BEFORE YOU START!!! Backup your var, ART and manufacturing-data partitions. You will need var, manufacturing-data partitions to restore original firmware if needed

Due to the fact that I moved partitions and sysupgrade is not implemented yet this has to be flashed via uboot!

1. Get trunk checked out

2. Download PATCH and unzip it

3. Apply patch:

cd <trunk folcer>
patch -p0 </path/to/patch

4. Run 'make menuconfig'

5. Select target system: 'AR71xx'

6. Select target profile: 'Netgear WNDAP360'

7. Add other packages you want (eg. luci, refer to generic documentation how to install feeds etc)

8. Make images.

9. Connect to your AP console and break booting sequence (press enter when prompted)

10. At this stage you need a tftp server with static ip 192.168.1.1, put openwrt-ar71xx-generic-wndap360-kernel.bin and openwrt-ar71xx-generic-wndap360-rootfs-squashfs.bin in it

11. Go to your router and download kernel to memory:

tftpboot 0x80010000 openwrt-ar71xx-generic-wndap360-kernel.bin

Take a note how long file was (it will be in output at the end of command). In my case it was: hex (160000)

12. Erase flash and copy in place (!!! IMPORTANT replace 160000 with the size you got if different!!)

erase 0xbf050000 +0x160000
cp.b 0x80010000 0xbf050000 0x160000

13. Do the same with rootfs, also keep in mind that size may and probably will vary (in my case it was hex (200000))

tftpboot 0x80010000 openwrt-ar71xx-generic-wndap360-rootfs-squashfs.bin
erase 0xbf200000 +0x200000
cp.b 0x80010000 0xbf200000 0x200000 

14. Once all is done, either type boot or reboot AP (uboot will be throwing CRC error information on boot but this doesn't break anything)

This is the OEM FLASH layout:

0x00000000-0x00040000 : "u-boot"
0x00040000-0x00050000 : "u-boot-env"
0x00050000-0x00150000 : "vmlinux.gz.uImage"
0x00150000-0x00760000 : "rootfs"
0x00760000-0x007e0000 : "var"
0x007e0000-0x007f0000 : "manufacturing-data"
0x007f0000-0x00800000 : "ART"

OpenWRT FLASH layout:

0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000050000 : "u-boot-env"
0x000000050000-0x000000200000 : "kernel"
0x000000200000-0x0000007f0000 : "rootfs"
0x0000003f0000-0x0000007f0000 : "rootfs_data"
0x0000007f0000-0x000000800000 : "art"
0x000000050000-0x0000007f0000 : "firmware"

If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.

Upgrade via usual sysupgrade.

→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The default network configuration is:

→ generic.failsafe

ar7100> bdinfo
boot_params = 0x87F73FA4
memstart    = 0x80000000
memsize     = 0x08000000
flashstart  = 0xBF000000
flashsize   = 0x00800000
flashoffset = 0x0002F62C
ethaddr     = 00:00:00:00:00:00
ip_addr     = 192.168.1.100
baudrate    = 9600 bps

ar7100> coninfo
List of available devices:
serial   80000003 SIO stdin stdout stderr

ar7100> imls       
Image at BF050000:
   Image Name:   Linux Kernel
   Created:      2011-04-07  13:27:18 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    917504 Bytes = 896 kB
   Load Address: 80020000
   Entry Point:  801ec000
   Verifying Checksum ... OK

ar7100> pci
Scanning PCI devices on bus 0
BusDevFun  VendorId   DeviceId   Device Class       Sub-Class
_____________________________________________________________
00.00.00   0x168c     0x0029     Network controller      0x80
00.01.00   0x168c     0x0029     Network controller      0x80

ar7100> showmd
ProductID   = WNDAP360
HWVer       = 1.0
reginfo     = 1
numofimages = -1
currimage   = -1
basemac     = 7444019729A0
maccnt0     = -1
maccnt1     = -1
maccnt2     = -1
maccnt3     = -1
serno       = 2PB1215K00503
boot_params = 0x87F73FA4
memstart    = 0x80000000
memsize     = 0x08000000
flashstart  = 0xBF000000
flashsize   = 0x00800000
flashoffset = 0x0002F62C
ethaddr     = 00:00:00:00:00:00
ip_addr     = 192.168.1.100
baudrate    = 9600 bps

ar7100> version

U-Boot 1.1.4 dni-1.07 (Jul  7 2009 - 14:17:28)

ar7100> printenv
bootdelay=4
baudrate=9600
loadUboot=tftpboot 0x80010000 u-boot.bin;erase 0xbf000000 +0x30000;cp.b 0x80010000 0xbf000000 0x30000
loadLinux=tftpboot 0x80010000 vmlinux.gz.uImage;erase 0xbf640000 +0x120000;cp.b 0x80010000 0xbf640000 0x120000
loadFiles=tftpboot 0x80010000 ap94-jffs2;erase 0xbf040000 +0x600000;cp.b 0x80010000 0xbf040000 0x600000
loadAll=run loadUboot;run loadLinux;run loadFiles
ethact=eth0
kimagename=vmlinux.gz.uImage
rimagename=rootfs.squashfs
download=tftp
memtmp_addr=0x80060000
kernel_size=+0x100000
kernel_addr=0xbf050000
rootfs_size=+0x610000
rootfs_addr=0xbf150000
clear_var=era 0xbf760000 +0x80000
serverip=192.168.1.1
ipaddr=192.168.1.100
bootargs=console=ttyS0,9600 rootfstype=squashfs root=31:03 init=/sbin/init mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),1024k(vmlinux.gz.uImage),6208k(rootfs),512k(var),64k(manufacturing-data),64k(ART)
erase_kimage=erase ${kernel_addr} ${kernel_size}
erase_rimage=erase ${rootfs_addr} ${rootfs_size}
kimage=${download} ${memtmp_addr} ${kimagename};run erase_kimage;cp.b ${memtmp_addr} ${kernel_addr} ${filesize}
rimage=${download} ${memtmp_addr} ${rimagename};run erase_rimage;cp.b ${memtmp_addr} ${rootfs_addr} ${filesize}
bootcmd=bootm 0xbf050000
flash_rootfs=run rimage
flash_kernel=run kimage
flash_all=run flash_kernel flash_rootfs clear_var
stdin=serial
stdout=serial
stderr=serial

Environment size: 1357/65532 bytes

netgear9729A8#cat /proc/cpuinfo
system type		: Atheros AR7100 (hydra)
processor		: 0
cpu model		: MIPS 24K V7.4
BogoMIPS		: 450.56
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 16
extra interrupt vector	: yes
hardware watchpoint	: yes
ASEs implemented	: mips16
VCED exceptions		: not available
VCEI exceptions		: not available

U-Boot 1.1.4 dni-1.07 (Jul  7 2009 - 14:17:28)

AP94 (ar7100) U-boot 0.0.12
DRAM:  b8050000: 0xc0140180
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 228k for U-Boot at: 87fc4000
Reserving 192k for malloc() at: 87f94000
Reserving 56 Bytes for Board Info at: 87f93fc8
Reserving 36 Bytes for Global Data at: 87f93fa4
Reserving 128k for boot params() at: 87f73fa4
Stack Pointer at: 87f73f88
Now running in RAM - U-Boot at: 87fc4000
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
: cfg1 0xf cfg2 0x7014
 VSCXXX Found 0  unit 0:0  phy_addr: 1  id: 004dd04e
PHY:   Atheros AR8021
eth0: 00:03:7f:e0:00:96
eth0 up
eth0
Manu data is valid!
### main_loop entered: bootdelay=4

### main_loop: bootcmd="bootm 0xbf050000"
Enter SPACE to drop into boot loader:  4  3  2  1  0 
## Booting image at bf050000 ...
   Image Name:   Linux Kernel
   Created:      2011-04-07  13:27:18 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    917504 Bytes = 896 kB
   Load Address: 80020000
   Entry Point:  801ec000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 801ec000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...
ýLinux version 2.6.23-WNDAP360_V2.0.0 (root@build) (gcc version 4.2.4) #1 Thu Apr 7 18:49:01 IST 2011
flash_size passed from bootloader = 8
arg 1: console=ttyS0,9600
arg 2: rootfstype=squashfs
arg 3: root=31:03
arg 4: init=/sbin/init
arg 5: mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),1024k(vmlinux.gz.uImage),6208k(rootfs),512k(var),64k(manufacturing-data),64k(ART)
CPU revision is: 00019374
Determined physical RAM map:
 memory: 08000000 @ 00000000 (usable)
Built 1 zonelists in Zone order.  Total pages: 32512
Kernel command line: console=ttyS0,9600 rootfstype=squashfs root=31:03 init=/sbin/init mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),1024k(vmlinux.gz.uImage),6208k(rootfs),512k(var),64k(manufacturing-data),64k(ART) 
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 512 (order: 9, 2048 bytes)
Using 340.000 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 127744k/131072k available (1501k kernel code, 3256k reserved, 334k data, 96k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
registering PCI controller with io_map_base unset
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
AR7100 GPIOC major 0
squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
7 cmdlinepart partitions found on MTD device ar7100-nor0
Creating 7 MTD partitions on "ar7100-nor0":
0x00000000-0x00040000 : "u-boot"
0x00040000-0x00050000 : "u-boot-env"
0x00050000-0x00150000 : "vmlinux.gz.uImage"
0x00150000-0x00760000 : "rootfs"
0x00760000-0x007e0000 : "var"
0x007e0000-0x007f0000 : "manufacturing-data"
0x007f0000-0x00800000 : "ART"
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 96k freed
init used greatest stack depth: 7436 bytes left
mount used greatest stack depth: 6328 bytes left
printmd used greatest stack depth: 6280 bytes left

Mounting etc to ramfs.      [DONE]

Mounting var to jffs2.      mount used greatest stack depth: 6200 bytes left
[DONE]

Checking SSH keys.          [DONE]

Checking for run file.      [DONE]

Starting System Logger.     [DONE]

Starting Kernel Logger.     [DONE]

Starting Panel LED.         [DONE]

Starting watchdog.          [DONE]

Starting Reset Detect.      [DONE]

Checking Manufac. data      [DONE]

Checking board file.        [CREATED]

Loading Ethernet module.    [GENMAC]

                            [DONE]

Checking database.          [DONE]

Verifing checksum.          [DONE]

Loading Bridge module.      [DONE]
^[
Loading wlan modules.       [DONE]

Creating vap interface.     [DONE]

Creating wds interface.     [DONE]

Starting configd.           [DONE]

Starting web server.        [DONE]

Starting Translator...      start-stop-daemon: cannot start /usr/bin/log_ro: No such file or directory
[syslog]

Starting Translator...      [password]

Starting Translator...      [ssh]

Starting Translator...      [snmp]

Starting Translator...      [telnet]

Starting Translator...      [dns]

Starting Translator...      route: SIOCADDRT: Invalid argument
[bridge_and_vlan_translator]

Starting Translator...      [hostapd_tr]

Starting Translator...      [nmbd_tr]

Starting Translator...      [http_redirect_tr]

Starting Translator...      l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
l2_packet_receive - recvfrom: Network is down
[dhcp]

Starting Translator...      kill: cannot kill pid 523: No such process
[ntp][1;


Welcome to SDK.


Have a lot of fun...


netgear9729A8 login:

Model Number

Photo of front of the casing

Photo of back of the casing

Note: This will void your warranty!

To open the case simply unscrew 5 torx bolts (marked with red on picture above), there are two clips inside (marked with blue on picture above), you need to fiddle a bit to get the case opened. PCB is on one more screw in the middle of it (inside).

Main PCB

FLASH CHIP:

RAM CHIPS:

→ port.serial general information about the serial port, serial port cable, etc.

The serial port is accessible through the back of the device with a RJ45 connector.

→ port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

→ generic.debrick

1. you could read about bootloader in general

1. as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

• Product page

For some Help with the Tags, please have a look here: tags