Netgear DG834GT

The Netgear DG834GT is not as similar to the OpenWrtDocs/Hardware/Netgear/DG834G as the name may imply. Unlike the DG834G which is AR7-based, this device is based on the BCM6348, which is of opposite endianess (this device is big-endian). The device runs Linux, you can reach it via telnet after opening the following web page of the router: http://<router_address>/setup.cgi?todo=debug

• MIPS CPU is 256MHz, Atheros MiniPCI WLAN, BCM5325 switch. 4MiB flash, 16MiB RAM. More about this device might be found by searching the forum.

Cpu Info

# cat /proc/cpuinfo
system type             : 96348GW-10
processor               : 0
cpu model               : BCM6348 V0.7
BogoMIPS                : 255.59
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available

Partition MTD

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 0022a000 00010000 "fs"
mtd1: 003e0000 00010000 "tag+fs+kernel"
mtd2: 00010000 00002000 "bootloader"
mtd3: 00010000 00010000 "nvram"
mtd4: 00010000 00002000 "bootloader"

Boot Log

Code Address: 0x80010000, Entry Address: 0x8021c018
Decompression OK!
Entry at 0x8021c018
Closing network.
Starting program at 0x8021c018
Linux version 2.6.8.1 (root@localhost.localdomain) (gcc version 3.4.2) #9 Wed Apr 4 22:14:23 CST 2007
Total Flash size: 4096K with 71 sectors
Scratch pad is not used for this flash part.
96348GW-10 prom init
CPU revision is: 00029107
mpi: No Card is in the PCMCIA slot
Determined physical RAM map:
 memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
  DMA zone: 4000 pages, LIFO batch:1
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB 2-way, linesize 16 bytes.
PID hash table entries: 64 (order 6: 512 bytes)
Using 128.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 13248k/16000k available (1856k kernel code, 2732k reserved, 235k data, 96k init, 0k highmem)
Calibrating delay loop... 255.59 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction...  unavailable.
NET: Registered protocol family 16
Can't analyze prologue code at 801de8dc
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
Initializing Cryptographic API
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 5 MTD partitions on "Physically mapped flash":
0x00010100-0x0023a100 : "fs"
mtd: partition "fs" doesn't start on an erase block boundary -- force read-only
0x00010000-0x003f0000 : "tag+fs+kernel"
0x00000000-0x00010000 : "bootloader"
0x003f0000-0x00400000 : "nvram"
0x00000000-0x00010000 : "bootloader"
brcmboard: brcm_board_init entry
bcm963xx_serial driver v2.0
blaadd: blaa_detect entry
adsl: adsl_init entry
Broadcom BCM6348A2 Ethernet Network Device v0.3 Apr  4 2007 19:32:39
Config Ethernet Switch Through SPI Slave Select 1
eth0: MAC Address: 00:1B:2F:32:AB:31
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
IPv4 over IPv4 tunneling driver
ip_conntrack version 2.1 (125 buckets, 1000 max) - 368 bytes per conntrack
ip_conntrack_h323: init
ip_nat_h323: initialize the module!
ip_tables: (C) 2000-2002 Netfilter core team
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 8
NET: Registered protocol family 20
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (cramfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 96k freed
init started:  BusyBox v1.00 (2007.01.29-08:12+0000) multi-call binary
init started:  BusyBox v1.00 (2007.01.29-08:12+0000) multi-call binary
Starting pid 40, console /dev/tts/0: '/usr/etc/rcS'
ipt_string: module license 'unspecified' taints kernel.
netfilter PSD loaded - (c) astaro AG
ipt_random match loaded
insmod: cannot insert `/lib/modules/ipt_mark.ko': Success (22): Success
BcmAdsl_Initialize=0x8011D968, g_pFnNotifyCallback=0x80212274
AnnexCParam=0x7FFF7E88 AnnexAParam=0x00000980 adsl2=0x00000000
pSdramPHY=0xA0FFFFF8, 0x4004000 0xFFFFFFFF
AdslCoreHwReset: AdslOemDataAddr = 0xA0FFD274
AnnexCParam=0x7FFF7E88 AnnexAParam=0x00000980 adsl2=0x00000000
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
device eth0 entered promiscuous mode
ap_name=(null) action=start
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
killall: upnpd: no process killed
killall: upnpd: no process killed
UPnP Initialized
Intialized UPnP
        with fullurl=http://192.168.0.1:49152/gateway.xml
                     ipaddress=192.168.0.1 port=49152
             web_dir_path=/usr/upnp/
             desc_doc_url=http://192.168.0.1:49152
Specifying the webserver root directory -- /usr/upnp/
Registering the RootDevice
RootDevice Registered
Initializing State Table
fullurl http://192.168.0.1:49152/gateway.xml
route: SIOC[ADD|DEL]RT: File exists
Please press Enter to activate this console.

CFE Menu

CFE version 1.0.37-5.11 for BCM96348 (32bit,SP,BE)
Build Date: Fri Sep 17 15:59:48 CST 2004 (root@Run-P4)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena.
Initializing Devices.
internal_open
bcm6348enet: init_emac
CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz
Total memory used by CFE:  0x80401000 - 0x8051C910 (1161488)
Initialized Data:          0x80418630 - 0x804192D0 (3232)
BSS Area:                  0x804192D0 - 0x8041A910 (5696)
Local Heap:                0x8041A910 - 0x8051A910 (1048576)
Stack Area:                0x8051A910 - 0x8051C910 (8192)
Text (code) segment:       0x80401000 - 0x80418624 (95780)
Boot area (physical):      0x0051D000 - 0x0055D000
Relocation Factor:         I:00000000 - D:00000000
Board IP address                : 192.168.1.1:ffffff00
Host IP address                 : 192.168.1.100
Gateway IP address              :
Run from flash/host (f/h)       : f
Default host run file name      : vmlinux
Default host flash file name    : bcm963xx_fs_kernel
Boot delay (0-9 seconds)        : 1
Board Id Name                   : 96348GW-10
Psi size in KB                  : 16
Number of MAC Addresses (1-32)  : 2
Base MAC Address                : 00:1b:2f:32:ab:31
Ethernet PHY Type               : Internal
Memory size in MB               : 16
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1
CFE>
*** command status = -1
CFE> help
Available commands:
d                   Download
a                   Asmod
w                   Write the whole image start from beginning of the flash
e                   Erase [n]vram or [a]ll flash except bootrom
r                   Run program from flash image or from host depend on [f/h] flag
p                   Print boot line and board parameter info
c                   Change booline parameters
f                   Write image to the flash
i                   Erase persistent storage data
b                   Change board parameters
reset               Reset the board
flashimage          Flashes a compressed image after the bootloader.
help                Obtain help for CFE commands

Serial Console

Serial console is J503. Settings are: 115200, 8, n, 1

JTAG Port

Jtag Port is J201 this port is verified.

Disposition on the board:

JTAG signals and pins

For write the firmware in the flash with JTAG Port read this JTAG Cable.

The cable Unbuffered Cable, Xilinx DLC5 Cable III work very good.

Experience Debrick

With access to Serial Console is possible to restore the firmware on the router from bootloader CFE. CFE can download the image with TFTP.

Attention to use the command e for erase the whole flash when CFE can't read the tag it delete all flash also the CFE. For example if the flash is empty by dd if=/dev/zero of=/dev/mtd1 the tag not exist. When the CFE is erased the only method to restore it is the JTAG Port. Dump of the CFE with dd if=/dev/mtd2 is in format BigEndian, but the dump with JTag Cable is in format LittleEndian so for restore a CFE need convert the image file.

OpenWRT

The device is supported in the development branch over ~rev 13370. The ADSL modem is not working. Do the following at your own risk.

svn co https://svn.openwrt.org/openwrt/trunk/
cd trunk
make menuconfig 

Select the Broadcom BCM63xx [2.6] target system, and the default Atheros wifi target profile.

make V=99

Launch a tftp server, and copy the trunk/bin/openwrt-96348GW-10-squashfs-cfe.bin to the tftproot. Attach your router to the PC with a level shifter, open a serial terminal with 115200 8n1, press a button, and power it up. You shold see the CFE menu:

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1
CFE>
CFE> flashimage 192.168.1.100:openwrt-96348GW-10-squashfs-cfe.bin
Loading 192.168.1.100:openwrt-96348GW-10-squashfs-cfe.bin ...
Finished loading 2621444 bytes
...............................................................

USB PORT

There is an unpopulated USB port near right from reset button.

• If you want to use it you need to solder the USB connector and the following parts:

Warning!Be careful with the voltage regulator! If you want to use an USB device which is powered from the USB port (usb stick, webcamera, etc.), you should not use SOT-223 package regulator, because it could not dissipate the amount of power.

Let's calculate. The input voltage is 12 Volt (or a bit more) the output is 5 Volt. So the regulator will dissipate (12-5)*current power. For example my webcam need 100 mA power according to it's description. So the regulator in my case will dissipate 7 V *0,1A = 0,7 W power. This amount of power cannot be handled by an SOT-223 package. Regulators in TO-220 package will do it better. The best choice is a small switching mode DC-DC converter.

Unfortunatelly there are some hardly solderable 0402 size parts are missing too.

• CategoryModel CategoryBCM63xx