User Tools

Site Tools


toh:netgear:wnr2000

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
toh:netgear:wnr2000 [2013/05/18 23:08]
petrichorxfi
toh:netgear:wnr2000 [2016/05/02 13:12] (current)
cinemast Added additional help for flashing to wnr2000v3
Line 1: Line 1:
 +====== Netgear WNR2000 ======
  
 +This is a 802.11n Router for the 2.4 GHz band with three built-in antennas of which the one in the middle (ANT_1_1) isn't used.
 +
 +The stock firmware for the v3 device runs OpenWRT 7.09 and contains 4 antennas:
 +  - Soldered aluminium antenna
 +  - On the main PCB
 +  - PCB antenna daughter board
 +  - PCB antenna daughter board
 +
 +{{:​media:​netgear:​wnr2000:​wnr2000rpt_v3_general_view.png?​300|}}
 +
 +===== Netgear WN2000RPT =====
 +
 +<WRAP box center 80%> {{:​meta:​icons:​tango:​48px-emblem-question.svg.png }} If you can **confirm** that OpenWrt is running on this device (i.e. you or someone else has **tested** it), please update the data accordingly. -> Click //View/Edit data//
 +/* Special style definitions for the various Tables of Hardware. ​           */
 +{{page>​meta:​infobox:​tohstyles&​noheader&​nofooter&​noeditbtn&​inline&​indent&​link}}
 +---- datatable ----
 +cols    : Model, Versions, Supported Since Rev_url, Supported Since Rel, Supported Current Rel, Device Techdata_pageid
 +align   : l,c,l,c,c,c
 +filter ​ : Model=WN2000RPT
 +----</​WRAP>​
 +
 +These are v0 of the WNR2000, the primary difference being that there is NO WAN PORT. Stock units run Kamikaze 7.09, I followed the main directions for the WNR2000 and the only issue ive seen is an inability to do a hardware reset. Havent bothered to look into it, just plugged it back into the serial connection and restored the device from there. Good luck.
 +
 +===== Supported Versions =====
 +^ Version/​Model ​  ^ S/N        ^ OpenWrt Version Supported ​         ^ Model Specific Notes   ^ Extra       ^
 +| v0              | ?          |      trunk (use AP81 profile) ​     | FCC ID: TBA            | WN2000RPT ​  |
 +| v1              | ?          |      trunk (use AP81 profile) ​     | FCC ID: PY308200083 ​   |             |
 +| v2              | ?          |  14.07 BB with proprietary driver ​ | FCC ID: PY309100105 ​   |             |
 +| v3              | ?          |     15.05 (use AR71XX profile) ​    | FCC ID: PY310200135 ​   |             |
 +| v4              | 1.0.0.58 ​  ​| ​    15.05 (use AR71XX profile) ​    | FCC ID: PY312300212 ​   |             |
 +| v5              | ?          |              untested ​             | FCC ID: PY314100256 ​   |             |
 +
 +===== Hardware Highlights =====
 +^ Version/​Model ^ CPU ^ Ram ^ Flash ^ Network ^ USB ^ Serial ^ JTag ^ Additional Notes ^
 +| v0   | Atheros AR9132 ​            | 32 MB | 4 MB | (4) 100 MBit/​s ​   | no | yes  | no  | The physical label may state "​rev0",​ yet dmesg may state '​v1'​. Please be aware of this fact, and use caution when deciding what version of OpenWRT to use on your specific device |
 +| v1   | Atheros AR9132 ​            | 32 MB | 4 MB | (4+1) 100 MBit/​s ​ | no | yes  | no  |
 +| v2   | Broadcom BCM4716 ​          | 32 MB | 4 MB | (4+1) 100 MBit/​s ​ | no | pads | no  | Generate your own OpenWrt image using the profile "​Broadcom-mips74k-wl"​ for WiFi support. The generated image cannot exceed 3,473,408 bytes so drop unnecessary packages. Tested with 14.07 BB |
 +| v3   | Atheros AR7241 ​            | 32 MB | 4 MB | (4+1) 100 MBit/​s ​ | no | yes  | yes (unpopulated) ​  | OpenWrt 15.05 works OK with exception of some LEDs and buttons (see __GPIO__ section). ​ Device is fully supported in trunk versions r48924 and later. |
 +| v4   | Atheros AR9341 ​            | 32 MB | 4 MB | (4+1) 100 MBit/​s ​ | no | yes  | yes |
 +| v5   | Qualcomm Atheros QCA9531 ​  | 32 MB | ? MB | (4+1) 100 MBit/​s ​ | no | pads | ?   |
 +
 +==== CPU (WNR2000v3) ====
 +<​code>​
 +# cat /​proc/​cpuinfo
 +system type : Atheros AR7241 rev 1
 +machine : NETGEAR WNR2000 V3
 +processor :​ 0
 +cpu model : MIPS 24Kc V7.4
 +BogoMIPS : 239.61
 +wait instruction :​ yes
 +microsecond timers : yes
 +tlb_entries :​ 16
 +extra interrupt vector : yes
 +hardware watchpoint :​ yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
 +isa : mips1 mips2 mips32r1 mips32r2
 +ASEs implemented :​ mips16
 +shadow register sets : 1
 +kscratch registers : 0
 +package : 0
 +core : 0
 +VCED exceptions :​ not available
 +VCEI exceptions :​ not available
 +</​code>​
 +===== Installation =====
 +==== Flashing modified u-boot and pre-built OpenWrt on WNR2000v1 ====
 +
 +  - follow [[telnet.console|Unlocking the Netgear Telnet Console]] to unlock telnet on the OEM firmware and be able to telnet into the router
 +  - (optional, but recommended) [[doc:​howto:​generic.backup|Back up]] your u-boot and art flash partitions as outlined by forum user CheBuzz in the second code box in [[https://​forum.openwrt.org/​viewtopic.php?​pid=123593#​p123593|this post]]
 +  - Follow the info in [[https://​forum.openwrt.org/​viewtopic.php?​pid=143969#​p143969|radengr'​s post]] and [[https://​forum.openwrt.org/​viewtopic.php?​pid=124422#​p124422|fuhry'​s post]] to flash. Linking to the posts instead of copying the commands here is intentional so you know what you are doing ;-)
 +    * Note: Fuhry'​s domain has changed. His new domain is: "​http://​fuhry.com/"​. He does NOT allow director traversal, meaning you must know the //exact// file you need. 
 +      *For example his re-partition script is at [[http://​fuhry.com/​b/​wnr2000//​install-repart.sh]].
 +    * 500K Additional Space: According to dony71 on the forum, to gain the additional 500K space that fuhry refers to, you must make [[https://​forum.openwrt.org/​viewtopic.php?​pid=198205#​p198205|these]] additional changes.
 +  - Reboot, then [[doc:​howto:​basic.config]].
 +
 +==== Flashing OpenWrt on WNR2000v3 ====
 +
 +  - Since changeset r45054 from 27.03.2015 OpenWrt can be flashed by using the build in updater in the Netgear Web-Gui.
 +  * (Optional Information) Bug #18959 gives all the information for the WNR2000v3. https://​dev.openwrt.org/​ticket/​18959
 +  - Installing OpenWrt: Use https://​downloads.openwrt.org/​snapshots/​trunk/​ar71xx/​generic/​openwrt-ar71xx-generic-wnr2000v3-squashfs-factory.img with build in updater.
 +  - After automatic reboot follow: [[doc:​howto:​basic.config]].
 +
 +<WRAP center round tip 60%>
 +If you are experiencing troubles, its probably because the device id of your router got messed up. To fix this you have attach a serial console to it. All further steps are described here: http://​www.techinfodepot.info/​wiki/​Netgear_WNR2000_v3#​JTAG-Serial_Info
 +
 +Read the section about (Serial recovery), where it states how to set the proper device id. 
 +If you flash through TFTP while having a serial console attached the firmware spits out the reason, why the firmware cannot be flashed. In my case it was a mismatch between the product id "​wnr2000v3"​ vs "​WNR200V3"​.
 +</​WRAP>​
 +
 +
 +
 +
 +
 +
 +==== Installing OpenWrt onto a RAMdisk on WNR2000v1 ====
 +The original U-Boot bootloader runs a CRC check on the flash before it executes the **bootcmd** command. This prevents OpenWrt from
 +being run from flash. As long as you do not replace the OEM bootloader, you can only create an OpenWrt ramdisk image and load it via tftp. This requires access to the serial console:
 +
 +  * configure the NIC of a PC with a tftp server at 192.168.1.12
 +  * copy ''​openwrt-ar71xx-uImage-initramfs-lzma.bin''​ into the directory of the tftp server (e.g. /tftpboot)
 +
 +On the WNR2000v1 serial console:
 +  * press any key after ''​Hit any key to stop autoboot:''​ to stop autoboot
 +  * ''​tftpboot 0x81000000 openwrt-ar71xx-uImage-initramfs-lzma.bin''​ - this should print a couple of ''#''​ signs
 +  * ''​setenv bootargs board=WNR2000''​
 +  * ''​bootm''​ - boots the kernel
 +
 +e.g.
 +<​code>​
 +U-Boot 1.1.4.16-g04e9b8bf (May 14 2008 - 17:04:28)
 +
 +AP81 (ar7100) U-boot
 +sri
 +32 MB
 +Top of RAM usable for U-Boot at: 82000000
 +Reserving 245k for U-Boot at: 81fc0000
 +Reserving 192k for malloc() at: 81f90000
 +Reserving 44 Bytes for Board Info at: 81f8ffd4
 +Reserving 36 Bytes for Global Data at: 81f8ffb0
 +Reserving 128k for boot params() at: 81f6ffb0
 +Stack Pointer at: 81f6ff98
 +Now running in RAM - U-Boot at: 81fc0000
 +id read 0x100000ff
 +flash size 4MB, sector count = 64
 +Flash: 4MB
 +In:    serial
 +Out:   ​serial
 +Err:   ​serial
 +Net:   ​ag7100_enet_initialize...
 +Fetching MAC Address from 0x81fea7b0
 +: cfg1 0xf cfg2 0x7114
 +eth0: 00:​1f:​33:​f3:​30:​05
 +dup 1 speed 100
 +eth0 up
 +eth0
 +### main_loop entered: bootdelay=4
 +
 +### main_loop: bootcmd="​bootm 0xbf2a0000"​
 +Hit any key to stop autoboot: ​ 0 
 +ar7100> tftpboot 0x81000000 wnr2000
 +Using eth0 device
 +TFTP from server 192.168.1.12;​ our IP address is 192.168.1.10
 +Filename '​wnr2000'​.
 +Load address: 0x81000000
 +Loading: #################################################################​
 +         #################################################################​
 +         #################################################################​
 +         #################################################################​
 +         #################################################################​
 +         #################################################################​
 +         #############################​
 +done
 +Bytes transferred = 2143454 (20b4de hex)
 +ar7100> setenv bootargs board=WNR2000
 +ar7100> bootm
 +## Booting image at 81000000 ...
 +   Image Name:   MIPS OpenWrt Linux-2.6.32.10
 +   ​Created: ​     2010-03-28 ​  ​6:​54:​52 UTC
 +   Image Type:   MIPS Linux Kernel Image (lzma compressed)
 +   Data Size:    2143390 Bytes =  2 MB
 +   Load Address: 80060000
 +   Entry Point: ​ 80060000
 +   ​Verifying Checksum ... OK
 +   ​Uncompressing Kernel Image ...OK
 +No initrd
 +## Transferring control to Linux (at address 80060000) ...
 +## Giving linux memsize in bytes, 33554432
 +
 +Starting kernel ...
 +
 +Linux version 2.6.32.10 (joerga@quad) (gcc version 4.3.3 (GCC) ) #1 Sun Mar 28 08:54:48 CEST 2010
 +bootconsole [early0] enabled
 +CPU revision is: 00019374 (MIPS 24Kc)
 +Atheros AR9130 rev 1, CPU:400.000 MHz, AHB:200.000 MHz, DDR:400.000 MHz
 +Determined physical RAM map:
 + ​memory:​ 02000000 @ 00000000 (usable)
 +User-defined physical RAM map:
 + ​memory:​ 02000000 @ 00000000 (usable)
 +Initrd not found or empty - disabling initrd
 +Zone PFN ranges:
 +  Normal ​  ​0x00000000 -> 0x00002000
 +</​code>​
 +
 +====Installing OpenWRT on WNR2000 v4====
 +
 +The Wiki on how to Install OpenWRT on wnr2000v4 can be found here: [[toh:​netgear:​wnr2000v4]]
 +
 +
 +===== Hardware =====
 +==== Info ====
 +| **Version:​** ​       | v1        | v2         | v3        | v4        | v5        |
 +| **Architecture:​** ​  | MIPS      | MIPS       | MIPS      | MIPS      | MIPS      |
 +| **Vendor:​** ​        | Atheros ​  | Broadcom ​  | Atheros ​  | Atheros ​  | Atheros ​  |
 +| **Bootloader:​** ​    | [[doc:​techref:​bootloader:​uboot|U-Boot]] | [[doc:​techref:​bootloader:​CFE]] | [[doc:​techref:​bootloader:​uboot|U-Boot]] | [[doc:​techref:​bootloader:​uboot|U-Boot]] | [[doc:​techref:​bootloader:​uboot|U-Boot]] |
 +| **System-On-Chip:​** | Atheros AR9132 | Broadcom BCM4716 | Atheros AR7241 | Atheros AR9341 | Qualcomm Atheros QCA9531 |
 +| **CPU Speed:​** ​     | 400 MHz | 300 Mhz | 400 Mhz | 500 Mhz | ? |
 +| **Flash-Chip:​** ​    | MX 25L3205DMI | MX 25L3205DMI | MX 25L3206EM2I | MX 25L3206EM2I | ? |
 +| **Flash size:​** ​    | 4 MiB | 4 MiB | 4 MiB | 4 MiB | ? |
 +| **RAM-Chip:​** | Hynix HY5DU561622FTP-D43 | Samsung K4H561638J-LCCC | ESMT M13S2561616A-AZK1P03Z8 | ESMT M13S2561616A | Winbond W9425G6JH-4 |
 +| **RAM size:** | 32 MiB | 32 MiB | 32 MiB | 32 MiB | 32 MiB |
 +| **Wireless:​** | Atheros AR9103 (3x3 integrated) | (integrated) | Atheros AR9287 | Atheros 9341 (integrated) | Qualcomm Atheros QCA9531 (integrated) |
 +| **Ethernet:​** | Atheros AR8216 | Broadcom BCM5325E | (integrated) | Atheros 9341 (integrated) | Qualcomm Atheros QCA9531 (integrated) |
 +| **USB:​** ​     | No                | No           | No         | No         | No   |
 +| **Serial:​** ​  | [[#​Serial|Yes]] ​  | pads (JP1)   | Yes (JP1)   | Yes(JP1) ​  | pads (JP2) |
 +| **JTAG:​** ​    | [[#​JTAG|No]] ​     | No           | Yes (J1)        | Yes(JP2) ​  | ?    |
 +
 +==== Opening the case ====
 +**Note:** This will void your warranty!
 +  *To remove the cover remove two little silver screws (Torx 5 or 6) at the bottom and slide the front and back cover down to the feet for some mm. 
 +
 +**PCB upper side**\\
 +{{media:​netgear:​wnr2000:​wnr2000v1_pcb_up.jpg?​400}}
 +
 +**PCB back side**\\
 +{{media:​netgear:​wnr2000:​wnr2000v1_pcb_down.jpg?​400|PCB back side}}
 +
 +**PCB detail at the CPU**\\
 +{{media:​netgear:​wnr2000:​wnr2000v1_pcb_detail_small.jpg?​400|PCB upper side, some PCB trace details}}
 +
 +==== Serial ====
 +  * WNR2000v0 (rev0)
 +    * Serial == Unknown. dmesg states it is a v1, yet both externally and internally the physical stickers state "​rev0"​. Can someone please update this? *Note: I own a "​rev0"​ model running Trunk Generic k3.8.12 currently (generic version fills /rom to 100%, thus custom versions are recommended).<​code bash>
 +root@OpenWrt:/​tmp#​ dmesg
 +[    0.000000] Linux version 3.8.12 (fnord@tschunk) (gcc version 4.6.4 (OpenWrt/​Linaro GCC 4.6-2012.12 r36641) ) #1 Wed May 15 21:23:58 UTC 2013
 +[    0.000000] MyLoader: sysp=aaaa5554,​ boardp=aaaa5554,​ parts=aaaa5554
 +[    0.000000] bootconsole [early0] enabled
 +[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
 +[    0.000000] SoC: Atheros AR9132 rev 1
 +[    0.000000] Clocks: CPU:​400.000MHz,​ DDR:​400.000MHz,​ AHB:​200.000MHz,​ Ref:​5.000MHz
 +[    0.000000] Determined physical RAM map:
 +[    0.000000] ​ memory: 02000000 @ 00000000 (usable)</​code>​
 +  * WNR2000v1
 +    * The serial port is at JP1: 115200 8N1 at 3.3V. Pins are, from left with the ethernet ports above: [Vcc] [Tx] [Rx] [GND]
 +  * WNR2000v2
 +    * The serial port is at JP1: 115200 8N1 at 3.3V. Pads are, from top to bottom with the ethernet ports above: [Vcc] [Tx] [-] [-] [Rx][GND]
 +  * WNR2000v3
 +    * The serial port is at JP1: 115200 8N1 at 3.3V. Pads are, from left to right with the ethernet ports on right: [Vcc] [Tx] [Rx] [GND] 
 +  * WNR2000v4
 +    * The serial port is at JP1: 115200 8N1 at 3.3V. Pads are, from left to right with the ethernet ports on right: [GND] [Rx] [Tx] [Vcc] 
 +  * WNR2000v5
 +    * The serial port is at JP2: 115200 8N1 at 3.3V. Pads are, from left to right with the ethernet ports on right: [GND] [Rx] [Tx] [Vcc] 
 +  * WNR2000RPTv2 (rev0)
 +    * The serial port is at JP1: 115200 8N1 at 3.3V. Pins are, from left to right with the ethernet ports on the right: [Vcc] [Rx] [Tx] [GND]
 +==== GPIO ====
 +=== WNR2000 v3 ===
 +
 +GPIO LEDs and buttons on this device are connected to either AR7241 SoC or AR9287 wireless chip, so not all of them are accessible to stock version of OpenWrt 15.05 (on SoC some are masked by JTAG, also ath9k driver does not register AR9287 GPIOs in kernel). Please read more in __Patches__ section below about current status of addressing these issues.
 +
 +Controlled by **AR7241** SoC (20 GPIOs total, some shared with JTAG or built-in Ethernet switch) :
 +^   ​Type ​  ​^ ​    ​Function ​    ​^ ​    ​GPIO ​     ^   ​Polarity ​   ^   ​Notes ​  ^
 +|   ​LED ​   |  WAN  GREEN      |   ​0 ​ (0, 0)   ​| ​ active low   ​| ​ |
 +|   ​LED ​   |  LAN1 AMBER      |   ​1 ​ (0, 1)   ​| ​ active low   ​| ​ |
 +|   ​LED ​   |  LAN2 AMBER      |   ​6 ​ (0, 6)   ​| ​ active low   ​| ​ shared with JTAG - see note [0]  |
 +|   ​LED ​   |  WPS  GREEN      |   ​7 ​ (0, 7)   ​| ​ active low   ​| ​ shared with JTAG - see note [0]  |
 +|   ​LED ​   |  LAN3 AMBER      |   ​8 ​ (0, 8)   ​| ​ active low   ​| ​ shared with JTAG - see note [0]  |
 +|  Button ​ |      WPS         ​| ​ 11  (0, 11)  |  active low   ​| ​ |
 +|   ​LED ​   |  LAN4 AMBER      |  12  (0, 12)  |  active low   ​| ​ |
 +|   ​LED ​   |  LAN1 GREEN      |  13  (0, 13)  |  active low   ​| ​ link activity - see note [1]  |
 +|   ​LED ​   |  LAN2 GREEN      |  14  (0, 14)  |  active low   ​| ​ link activity - see note [1]  |
 +|   ​LED ​   |  LAN3 GREEN      |  15  (0, 15)  |  active low   ​| ​ link activity - see note [1]  |
 +|   ​LED ​   |  LAN4 GREEN      |  16  (0, 16)  |  active low   ​| ​ link activity - see note [1]  |
 +|   ​LED ​   |  WAN  AMBER      |  17  (0, 17)  |  active low   ​| ​ link activity - see note [1]  |
 +
 +Controlled by **AR9287** wireless chip (11 GPIOs total, unaccessible with default ath9k driver, see __Patches__ section below) :
 +^   ​Type ​  ​^ ​    ​Function ​    ​^ ​    ​GPIO ​     ^   ​Polarity ​   ^   ​Notes ​  ^
 +|   ​LED ​   |  WLAN  BLUE      |  54  (1, 1)   ​| ​ active low   ​| ​ not all triggers work - see note [2]  |
 +|   ​LED ​   |  TEST  AMBER     ​| ​ 55  (1, 2)   ​| ​ active low   ​| ​ aka POWER AMBER  - see note [3]  |
 +|   ​LED ​   |  POWER GREEN     ​| ​ 56  (1, 3)   ​| ​ active low   ​| ​ |
 +|  Button ​ |     ​RESET ​       |  61  (1, 8)   ​| ​ active low   ​| ​ |
 +|  Button ​ |     ​RFKILL ​      ​| ​ 62  (1, 9)   ​| ​ active low   ​| ​ |
 +
 +**//​Notes://​**
 +
 +  *//[0] - needs reprogramming of SoC to deallocate GPIO pins from JTAG//
 +  *//[1] - needs reprogramming of SoC to deallocate GPIO pins from built-in Ethernet switch; required for different link speed colors//
 +  *//[2] - '​phy0radio'​ trigger does not work, use default '​phy0tpt'​ or '​wlan0'​ netdevice instead//
 +  *//[3] - this is amber light on power LED (labelled TEST in u-boot sources)//
 +
 +=== Patches ===
 +
 +Patches providing full GPIO support on WNR2000v3 have been submitted to trunk ([[https://​patchwork.ozlabs.org/​project/​openwrt/​list/?​submitter=68145]]).\\
 +They are included in OpenWrt starting from version r48924. \\
 +All above patches and their versions backported to Chaos Chalmer (15.05) are available at [[https://​micu.webserwer.pl/​pmwiki/​pmwiki.php?​n=OpenWRT.Downloads]].
 +
 +=== GPIO in OpenWrt ===
 +<​code>​
 +# cat /​sys/​kernel/​debug/​gpio
 +GPIOs 0-19, ath79:
 + ​gpio-0 ​  ​(netgear:​green:​wan ) out hi    ​
 + ​gpio-1 ​  ​(netgear:​amber:​lan1) out hi    ​
 + ​gpio-6 ​  ​(netgear:​amber:​lan2) out hi    ​
 + ​gpio-7 ​  ​(netgear:​green:​wps ) out hi    ​
 + ​gpio-8 ​  ​(netgear:​amber:​lan3) out hi    ​
 + ​gpio-11 ​ (wps                 ) in  hi    ​
 + ​gpio-12 ​ (netgear:​amber:​lan4) out hi    ​
 + ​gpio-13 ​ (netgear:​green:​lan1) out lo    ​
 + ​gpio-14 ​ (netgear:​green:​lan2) out lo    ​
 + ​gpio-15 ​ (netgear:​green:​lan3) out lo    ​
 + ​gpio-16 ​ (netgear:​green:​lan4) out lo    ​
 + ​gpio-17 ​ (netgear:​amber:​wan ) out lo    ​
 +
 +GPIOs 53-63, ath9k-phy0:
 + ​gpio-54 ​ (netgear:​blue:​wlan ) out lo    ​
 + ​gpio-55 ​ (netgear:​amber:​test) out hi    ​
 + ​gpio-56 ​ (netgear:​green:​powe) out lo    ​
 + ​gpio-61 ​ (reset ​              ) in  hi    ​
 + ​gpio-62 ​ (rfkill ​             ) in  hi    ​
 +</​code>​
 +
 +==== JTAG ====
 +JTAG pins were found by removing the BGA from a WNR2000 and a TP-Link WR-1043ND (AR9132 with JTAG header)
 +and comparing the PCB traces. The top side of the PCB is the one with the heatsinks.
 +
 +^ Name    ^ BGA pin   ^ Top/Bottom of PCB   ^ Location on PCB     ^
 +| TMS     | G20       | bottom ​             | R335 towards C324   |
 +| TDO     | G21       | top                 | TP34                |
 +| nTRST   | F22       | top                 | R68 toward CPU      |
 +| TCK     | F21       | top                 | R336 toward CPU     |
 +| TDI     | G22       | top                 | R334 toward CPU     |
 +| nSRST   | D22       | top                 | U8 toward R262      |
 +
 +(Be aware that there is no "​I"​ row in the BGA counting!)
 +
 +{{media:​netgear:​wnr2000:​wnr2000_jtag_top.jpg?​400|JTAG pins on PCB top side}}
 +{{media:​netgear:​wnr2000:​wnr2000_jtag_bot.jpg?​400|TMS pin on PCB bottom side}}
 +
 +
 +===== Debricking =====
 +-> [[doc:​howto:​generic.debrick]]
 +
 +User **RoundSparrow** posted this little how-to in the [[https://​forum.openwrt.org/​viewtopic.php?​pid=79475|forum topic]]:
 +
 +>​Experimenting with flashing, I've managed to mess up the firmware a few times. ​ Good news is you can recover it.  If you hold down reset (for like 30 seconds) while you turn on power to unit... it goes into tftp recover mode.
 +>
 +><​code>​U-Boot 1.1.4.16-g04e9b8bf (May 14 2008 - 17:04:28)
 +
 +AP81 (ar7100) U-boot
 +sri
 +32 MB
 +Top of RAM usable for U-Boot at: 82000000
 +Reserving 245k for U-Boot at: 81fc0000
 +Reserving 192k for malloc() at: 81f90000
 +Reserving 44 Bytes for Board Info at: 81f8ffd4
 +Reserving 36 Bytes for Global Data at: 81f8ffb0
 +Reserving 128k for boot params() at: 81f6ffb0
 +Stack Pointer at: 81f6ff98
 +Now running in RAM - U-Boot at: 81fc0000
 +id read 0x100000ff
 +flash size 4MB, sector count = 64
 +Flash: 4MB
 +In:    serial
 +Out:   ​serial
 +Err:   ​serial
 +Net:   ​ag7100_enet_initialize...
 +Fetching MAC Address from 0x81fea7b0
 +: cfg1 0xf cfg2 0x7114
 +eth0: 00:​22:​3f:​0b:​c5:​9c
 +dup 1 speed 100
 +eth0 up
 +eth0
 +Factory Reset Mode
 +The Router is in TFTP Server Firmware Recovery mode NOW!
 +Listening on Port : 69, IP Address: 192.168.1.1...</​code>​
 +>I got the factory firmware back on by using tftp tips from this page: [[http://​cyberstorm.altervista.org/​wag354g/​guides/​howto_unbricking_wag354g_en.txt]]
 +
 +
 +===== Links =====
 +   * [[http://​www.smallnetbuilder.com/​content/​view/​30615/​96 | Review at Smallnetbuilder.com]]
 +   * [[https://​forum.openwrt.org/​viewtopic.php?​pid=79475 | Thread in OpenWrt Forum]]
 +   * [[https://​forum.openwrt.org/​viewtopic.php?​id=24016 | Another Thread with the quest for the JTAG pins]]
 +
 +===== Tags =====
 +{{tag>​AR9132 AR9341 bcm47xx bcm4716 qca9531 qca953x ar71xx ar7240 ar7241 ar9287 4flash 32ram}}