Topic: Netgear DGN1000

The content of this topic has been archived between 24 Apr 2018 and 6 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 3

Post #1

cedricb

11 Sep 2012, 21:04

Hi,

I'm just wondering if it'll be possible to install OpenWrt on the Netgear DGN1000 ?

So far I've been able to telnet to the device by uploading/installing telnetd...

# cat version
Linux version 2.6.20-Amazon_SE (root@localhost.localdomain) (gcc version 3.4.4 20050119 (MIPS SDE)) #32 Sun Jul 4 14:08:29 CST 2010

# cat cpuinfo
system type : R0416_BSP_EPHY_SPI_HOST_A4
processor : 0
cpu model : MIPS 4KEc V6.12
BogoMIPS : 266.24
wait instruction : yes
microsecond timers : yes
tlb_entries : 16
extra interrupt vector : yes
hardware watchpoint : yes
ASEs implemented : mips16
VCED exceptions : not available
VCEI exceptions : not available

# free
total used free shared buffers
Mem: 29900 12120 17780 0 1152
Swap: 0 0 0
Total: 29900 12120 17780

# cat partitions
major minor #blocks name
31 0 128 mtdblock0
31 1 64 mtdblock1
31 2 64 mtdblock2
31 3 64 mtdblock3
31 4 6848 mtdblock4
31 5 1024 mtdblock5
31 6 7872 mtdblock6
31 7 128 mtdblock7

I don't know where to go from here...

GPL source code of the Netgear firmware which matches my device number --> http://www.downloads.netgear.com/files/ … rc.tar.zip

Cheers,
Ced.

(Last edited by cedricb on 11 Sep 2012, 21:24)

Post #2

cedricb

12 Sep 2012, 08:31

...more info on the internet -> http://www.wikidevi.com/wiki/Netgear_DGN1000
The wikidevi page specifies that there is a USB port, I can't see any with my old eyes!

To night, I'll have a go on the J1 connector with a multimeter... ;-)

Can somebody shed some light which has ported a similar device/chipset/etc.

Post #3

cedricb

12 Sep 2012, 19:59

I've checked J1 and the left pad is the GND. The strange thing is; the 2nd, 3rd and 4th pads measured 3.3V against GND... I thought RX will be at 0V (based on the "serial console" page on the wiki). It looks like the 2nd and 4th pads are going to the Infineon chip. I've ordered a USB to TTL converter, so it safe to use the 1st, 2nd and 4th pads?? :-)

Otherwise there is a non-populated USB connector (pcb type) on the front; J2.

Post #4

davide.85

14 Sep 2012, 16:40

hello I'm also working on DGN1000, I have to say I'm not an expert, but I wanted to connect a usb port for my printer. I saw the J2 free before and following the links look like they are 3 and come to a socket and then leave and go on 24-25-26 pin cpu. But I'm not sure.
What do you think?
is there a way to confirm what I'm saying?
I'm sorry if my English is not good, but I am Italian.

(Last edited by davide.85 on 14 Sep 2012, 16:45)

Post #5

cedricb

14 Sep 2012, 16:54

@davide.85 - Did you connect to the J1 UART ? I've received a TTL converter so I'm just wondering if you know which pins are RX and TX ?

For the USB, I think I'll solder a PCB USB connector when I get the device flashed; I would see if it works or not...

Can you share your process please? ...per favore?

Post #6

davide.85

14 Sep 2012, 17:38

ust yesterday I started so I did nothing and I should read the documentation of openwrt it is the first time I start this project. Anyway I'm looking at network information CPU (psb 50601 Infineon) but found very little and nothing on the pins. So, I'm sorry, but I can not say what TX and RX. but by following the links J2, seem to those who have said the pins.
I'll just progress I will share the process.
Let me know if you can find them.....:)

Post #7

cedricb

14 Sep 2012, 18:45

voila...

ROM VER: 1.2.0
CFG 04
EEPROM Data OK


U-Boot 1.1.5-2.2 (Dec  3 2009 - 16:57:11)

DRAM:  32 MB

 relocate_code start
 relocate_code finish.
Now running in RAM - U-Boot at: 81fc0000
Flash:  8 MB
using default environment

In:    serial
Out:   serial
Err:   serial
Net:   External Clock
Selected EPHY_MODE 
AMAZON_SE Switch
mac = c4:3d:c7:bf:54:30
AMAZON_SE_GPIO_P0_IN = 0xa9ff..
AMAZON_SE_GPIO_P1_IN = 0x2b08..

Type "run flash_nfs" to mount root filesystem over NFS

Input Ctrl-c to stop autoboot:  0 
Check FW intergality...OK
bootloader verion = 1.07
## Booting image at 00700000 ...
   Image Name:   MIPS Linux-2.6.20
   Created:      2010-07-04   6:08:32 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    791251 Bytes = 772.7 kB
   Load Address: 80002000
   Entry Point:  80265000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 2.6.20-Amazon_SE
 (root@localhost.localdomain) (gcc version 3.4.4 20050119 (MIPS SDE)) #32 Sun Jul 4 14:08:29 CST 2010
Current Model:R0416_BSP_EPHY_SPI_HOST_A4
This model supports only basic BSP feature on Amazon SE Small board with SPI flash USB host and PPE A4 firmware
CPU revision is: 0001906c
Determined physical RAM map:
User-defined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 8128
Kernel command line: root=/dev/mtdblock4 ip=192.168.1.1:192.168.1.123::::eth0:on console=ttyS0,115200 ethaddr=c4:3d:c7:bf:54:30 mem=32M panic=1 
Primary instruction cache 8kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 128 (order: 7, 512 bytes)
mips_hpt_frequency:133333333
r4k_offset: 00145855(1333333)
Using 133.333 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29772k/32768k available (2064k kernel code, 2996k reserved, 377k data, 128k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 1024 bind 512)
TCP reno registered
amazon_se_dma_init
dma_chip_init
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 25 for timer[0]
gptu: succeeded to request irq 26 for timer[1]
gptu: succeeded to request irq 27 for timer[2]
gptu: succeeded to request irq 28 for timer[3]
gptu: succeeded to request irq 29 for timer[4]
gptu: succeeded to request irq 30 for timer[5]
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered (default)
Infineon Technologies port driver version 1.0.2 
cgu: misc_register on minor = 62
led: misc_register on minor = 151
drivers/char/amazon_se_led.c amazon_se_led_config 1244: f_software_update = 1
drivers/char/amazon_se_led.c amazon_se_led_config 1244: f_software_update = 1
drivers/char/amazon_se_led.c amazon_se_led_config 1244: f_software_update = 1
drivers/char/amazon_se_led.c amazon_se_led_config 1244: f_software_update = 1
Unknown module try to reserve GPIO
Unknown module try to reserve GPIO
Infineon Technologies Synchronous Serial Controller (SSC) driver version 0.2.1
IFX MEI Version 4.00.01

Infineon CPE API Driver version: DSL CPE API V3.20.5.1

DSL_DRV: using proc fs
ttyS0 at MMIO 0xbe100c00 (irq = 2) is a IFX_ASC
PPP generic driver version 2.4.2
NET: Registered protocol family 24
IMQ starting with 2 devices...
IMQ driver loaded successfully.
    Hooking IMQ before NAT on PREROUTING.
    Hooking IMQ after NAT on POSTROUTING.
Loading A4 (ATM+MII0) driver ...... Force to 100MB Duplex
Succeeded!
PPE datapath driver info:
  Version ID: 8.3.5.1.0.0.1
  Family    : Amazon-SE
  DR Type   : Normal Data Path | Indirect-Fast Path
  Interface : MII0 | ATM
  Mode      : Routing
  Release   : 0.0.1
PPE firmware info:
  Version ID: 3.1.2.6.1.3
  Family    : Amazon-SE
  FW Type   : Standard
  Interface : MII0 + ATM
  Mode      : Bridging + IPv4 Routing
  Release   : 1.3
PPA API --- init successfully
Infineon Technologies Synchronous SPI flash driver version 0.0.1 
MTD driver for SPI flash.
Probing for Serial flash ...
Update rx_eff_size to 4
 <5>Creating 8 MTD partitions on "amazon_se-spi":
0x00000000-0x00020000 : "U-Boot"
0x00020000-0x00030000 : "ENV_MAC"
0x00030000-0x00040000 : "DPF"
0x00040000-0x00050000 : "NVRAM"
0x00050000-0x00700000 : "RootFS_DPUMP"
0x00700000-0x00800000 : "Kernel"
0x00050000-0x00800000 : "ROOTFS_KERNEL"
0x00000000-0x00020000 : "POT"
Update rx_eff_size to 4096
 <6>dwc_otg: version 2.2-RC3
dwc_otg dwc_otg: DWC OTG Controller
dwc_otg dwc_otg: new USB bus registered, assigned bus number 1
dwc_otg dwc_otg: irq 31, io mem 0x00000000
DWC_otg: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
nf_ct_ftp: registering helper for pf: 2 port: 21
nf_ct_ftp: registering helper for pf: 10 port: 21
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
usb 1-1: new high speed USB device using dwc_otg and address 2
usb 1-1: configuration #1 chosen from 1 choice
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 8
atmpvc_init() failed with -17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Time: MIPS clocksource has been installed.
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 128k freed
init started: BusyBox v1.13.1 (2010-07-04 14:01:59 CST
starting pid 14, tty '': '/usr/etc/rcS
netfilter PSD loaded - (c) astaro AG
cat: can't open '/tmp/etc/block.htm': No such file or directory
ct_mgr: module license 'SerComm' taints kernel.
device eth0 entered promiscuous mode
br0: port 1(eth0) entering learning state
cat: can't open '/proc/nvram/BaseMacAddr': No such file or directory
ap_name=(null) action=start
/bin/echo GMT+0 > /etc/TZ
killall: udhcpd: no process killed
iptables: No chain/target/match by that name
killall: miniupnpd: no process killed
killall: dnrd: no process killed
Notice: caching turned off
Warning: Using /etc/hosts will be removed in a future version. Please use only the /etc/dnrd/master file or use -m off.
dnrd -a 192.168.1.2 -m hosts -c off --timeout=0 -b  -s 1.1.1.1 
ff
WaitForConfiguration
100

Please press Enter to activate this console. WaitForLinkActivate
200

Post #8

davide.85

14 Sep 2012, 19:21

woowwww,
you're just a genius.
really well done.
can you explain me step by step how you did and what you used?
I would be really grateful.
You say that so I could put a printer with usb?:D

Post #9

cedricb

14 Sep 2012, 20:16

Here is the configuration for the 4 pads on the J1 connector:

J1 [GND] [TX] [VCC] [RX]

...scratch gently the pads with a little screw driver and solder 3 pins...

you need to connect your USB TTL converter (e.g: http://www.amazon.co.uk/dp/B004ROOPK6/r … 1_3p_dp_1) as:
- GND <--> GND
- TX <--> RX
- RX <--> TX

I've used "kermit" on my Linux host to have the serial console:

>> kermit -l /dev/ttyUSB0 
set speed 115200
set reliable
fast
set carrier-watch off
set flow-control none 
set prefixing all
connect

...my next task is to understand what to do with the bootloader to flash a openwrt firmware. HELP welcome please!

I've built openwrt from trunk:
- target -> Lantiq
- subtarget -> Amazon-SE
- kernel modules -> Wireless drivers -> ath9k-htc (for Atheros AR9271)

The only thing I can't find in "menuconfig" is the driver for the Ethernet switch Atheros AR8216

Post #10

cedricb

14 Sep 2012, 21:19

AMAZON_SE # printenv
bootcmd=run flash_flash
bootdelay=1
baudrate=115200
preboot=echo;echo Type "run flash_nfs" to mount root filesystem over NFS;echo
mem=32M
ipaddr=192.168.1.1
serverip=192.168.1.123
netdev=eth0
baudrate=115200
rootpath=/opt/nfs
nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=$(serverip):$(rootpath)
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):on
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) mem=$(mem) panic=1
flash_nfs=run nfsargs addip addmisc;bootm $(kernel_addr)
ramdisk_addr=B0100000
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
bootfile=uImage
u-boot=bootloader.bin
firmware=firmware.img
fullimage=ifx_adslrt.img
net_nfs=tftp 80500000 $(bootfile);run nfsargs addip addmisc;bootm
root_filesystem=rootfs.img
load=tftp 80500000 $(u-boot)
update=protect off 1:0-2;era 1:0-2;cp.b 80500000 0x0 $(filesize)
flashargs=setenv bootargs root=/dev/mtdblock4
flash_flash=run flashargs addip addmisc; bootm $(kernel_addr)
update_uboot=tftpboot 80400000 $(u-boot); cp.b 80400000 00000000 $(filesize)
update_kernel=tftpboot 80400000 $(bootfile);upgrade 80400000 $(filesize)
update_rootfs=tftpboot 80400000 $(root_filesystem);upgrade 80400000 $(filesize)
update_firmware=tftpboot 80400000 $(firmware);upgrade 80400000 $(filesize)
update_fullimage=tftpboot 80400000 $(fullimage);upgrade 80400000 $(filesize)
update_download=tftp 80100000 download.bin;cp.b 80100000 0x15000 $(filesize)
reset_uboot_config=mw 80400000 'FFFFFFFF' 0x8000;cp.b 80400000 0x00020000 0x8000;reset
part0_begin=0x00000000
part1_begin=0x00010000
part2_begin=0x00040000
total_part=3
flash_end=0x003FFFFF
data_block0=uboot
data_block1=firmware
data_block2=rootfs
data_block3=kernel
data_block4=sysconfig
data_block5=ubootconfig
data_block6=fwdiag
total_db=7
f_uboot_addr=0x00000000
f_uboot_size=0
f_firmware_addr=0x00010000
f_firmware_size=0
f_rootfs_addr=0x00050000
f_rootfs_size=0
f_rootfs_end=0x00050000
f_kernel_addr=0x00700000
kernel_addr=0x00700000
f_kernel_size=0
f_sysconfig_addr=0x003FD200
f_sysconfig_size=0
f_ubootconfig_addr=0x00020000
f_ubootconfig_size=0x8000
f_fwdiag_addr=0x003FFE00
f_fwdiag_size=0x0200
chipid=1.2
boardid=112233
stdin=serial
stdout=serial
stderr=serial
ethact=AMAZON_SE Switc
ethaddr=c4:3d:c7:bf:54:30

Environment size: 2368/32764 bytes

AMAZON_SE # tftpboot
Using AMAZON_SE Switch?=?T0 device
TFTP from server 192.168.1.123; our IP address is 192.168.1.1
Filename 'uImage'.
Load address: 0x80100000
Loading: T T T T T T T 
Abort
AMAZON_SE #

...setup a tftp server on 192.168.1.123 and do --> tftpboot 0x801000000 <my super donkey image> ??

...then what?

I don't know which image to use?

2359300 Sep 14 21:24 openwrt-lantiq-ase-jffs2-128k.rootfs
2359300 Sep 14 21:24 openwrt-lantiq-ase-jffs2-256k.rootfs
2293764 Sep 14 21:24 openwrt-lantiq-ase-jffs2-64k.rootfs
3407876 Sep 14 21:24 openwrt-lantiq-ase-NONE-jffs2-128k.image
3407876 Sep 14 21:24 openwrt-lantiq-ase-NONE-jffs2-256k.image
3276804 Sep 14 21:24 openwrt-lantiq-ase-NONE-jffs2-64k.image
2621444 Sep 14 21:24 openwrt-lantiq-ase-NONE-squashfs.image
917546 Sep 14 21:24 openwrt-lantiq-ase-NONE-uImage
1527794 Sep 14 21:24 openwrt-lantiq-ase-squashfs.rootfs

Sorry I've never done anything like this...

(Last edited by cedricb on 14 Sep 2012, 21:33)

Post #11

cedricb

15 Sep 2012, 12:24

AMAZON_SE # setenv ipaddr 192.168.1.2
AMAZON_SE # setenv serverip 192.168.1.35

AMAZON_SE # tftpboot
Using AMAZON_SE Switch?=?T0 device
TFTP from server 192.168.1.35; our IP address is 192.168.1.2
Filename 'uImage'.
Load address: 0x80100000
Loading: #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     ##########################################################
done
Bytes transferred = 2621444 (280004 hex)

AMAZON_SE # cp.b 0x80100000 0x00700000 0x280004
Copy to Serial Flash... done

AMAZON_SE # run flash_flash
## Booting image at 00700000 ...
   Image Name:   MIPS OpenWrt Linux-3.3.8
   Created:      2012-09-15  10:42:51 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    917473 Bytes = 896 kB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 3.3.8 (cedric@anubis) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Sat Sep 15 11:42:49 BST 2012
[    0.000000] SoC: Amazon_SE rev 1.3
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0001906c (MIPS 4KEc)
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00002000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00002000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line: root=/dev/mtdblock4 ip=192.168.1.2:192.168.1.35::::eth0:on console=ttyS0,115200 ethaddr=c4:3d:c7:bf:54:30 mem=32M panic=1 
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Primary instruction cache 8kB, VIPT, 4-way, linesize 16 bytes.
[    0.000000] Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes
[    0.000000] Memory: 29664k/32768k available (2170k kernel code, 3104k reserved, 348k data, 160k init, 0k highmem)
[    0.000000] NR_IRQS:256
[    0.000000] CPU Clock: 266MHz
[    0.000000] Calibrating delay loop... 264.70 BogoMIPS (lpj=529408)
[    0.036000] pid_max: default: 32768 minimum: 301
[    0.040000] Mount-cache hash table entries: 512
[    0.056000] NET: Registered protocol family 16
[    0.068000] gpiochip_add: registered GPIOs 0 to 15 on device: ltq_gpio
[    0.072000] gpiochip_add: registered GPIOs 16 to 31 on device: ltq_gpio
[    0.076000] MIPS: machine is Generic Lantiq based board
[    0.104000] bio: create slab <bio-0> at 0
[    0.116000] Switching to clocksource MIPS
[    0.132000] NET: Registered protocol family 2
[    0.136000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.144000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    0.152000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.156000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.164000] TCP reno registered
[    0.168000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.172000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.180000] NET: Registered protocol family 1
[    0.184000] gptu: totally 6 16-bit timers/counters
[    0.192000] gptu: misc_register on minor 63
[    0.196000] gptu: succeeded to request irq 126
[    0.200000] gptu: succeeded to request irq 127
[    0.204000] gptu: succeeded to request irq 128
[    0.208000] gptu: succeeded to request irq 129
[    0.216000] gptu: succeeded to request irq 130
[    0.220000] gptu: succeeded to request irq 131
[    0.228000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.236000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.248000] msgmni has been set to 57
[    0.252000] io scheduler noop registered
[    0.256000] io scheduler deadline registered (default)
[    0.260000] ltq_asc.0: ttyLTQ0 at MMIO 0x1e100c00 (irq = 72) is a ltq_asc
[    0.284000] TCP cubic registered
[    0.284000] NET: Registered protocol family 17
[    0.292000] 8021q: 802.1Q VLAN Support v1.8
[    0.296000] turn off boot console early0

ROM VER: 1.2.0
CFG 04
EEPROM Data OK
UART

I've done the following:
- upload openwrt-lantiq-ase-NONE-squashfs.image (uImage)
- copy the image at the previous address 0x00700000
- and boot

The kernel starts booting then the device resets and locks!!!

I've restarted the board and same issue; stopped on the UART line...

Post #12

davide.85

15 Sep 2012, 14:02

thank you very much, as soon as I get the converter usb / tll I start work.
you've noticed that little hoof free?
do you think there is likely to go a microcontroller usb converter / tll in so you can put a usb socket on jag2?

Post #13

cedricb

15 Sep 2012, 16:11

I've downloaded the official source from Netgear and compiled the bootloader. I've tried to send the bootloader.bin using kermit but nothing is happening... Is there a way to upload a new u-boot via UART ?

Post #14

davide.85

15 Sep 2012, 18:07

I'm not very knowledgeable about these things.
But usually, the coupling of BOOT is much more difficult as the time window is very narrow.
try to see here http://www.hwupgrade.it/forum/archive/i … 81027.html
the hardware is different but maybe it could be helpful

Post #15

davide.85

15 Sep 2012, 18:10

I believe that you will succeed:D

Post #16

thomas.malcolm.bennett

30 Dec 2012, 18:57

just came across this some one has managed to makea custom firmware and has source unfortunatey i have no idea what to do wth this infomation but you guys seem like you may
http://www.netgear-forum.com/forum/inde … opic=70380

(Last edited by thomas.malcolm.bennett on 30 Dec 2012, 18:57)

Post #17

quackquack

19 Apr 2013, 02:43

looks like i got myself a broken dgn1000 device, the previous owner sold it for 10 US$, yes its bricked. anyway to revive it?

http://wiki.openwrt.org/toh/arcadyan/arv4518pw the wiki says:

UART boot

To enable UART booting in the ARV4518 board, just shortcut R80 and put the left side of R65 to +3.3V and…

same can be done for this device? i have got buspirate an also an external programmer, how to revive it?

thanks in advance
-paul

Post #18

jmp

22 Oct 2013, 16:47

@cedricb seems that doing what you have overwrites uboot

I had this problem when following your steps earlier.

The only way to recover uboot is to lift and reflash the SPI EEPROM

I used a raspberry pi and flashrom tool to do this.

See

http://www.macronix.com/QuickPlace/hq/P … 20v1.8.pdf

for the flash pinout

Has anyone else made any progress with this?

Post #19

bulanula

5 Jun 2014, 14:35

Sorry to bump an old thread but I just got a hold of one of these devices today.

Pretty nice specs for the price ( IMHO ) :

32 MB RAM
8 MB flash
AR9271 certified ( not draft ) wireless N with 150 mbps support
Lantiq CPU
Uboot bootloader
ADSL that should also theoretically work fine.

I will try to get a serial connection going BUT I will only try and write anything to flash once I have an image that does fully boot.

Anybody have some tips ?

It seems stock Uboot does not like OpenWRT however, that same problem existed on another SIMILAR platform ( Home Hub 2 type B which also has Uboot, AR9160, Lantiq CPU so very similar hardware ) but I don't know how they patched their Uboot to work properly. They did share their work and all the sources, so it should be easy for us to replicate their approach.

However, it seems we do have the Uboot sources from Netgear thus it should be doable and not very difficult !

It really is a shame this is not natively supported as the hardware is great underneath the horrible stock firmware. As I said, very similar to BT Home Hub 2 type B platform so maybe we can try and modify our Uboot to play nice just like the BT HH folks did ?

(Last edited by bulanula on 5 Jun 2014, 14:37)

Post #20

krembuk

14 May 2016, 01:19

Anyone still working on this? Just ordered new router at USD5 from https://www.jakartanotebook.com/netgear … tter-black (sorry, it's in Indonesian). The price is tempting, so I don't quite mind playing with thistoy. Any companion will be much appreciated.

Post #21

zx82

16 May 2016, 15:54

krembuk wrote:

Anyone still working on this?

OpenWrt doesn't support hardware with so little RAM any more (these shipped with 16MiB, at least in the UK), so you'd be looking at a pretty old release at best, and it'd be no fun squeezing anything into 4MiB of flash either. Also, support for Amazon SE in OpenWrt probably never got very far; only the SMT-G3xxx ever had any degree of support. I don't think any proper documentation/datasheets ever surfaced, so it might just have been a source code drop. You can get lots more even for $5 now.

That said, by all means try and do something useful with it if you feel you can, to save it from Silicon Heaven. Even if all you can do is configure the switch chip to act as a simple bridge without DHCP (or maybe even a hub; those come in handy sometimes), that might be better than burying it.

(Last edited by zx82 on 16 May 2016, 15:57)

Post #22

krembuk

17 May 2016, 12:03

zx82 wrote:

krembuk wrote:
Anyone still working on this?
OpenWrt doesn't support hardware with so little RAM any more (these shipped with 16MiB, at least in the UK), so you'd be looking at a pretty old release at best, and it'd be no fun squeezing anything into 4MiB of flash either. Also, support for Amazon SE in OpenWrt probably never got very far; only the SMT-G3xxx ever had any degree of support. I don't think any proper documentation/datasheets ever surfaced, so it might just have been a source code drop. You can get lots more even for $5 now.
That said, by all means try and do something useful with it if you feel you can, to save it from Silicon Heaven. Even if all you can do is configure the switch chip to act as a simple bridge without DHCP (or maybe even a hub; those come in handy sometimes), that might be better than burying it.

This DGN1000SP comes with 8MB flash and 32MB RAM, which I think is quite interesting.
I found the GPL source code here: http://download2.polytechnic.edu.na/pub … rc.tar.zip

Official Netgear source download: http://kb.netgear.com/app/answers/detai … -%28gpl%29

Thanks for the info about Amazon SE, I just realized that this thing is not AR7

Can you enlighten me, suppose I want to backup the whole 8MB flash, do you think I can use dd if=/dev/flash0?
Here are the partitions:

# cat partitions
major minor  #blocks  name

  31     0        128 mtdblock0
  31     1         64 mtdblock1
  31     2         64 mtdblock2
  31     3         64 mtdblock3
  31     4       6848 mtdblock4
  31     5       1024 mtdblock5
  31     6       7872 mtdblock6
  31     7        128 mtdblock7


# cat mtd
dev:    size   erasesize  name
mtd0: 00020000 00010000 "U-Boot"
mtd1: 00010000 00010000 "ENV_MAC"
mtd2: 00010000 00010000 "DPF"
mtd3: 00010000 00010000 "NVRAM"
mtd4: 006b0000 00010000 "RootFS_DPUMP"
mtd5: 00100000 00010000 "Kernel"
mtd6: 007b0000 00010000 "ROOTFS_KERNEL"
mtd7: 00020000 00010000 "POT"

(Last edited by krembuk on 24 May 2016, 06:05)

Post #23

zx82

17 May 2016, 12:18

krembuk wrote:

This DGN1000SP comes with 8MB flash and 32MB RAM, which I think is quite interesting.

I'm glad yours is a better unit, although it's probably still a lot of work. Having said it's poorly supported, the DGN1000B (and Amazon SE) does at least have a .dts entry (even in trunk) so you could try building an image.

krembuk wrote:

Thanks for the info about Amazon SE, I just realized that this thing is not AR7

I'd imagine Amazon and Danube share a lot with AR7.

krembuk wrote:

Can enlighten me, suppose I want to backup the whole 8MB flash, do you think I can use dd if=/dev/flash0?

You probably want to look at the kernel log for that. I think you want to grab mtdblock0, 1, 2, 3 and 6 to get everything, but check your unit's log for the ranges (after "Creating n MTD partitions").

Post #24

krembuk

19 May 2016, 05:43

zx82 wrote:

krembuk wrote:
This DGN1000SP comes with 8MB flash and 32MB RAM, which I think is quite interesting.
I'm glad yours is a better unit, although it's probably still a lot of work. Having said it's poorly supported, the DGN1000B (and Amazon SE) does at least have a .dts entry (even in trunk) so you could try building an image.
krembuk wrote:
Thanks for the info about Amazon SE, I just realized that this thing is not AR7
I'd imagine Amazon and Danube share a lot with AR7.
krembuk wrote:
Can enlighten me, suppose I want to backup the whole 8MB flash, do you think I can use dd if=/dev/flash0?
You probably want to look at the kernel log for that. I think you want to grab mtdblock0, 1, 2, 3 and 6 to get everything, but check your unit's log for the ranges (after "Creating n MTD partitions").

Many thanks for the reply. Just successfully built the provided GPL source, it produces the newfirmware.bin without any error, so straight-forward! This is my first time to cross compile a provided source, and it was without any error: I'm amazed! Still a lo of work to do, please wish me luck. Again, thanks for the reply.

Post #25

zx82

19 May 2016, 09:23

krembuk wrote:

Just successfully built the provided GPL source

Which zip from Netgear did you use?

krembuk wrote:

it produces the newfirmware.bin without any error, so straight-forward!

It is fairly impressive that the build is sufficiently self-contained to still work; unfortunately it's probably a kernel from the dark ages with tons of vulnerabilities, and getting OpenWrt userspace working on that doesn't strike me as fun.

krembuk wrote:

please wish me luck

Good luck! Turns out I have both the 16/4 variant and the 32/8 variant here. Out of curiosity I had a go at booting the generic ASE kernel from Attitude Adjustment (still pretty old, 3.3.8) on the 32/8 variant. It booted and panicked at the lack of root filesystem; I see no mention of flash probing (NOR, NAND or SPI) in the output, so I suspect the generic kernel might have no support for AmazonSE SPI. Then I somehow managed to overwrite U-Boot, so called it a day.

I'll see if I can restore U-Boot over serial later, and see whether the SPI support is just a missing config flag, or whether the Danube SPI driver works, or whether the Infineon driver in the 2.x code drop might build in a 3.x kernel.

(Last edited by zx82 on 19 May 2016, 09:24)

Page 1 of 3