Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision Next revisionBoth sides next revision | ||
| toh:netgear:wnap210 [2014/05/05 09:08] – created ciusss89 | toh:netgear:wnap210 [2019/03/19 10:28] – [Hardware Highlights] rudih | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ====== Netgear WNAP210 ====== | ||
| + | The WNAP210 is a b/g/n wireless access point, capable of running OpenWRT. | ||
| + | |||
| + | ===== Version ===== | ||
| + | PBC revision is marked as rev:3 | ||
| + | |||
| + | ===== Hardware Highlights ===== | ||
| + | ^ Version / Model ^ SoC ^ WiFi ^ Ethernet ^ Ram ^ Flash ^ LAN ^ USB ^ Serial ^ JTag ^ | ||
| + | | Unknown (maybe v1) |Atheros AR9132 CPU@400MHz | Atheros AR9103 | Atheros AR8021 | 32MiB | MX 25L6406EMI, 8MB | 1 | ? | Yes | Yes | | ||
| + | | v2 | Atheros AR9132 CPU@400 MHz | < | ||
| + | |||
| + | ==== Serial console ==== | ||
| + | |||
| + | The serial console connector (JP1), pinout: GND - TX - RX - VCC. Ground pin is near to flash chip. Serial setup is 115200 8N1. | ||
| + | |||
| + | Version 2 Pin ordering: P1: VCC (3.3V), P2: TX, P3: RX, P4: GND | ||
| + | |||
| + | ==== LED table ==== | ||
| + | |||
| + | ^ GPIO ^ LED ^ Colour ^ Active ^ | ||
| + | | 1 | Tick | Orange | High | | ||
| + | | 6 | WLAN | Blue | High | | ||
| + | |||
| + | ==== LOGS ==== | ||
| + | |||
| + | Bootloader is u-boot. | ||
| + | < | ||
| + | U-Boot 1.1.4-WNAP210-V2.2 (Mar 24 2009 - 18:08:52) | ||
| + | |||
| + | AP83 (ar9100 with SPI flash) | ||
| + | DRAM: 32 MB | ||
| + | Found MXIC Flash. ID c22017 | ||
| + | Flash: | ||
| + | In: serial | ||
| + | Out: | ||
| + | Err: | ||
| + | Net: | ||
| + | Fetching MAC Address from 0xbf7f1000 | ||
| + | MAC_CFG1 0xf MAC_CFG2 0x7114 | ||
| + | PHY Setting up... | ||
| + | VSCXXX Found 0 unit 0:0 phy_addr: 1 id: 004dd04e | ||
| + | PHY: | ||
| + | eth0: 10: | ||
| + | eth0 up | ||
| + | |||
| + | Manu data is valid! | ||
| + | Enter SPACE to drop into boot loader: | ||
| + | ar7100> | ||
| + | ar7100> bdinfo | ||
| + | cpufreq | ||
| + | cpuinfo | ||
| + | boot_params = 0x81F6BFA4 | ||
| + | memstart | ||
| + | memsize | ||
| + | flashstart | ||
| + | flashsize | ||
| + | flashoffset = 0x00037EDC | ||
| + | ethaddr | ||
| + | ip_addr | ||
| + | baudrate | ||
| + | ar7100> | ||
| + | ar7100> version | ||
| + | |||
| + | U-Boot 1.1.4-WNAP210-V2.2 (Mar 24 2009 - 18:08:52) | ||
| + | chiamgming@gmail.com | ||
| + | ar7100> showmd | ||
| + | ProductID | ||
| + | HWVer = 00:00:00:02 | ||
| + | reginfo | ||
| + | numofimages = -1 | ||
| + | currimage | ||
| + | basemac | ||
| + | maccnt0 | ||
| + | maccnt1 | ||
| + | maccnt2 | ||
| + | maccnt3 | ||
| + | serno = 22042A5D00CE7 | ||
| + | cpufreq | ||
| + | cpuinfo | ||
| + | boot_params = 0x81F6BFA4 | ||
| + | memstart | ||
| + | memsize | ||
| + | flashstart | ||
| + | flashsize | ||
| + | flashoffset = 0x00037EDC | ||
| + | ethaddr | ||
| + | ip_addr | ||
| + | baudrate | ||
| + | ar7100> | ||
| + | ar7100> imls | ||
| + | Image at BF050000: | ||
| + | Image Name: Linux Kernel | ||
| + | | ||
| + | Image Type: MIPS Linux Kernel Image (gzip compressed) | ||
| + | Data Size: 917504 Bytes = 896 kB | ||
| + | Load Address: 80060000 | ||
| + | Entry Point: | ||
| + | | ||
| + | ar7100> | ||
| + | ar7100> iminfo | ||
| + | |||
| + | ## Checking Image at 81000000 ... | ||
| + | Bad Magic Number | ||
| + | ar7100> fsinfo | ||
| + | mtdparts variable not set, see 'help mtdparts' | ||
| + | ar7100> flinfo | ||
| + | |||
| + | Bank # 1: The hell do you want flinfo for?? | ||
| + | ar7100> | ||
| + | ar7100> coninfo | ||
| + | List of available devices: | ||
| + | serial | ||
| + | ar7100> | ||
| + | </ | ||
| + | |||
| + | Default printenv | ||
| + | |||
| + | < | ||
| + | ar7100> printenv | ||
| + | bootdelay=5 | ||
| + | baudrate=115200 | ||
| + | ethaddr=00: | ||
| + | uboot_addr=0xbf000000 | ||
| + | uboot_size=+0x40000 | ||
| + | uboot_env_addr=0xbf040000 | ||
| + | uboot_env_size=+0x10000 | ||
| + | ap_config_addr=0xbf290000 | ||
| + | ap_config_size=+0x10000 | ||
| + | cvr_config_addr=0xbf2a0000 | ||
| + | cvr_config_size=+0x10000 | ||
| + | manu_addr=0xbf7e0000 | ||
| + | manu_size=+0x10000 | ||
| + | art_addr=0xbf7f0000 | ||
| + | art_size=+0x10000 | ||
| + | rootfs=burn | ||
| + | uimagename=u-boot.bin | ||
| + | erase_uimage=erase ${uboot_addr} ${uboot_size} | ||
| + | erase_eimage=erase ${uboot_env_addr} ${uboot_env_size} | ||
| + | erase_apimage=erase ${ap_config_addr} ${ap_config_size} | ||
| + | erase_cvrimage=erase ${cvr_config_addr} ${cvr_config_size} | ||
| + | erase_aimage=erase ${art_addr} ${art_size} | ||
| + | erase_ckmimage=erase ${ckm_addr} ${ckm_size} | ||
| + | erase_manuimage=erase ${manu_addr} ${manu_size} | ||
| + | uimage=${download} ${memtmp_addr} ${uimagename}; | ||
| + | apimage=${download} ${memtmp_addr} ap_user_config${USER}; | ||
| + | cvrimage=${download} ${memtmp_addr} cvr_user_config${USER}; | ||
| + | aimage=${download} ${memtmp_addr} art_data_64k${USER}; | ||
| + | manuimage=${download} ${memtmp_addr} manu_data_64k${USER}; | ||
| + | clearenv=run erase_eimage | ||
| + | producttest=memtest ram 1;memtest flash 1;porttest lan; | ||
| + | ethact=eth0 | ||
| + | kimagename=vmlinux.gz.uImage | ||
| + | rimagename=rootfs.squashfs | ||
| + | download=tftp | ||
| + | memtmp_addr=0x80060000 | ||
| + | kernel_size=+0x100000 | ||
| + | kernel_addr=0xbf050000 | ||
| + | rootfs_size=+0x610000 | ||
| + | rootfs_addr=0xbf150000 | ||
| + | clear_var=era 0xbf760000 +0x80000 | ||
| + | serverip=192.168.0.101 | ||
| + | ipaddr=192.168.0.236 | ||
| + | bootargs=console=ttyS0, | ||
| + | erase_kimage=erase ${kernel_addr} ${kernel_size} | ||
| + | erase_rimage=erase ${rootfs_addr} ${rootfs_size} | ||
| + | kimage=${download} ${memtmp_addr} ${kimagename}; | ||
| + | rimage=${download} ${memtmp_addr} | ||
| + | bootcmd=bootm 0xbf050000 | ||
| + | flash_rootfs=run rimage | ||
| + | flash_kernel=run kimage | ||
| + | flash_all=run flash_kernel flash_rootfs clear_var | ||
| + | stdin=serial | ||
| + | stdout=serial | ||
| + | stderr=serial | ||
| + | |||
| + | Environment size: 2380/65532 bytes | ||
| + | </ | ||
| + | |||
| + | **Netgear firmware boot** | ||
| + | < | ||
| + | ar7100> bootd | ||
| + | ## Booting image at bf050000 ... | ||
| + | Image Name: Linux Kernel | ||
| + | | ||
| + | Image Type: MIPS Linux Kernel Image (gzip compressed) | ||
| + | Data Size: 917504 Bytes = 896 kB | ||
| + | Load Address: 80060000 | ||
| + | Entry Point: | ||
| + | | ||
| + | | ||
| + | |||
| + | Starting kernel @80214000... | ||
| + | |||
| + | Linux version 2.6.23-WNAP210_2.1.1 (root@build) (gcc version 4.2.4) #1 Wed Oct 5 12:52:10 IST 2011 | ||
| + | flash_size passed from bootloader = 8 | ||
| + | arg 1: console=ttyS0, | ||
| + | arg 2: rootfstype=squashfs | ||
| + | arg 3: root=31:03 | ||
| + | arg 4: init=/ | ||
| + | arg 5: mtdparts=ar7100-nor0: | ||
| + | arg 6: mem=32M | ||
| + | CPU revision is: 00019374 | ||
| + | Determined physical RAM map: | ||
| + | | ||
| + | User-defined physical RAM map: | ||
| + | | ||
| + | Built 1 zonelists in Zone order. | ||
| + | Kernel command line: console=ttyS0, | ||
| + | Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes. | ||
| + | Primary data cache 32kB, 4-way, linesize 32 bytes. | ||
| + | Synthesized TLB refill handler (20 instructions). | ||
| + | Synthesized TLB load handler fastpath (32 instructions). | ||
| + | Synthesized TLB store handler fastpath (32 instructions). | ||
| + | Synthesized TLB modify handler fastpath (31 instructions). | ||
| + | Cache parity protection disabled | ||
| + | PID hash table entries: 128 (order: 7, 512 bytes) | ||
| + | Using 200.000 MHz high precision timer. | ||
| + | console [ttyS0] enabled | ||
| + | Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) | ||
| + | Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) | ||
| + | Memory: 30204k/ | ||
| + | Mount-cache hash table entries: 512 | ||
| + | NET: Registered protocol family 16 | ||
| + | NET: Registered protocol family 2 | ||
| + | Time: MIPS clocksource has been installed. | ||
| + | IP route cache hash table entries: 1024 (order: 0, 4096 bytes) | ||
| + | TCP established hash table entries: 1024 (order: 1, 8192 bytes) | ||
| + | TCP bind hash table entries: 1024 (order: 0, 4096 bytes) | ||
| + | TCP: Hash tables configured (established 1024 bind 1024) | ||
| + | TCP reno registered | ||
| + | AR7100 GPIOC major 0 | ||
| + | squashfs: version 3.3 (2007/ | ||
| + | squashfs: LZMA suppport for slax.org by jro | ||
| + | JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc. | ||
| + | io scheduler noop registered | ||
| + | io scheduler deadline registered (default) | ||
| + | Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing enabled | ||
| + | serial8250: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A | ||
| + | serial8250.0: | ||
| + | 7 cmdlinepart partitions found on MTD device ar7100-nor0 | ||
| + | Creating 7 MTD partitions on " | ||
| + | 0x00000000-0x00040000 : " | ||
| + | 0x00040000-0x00050000 : " | ||
| + | 0x00050000-0x00150000 : " | ||
| + | 0x00150000-0x00760000 : " | ||
| + | 0x00760000-0x007e0000 : " | ||
| + | 0x007e0000-0x007f0000 : " | ||
| + | 0x007f0000-0x00800000 : " | ||
| + | TCP cubic registered | ||
| + | NET: Registered protocol family 1 | ||
| + | NET: Registered protocol family 17 | ||
| + | VFS: Mounted root (squashfs filesystem) readonly. | ||
| + | Freeing unused kernel memory: 84k freed | ||
| + | |||
| + | Mounting etc to ramfs. | ||
| + | |||
| + | Mounting var to jffs2. | ||
| + | |||
| + | Checking SSH keys. [DONE] | ||
| + | |||
| + | Checking for run file. [DONE] | ||
| + | |||
| + | Starting System Logger. | ||
| + | |||
| + | Starting Kernel Logger. | ||
| + | |||
| + | Starting Panel LED. | ||
| + | |||
| + | Starting watchdog. | ||
| + | |||
| + | Starting Reset Detect. | ||
| + | |||
| + | Checking Manufac. data [DONE] | ||
| + | |||
| + | Checking board file. [CREATED] | ||
| + | |||
| + | Loading Ethernet module. | ||
| + | |||
| + | [DONE] | ||
| + | |||
| + | Checking database. | ||
| + | |||
| + | Verifing checksum. | ||
| + | |||
| + | Loading Bridge module. | ||
| + | [DONE] | ||
| + | |||
| + | Loading wlan modules. | ||
| + | |||
| + | Creating vap interface. | ||
| + | |||
| + | Creating wds interface. | ||
| + | |||
| + | Starting configd. | ||
| + | |||
| + | Starting web server. | ||
| + | |||
| + | Starting Translator... | ||
| + | [syslog] | ||
| + | |||
| + | Starting Translator... | ||
| + | |||
| + | Starting Translator... | ||
| + | |||
| + | Starting Translator... | ||
| + | |||
| + | Starting Translator... | ||
| + | |||
| + | Starting Translator... | ||
| + | |||
| + | Starting Translator... | ||
| + | [bridge_and_vlan_translator] | ||
| + | |||
| + | Starting Translator... | ||
| + | |||
| + | Starting Translator... | ||
| + | |||
| + | Starting Translator... | ||
| + | |||
| + | Starting Translator... | ||
| + | |||
| + | Starting Translator... | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | [http_redirect_tr] | ||
| + | |||
| + | Starting Translator... | ||
| + | |||
| + | Sending ARPingARPING to 192.168.0.236 from 192.168.0.236 via brtrunk | ||
| + | Sent 1 probe(s) (1 broadcast(s)) | ||
| + | Received 0 reply (0 request(s), 0 broadcast(s)) | ||
| + | l2_packet_receive - recvfrom: Network is down | ||
| + | ARPING to 192.168.0.236 from 192.168.0.236 via brtrunk | ||
| + | Sent 1 probe(s) (1 broadcast(s)) | ||
| + | Received 0 reply (0 request(s), 0 broadcast(s)) | ||
| + | ARPING to 192.168.0.236 from 192.168.0.236 via brtrunk | ||
| + | Sent 1 probe(s) (1 broadcast(s)) | ||
| + | Received 0 reply (0 request(s), 0 broadcast(s)) | ||
| + | ARPING to 192.168.0.236 from 192.168.0.236 via brtrunk | ||
| + | Sent 1 probe(s) (1 broadcast(s)) | ||
| + | Received 0 reply (0 request(s), 0 broadcast(s)) | ||
| + | ARPING to 192.168.0.236 from 192.168.0.236 via brtrunk | ||
| + | Sent 1 probe(s) (1 broadcast(s)) | ||
| + | Received 0 reply (0 request(s), 0 broadcast(s)) | ||
| + | ARPING to 192.168.0.236 from 192.168.0.236 via brtrunk | ||
| + | Sent 1 probe(s) (1 broadcast(s)) | ||
| + | Received 0 reply (0 request(s), 0 broadcast(s)) | ||
| + | ARPING to 192.168.0.236 from 192.168.0.236 via brtrunk | ||
| + | Sent 1 probe(s) (1 broadcast(s)) | ||
| + | Received 0 reply (0 request(s), 0 broadcast(s)) | ||
| + | |||
| + | System initilization is .. [DONE...] | ||
| + | |||
| + | |||
| + | Welcome to SDK. | ||
| + | |||
| + | Have a lot of fun... | ||
| + | |||
| + | netgear454388 login: | ||
| + | </ | ||
| + | |||
| + | //Default user/psd is admin/ | ||
| + | |||
| + | **Inspection** | ||
| + | < | ||
| + | # cat /proc/mtd | ||
| + | dev: size | ||
| + | mtd0: 00040000 00010000 " | ||
| + | mtd1: 00010000 00010000 " | ||
| + | mtd2: 00100000 00010000 " | ||
| + | mtd3: 00610000 00010000 " | ||
| + | mtd4: 00080000 00010000 " | ||
| + | mtd5: 00010000 00010000 " | ||
| + | mtd6: 00010000 00010000 " | ||
| + | |||
| + | # cat / | ||
| + | system type : Atheros AR9100 | ||
| + | processor | ||
| + | cpu model : MIPS 24K V7.4 | ||
| + | BogoMIPS | ||
| + | wait instruction | ||
| + | microsecond timers | ||
| + | tlb_entries | ||
| + | extra interrupt vector | ||
| + | hardware watchpoint | ||
| + | ASEs implemented | ||
| + | VCED exceptions | ||
| + | VCEI exceptions | ||
| + | </ | ||
| + | |||
| + | ==== U-Boot recovery mode ==== | ||
| + | If the checksum check fails, u-boot enters tftp recovery mode. It will listen on IP 192.168.0.236 and accept new factory images via tftp (don't forget to set binary mode). | ||
| + | Recovery mode is indicated by the power led lighting up briefly in orange, followed by about 1-second interval green blinking. | ||
| + | This can be used to go back to the stock firmware, by deliberately erasing the checksum partition. | ||
| + | |||
| + | < | ||
| + | U-Boot 1.1.4-WNAP210-V2.2 (Mar 24 2009 - 18:08:52) | ||
| + | |||
| + | AP83 (ar9100 with SPI flash) | ||
| + | DRAM: 32 MB | ||
| + | Found MXIC Flash. ID c22017 | ||
| + | Flash: | ||
| + | In: serial | ||
| + | Out: | ||
| + | Err: | ||
| + | Net: | ||
| + | Fetching MAC Address from 0xbf7f1000 | ||
| + | MAC_CFG1 0x7 MAC_CFG2 0x7114 | ||
| + | PHY Setting up... | ||
| + | VSCXXX Found 0 unit 0:0 phy_addr: 1 id: 004dd04e | ||
| + | PHY: | ||
| + | eth0: 10: | ||
| + | eth0 up | ||
| + | |||
| + | Manu data is valid! | ||
| + | Enter SPACE to drop into boot loader: | ||
| + | ## Booting image at bf050000 ... | ||
| + | Bad Magic Number | ||
| + | eth0 link down | ||
| + | |||
| + | The Router is in TFTP Server Firmware Recovery mode NOW! | ||
| + | Listening on Port : 69, IP Address: 192.168.0.236... | ||
| + | |||
| + | </ | ||
| + | |||
| + | ===== Tags ===== | ||
| + | [[meta: | ||
| + | {{tag> | ||