        gateway not set, nameserver not set
Checking crc...
img_boot=0


trx_failed=0 at <nflash1.trx>
the_image=0 trx_name=nflash1.trx os_name=nflash0.os, osaddr=0x80001000 bufsize=0x6FF000
boot -raw -z -addr=0x80001000 -max=0x6ff000 nflash0.os:
Got the Linux image 0
Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: ........... 7335936 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000

I tried the following but still got the same outcome:

  • Enabling EARLY_PRINTK
  • Flashing a trx file built using the stock firmware trx and lzma.
  • Booting the stock kernel file.

I also tried booting the OpenWrt kernel, but the bootloader fails with the error Section would load outside available DRAM. The Openwrt kernel comes out at 8284180 bytes, which I planned to reduce... but it seems pointless if the router cant even boot it's own stock kernel.

I plan to try and package the stock kernel with OpenWrt using the stock tools, to try and narrow down the issue.