User Tools

Site Tools


toh:netgear:wnr2000

Netgear WNR2000

This is a 802.11n Router for the 2.4 GHz band with three built-in antennas of which the one in the middle (ANT_1_1) isn't used.

The stock firmware for the v3 device runs OpenWRT 7.09 and contains 4 antennas:

  1. Soldered aluminium antenna
  2. On the main PCB
  3. PCB antenna daughter board
  4. PCB antenna daughter board

Netgear WN2000RPT

If you can confirm that OpenWrt is running on this device (i.e. you or someone else has tested it), please update the data accordingly. → Click View/Edit data

These are v0 of the WNR2000, the primary difference being that there is NO WAN PORT. Stock units run Kamikaze 7.09, I followed the main directions for the WNR2000 and the only issue ive seen is an inability to do a hardware reset. Havent bothered to look into it, just plugged it back into the serial connection and restored the device from there. Good luck.

Supported Versions

Version/Model S/N OpenWrt Version Supported Model Specific Notes Extra
v0 ? trunk (use AP81 profile) FCC ID: TBA WN2000RPT
v1 ? trunk (use AP81 profile) FCC ID: PY308200083
v2 ? 14.07 BB with proprietary driver FCC ID: PY309100105
v3 ? 15.05 (use AR71XX profile) FCC ID: PY310200135
v4 1.0.0.58 15.05 (use AR71XX profile) FCC ID: PY312300212
v5 ? untested FCC ID: PY314100256

Hardware Highlights

Version/Model CPU Ram Flash Network USB Serial JTag Additional Notes
v0 Atheros AR9132 32 MB 4 MB (4) 100 MBit/s no yes no The physical label may state "rev0", yet dmesg may state 'v1'. Please be aware of this fact, and use caution when deciding what version of OpenWRT to use on your specific device
v1 Atheros AR9132 32 MB 4 MB (4+1) 100 MBit/s no yes no
v2 Broadcom BCM4716 32 MB 4 MB (4+1) 100 MBit/s no pads no Generate your own OpenWrt image using the profile "Broadcom-mips74k-wl" for WiFi support. The generated image cannot exceed 3,473,408 bytes so drop unnecessary packages. Tested with 14.07 BB
v3 Atheros AR7241 32 MB 4 MB (4+1) 100 MBit/s no yes yes (unpopulated) OpenWrt 15.05 works OK with exception of some LEDs and buttons (see GPIO section). Device is fully supported in trunk versions r48924 and later.
v4 Atheros AR9341 32 MB 4 MB (4+1) 100 MBit/s no yes yes
v5 Qualcomm Atheros QCA9531 32 MB 4 MB (4+1) 100 MBit/s no pads ?

CPU (WNR2000v3)

# cat /proc/cpuinfo
system type		: Atheros AR7241 rev 1
machine			: NETGEAR WNR2000 V3
processor		: 0
cpu model		: MIPS 24Kc V7.4
BogoMIPS		: 239.61
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 16
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 0
VCED exceptions		: not available
VCEI exceptions		: not available

Installation

Flashing modified u-boot and pre-built OpenWrt on WNR2000v1

  1. follow Unlocking the Netgear Telnet Console to unlock telnet on the OEM firmware and be able to telnet into the router
  2. (optional, but recommended) Back up your u-boot and art flash partitions as outlined by forum user CheBuzz in the second code box in this post
  3. Follow the info in radengr's post and fuhry's post to flash. Linking to the posts instead of copying the commands here is intentional so you know what you are doing ;-)
    • Note: Fuhry's domain has changed. His new domain is: "http://fuhry.com/". He does NOT allow director traversal, meaning you must know the exact file you need.
    • 500K Additional Space: According to dony71 on the forum, to gain the additional 500K space that fuhry refers to, you must make these additional changes.
  4. Reboot, then basic.config.

Flashing OpenWrt on WNR2000v3

  1. Since changeset r45054 from 27.03.2015 OpenWrt can be flashed by using the built-in updater in the Netgear Web-Gui:
  2. If the built-in updater rejects the image, you can use "tftp2.exe" or similar to flash the device:
    • Prep the router to receive the image: turn off the router, hold down the reset button, turn ON the router (with reset button still pressed), then wait about 10-15 seconds for the light to start flashing green. Once it's flashing green, you can release the reset button and the router is ready to receive an image (the device seems to wait forever for an image, so you don't have to hurry).
    • To flash with tftp2.exe: set your computer to a static IP (such as 192.168.1.7) and connect the computer to one of the router's 4 wired-ethernet ports (NOT the WAN port). Open the tftp2.exe program on your computer, set the "Server" to 192.168.1.1, leave "Password" blank, for "File" choose the OpenWRT image, then click "Upgrade". That's it. After about 2-3 minutes, the image will finalize and you should be able to login to Luci immediately at 192.168.1.1
  3. After automatic reboot follow: basic.config.

If you are experiencing troubles, its probably because the device id of your router got messed up. To fix this you have attach a serial console to it. All further steps are described here: http://www.techinfodepot.info/wiki/Netgear_WNR2000_v3#JTAG-Serial_Info

Read the section about (Serial recovery), where it states how to set the proper device id. If you flash through TFTP while having a serial console attached the firmware spits out the reason, why the firmware cannot be flashed. In my case it was a mismatch between the product id "wnr2000v3" vs "WNR200V3".

Installing OpenWrt onto a RAMdisk on WNR2000v1

The original U-Boot bootloader runs a CRC check on the flash before it executes the bootcmd command. This prevents OpenWrt from being run from flash. As long as you do not replace the OEM bootloader, you can only create an OpenWrt ramdisk image and load it via tftp. This requires access to the serial console:

  • configure the NIC of a PC with a tftp server at 192.168.1.12
  • copy openwrt-ar71xx-uImage-initramfs-lzma.bin into the directory of the tftp server (e.g. /tftpboot)

On the WNR2000v1 serial console:

  • press any key after Hit any key to stop autoboot: to stop autoboot
  • tftpboot 0x81000000 openwrt-ar71xx-uImage-initramfs-lzma.bin - this should print a couple of # signs
  • setenv bootargs board=WNR2000
  • bootm - boots the kernel

e.g.

U-Boot 1.1.4.16-g04e9b8bf (May 14 2008 - 17:04:28)

AP81 (ar7100) U-boot
sri
32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 245k for U-Boot at: 81fc0000
Reserving 192k for malloc() at: 81f90000
Reserving 44 Bytes for Board Info at: 81f8ffd4
Reserving 36 Bytes for Global Data at: 81f8ffb0
Reserving 128k for boot params() at: 81f6ffb0
Stack Pointer at: 81f6ff98
Now running in RAM - U-Boot at: 81fc0000
id read 0x100000ff
flash size 4MB, sector count = 64
Flash: 4MB
In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
Fetching MAC Address from 0x81fea7b0
: cfg1 0xf cfg2 0x7114
eth0: 00:1f:33:f3:30:05
dup 1 speed 100
eth0 up
eth0
### main_loop entered: bootdelay=4

### main_loop: bootcmd="bootm 0xbf2a0000"
Hit any key to stop autoboot:  0 
ar7100> tftpboot 0x81000000 wnr2000
Using eth0 device
TFTP from server 192.168.1.12; our IP address is 192.168.1.10
Filename 'wnr2000'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #############################
done
Bytes transferred = 2143454 (20b4de hex)
ar7100> setenv bootargs board=WNR2000
ar7100> bootm
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-2.6.32.10
   Created:      2010-03-28   6:54:52 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2143390 Bytes =  2 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ...OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

Linux version 2.6.32.10 (joerga@quad) (gcc version 4.3.3 (GCC) ) #1 Sun Mar 28 08:54:48 CEST 2010
bootconsole [early0] enabled
CPU revision is: 00019374 (MIPS 24Kc)
Atheros AR9130 rev 1, CPU:400.000 MHz, AHB:200.000 MHz, DDR:400.000 MHz
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000

Installing OpenWRT on WNR2000 v4

The Wiki on how to Install OpenWRT on wnr2000v4 can be found here: wnr2000v4

Hardware

Info

Version: v1 v2 v3 v4 v5
Architecture: MIPS MIPS MIPS MIPS MIPS
Vendor: Atheros Broadcom Atheros Atheros Atheros
Bootloader: U-Boot CFE U-Boot U-Boot U-Boot
System-On-Chip: Atheros AR9132 Broadcom BCM4716 Atheros AR7241 Atheros AR9341 Qualcomm Atheros QCA9531
CPU Speed: 400 MHz 300 Mhz 400 Mhz 500 Mhz ?
Flash-Chip: MX 25L3205DMI MX 25L3205DMI MX 25L3206EM2I MX 25L3206EM2I ?
Flash size: 4 MiB 4 MiB 4 MiB 4 MiB ?
RAM-Chip: Hynix HY5DU561622FTP-D43 Samsung K4H561638J-LCCC ESMT M13S2561616A-AZK1P03Z8 ESMT M13S2561616A Winbond W9425G6JH-4
RAM size: 32 MiB 32 MiB 32 MiB 32 MiB 32 MiB
Wireless: Atheros AR9103 (3x3 integrated) (integrated) Atheros AR9287 Atheros 9341 (integrated) Qualcomm Atheros QCA9531 (integrated)
Ethernet: Atheros AR8216 Broadcom BCM5325E (integrated) Atheros 9341 (integrated) Qualcomm Atheros QCA9531 (integrated)
USB: No No No No No
Serial: Yes pads (JP1) Yes (JP1) Yes(JP1) pads (JP2)
JTAG: No No Yes (J1) Yes(JP2) ?

Opening the case

Note: This will void your warranty!

  • To remove the cover remove two little silver screws (Torx 5 or 6) at the bottom and slide the front and back cover down to the feet for some mm.

PCB upper side
WNR2000v1 PCB upper side

PCB back side
PCB back side

PCB detail at the CPU
PCB upper side, some PCB trace details

Serial

  • WNR2000v0 (rev0)
    • Serial == Unknown. dmesg states it is a v1, yet both externally and internally the physical stickers state "rev0". Can someone please update this? *Note: I own a "rev0" model running Trunk Generic k3.8.12 currently (generic version fills /rom to 100%, thus custom versions are recommended).
      root@OpenWrt:/tmp# dmesg
      [    0.000000] Linux version 3.8.12 (fnord@tschunk) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2012.12 r36641) ) #1 Wed May 15 21:23:58 UTC 2013
      [    0.000000] MyLoader: sysp=aaaa5554, boardp=aaaa5554, parts=aaaa5554
      [    0.000000] bootconsole [early0] enabled
      [    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
      [    0.000000] SoC: Atheros AR9132 rev 1
      [    0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:5.000MHz
      [    0.000000] Determined physical RAM map:
      [    0.000000]  memory: 02000000 @ 00000000 (usable)
  • WNR2000v1
    • The serial port is at JP1: 115200 8N1 at 3.3V. Pins are, from left with the ethernet ports above: [Vcc] [Tx] [Rx] [GND]
  • WNR2000v2
    • The serial port is at JP1: 115200 8N1 at 3.3V. Pads are, from top to bottom with the ethernet ports above: [Vcc] [Tx] [-] [-] [Rx][GND]
  • WNR2000v3
    • The serial port is at JP1: 115200 8N1 at 3.3V. Pads are, from left to right with the ethernet ports on right: [Vcc] [Tx] [Rx] [GND]
  • WNR2000v4
    • The serial port is at JP1: 115200 8N1 at 3.3V. Pads are, from left to right with the ethernet ports on right: [GND] [Rx] [Tx] [Vcc]
  • WNR2000v5
    • The serial port is at JP2: 115200 8N1 at 3.3V. Pads are, from left to right with the ethernet ports on right: [GND] [Rx] [Tx] [Vcc]
  • WNR2000RPTv2 (rev0)
    • The serial port is at JP1: 115200 8N1 at 3.3V. Pins are, from left to right with the ethernet ports on the right: [Vcc] [Rx] [Tx] [GND]

GPIO

WNR2000 v3

GPIO LEDs and buttons on this device are connected to either AR7241 SoC or AR9287 wireless chip, so not all of them are accessible to stock version of OpenWrt 15.05 (on SoC some are masked by JTAG, also ath9k driver does not register AR9287 GPIOs in kernel). Please read more in Patches section below about current status of addressing these issues.

Controlled by AR7241 SoC (20 GPIOs total, some shared with JTAG or built-in Ethernet switch) :

Type Function GPIO Polarity Notes
LED WAN GREEN 0 (0, 0) active low
LED LAN1 AMBER 1 (0, 1) active low
LED LAN2 AMBER 6 (0, 6) active low shared with JTAG - see note [0]
LED WPS GREEN 7 (0, 7) active low shared with JTAG - see note [0]
LED LAN3 AMBER 8 (0, 8) active low shared with JTAG - see note [0]
Button WPS 11 (0, 11) active low
LED LAN4 AMBER 12 (0, 12) active low
LED LAN1 GREEN 13 (0, 13) active low link activity - see note [1]
LED LAN2 GREEN 14 (0, 14) active low link activity - see note [1]
LED LAN3 GREEN 15 (0, 15) active low link activity - see note [1]
LED LAN4 GREEN 16 (0, 16) active low link activity - see note [1]
LED WAN AMBER 17 (0, 17) active low link activity - see note [1]

Controlled by AR9287 wireless chip (11 GPIOs total, unaccessible with default ath9k driver, see Patches section below) :

Type Function GPIO Polarity Notes
LED WLAN BLUE 54 (1, 1) active low not all triggers work - see note [2]
LED TEST AMBER 55 (1, 2) active low aka POWER AMBER - see note [3]
LED POWER GREEN 56 (1, 3) active low
Button RESET 61 (1, 8) active low
Button RFKILL 62 (1, 9) active low

Notes:

  • [0] - needs reprogramming of SoC to deallocate GPIO pins from JTAG
  • [1] - needs reprogramming of SoC to deallocate GPIO pins from built-in Ethernet switch; required for different link speed colors
  • [2] - 'phy0radio' trigger does not work, use default 'phy0tpt' or 'wlan0' netdevice instead
  • [3] - this is amber light on power LED (labelled TEST in u-boot sources)

Patches

Patches providing full GPIO support on WNR2000v3 have been submitted to trunk (https://patchwork.ozlabs.org/project/openwrt/list/?submitter=68145).
They are included in OpenWrt starting from version r48924.
All above patches and their versions backported to Chaos Chalmer (15.05) are available at https://micu.webserwer.pl/pmwiki/pmwiki.php?n=OpenWRT.Downloads.

GPIO in OpenWrt

# cat /sys/kernel/debug/gpio
GPIOs 0-19, ath79:
 gpio-0   (netgear:green:wan ) out hi    
 gpio-1   (netgear:amber:lan1) out hi    
 gpio-6   (netgear:amber:lan2) out hi    
 gpio-7   (netgear:green:wps ) out hi    
 gpio-8   (netgear:amber:lan3) out hi    
 gpio-11  (wps                 ) in  hi    
 gpio-12  (netgear:amber:lan4) out hi    
 gpio-13  (netgear:green:lan1) out lo    
 gpio-14  (netgear:green:lan2) out lo    
 gpio-15  (netgear:green:lan3) out lo    
 gpio-16  (netgear:green:lan4) out lo    
 gpio-17  (netgear:amber:wan ) out lo    

GPIOs 53-63, ath9k-phy0:
 gpio-54  (netgear:blue:wlan ) out lo    
 gpio-55  (netgear:amber:test) out hi    
 gpio-56  (netgear:green:powe) out lo    
 gpio-61  (reset               ) in  hi    
 gpio-62  (rfkill              ) in  hi    

JTAG

JTAG pins were found by removing the BGA from a WNR2000 and a TP-Link WR-1043ND (AR9132 with JTAG header) and comparing the PCB traces. The top side of the PCB is the one with the heatsinks.

Name BGA pin Top/Bottom of PCB Location on PCB
TMS G20 bottom R335 towards C324
TDO G21 top TP34
nTRST F22 top R68 toward CPU
TCK F21 top R336 toward CPU
TDI G22 top R334 toward CPU
nSRST D22 top U8 toward R262

(Be aware that there is no "I" row in the BGA counting!)

JTAG pins on PCB top side TMS pin on PCB bottom side

Debricking

generic.debrick

User RoundSparrow posted this little how-to in the forum topic:

Experimenting with flashing, I've managed to mess up the firmware a few times. Good news is you can recover it. If you hold down reset (for like 30 seconds) while you turn on power to unit… it goes into tftp recover mode.

U-Boot 1.1.4.16-g04e9b8bf (May 14 2008 - 17:04:28)

AP81 (ar7100) U-boot
sri
32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 245k for U-Boot at: 81fc0000
Reserving 192k for malloc() at: 81f90000
Reserving 44 Bytes for Board Info at: 81f8ffd4
Reserving 36 Bytes for Global Data at: 81f8ffb0
Reserving 128k for boot params() at: 81f6ffb0
Stack Pointer at: 81f6ff98
Now running in RAM - U-Boot at: 81fc0000
id read 0x100000ff
flash size 4MB, sector count = 64
Flash: 4MB
In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
Fetching MAC Address from 0x81fea7b0
: cfg1 0xf cfg2 0x7114
eth0: 00:22:3f:0b:c5:9c
dup 1 speed 100
eth0 up
eth0
Factory Reset Mode
The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.1...

I got the factory firmware back on by using tftp tips from this page: http://cyberstorm.altervista.org/wag354g/guides/howto_unbricking_wag354g_en.txt

Tags

toh/netgear/wnr2000.txt · Last modified: 2016/10/03 21:38 by Munix