User Tools

Site Tools


toh:netgear:wndap360

Netgear WNDAP360

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
v1 2011-05-04? - r37193 Initial installation via uBoot only

Hardware Highlights

CPU Ram Flash Network USB Serial JTag
Atheros AR7100 128MiB 8MiB 2x2 (2.4Ghz) and 2x2 (5Ghz), 1 x 1Gbps RJ45 No Yes (on back panel) ?

Installation

BEFORE YOU START!!!

  • Backup your var, ART and manufacturing-data partitions. You will need var, manufacturing-data partitions to restore original firmware if needed
  • Due to the fact that I moved partitions this has to be flashed via uboot! (only first flash, then sysupgrade is possible)

Get Image Files

  • You can checkout latest code from trunck and make your own images.
  • If you want to re-use the images I have created (built with DNSAMAQ, Firewall, IPV6 support and LuCI with SSL), you can download the .bin files and skip to Section 2 / step 7.

Section 1: Make Images

1. Get trunk checked out (since r37193 no patching is needed, all is included in trunk)

4. (Optional) Build and Install Feeds if required. eg, LuCI (refer to generic documentation how to install feeds)

cd <trunk folder>
./scripts/feeds update
./scripts/feeds install luci

5. Run menuconfig

make menuconfig
  • Select target system: 'AR71xx'
  • Select target profile: 'Netgear WNDAP360'
  • Add other packages you want eg. luci (for web GUI).

6. Make images. Images will be generated under /trunk/bin folder.

make

Section 2: Load Images to Router

7. Connect to your AP console and break booting sequence (press enter when prompted

  • You need a Cisco Console Cable (and a RJ232 to USB if you donot have a console port)
  • On windows you can use PuTTY to connect to console and screen on Mac / Linux. (Use the 9600,8,N,1 jack of the router)

8. At this stage you need a tftp server with static ip 192.168.1.1 (This IP/subnet is different than the defualt IP your router in factory condition. This is the IP router assumes while in uBoot)

  • put openwrt-ar71xx-generic-wndap360-kernel.bin and openwrt-ar71xx-generic-wndap360-rootfs-squashfs.bin in it
  • Connect the router to your PC/Mac using network cable.

9 Go to your router and download kernel to memory:

tftpboot 0x80010000 openwrt-ar71xx-generic-wndap360-kernel.bin

Output:

Trying eth0
Using eth0 device
TFTP from server 192.168.1.1; our IP address is 192.168.1.100
Filename 'openwrt-ar71xx-generic-wndap360-kernel.bin'.
Load address: 0x80010000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################
done
Bytes transferred = 1441792 (160000 hex)

NOTE: Take a note how long file was. It will be in output at the end of command; in my case it was: (160000 hex)

10. Erase flash and copy in place (IMPORTANT replace 160000 with the size you got if different!!)

erase 0xbf050000 +0x160000
cp.b 0x80010000 0xbf050000 0x160000

Output:

ar7100> erase 0xbf050000 +0x160000
Erase Flash from 0xbf050000 to 0xbf1affff in Bank # 1
First 0x5 last 0x1a sector size 0x10000
Erased 22 sectors
ar7100> cp.b 0x80010000 0xbf050000 0x160000
Copy to Flash... write addr: bf050000
done

11. Do the same with rootfs. IMPORTANT keep in mind that size may and probably will vary. In my case it was (220000 hex)

tftpboot 0x80010000 openwrt-ar71xx-generic-wndap360-rootfs-squashfs.bin
erase 0xbf200000 +0x220000
cp.b 0x80010000 0xbf200000 0x220000 

Output:

ar7100> tftpboot 0x80010000 openwrt-ar71xx-generic-wndap360-rootfs-squashfs.bin
Trying eth0
Using eth0 device
TFTP from server 192.168.1.1; our IP address is 192.168.1.100
Filename 'openwrt-ar71xx-generic-wndap360-rootfs-squashfs.bin'.
Load address: 0x80010000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##############################################
done
Bytes transferred = 2228224 (220000 hex)
ar7100> erase 0xbf200000 +0x220000
Erase Flash from 0xbf200000 to 0xbf41ffff in Bank # 1
First 0x20 last 0x41 sector size 0x10000
Erased 34 sectors
ar7100> cp.b 0x80010000 0xbf200000 0x220000
Copy to Flash... write addr: bf200000
done

14. Once all is done, either type boot or reboot AP

15. Once the router reboots, you can acces LuCI on http://192.168.1.1

  • you will need to change your computer's IP to may be 192.168.1.2 before accessing LuCi

Flash Layout

This is the OEM FLASH layout:

0x00000000-0x00040000 : "u-boot"
0x00040000-0x00050000 : "u-boot-env"
0x00050000-0x00150000 : "vmlinux.gz.uImage"
0x00150000-0x00760000 : "rootfs"
0x00760000-0x007e0000 : "var"
0x007e0000-0x007f0000 : "manufacturing-data"
0x007f0000-0x00800000 : "ART"

OpenWRT FLASH layout:

0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000050000 : "u-boot-env"
0x000000050000-0x000000200000 : "kernel"
0x000000200000-0x0000007f0000 : "rootfs"
0x0000003f0000-0x0000007f0000 : "rootfs_data"
0x0000007f0000-0x000000800000 : "art"
0x000000050000-0x0000007f0000 : "firmware"

OEM installation using the TFTP method

If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.

Upgrading OpenWrt

Upgrade via usual sysupgrade.

Basic configuration

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

Specific Configuration

Interfaces

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi 192.168.1.1/24
eth0 LAN DHCP
wlan0 WiFi Disabled
wlan1 WiFi Disabled

Failsafe mode

Info gathered from OEM configuration

U-Boot info commands

ar7100> bdinfo
boot_params = 0x87F73FA4
memstart    = 0x80000000
memsize     = 0x08000000
flashstart  = 0xBF000000
flashsize   = 0x00800000
flashoffset = 0x0002F62C
ethaddr     = 00:00:00:00:00:00
ip_addr     = 192.168.1.100
baudrate    = 9600 bps

ar7100> coninfo
List of available devices:
serial   80000003 SIO stdin stdout stderr

ar7100> imls       
Image at BF050000:
   Image Name:   Linux Kernel
   Created:      2011-04-07  13:27:18 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    917504 Bytes = 896 kB
   Load Address: 80020000
   Entry Point:  801ec000
   Verifying Checksum ... OK

ar7100> pci
Scanning PCI devices on bus 0
BusDevFun  VendorId   DeviceId   Device Class       Sub-Class
_____________________________________________________________
00.00.00   0x168c     0x0029     Network controller      0x80
00.01.00   0x168c     0x0029     Network controller      0x80

ar7100> showmd
ProductID   = WNDAP360
HWVer       = 1.0
reginfo     = 1
numofimages = -1
currimage   = -1
basemac     = 7444019729A0
maccnt0     = -1
maccnt1     = -1
maccnt2     = -1
maccnt3     = -1
serno       = 2PB1215K00503
boot_params = 0x87F73FA4
memstart    = 0x80000000
memsize     = 0x08000000
flashstart  = 0xBF000000
flashsize   = 0x00800000
flashoffset = 0x0002F62C
ethaddr     = 00:00:00:00:00:00
ip_addr     = 192.168.1.100
baudrate    = 9600 bps

ar7100> version

U-Boot 1.1.4 dni-1.07 (Jul  7 2009 - 14:17:28)

ar7100> printenv
bootdelay=4
baudrate=9600
loadUboot=tftpboot 0x80010000 u-boot.bin;erase 0xbf000000 +0x30000;cp.b 0x80010000 0xbf000000 0x30000
loadLinux=tftpboot 0x80010000 vmlinux.gz.uImage;erase 0xbf640000 +0x120000;cp.b 0x80010000 0xbf640000 0x120000
loadFiles=tftpboot 0x80010000 ap94-jffs2;erase 0xbf040000 +0x600000;cp.b 0x80010000 0xbf040000 0x600000
loadAll=run loadUboot;run loadLinux;run loadFiles
ethact=eth0
kimagename=vmlinux.gz.uImage
rimagename=rootfs.squashfs
download=tftp
memtmp_addr=0x80060000
kernel_size=+0x100000
kernel_addr=0xbf050000
rootfs_size=+0x610000
rootfs_addr=0xbf150000
clear_var=era 0xbf760000 +0x80000
serverip=192.168.1.1
ipaddr=192.168.1.100
bootargs=console=ttyS0,9600 rootfstype=squashfs root=31:03 init=/sbin/init mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),1024k(vmlinux.gz.uImage),6208k(rootfs),512k(var),64k(manufacturing-data),64k(ART)
erase_kimage=erase ${kernel_addr} ${kernel_size}
erase_rimage=erase ${rootfs_addr} ${rootfs_size}
kimage=${download} ${memtmp_addr} ${kimagename};run erase_kimage;cp.b ${memtmp_addr} ${kernel_addr} ${filesize}
rimage=${download} ${memtmp_addr} ${rimagename};run erase_rimage;cp.b ${memtmp_addr} ${rootfs_addr} ${filesize}
bootcmd=bootm 0xbf050000
flash_rootfs=run rimage
flash_kernel=run kimage
flash_all=run flash_kernel flash_rootfs clear_var
stdin=serial
stdout=serial
stderr=serial

Environment size: 1357/65532 bytes

/proc/cpuinfo

netgear9729A8#cat /proc/cpuinfo
system type   : Atheros AR7100 (hydra)
processor   : 0
cpu model   : MIPS 24K V7.4
BogoMIPS    : 450.56
wait instruction  : yes
microsecond timers  : yes
tlb_entries   : 16
extra interrupt vector  : yes
hardware watchpoint : yes
ASEs implemented  : mips16
VCED exceptions   : not available
VCEI exceptions   : not available

Full booting sequence


U-Boot 1.1.4 dni-1.07 (Jul  7 2009 - 14:17:28)

AP94 (ar7100) U-boot 0.0.12
DRAM:  b8050000: 0xc0140180
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 228k for U-Boot at: 87fc4000
Reserving 192k for malloc() at: 87f94000
Reserving 56 Bytes for Board Info at: 87f93fc8
Reserving 36 Bytes for Global Data at: 87f93fa4
Reserving 128k for boot params() at: 87f73fa4
Stack Pointer at: 87f73f88
Now running in RAM - U-Boot at: 87fc4000
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
: cfg1 0xf cfg2 0x7014
 VSCXXX Found 0  unit 0:0  phy_addr: 1  id: 004dd04e
PHY:   Atheros AR8021
eth0: 00:03:7f:e0:00:96
eth0 up
eth0
Manu data is valid!
### main_loop entered: bootdelay=4

### main_loop: bootcmd="bootm 0xbf050000"
Enter SPACE to drop into boot loader:  4  3  2  1  0 
## Booting image at bf050000 ...
   Image Name:   Linux Kernel
   Created:      2011-04-07  13:27:18 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    917504 Bytes = 896 kB
   Load Address: 80020000
   Entry Point:  801ec000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 801ec000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...
ýLinux version 2.6.23-WNDAP360_V2.0.0 (root@build) (gcc version 4.2.4) #1 Thu Apr 7 18:49:01 IST 2011
flash_size passed from bootloader = 8
arg 1: console=ttyS0,9600
arg 2: rootfstype=squashfs
arg 3: root=31:03
arg 4: init=/sbin/init
arg 5: mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),1024k(vmlinux.gz.uImage),6208k(rootfs),512k(var),64k(manufacturing-data),64k(ART)
CPU revision is: 00019374
Determined physical RAM map:
 memory: 08000000 @ 00000000 (usable)
Built 1 zonelists in Zone order.  Total pages: 32512
Kernel command line: console=ttyS0,9600 rootfstype=squashfs root=31:03 init=/sbin/init mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),1024k(vmlinux.gz.uImage),6208k(rootfs),512k(var),64k(manufacturing-data),64k(ART) 
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 512 (order: 9, 2048 bytes)
Using 340.000 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 127744k/131072k available (1501k kernel code, 3256k reserved, 334k data, 96k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
registering PCI controller with io_map_base unset
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
AR7100 GPIOC major 0
squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
7 cmdlinepart partitions found on MTD device ar7100-nor0
Creating 7 MTD partitions on "ar7100-nor0":
0x00000000-0x00040000 : "u-boot"
0x00040000-0x00050000 : "u-boot-env"
0x00050000-0x00150000 : "vmlinux.gz.uImage"
0x00150000-0x00760000 : "rootfs"
0x00760000-0x007e0000 : "var"
0x007e0000-0x007f0000 : "manufacturing-data"
0x007f0000-0x00800000 : "ART"
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 96k freed
init used greatest stack depth: 7436 bytes left
mount used greatest stack depth: 6328 bytes left
printmd used greatest stack depth: 6280 bytes left

Mounting etc to ramfs.      [DONE]

Mounting var to jffs2.      mount used greatest stack depth: 6200 bytes left
[DONE]

Checking SSH keys.          [DONE]

Checking for run file.      [DONE]

Starting System Logger.     [DONE]

Starting Kernel Logger.     [DONE]

Starting Panel LED.         [DONE]

Starting watchdog.          [DONE]

Starting Reset Detect.      [DONE]

Checking Manufac. data      [DONE]

Checking board file.        [CREATED]

Loading Ethernet module.    [GENMAC]

                            [DONE]

Checking database.          [DONE]

Verifing checksum.          [DONE]

Loading Bridge module.      [DONE]
^[
Loading wlan modules.       [DONE]

Creating vap interface.     [DONE]

Creating wds interface.     [DONE]

Starting configd.           [DONE]

Starting web server.        [DONE]

Starting Translator...      start-stop-daemon: cannot start /usr/bin/log_ro: No such file or directory
[syslog]

Starting Translator...      [password]

Starting Translator...      [ssh]

Starting Translator...      [snmp]

Starting Translator...      [telnet]

Starting Translator...      [dns]

Starting Translator...      route: SIOCADDRT: Invalid argument
[bridge_and_vlan_translator]

Starting Translator...      [hostapd_tr]

Starting Translator...      [nmbd_tr]

Starting Translator...      [http_redirect_tr]

Starting Translator...      l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
[dhcp]

Starting Translator...      kill: cannot kill pid 523: No such process
[ntp][1;


Welcome to SDK.


Have a lot of fun...


netgear9729A8 login:

Hardware

Info

Architecture: MIPS
Vendor: Qualcomm Atheros
Bootloader: U-Boot
System-On-Chip: AR7161 rev2
CPU/Speed 24K V7.4 680 Mhz
Flash-Chip: MX25L6406EMI-12G
Flash size: 8 MiB
RAM: 128 MiB
Wireless: 802.11abgn
Ethernet: 1 10/100/1000
Internet: No
USB: No
Serial: Yes
JTAG: ?

Photos

Model Number

Photo of front of the casing

Photo of back of the casing

Opening the case

Note: This will void your warranty!

To open the case simply unscrew 5 torx bolts (marked with red on picture above), there are two clips inside (marked with blue on picture above), you need to fiddle a bit to get the case opened. PCB is on one more screw in the middle of it (inside).

Main PCB

FLASH CHIP:

RAM CHIPS:

Serial

port.serial general information about the serial port, serial port cable, etc.

The serial port is accessible through the back of the device with a RJ45 connector.

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

Debricking

Bootloader Mods

  1. you could read about bootloader in general

Hardware mods

  1. as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

Resources

Notes

Tags

For some Help with the Tags, please have a look here: tags

toh/netgear/wndap360.txt · Last modified: 2014/03/04 11:00 by jaceq