Netgear dm200, missing download link, and failed tftp flash

darkheart46 · December 24, 2017, 1:21pm

Hello comrades, the link to download the netgear dm200 https://downloads.lede-project.org/snapshots/targets/lantiq/xrx200/openwrt-lantiq-xrx200-DM200-squashfs-factory.img is not working.

I searched for mirrors and downloaded it from other mirror, but when I make the tftp flash, appears as succesful, but then the router dont get any ip, and in the computer i tried to do static ip has 192.168.1.1 standard or 192.168.5.1 (router stock) or 192.168.0.1 with no response, and if i take windows to get one ip by dhcp gets a 169.x.x.x weird one with 255.255.0.0 and no gateway.

I did other tftp flash to stock fw and works correctly, but I'm looking to make it work because already got lede in my edgerouter x and my tplink1043, and works like a charm, soo any thoughts or guidance my fellow router friends?

Kind regards and merry xmas for all

tmomas · December 25, 2017, 11:04am

There has been some renaming of image files going on lately, and the ToH hasn't been updated accordingly yet.
I've done this now for the DM200 (other affected devices to follow shortly).

tomn · January 5, 2018, 12:54am

Hi,

This sounds about right to me. After the initial install the modem should act as a DHCP server and be accessible by SSH at 192.168.1.1, as with any other LEDE device.

This is a snapshot release, so LUCI (the web interface) isn't included and therefore you would need to configure it over SSH.

The configuration can be a bit tricky (it does nothing by default); the information is online but it's a bit spread out; I'll try to write something on the wiki about this soon.

darkheart46 · January 5, 2018, 10:49am

Hi, finally was a problem with the firmware file that i was using. (i dont know why)
I tried with an older one from a .de mirror repository and it worked doing it using tftp in ip 192.168.0.1 (default ip for this router is 192.168.5.1).

Then i configued it as modem router for bt adsl (uk), i put here the config for anyone wanting to configure a modem router lantiq to work with adsl because there is not a lot of documentation about this topic.
Kind regards.

NETGEAR DM200 LEDE MODEM (BT-UK) CONFIG

cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'xxxx:xxxx:xxxx::/48'

config atm-bridge 'atm'
        option vpi '0'
        option vci '38'
        option encaps 'llc'
        option payload 'bridged'

config dsl 'dsl'
        option annex 'a'
        option xfer_mode 'atm'
        option line_mode 'adsl'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0'
        option proto 'static'
        option ipaddr '192.168.2.10'
        option netmask '255.255.255.0'
        option dns     '8.8.8.8'
        option ip6assign '60'

config device 'lan_dev'
        option name 'eth0'
        option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'wan'
        option ifname 'dsl0' #dsl0 original
        option proto 'pppoe'
        option username 'usebtusername'
        option password 'btpassworddontmatter'
        option ipv6 'auto'

config device 'wan_dev'
        option name 'dsl0' #dsl0 original
        option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'wan6'
        option ifname '@wan'  #@wan original
        option proto 'dhcpv6'

mkresin · January 5, 2018, 11:38am

@darkheart46 Are you able to reproduce/are you affected by a similar issue as reported in https://bugs.lede-project.org/index.php?do=details&task_id=1247?

You seem to have the same type of line as the reporter in the linked ticket (adsl via atm with pppoe).

mongoled · February 14, 2018, 2:19pm

Hi,

can someone assist with the command that is required to install this firmware onto the DM200 ?

For example for the TL-WR841ND we do the following

Erase the flash:
erase 0x9f020000 +0x3c0000

Copy RAM content to flash:
cp.b 0x80000000 0x9f020000 0x3c0000

Set up the boot
bootm 0x9f020000

But I dont know which are the boundries for the DM200

I am attaching the printenv

VR9 # printenv
bootcmd=sleep 1;nmrp;sf probe 0:3;sf read $loadaddr 0x30000 0x710000;if chk_dniimg $loadaddr; then bootm $loadaddr;else fw_recovery; fi
bootdelay=2
baudrate=115200
preboot=echo;echo Type \"run flash_nfs\" to mount root filesystem over NFS;echo
bootfile="uImage"
mem=62M
phym=64M
ipaddr=192.168.5.1
serverip=192.168.5.200
netdev=eth0
console=ttyLTQ0
tftppath=
loadaddr=0x80800000
rootpath=/mnt/full_fs
rootfsmtd=/dev/mtdblock3
nfsargs=
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):on
addmisc=setenv bootargs $(bootargs) console=$(console),$(baudrate) ethaddr=$(ethaddr) mem=$(mem) panic=1 mtdparts=$(mtdparts) init=/etc/preinit vpe1_load_addr=0x83f00000 vpe1_mem=1M ubootver=$(ver)
flash_nfs=
net_nfs=
net_flash=
net_ram=tftp $(loadaddr) $(tftppath)$(bootfile);run ramargs addip addmisc;bootm
u-boot=u-boot.ltq
rootfs=rootfs.img
firmware=firmware.img
fullimage=fullimage.img
totalimage=totalimage.img
load=tftp $(loadaddr) $(u-boot)
update=protect off 1:0-2;era 1:0-2;cp.b $(loadaddr) B0000000 $(filesize)
flashargs=setenv bootargs root=$(rootfsmtd) ro rootfstype=squashfs quiet
flash_flash=sf probe 3;sf read $(loadaddr) $(f_kernel_addr) $(f_kernel_size);runflashargs addip addmisc;bootm $(loadaddr); run update_fullimage; reset
update_uboot=tftpboot $(loadaddr) $(tftppath)$(u-boot);sf probe 0:3;sf erase 0 10000;sf write $(loadaddr) 0 $(filesize);run reset_sysconfig;reset
update_kernel=tftpboot $(loadaddr) $(tftppath)$(bootfile);upgrade $(loadaddr) $(filesize)
update_bootloader=run update_uboot;run update_gphyfirmware
update_rootfs=tftpboot $(loadaddr) $(tftppath)$(rootfs);upgrade $(loadaddr) $(filesize)
update_firmware=tftpboot $(loadaddr) $(tftppath)$(firmware);upgrade $(loadaddr) $(filesize)
update_fullimage=tftpboot $(loadaddr) $(tftppath)$(fullimage);upgrade $(loadaddr) $(filesize)
update_totalimage=tftpboot $(loadaddr) $(tftppath)$(totalimage);upgrade $(loadaddr) $(filesize)
reset_uboot_config=sf probe 3; sf write 80400000 $(f_ubootconfig_addr) $(f_ubootconfig_size)
reset_ddr_config=sf probe 3; sf write 80400000 $(f_ddrconfig_addr) $(f_ddrconfig_size)
reset_sysconfig=sf probe 3;sf erase $(f_sysconfig_addr) 10000
mtdparts=ltq_sflash:64k(uboot),64k(gphyfirmware),512k(firmware),13568k(rootfs),2048k(data),64k(sysconfig),8k(ubootconfig),4k(dectconfig),8k(wlanconfig),-(res)
part0_begin=0x00000000
part1_begin=0x00020000
part2_begin=0x000A0000
total_part=3
flash_end=0x007FFFFF
data_block0=uboot
data_block1=firmware
data_block2=rootfs
data_block3=kernel
data_block4=sysconfig
data_block5=ubootconfig
data_block6=dectconfig
data_block7=wlanconfig
total_db=8
f_uboot_addr=0x00000000
f_uboot_size=0
f_ubootconfig_addr=0x007F0000
f_ubootconfig_size=0x2000
f_ubootconfig_end=0x007F1FFF
f_gphy_firmware_addr=IFX_CFG_FLASH_GPHY_FIRMWARE_IMAGE_START_ADDR
f_gphy_firmware_size=IFX_CFG_FLASH_GPHY_FIRMWARE_IMAGE_SIZE
f_gphy_firmware_end=IFX_CFG_FLASH_GPHY_FIRMWARE_IMAGE_END_ADDR
f_kernel_addr=0x007DFFFF
f_kernel_size=0
f_kernel_end=IFX_CFG_FLASH_KERNEL_IMAGE_END_ADDR
f_rootfs_addr=0x000A0000
f_rootfs_size=0
f_rootfs_end=IFX_CFG_FLASH_ROOTFS_IMAGE_END_ADDR
f_firmware_addr=0x00020000
f_firmware_size=0
f_fwdiag_addr=IFX_CFG_FLASH_FIRMWARE_DIAG_START_ADDR
f_fwdiag_size=IFX_CFG_FLASH_FIRMWARE_DIAG_SIZE
f_sysconfig_addr=0x007E0000
f_sysconfig_size=0x10000
f_dectconfig_addr=0x007F2000
f_dectconfig_size=0x1000
f_wlanconfig_addr= 0x007F3000
f_wlanconfig_size=0x2000
f_ddrconfig_addr=0x0001FFE0
f_ddrconfig_size=32
f_ddrconfig_end=0x0001ffff
f_data_addr=IFX_CFG_FLASH_DATA_IMAGE_START_ADDR
f_data_size=IFX_CFG_FLASH_DATA_IMAGE_SIZE
f_data_end=IFX_CFG_FLASH_DATA_IMAGE_END_ADDR
dni_tftp_uboot=tftpboot $loadaddr u-boot.ltq;crc32 $loadaddr $filesize
dni_burn_uboot=sf probe 0:3;sf write $loadaddr 0 $filesize;sf erase 0x007e0000 10000;sf erase 0x007f0000 0x02000
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot-2010.06-12284-ga4702df
ethaddr=8c:3b:ad:0c:09:c0
ethact=vr9 Switch

Thanks

anon57995562 · February 15, 2018, 12:04am

See this OpenWrt wiki page...

mongoled · February 15, 2018, 7:57am

Hi!

I have seen that page, could you kindly point out where on that page is an answer to my question ?

I could not see any clear directions on how to flash the firmware onto the DM200 from the Netgear DM200 wiki.

That the information I require can be deduced from the wiki is probably likely, but I do not have the technical knowledge to determine this, hence the reason for my post asking for assistance.

Would have been nice for the OP to post how he achieved the flash.

I have tried two ways, by flashing via the Netgear GUI and by flashing via tftp method. Both methods result in a "bad magic number" error message.

Have tried with the latest Netgear firmware and the oldest Netgear firmware installed on the device prior to me attempting to flash the lede firmware.

Thanks

anon57995562 · February 15, 2018, 8:12am

You should be able to get that from the OEM log in the OpenWrt wiki.

mongoled · February 15, 2018, 8:30am

Hi again,

yes as I said, the info is probably somewhere on that page, just would like someone more knowledgeable to point out what I should be looking at!

I could probably work out what is needed but the amount of hours I would need to determine this i.e. reading/researching/trial-error etc is not something I have copulous amounts of, hence the reason for me posting here !

There are knowledgeable people here who in a number of minutes could tell me what the boundaries are and what the command is to flash, I hope to hear from one of them.

Thanks

mongoled · February 20, 2018, 4:57pm

Nobody can assist ??

mongoled · February 23, 2018, 10:37am

So much for community support

mbo2o · February 23, 2018, 10:54am

If you bothered to check the wiki you would have discovered this in OEM boot log as suggested earlier.

   Booting kernel from Legacy Image at 80800000 ...
   Image Name:   MIPS LTQCPE Linux-3.10.12
   Created:      2016-08-22  15:34:27 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1633552 Bytes = 1.6 MiB
   Load Address: 80002000
   Entry Point:  8000a970
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

mongoled · February 23, 2018, 11:03am

Loads OK from my location (Ayia Napa, Cyprus)

mongoled · February 23, 2018, 11:10am

As I already pointed out.........

If I knew what to be looking for I wouldnt be asking questions here!

From what I have understood from all the things i have read, this firmware should work by being flashed via the Netgear GUI and using the squash-factory.img file.

But it does not, it bricks the device.

So I came here for 'support' but the only thing I am hearing is people pointing out to me that the information is available, but no one telling me what to do with it!

mongoled · February 23, 2018, 11:14am

Continuing from your post "If you bothered to check" remark (I could also have said to you "if you bothered to read what I wro............" to your response)

Does the "Load Address" or the "Entry Point" signify where we start the "erase" command as per below ??

erase 0xbf020000 +0x3c0000 (this is from the wiki for TL-WR841ND v3)

Thanks

mongoled · February 23, 2018, 12:18pm

Hi,

touche, im no expert either

I have oh so many pieces of the puzzle, actually I have more pieces than the actual puzzle!

1/ Never assume anything, lol
2/ My device is bricked in that to an 'average' user it would be completely disfuntional
3/ The device is in recovery mode so obviously no DHCP works

FYI, I have a serial ttl console that I am using to access and recover the DM200

mongoled · February 23, 2018, 12:23pm

You are doing exactly what I was doing and that is making educated guesses. Unfortunately it will be me who totally bricks the device if I erase the wrong area of the RAM, hence the reason I was asking for assistance from someone who knew what they were doing, LOL

The erase command is not recognized in this version of uboot that is on this Netgear.

It seems to me that something has been broken in the snapshots, as other peeps have been successfully flashing there DM200's.

I have two here and both get bricked when flashing through the Netgear interface with a "bad magic number" error message.

Have to recover with tftp method...............

So as things stand, no expert is willing to provide any assistance

mongoled · February 23, 2018, 1:56pm

Hi again!

After flashing from the Netgear GUI the device goes into 'recovery mode'

Exact message below

** check the 1 image **
Verifying Checksum ... OK
** check the 2 image **
** Bad Magic Number ** 0xc5a65360 **

The router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.5.1
Upgrade Mode (This part is flashing)

Thats as far as the boot process goes.

In this state the device will accept firmware pushed to it via tftp transfer.

Will post in next post the uboot commands that are available..............

mongoled · February 23, 2018, 2:04pm

uboot commands:

?       - alias for 'help'
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chk_dniimg- check integrity of dni firmware image.
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
exit    - exit script
false   - do nothing, unsuccessfully
fw_recovery- fw_recovery - start tftp server to recovery dni firmware image.
go      - start application at address 'addr'
help    - print command description/usage
loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
nmrp    - nmrp - start nmrp mechanism to upgrade firmware-image or string-table.
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
set_hw_id- Set hw_id
set_mac - Set ethernet MAC address
set_model_id- Set model_id
set_parameters- Set <serial number>, <lan mac>, <wan mac>,
set_region- Set region number
set_serial- Set serial number
setenv  - set environment variables
sf      - SPI flash sub-system
show_hw_id- Show hw_id
show_mac- Show ethernet MAC addresses
show_model_id- Show model_id
show_parameters- Show hw_id, model_id, region number, serial number, MAC address.
show_region- Show <region number> on Board
show_serial- Show <serial number> on Board
showvar - print local hushshell variables
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
upgrade - upgrade - forward/backward copy memory to pre-defined flash location
version - print monitor version