NETGEAR WNDR4300 v1

This page covers WNDR4300 v1 and WNDR4300SW.

There are several versions of this router:

  • V1: The label at the bottom of the router says WNDR4300. Similar to WNDR3700v4 but 3T3R. OpenWrt forum thread on WNDR3700v4. Stock Netgear WNDR4300v1 comes pre-installed with a modified version of OpenWrt Kamikaze (bleeding-edge, r18571). One can access a terminal on the WNDR4300v1 by using telnet.
  • V2: The label at the bottom of the router says WNDR4300v2. For v2 see NETGEAR WNDR4300 v2
  • SW: SureWest, Northern California ISP. Hardware identical to the V1 hardware with a custom OpenWrt Kamikaze SureWest build. Will only accept OpenWrt/LEDE firmware after modifying the 128 byte header and checksum values up till 19.07. Subsequent releases will have a separate SW image.

Note: in menuconfig, in order to see “WNDR4300” in “Target Profile”, first set “Subtarget” to “Generic devices with NAND flash”.

:!: SW model has hardware identical to v1 but OpenWrt firmware requires modified 128 byte header and checksum

:!: Before Barrier Breaker 14.07 RC1, sysupgrade and persistent system settings used to be problematic on WNDR4300v1, but those have been fixed from 14.07 RC1 on.

:!: As of Chaos Calmer 15.05 both radios are supported at least on the v1 unit.

Install OpenWrt (generic explanation)

The Netgear WNDR3700(v4) installation instructions are applicable for the WNDR4300v1 device too. However, make sure using the firmware with the correct model designation in the firmware filename (wndr4300).

This is for installing for the first time OpenWrt on the router (still with the stock firmware):

  1. Connect your computer to the router with an ethernet cable and browse to http://192.168.1.1/
    (default credentials are admin password)
  2. In Netgear web interface go to:
    Advanced > Administration > Firmware Upgrade
  3. Upload the Openwrt firmware:
    openwrt-19.07.3-ar71xx-nand-wndr4300-ubi-factory.img
  4. Proceed with the firmware installation and wait some minutes until it finish.

:!: To restore the original Netgear firmware, the firmware files downloaded from Netgear (.img files) can be tftp'd directly to the router (the chapter Recovery flash in failsafe mode of the Netgear WNDR3700 page is applicable for WNDR4300 too).

  1. set a static IP on your computer, i.e 192.168.1.2/24 (a.k.a. 192.168.1.2 with a netmask of 255.255.255.0), and connect the ethernet cable to the router (it is important that the cable is plugged in before the following steps)
  2. power off the router
  3. press and hold the RESET button (factory reset button on the bottom with the red circle around it)
  4. turn on the router while continuing to hold the RESET
  5. continue to hold the RESET button until the power LED begins to flash orange and then flashes green
  6. once the power LED is flashing green, release RESET
  7. start the TFTP transfer to router at 192.168.1.1. In your computer execute:
    tftp 192.168.1.1 -m binary -c put factory.img

You can also break into Uboot command line via serial interface and execute:
fw_recovery
Then you can send the factory firmware via tftp client from the computer.

This is for booting OpenWrt without touching the flash chip memory (serial cable and tftp server in your PC required):

  1. build your own firmware, specifically select the RAMDISK option when configuring via make menuconfig
  2. set the 192.168.1.7 static IP on your computer, and connect the ethernet cable to the router
  3. put the xxxxxx-wndr4300-initramfs-uImage.bin into the TFTP server at your computer
  4. boot the router and break into the Uboot command line, via serial console
  5. enter the following into Uboot command line:
    tftpboot 82000000 xxxxxx-wndr4300-initramfs-uImage.bin
    bootm 
  6. The system should boot!

Example: session booting a ramdisk image

ar7240> tftpboot 80800000 lede-ar71xx-nand-wndr4300-initramfs-uImage.bin Using eth0 device TFTP from server 192.168.1.7; our IP address is 192.168.1.1 Filename 'lede-ar71xx-nand-wndr4300-initramfs-uImage.bin'. Load address: 0x80800000 Loading: *\0x08################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ########################################################## done Bytes transferred = 4286435 (4167e3 hex) ar7240> bootm ## Booting image at 80800000 ... Image Name: MIPS OpenWrt Linux-4.4.49 Created: 2017-02-20 11:06:18 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 4286371 Bytes = 4.1 MB Load Address: 80060000 Entry Point: 80060000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... [ 0.000000] Linux version 4.4.49 (dani@tool) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3383-0bf85ef) ) #0 Mon Feb 20 11:06:18 2017 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc) [ 0.000000] SoC: Atheros AR9344 rev 2 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] No valid device tree found, continuing without [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]


Interfaces

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi 192.168.1.1/24
(eth0) AR8327 Gigabit Switch None
VLAN 1 (eth0.1) LAN ports (1 to 4) None
VLAN 2 (eth0.2) WAN port (5) DHCP
wlan0 WiFi 2.4 GHz Disabled
wlan1 WiFi 5 GHz Disabled

Interfaces

root@WNDR4300:/# ifconfig ath0 Link encap:Ethernet HWaddr 00:8E:F2:F9:E9:56 inet6 addr: fe80::28e:f2ff:fef9:e956/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:1528 errors:0 dropped:1263 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:611200 (596.8 KiB) ath1 Link encap:Ethernet HWaddr 00:8E:F2:F9:E9:58 inet6 addr: fe80::28e:f2ff:fef9:e958/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:63 errors:0 dropped:1262 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:23814 (23.2 KiB) br0 Link encap:Ethernet HWaddr 00:8E:F2:F9:E9:56 inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: fe80::28e:f2ff:fef9:e956/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:11914 errors:0 dropped:0 overruns:0 frame:0 TX packets:7801 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:814320 (795.2 KiB) TX bytes:3655772 (3.4 MiB) eth0 Link encap:Ethernet HWaddr 00:8E:F2:F9:E9:56 inet6 addr: fe80::28e:f2ff:fef9:e956/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:11918 errors:0 dropped:0 overruns:0 frame:0 TX packets:7284 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:862528 (842.3 KiB) TX bytes:3568425 (3.4 MiB) eth1 Link encap:Ethernet HWaddr 00:8E:F2:F9:E9:57 inet6 addr: fe80::28e:f2ff:fef9:e957/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:35 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:9398 (9.1 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:26806 errors:0 dropped:0 overruns:0 frame:0 TX packets:26806 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1093086 (1.0 MiB) TX bytes:1093086 (1.0 MiB) phy0 Link encap:Ethernet HWaddr 00:8E:F2:F9:E9:56 inet6 addr: fe80::28e:f2ff:fef9:e956/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:11918 errors:0 dropped:0 overruns:0 frame:0 TX packets:8170 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1077052 (1.0 MiB) TX bytes:3662022 (3.4 MiB) wifi0 Link encap:Ethernet HWaddr 00:8E:F2:F9:E9:56 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:363172 errors:0 dropped:0 overruns:0 frame:0 TX packets:39405 errors:1101 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) Interrupt:2 Memory:b8100000-b811ffff wifi1 Link encap:Ethernet HWaddr 00:8E:F2:F9:E9:58 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:190 errors:0 dropped:0 overruns:0 frame:0 TX packets:34344 errors:46 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) Interrupt:64 Memory:b0000000-b0020000


VLAN

root@WNDR4300:/# cat /proc/net/vlan/config 
VLAN Dev name    | VLAN ID
Name-Type: VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD
eth0           | 1  | phy0
eth1           | 2  | phy0

Wireless

Done in the file /etc/config/wireless

GPIO

From /etc/rc.local

# Configure GPIO4 as input
mm 0xb8040000 `md 0xb8040000 | awk '{printf("0x%x\n"),or(int($3),0x10)}'`
V1
Instruction set MIPS
Vendor Qualcomm Atheros
bootloader U-Boot
System-On-Chip AR9344
CPU @Frq MIPS 74Kc @560MHz
Flash-Chip Micron 29F1G08ABADA
Flash size 128 MiB NAND
RAM Nanya NT5TU32M16DG-AC / DDR2-800
RAM size 128 MiB
Wireless Atheros AR9340 2.4GHz 802.11bgn, 2T2R
Atheros AR9580 5GHz 802.11an, 3T3R
RegDomain US
Ethernet Atheros AR8327 Gigabit Switch
USB Yes 1 x 2.0
PSU 12V DC 2.5A / P030WF120B
Serial Yes
JTAG Yes

Available here: http://uk.hardware.info/reviews/3685/4/netgear-wndr4300-review-3800+40004300-photos-and-screenshots

Model Number

Front:

Photo of front of the casing

Back:

Photo of back of the casing

Note: This will void your warranty!

Note: Instructions from WNDR3700

  • To remove the cover use a Torx (T-8) screwdriver.
  • There are two screws easily visible on the bottom of the case.
  • There are four more screws under the rubber feet. The feet are not glued to the plastic and can easily be removed and pushed back into place once reassembled. The feet have rubber tethers, but you can slide them out gently without damaging them, and later you can reinsert them just as easily. Don't forget to put them in a plastic baggie so you don't lose them!

V1 Photo of PCB

The serial connection are the headers just to the left of the RF shield. From the bottom of the picture, which is the front of the device, the GND pin is first followed by RX, TX, and finally VCC is the topmost pin (towards the back of the device). Another image is available here: http://uk.hardware.info/reviews/3685/2/netgear-wndr4300-review-3800+40004300-atheros-pcb

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device: GND pin is at the front of the device, followed by RX/TX/VCC

115200 baud, 8 data bits, 1 stop bit, no parity, no handshake

Having a serial console connected at boot may cause the device to fail booting. Connect a few seconds after power on or later. Specifically the Tx line causes the failure.

find_hif: bootstrap = 0xaf055b
WASP BootROM Ver. 1.1
Nand Flash init
ONFI: Control setting = 0xb44
hdr: [0xbd004000 : 0xbd004000 : 0x3000 : 0xc200e86c]
nand_load_fw: read 6 pages
nand_load_fw: 0x10000 0x800 0xbd0047f0
nand_load_fw: 0x20000 0x800 0xbd004ff0
nand_load_fw: 0x30000 0x800 0xbd0057f0
nand_load_fw: 0x40000 0x800 0xbd005ff0
nand_load_fw: 0x50000 0x800 0xbd0067f0
f/w 0 read complete, jumping to 0xbd004000
initialize PLL & DDR

sri
Wasp 1.2
Wasp (16bit) ddr1 init             <---- this should be:  Wasp (32bit) ddr2 init
setting for 40
fw1: Nand Init
leave FW1
f/w 0 execution complete
hdr: [0xa0100000 : 0xa0100000 : 0x11000 : 0x26e9875d]
nand_load_fw: read 34 pages
nand_load_fw: 0x70000 0x800 0xa01007f0
... 31 increments ...
nand_load_fw: 0x270000 0x800 0xa01107f0
Checksum mismatch. 0x26e9875d != 0xa1b631f6
 -- repeat ad infinitum --

port.jtag general information about the JTAG port, JTAG cable, etc.

The JTAG port is located in the bottom left of the PCB, see Opening the case. However the pins are also used for LEDs (GPIO pins 0-3)

How to connect to the JTAG Port of this specific device: TODO

GPIO LOW = 0V, GPIO HIGH = 2.64V

GPIO pin Function PCB markings
0 LED power green
1 LED wan green
2 LED power amber
3 LED wan amber
4 R204 / R597 - direct to SoC wndr4300-serial_port.jpg
5 SPI CS0# - not connected wndr4300-spi-gpios.jpg
wndr4300-gpios_bottom.jpg
6 SPI CLK - not connected
7 SPI MOSI - not connected
8 SPI MISO - not connected
9 UART0 serial IN wndr4300-serial_port.jpg
10 UART0 serial OUT
11 LED_WLAN 2G
12 Button WPS
13 LED USB
14 LED WLAN 5G
15 Button WIRELESS
16 LED wps green
17 LED wps amber
18 wifi LNA 0 - R397 pullup wndr4300-gpios-undershield.jpg
wndr4300-gpios_bottom.jpg
19 wifi LNA 1
20 R395 pullup - unsoldered
21 Button RESET
22 eth switch - R396 pullup

For making the SPI pins work as GPIOs, a pinmux modification is needed. You can execute the command:

devmem 0x18040030 32 0x00000000

For making the UART0 pins work as GPIOs (it will also disable SPI MISO pin):

devmem 0x18040034 32 0x00000000
root@WNDR4300:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "u-boot"
mtd1: 00040000 00020000 "u-boot-env"
mtd2: 00040000 00020000 "caldata"
mtd3: 00080000 00020000 "pot"
mtd4: 00200000 00020000 "language"
mtd5: 00080000 00020000 "config"
mtd6: 00300000 00020000 "traffic_meter"
mtd7: 00120000 00020000 "kernel"
mtd8: 017e0000 00020000 "rootfs"
mtd9: 00f40000 00020000 "rootfs_data"
mtd10: 01900000 00020000 "firmware"
mtd11: 00040000 00020000 "caldata_backup"
mtd12: 06000000 00020000 "reserved"

dmesg Output (as of Firmware 1.0.1.34)

Atheros on-chip NAND FLash Controller Driver, Version 0.1 (c) 2010 Atheros Communications, Ltd.
Ath Nand ID[878555a0]: 2c:f1:80:95:02
ONFI MICRON      MT29F1G08ABADAWP   
Micron NAND 128MiB 3,3V 8-bit [128MB]
12 cmdlinepart partitions found on MTD device ath-nand
Creating 12 MTD partitions on "ath-nand":
0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000080000 : "u-boot-env"
0x000000080000-0x0000000c0000 : "caldata"
0x0000000c0000-0x000000140000 : "pot"
0x000000140000-0x000000340000 : "language"
0x000000340000-0x0000003c0000 : "config"
0x0000003c0000-0x0000006c0000 : "traffic_meter"
0x0000006c0000-0x0000007e0000 : "kernel"
0x0000007e0000-0x000001fc0000 : "rootfs"
mtd: find squashfs magic at 0x7e0000 of "ath-nand"
the correct location of partition "rootfs": 0x0000007e0000-0x000001fc0000
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=1080000, len=F40000 
0x000001080000-0x000001fc0000 : "rootfs_data"
0x0000006c0000-0x000001fc0000 : "firmware"
0x000001fc0000-0x000002000000 : "caldata_backup"
0x000002000000-0x000008000000 : "reserved"
=== NAND Parameters ===
sc = 0x87855400 bbt = 0x878f7200 bbt_size = 0x100 nf_ctrl = 0x344
page = 0x800 block = 0x20000 oob = 0x40

Visual representation

Netgear WNDR4300
Layer0 Atheros NAND Flash Controller: Micron NAND 128MiB 3,3V 8-bit [128MB]
Layer1 mtd0 u-boot 256KiB mtd1 u-boot-env 256KiB mtd2 caldata 256KiB mtd3 pot 512KiB mtd4 language 2MiB mtd5 config 512KiB mtd6 traffic_meter 2MiB mtd10 firmware 25MiB mtd11 caldata_backup 256KiB mtd12 reserved 96MiB
Layer2 mtd7 kernel 1152KiB mtd8 rootfs 24448KiB
mountpoint / /jffs
filesystem mini_fo/overlayfs
Layer3 mtd9 rootfs_data 15616KiB
mountpoint /rom /overlay
filesystem none none none none none none none none SquashFS JFFS2 none JFFS2

Current (from v21.02.0-rc1)

It was changed in this commit to a “ubiconcat” layout to utilize all space on the flash memory.

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "u-boot"
mtd1: 00040000 00020000 "u-boot-env"
mtd2: 00040000 00020000 "caldata"
mtd3: 00080000 00020000 "pot"
mtd4: 00200000 00020000 "language"
mtd5: 00080000 00020000 "config"
mtd6: 00300000 00020000 "traffic_meter"
mtd7: 00400000 00020000 "kernel"
mtd8: 01500000 00020000 "ubiconcat0"
mtd9: 01900000 00020000 "firmware"
mtd10: 00040000 00020000 "caldata_backup"
mtd11: 06000000 00020000 "ubiconcat1"
mtd12: 07500000 00020000 "ubi"

Older

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00040000 00020000 "u-boot"
mtd1: 00040000 00020000 "u-boot-env"
mtd2: 00040000 00020000 "caldata"
mtd3: 00080000 00020000 "pot"
mtd4: 00200000 00020000 "language"
mtd5: 00080000 00020000 "config"
mtd6: 00300000 00020000 "traffic_meter"
mtd7: 00200000 00020000 "kernel"
mtd8: 01700000 00020000 "ubiroot"
mtd9: 01900000 00020000 "firmware"
mtd10: 00040000 00020000 "caldata_backup"
mtd11: 06000000 00020000 "reserved"
mtd12: 001d1000 0001f000 "rootfs"
mtd13: 0118f000 0001f000 "rootfs_data"
Visual representation

Click to display ⇲

Click to hide ⇱

Netgear WNDR4300
Layer0 Atheros NAND Flash Controller: Micron NAND 128MiB 3,3V 8-bit [128MB]
Layer1 mtd0 u-boot 256KiB mtd1 u-boot-env 256KiB mtd2 caldata 256KiB mtd3 pot 512KiB mtd4 language 2MiB mtd5 config 512KiB mtd6 traffic_meter 2MiB mtd9 firmware 25MiB mtd10 caldata_backup 256KiB mtd11 reserved 96MiB
Layer2 mtd7 kernel 2048KiB mtd8 ubiroot 23MiB
wear-leveling ubi and gluebi/overlayfs
Layer3 mtd12 rootfs 1860KiB* mtd13 rootfs_data 17980KiB*
mountpoint /rom /overlay
filesystem none none none none none none none none SquashFS JFFS2 none none

* dynamic size

find_hif: bootstrap = 0xaf055a WASP BootROM Ver. 1.1 Nand Flash init ONFI: Control setting = 0xb44 hdr: [0xbd004000 : 0xbd004000 : 0x3000 : 0xc200e86c] nand_load_fw: read 6 pages nand_load_fw: 0x10000 0x800 0xbd0047f0 nand_load_fw: 0x20000 0x800 0xbd004ff0 nand_load_fw: 0x30000 0x800 0xbd0057f0 nand_load_fw: 0x40000 0x800 0xbd005ff0 nand_load_fw: 0x50000 0x800 0xbd0067f0 f/w 0 read complete, jumping to 0xbd004000 initialize PLL & DDR sri Wasp 1.2 Wasp (32bit) ddr2 init setting for 40 fw1: Nand Init leave FW1 f/w 0 execution complete hdr: [0xa0100000 : 0xa0100000 : 0x11000 : 0x26e9875d] nand_load_fw: read 34 pages nand_load_fw: 0x70000 0x800 0xa01007f0 nand_load_fw: 0x80000 0x800 0xa0100ff0 nand_load_fw: 0x90000 0x800 0xa01017f0 nand_load_fw: 0xa0000 0x800 0xa0101ff0 nand_load_fw: 0xb0000 0x800 0xa01027f0 nand_load_fw: 0xc0000 0x800 0xa0102ff0 nand_load_fw: 0xd0000 0x800 0xa01037f0 nand_load_fw: 0xe0000 0x800 0xa0103ff0 nand_load_fw: 0xf0000 0x800 0xa01047f0 nand_load_fw: 0x100000 0x800 0xa0104ff0 nand_load_fw: 0x110000 0x800 0xa01057f0 nand_load_fw: 0x120000 0x800 0xa0105ff0 nand_load_fw: 0x130000 0x800 0xa01067f0 nand_load_fw: 0x140000 0x800 0xa0106ff0 nand_load_fw: 0x150000 0x800 0xa01077f0 nand_load_fw: 0x160000 0x800 0xa0107ff0 nand_load_fw: 0x170000 0x800 0xa01087f0 nand_load_fw: 0x180000 0x800 0xa0108ff0 nand_load_fw: 0x190000 0x800 0xa01097f0 nand_load_fw: 0x1a0000 0x800 0xa0109ff0 nand_load_fw: 0x1b0000 0x800 0xa010a7f0 nand_load_fw: 0x1c0000 0x800 0xa010aff0 nand_load_fw: 0x1d0000 0x800 0xa010b7f0 nand_load_fw: 0x1e0000 0x800 0xa010bff0 nand_load_fw: 0x1f0000 0x800 0xa010c7f0 nand_load_fw: 0x200000 0x800 0xa010cff0 nand_load_fw: 0x210000 0x800 0xa010d7f0 nand_load_fw: 0x220000 0x800 0xa010dff0 nand_load_fw: 0x230000 0x800 0xa010e7f0 nand_load_fw: 0x240000 0x800 0xa010eff0 nand_load_fw: 0x250000 0x800 0xa010f7f0 nand_load_fw: 0x260000 0x800 0xa010fff0 nand_load_fw: 0x270000 0x800 0xa01107f0 f/w 1 read complete, jumping to 0xa0100000 U-Boot 1.1.4 (Jun 28 2012 - 10:12:47) U-boot dni29 V0.3 for DNI HW ID: 29763948 flash 128MB RAM 128MB 1st Radio 2x2 2nd Radio 3x3 DRAM: 128 MB Atheros on-chip NAND FLash Controller Driver, Version 0.1 (c) 2010 Atheros Communications, Ltd. Ath Nand ID[87ff0178]: 2c:f1:80:95:02 ONFI MICRON MT29F1G08ABADAWP Micron NAND 128MiB 3,3V 8-bit [128MB] ====== NAND Parameters ====== sc = 0x87ff0158 bbt = 0x87f68008 bbt_size = 0x100 nf_ctrl = 0x344 page = 0x800 block = 0x20000 oob = 0x40 size = 128MB Setting 0xb8116290 to 0x50a02d0f Using default environment In: serial Out: serial Err: serial Net: ag934x_enet_initialize... 4096 bytes read: OK Fetching MAC Address from 0x87fe7928 wasp reset mask:c02300 WASP ----> S17 PHY * : cfg1 0x80000000 cfg2 0x7114 eth0: 28:c6:8e:19:ce:53 athrs17_reg_init: complete eth0 up eth0 Hit any key to stop autoboot: 0 dup 1 speed 1000 Client starts...[Listening] for ADVERTISE...TTT Retry count exceeded; boot the image as usual nmrp server is stopped or failed ! Loading from device 0: ath-nand (offset 0x6c0000)


Linux version 2.6.31 (root@dnixm-compiler1) (gcc version 4.3.3 (GCC) ) #1 Thu Jul 19 20:41:40 CST 2012 flash_size passed from bootloader = 0 CPU revision is: 0001974c (MIPS 74Kc) ath_sys_frequency: cpu srif ddr srif cpu 560 ddr 400 ahb 200 Determined physical RAM map: memory: 08000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00008000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00008000 On node 0 totalpages: 32768 free_area_init_node: node 0, pgdat 80304a60, node_mem_map 81000000 Normal zone: 256 pages used for memmap Normal zone: 0 pages reserved Normal zone: 32512 pages, LIFO batch:7 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512 Kernel command line: console=ttyS0,115200 rootfstype=squashfs board=WNDR4300 mtdparts=ath-nand:256k(u-boot)ro,256k(u-boot-env)ro,256k(caldata),512k(pot),2048k(language),512k(config),3072k(traffic_meter),1152k(kernel),24448k(rootfs),25600k@0x6c0000(firmware),256k(caldata_backup),-(reserved) PID hash table entries: 512 (order: 9, 2048 bytes) Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 126364k/131072k available (2591k kernel code, 4520k reserved, 499k data, 156k init, 0k highmem) SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 NR_IRQS:128 plat_time_init: plat time init done Calibrating delay loop... 279.55 BogoMIPS (lpj=559104) Mount-cache hash table entries: 512 NET: Registered protocol family 16 PCI init:ath_pcibios_init ath_pcibios_init(294): PCI CMD write: 0x356 registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb pci 0000:00:00.0: reg 10 64bit mmio: [0x000000-0x01ffff] pci 0000:00:00.0: reg 30 32bit mmio: [0x000000-0x00ffff] pci 0000:00:00.0: supports D1 pci 0000:00:00.0: PME# supported from D0 D1 D3hot pci 0000:00:00.0: PME# disabled Returning IRQ 64 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered NET: Registered protocol family 1 ATH GPIOC major 0 Initializing usb led semaphore squashfs: version 4.0 (2009/01/31) Phillip Lougher Registering mini_fo version $Id$ JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc. msgmni has been set to 247 io scheduler noop registered io scheduler deadline registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A console [ttyS0] enabled tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> Atheros on-chip NAND FLash Controller Driver, Version 0.1 (c) 2010 Atheros Communications, Ltd. Ath Nand ID[878555a0]: 2c:f1:80:95:02 ONFI MICRON MT29F1G08ABADAWP Micron NAND 128MiB 3,3V 8-bit [128MB] 12 cmdlinepart partitions found on MTD device ath-nand Creating 12 MTD partitions on "ath-nand": 0x000000000000-0x000000040000 : "u-boot" 0x000000040000-0x000000080000 : "u-boot-env" 0x000000080000-0x0000000c0000 : "caldata" 0x0000000c0000-0x000000140000 : "pot" 0x000000140000-0x000000340000 : "language" 0x000000340000-0x0000003c0000 : "config" 0x0000003c0000-0x0000006c0000 : "traffic_meter" 0x0000006c0000-0x0000007e0000 : "kernel" 0x0000007e0000-0x000001fc0000 : "rootfs" mtd: find squashfs magic at 0x7e0000 of "ath-nand" the correct location of partition "rootfs": 0x0000007e0000-0x000001fc0000 mtd: partition "rootfs" set to be root filesystem mtd: partition "rootfs_data" created automatically, ofs=1080000, len=F40000 0x000001080000-0x000001fc0000 : "rootfs_data" 0x0000006c0000-0x000001fc0000 : "firmware" 0x000001fc0000-0x000002000000 : "caldata_backup" 0x000002000000-0x000008000000 : "reserved" ====== NAND Parameters ====== sc = 0x87855400 bbt = 0x878f7200 bbt_size = 0x100 nf_ctrl = 0x344 page = 0x800 block = 0x20000 oob = 0x40 ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver Port Status 1c000004 ath-ehci ath-ehci.0: ATH EHCI ath-ehci ath-ehci.0: new USB bus registered, assigned bus number 1 ehci_reset Intialize USB CONTROLLER in host mode: 13 ehci_reset Port Status 1c000000 ath-ehci ath-ehci.0: irq 3, io mem 0x1b000000 ehci_reset Intialize USB CONTROLLER in host mode: 13 ehci_reset Port Status 1c000000 ath-ehci ath-ehci.0: USB 2.0 started, EHCI 1.00 usb usb1: New USB device found, idVendor=1d6b, idProduct=0002 usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb1: Product: ATH EHCI usb usb1: Manufacturer: Linux 2.6.31 ehci_hcd usb usb1: SerialNumber: platform usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (2048 buckets, 8192 max) ip_tables: (C) 2000-2006 Netfilter Core Team TCP cubic registered NET: Registered protocol family 10 ip6_tables: (C) 2000-2006 Netfilter Core Team IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 Ebtables v2.0 registered 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> arch/mips/atheros/gpio.c (ath_simple_config_init) JUMPSTART_GPIO: 12 athwdt_init: Registering WDT success ath_otp_init: Registering OTP success ath_clksw_init: Registering Clock Switch Interface success VFS: Mounted root (squashfs filesystem) readonly on device 31:8. Freeing unused kernel memory: 156k freed Please be patient, while OpenWrt loads ... mini_fo: using base directory: / mini_fo: using storage directory: /tmp/root PPP generic driver version 2.4.2 dni-qos module init. NET: Registered protocol family 24 nf_nat_STARCRAFT: module license 'unspecified' taints kernel. Disabling lock debugging due to kernel taint nf_conntrack_rtsp v0.6.21 loading nf_nat_rtsp v0.6.21 loading nf_conntrack_proto_esp loaded NET: Registered protocol family 27 PPPoL2TP kernel driver, V0.16.1 PPTP-GRE-v1.13 2007 (C) Delta Networks Inc. ATHR_GMAC: Length per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 ATHR_GMAC: RX TASKLET - Pkts per Intr:100 Reading Flash for Calibraton data from 0x0 and partition name is caldata ATHR_GMAC: Mac address for unit 0:878ab6d0 ATHR_GMAC: 00:8e:f2:f9:e9:56 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 128 ATHR_GMAC: Max rx descriptor count : 128 ATHR_GMAC: Mac capability flags : 223A1 Loading DNI-ENET driver Error, cannot find eth1 interface athr_gmac_ring_alloc Allocated 2048 at 0x87bf8000 athr_gmac_ring_alloc Allocated 2048 at 0x87bf8800 WASP ----> S17 PHY * Setting Drop CRC Errors, Pause Frames and Length Error frames athrs17_reg_init:done Setting PHY... enable s17 atheros header Phy setup Complete [az] 802.3az init done.. [az] 802.3az init done.. [az] 802.3az init done.. [az] 802.3az init done.. [az] 802.3az init done.. ADDRCONF(NETDEV_UP): phy0: link is not ready device eth0 entered promiscuous mode device phy0 entered promiscuous mode Loading DNI-ENET driver device pas0 entered promiscuous mode Enet:0 port2 up ATH_MAC_TIMER: enet unit:0 is up... RGMii 1000Mbps full duplex ATH_MAC_TIMER: done cfg2 0x7205 ifctl 0x0 miictrl ADDRCONF(NETDEV_CHANGE): phy0: link becomes ready br0: port 1(eth0) entering forwarding state br0: port 1(eth0) entering disabled state br0: port 1(eth0) entering forwarding state GPL NetUSB up! kc 86 : run_telnetDBGDServer start kc 223 : init_DebugD end INFO176C: NetUSB 1.02.03, 0002061F : May 23 2012 12:43:57 INFO176E: AUTH ISOC INFO176F: MOVE_HEAD filterAudio usbcore: registered new interface driver KC NetUSB General Driver INFO0AAB: --- checkSBusTimeoutThread start --- INFO0076: init proc : PAGE_SIZE 4096 INFO1640: infomap 8710c378 INFO1643: sleep to wait br0 to wake up INFO02D0: use dev Name br0 INFO164C: sleep to wait br0 end. INFO1665: UDP_BROAD 7423 tcpPort:625868800 INFO02D0: use dev Name br0 INFO154C: tcpConnector() started... dni-qos attached on eth1. INFO1429: Bind to br0 ufsd: driver (8.6, Mar 28 2012 18:34:58, LBD=ON, delalloc, acl, ioctl, bdi) loaded at 87300000 NTFS (with native replay) support included Hfs+/HfsX support included Big endian platform Built_for__Netgear_wndr_4300_2012-03-07 ADDRCONF(NETDEV_UP): sit0: link is not ready ADDRCONF(NETDEV_UP): pas0: link is not ready Enet:0 port:2 down ATH_MAC_TIMER: unit 0: phy 4 not up carrier 1 br0: port 1(eth0) entering disabled state ath_hal: 0.9.17.1 (AR5416, AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_ahb: 9.2.0_U10.1020 (Atheros/multi-bss) __ath_attach: Set global_scn[0] ACBKMinfree = 48 ACBEMinfree = 32 ACVIMinfree = 16 ACVOMinfree = 0 CABMinfree = 48 UAPSDMinfree = 0 Bootstrap clock 40MHz ar9300RadioAttach: Need analog access recipe!! read from Flash Restoring Cal data from Flash ###################[0x31]###################### ah_cal_mem = 0x0 #######################3963 ar9300CalibrationDataReadNand address 4096 Reading Flash for Calibraton data from 0x1000 and partition name is caldata ath_get_caps[5110] rx chainmask mismatch actual 3 sc_chainmak 0 ath_get_caps[5085] tx chainmask mismatch actual 3 sc_chainmak 0 SC Callback Registration for wifi0 wifi0: Atheros 9340: mem=0xb8100000, irq=2 ath_pci: 9.2.0_U10.1020 (Atheros/multi-bss) PCI: Setting latency timer of device 0000:00:00.0 to 64 __ath_attach: Set global_scn[1] ACBKMinfree = 48 ACBEMinfree = 32 ACVIMinfree = 16 ACVOMinfree = 0 CABMinfree = 48 UAPSDMinfree = 0 ar9300RadioAttach: Need analog access recipe!! read from Flash Restoring Cal data from Flash ###################[0x33]###################### ah_cal_mem = 0x0 #######################3963 ar9300CalibrationDataReadNand address 20480 Reading Flash for Calibraton data from 0x5000 and partition name is caldata ath_get_caps[5110] rx chainmask mismatch actual 7 sc_chainmak 0 ath_get_caps[5085] tx chainmask mismatch actual 7 sc_chainmak 0 SC Callback Registration for wifi1 wifi1: Atheros 9580: mem=0x10000000, irq=64 hw_base=0xb0000000 wlan_vap_create : enter. devhandle=0x873b02c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x873b02c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. VAP device ath0 created DES SSID SET=NETGEAR80 ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 WARNING: Fragmentation with HT mode NOT ALLOWED!! wlan_vap_create : enter. devhandle=0x859f82c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x859f82c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. VAP device ath1 created DES SSID SET=NETGEAR80-5G ieee80211_ioctl_siwmode: imr.ifm_active=66176, new mode=3, valid=1 WARNING: Fragmentation with HT mode NOT ALLOWED!! device ath0 entered promiscuous mode br0: port 3(ath0) entering forwarding state device ath1 entered promiscuous mode br0: port 4(ath1) entering forwarding state ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1 br0: port 3(ath0) entering disabled state DEVICE IS DOWN ifname=ath0 DEVICE IS DOWN ifname=ath0 br0: port 3(ath0) entering forwarding state ieee80211_ioctl_siwmode: imr.ifm_active=852608, new mode=3, valid=1 br0: port 4(ath1) entering disabled state DEVICE IS DOWN ifname=ath1 DEVICE IS DOWN ifname=ath1 br0: port 4(ath1) entering forwarding state Enet:0 port2 up ATH_MAC_TIMER: enet unit:0 is up... RGMii 1000Mbps full duplex ATH_MAC_TIMER: done cfg2 0x7205 ifctl 0x0 miictrl br0: port 1(eth0) entering forwarding state NET: Unregistered protocol family 24


[ 0.000000] Linux version 5.15.150 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23809-234f1a2efa) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Fri Mar 22 22:09:42 2024 [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc) [ 0.000000] MIPS: machine is Netgear WNDR4300 [ 0.000000] SoC: Atheros AR9344 rev 2 [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480 [ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2 [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 120232K/131072K available (6646K kernel code, 586K rwdata, 840K rodata, 1200K init, 221K bss, 10840K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 51 [ 0.000000] CPU clock: 560.000 MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6825930166 ns [ 0.000001] sched_clock: 32 bits at 280MHz, resolution 3ns, wraps every 7669584382ns [ 0.008397] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688) [ 0.085006] pid_max: default: 32768 minimum: 301 [ 0.091057] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.098884] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.115523] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.126061] futex hash table entries: 256 (order: -1, 3072 bytes, linear) [ 0.133573] pinctrl core: initialized pinctrl subsystem [ 0.141375] NET: Registered PF_NETLINK/PF_ROUTE protocol family [ 0.148356] thermal_sys: Registered thermal governor 'step_wise' [ 0.151675] gpio-18 (netgear:ext:lna0): hogged as output/high [ 0.164232] gpio-19 (netgear:ext:lna1): hogged as output/high [ 0.185613] clocksource: Switched to clocksource MIPS [ 0.192736] NET: Registered PF_INET protocol family [ 0.198320] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 0.207202] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.216280] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 0.224541] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.232734] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.240272] TCP: Hash tables configured (established 1024 bind 1024) [ 0.247211] UDP hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.254203] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.262160] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 0.268301] PCI: CLS 0 bytes, default 32 [ 0.276542] workingset: timestamp_bits=14 max_order=15 bucket_order=1 [ 0.289965] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.296247] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.308416] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251) [ 0.321053] pinctrl-single 1804002c.pinmux: 544 pins, size 68 [ 0.328618] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.338646] printk: console [ttyS0] disabled [ 0.343285] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A [ 0.352544] printk: console [ttyS0] enabled [ 0.361455] printk: bootconsole [early0] disabled [ 0.392793] nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xf1 [ 0.399326] nand: Micron NAND 128MiB 3,3V 8-bit [ 0.403924] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 0.411684] Scanning device for bad blocks [ 0.498950] 12 fixed-partitions partitions found on MTD device ar934x-nand [ 0.506015] OF: Bad cell count for /ahb/nand@1b000200/partitions [ 0.512160] OF: Bad cell count for /ahb/nand@1b000200/partitions [ 0.519055] OF: Bad cell count for /ahb/nand@1b000200/partitions [ 0.525202] OF: Bad cell count for /ahb/nand@1b000200/partitions [ 0.531622] Creating 12 MTD partitions on "ar934x-nand": [ 0.537073] 0x000000000000-0x000000040000 : "u-boot" [ 0.546276] 0x000000040000-0x000000080000 : "u-boot-env" [ 0.552947] 0x000000080000-0x0000000c0000 : "caldata" [ 0.561302] 0x0000000c0000-0x000000140000 : "pot" [ 0.567311] 0x000000140000-0x000000340000 : "language" [ 0.575519] 0x000000340000-0x0000003c0000 : "config" [ 0.581885] 0x0000003c0000-0x0000006c0000 : "traffic_meter" [ 0.590595] 0x0000006c0000-0x000000ac0000 : "kernel" [ 0.596887] 0x000000ac0000-0x000001fc0000 : "ubiconcat0" [ 0.605395] 0x0000006c0000-0x000001fc0000 : "firmware" [ 0.734783] 0x000001fc0000-0x000002000000 : "caldata_backup" [ 0.741850] 0x000002000000-0x000008000000 : "ubiconcat1" [ 0.757655] Concatenating MTD devices: [ 0.761479] (0): "ubiconcat0" [ 0.764495] (1): "ubiconcat1" [ 0.767573] into device "ubi-concat" [ 0.771241] 1 fixed-partitions partitions found on MTD device ubi-concat [ 0.778064] Creating 1 MTD partitions on "ubi-concat": [ 0.783285] 0x000000000000-0x000007500000 : "ubi" [ 1.151650] switch0: Atheros AR8327 rev. 4 switch registered on mdio.0 [ 1.805875] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd034, driver=Atheros AR8216/AR8236/AR8316] [ 1.817214] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii [ 1.827982] NET: Registered PF_INET6 protocol family [ 1.846862] Segment Routing with IPv6 [ 1.850688] In-situ OAM (IOAM) with IPv6 [ 1.854847] NET: Registered PF_PACKET protocol family [ 1.860134] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 1.873693] 8021q: 802.1Q VLAN Support v1.8 [ 1.882980] PCI host bridge to bus 0000:00 [ 1.887218] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff] [ 1.894207] pci_bus 0000:00: root bus resource [io 0x0000] [ 1.899886] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 1.907998] pci 0000:00:00.0: [168c:0033] type 00 class 0x028000 [ 1.914144] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit] [ 1.921109] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref] [ 1.928020] pci 0000:00:00.0: supports D1 [ 1.932099] pci 0000:00:00.0: PME# supported from D0 D1 D3hot [ 1.939751] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 [ 1.946569] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1001ffff 64bit] [ 1.954023] pci 0000:00:00.0: BAR 6: assigned [mem 0x10020000-0x1002ffff pref] [ 1.966651] UBI: auto-attach mtd12 [ 1.970152] ubi0: attaching mtd12 [ 2.921162] ubi0: scanning is finished [ 2.936501] ubi0: attached mtd12 (name "ubi", size 117 MiB) [ 2.942190] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 2.949215] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 2.956135] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 2.963201] ubi0: good PEBs: 936, bad PEBs: 0, corrupted PEBs: 0 [ 2.969320] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128 [ 2.976661] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1696887935 [ 2.985943] ubi0: available PEBs: 0, total reserved PEBs: 936, PEBs reserved for bad PEB handling: 19 [ 2.995392] ubi0: background thread "ubi_bgt0d" started, PID 235 [ 3.003361] block ubiblock0_0: created from ubi0:0(rootfs) [ 3.009011] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem [ 3.023473] VFS: Mounted root (squashfs filesystem) readonly on device 254:0. [ 3.036422] Freeing unused kernel image (initmem) memory: 1200K [ 3.042447] This architecture does not have kernel memory protection. [ 3.049023] Run /sbin/init as init process [ 3.053181] with arguments: [ 3.053187] /sbin/init [ 3.053194] with environment: [ 3.053199] HOME=/ [ 3.053205] TERM=linux [ 3.594766] init: Console is alive [ 3.598846] init: - watchdog - [ 4.609096] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 4.677880] usbcore: registered new interface driver usbfs [ 4.683568] usbcore: registered new interface driver hub [ 4.689119] usbcore: registered new device driver usb [ 4.706104] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 4.716339] fsl-ehci: Freescale EHCI Host controller driver [ 4.723815] ehci-platform: EHCI generic platform driver [ 4.729624] ehci-platform 1b000000.usb: EHCI Host Controller [ 4.735410] ehci-platform 1b000000.usb: new USB bus registered, assigned bus number 1 [ 4.743545] ehci-platform 1b000000.usb: irq 3, io mem 0x1b000000 [ 4.775633] ehci-platform 1b000000.usb: USB 2.0 started, EHCI 1.00 [ 4.782970] hub 1-0:1.0: USB hub found [ 4.787742] hub 1-0:1.0: 1 port detected [ 4.798253] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 4.816218] init: - preinit - [ 6.076881] random: jshn: uninitialized urandom read (4 bytes read) [ 6.233493] random: jshn: uninitialized urandom read (4 bytes read) [ 6.478753] mtdblock: MTD device 'caldata' is NAND, please consider using UBI block devices instead. [ 6.511634] random: jshn: uninitialized urandom read (4 bytes read) [ 7.177095] random: jshn: uninitialized urandom read (4 bytes read) [ 8.191854] eth0: link up (1000Mbps/Full duplex) [ 8.204154] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 8.218640] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready [ 8.246237] random: procd: uninitialized urandom read (4 bytes read) [ 10.477623] UBIFS (ubi0:1): Mounting in unauthenticated mode [ 10.483642] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 388 [ 10.717573] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data" [ 10.725552] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 10.735669] UBIFS (ubi0:1): FS size: 110723072 bytes (105 MiB, 872 LEBs), max 883 LEBs, journal size 5586944 bytes (5 MiB, 44 LEBs) [ 10.747695] UBIFS (ubi0:1): reserved for root: 4952683 bytes (4836 KiB) [ 10.754414] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 7A424941-5E39-48D9-B012-0985059CA397, small LPT model [ 10.767675] mount_root: overlay filesystem has not been fully initialized yet [ 10.776299] mount_root: switching to ubifs overlay [ 11.154654] urandom-seed: Seed file not found (/etc/urandom.seed) [ 11.232543] eth0: link down [ 11.260019] procd: - early - [ 11.263325] procd: - watchdog - [ 12.041136] procd: - watchdog - [ 12.044829] procd: - ubus - [ 12.125516] random: ubusd: uninitialized urandom read (4 bytes read) [ 12.135468] random: ubusd: uninitialized urandom read (4 bytes read) [ 12.142562] random: ubusd: uninitialized urandom read (4 bytes read) [ 12.155757] procd: - init - [ 13.192013] random: jshn: uninitialized urandom read (4 bytes read) [ 13.272807] random: ubusd: uninitialized urandom read (4 bytes read) [ 13.340811] kmodloader: loading kernel modules from /etc/modules.d/* [ 14.069857] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b [ 14.077543] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36 [ 14.702539] PPP generic driver version 2.4.2 [ 14.716859] NET: Registered PF_PPPOX protocol family [ 14.830374] ath: EEPROM regdomain: 0x0 [ 14.830402] ath: EEPROM indicates default country code should be used [ 14.830410] ath: doing EEPROM country->regdmn map search [ 14.830428] ath: country maps to regdmn code: 0x3a [ 14.830438] ath: Country alpha2 being used: US [ 14.830446] ath: Regpair used: 0x3a [ 14.844058] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ 14.846513] ieee80211 phy0: Atheros AR9340 Rev:2 mem=0xb8100000, irq=12 [ 14.853788] ath9k 0000:00:00.0: enabling device (0000 -> 0002) [ 14.911487] ath: EEPROM regdomain: 0x0 [ 14.911516] ath: EEPROM indicates default country code should be used [ 14.911524] ath: doing EEPROM country->regdmn map search [ 14.911542] ath: country maps to regdmn code: 0x3a [ 14.911552] ath: Country alpha2 being used: US [ 14.911561] ath: Regpair used: 0x3a [ 14.923181] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht' [ 14.925445] gpio-496 (netgear:power:usb): hogged as output/high [ 14.931842] ieee80211 phy1: Atheros AR9300 Rev:4 mem=0xb0000000, irq=16 [ 15.026128] kmodloader: done loading kernel modules from /etc/modules.d/* [ 16.786189] urngd: v1.0.2 started. [ 17.086294] mtdblock: MTD device 'caldata' is NAND, please consider using UBI block devices instead. [ 17.825711] random: crng init done [ 17.829185] random: 31 urandom warning(s) missed due to ratelimiting [ 42.676301] eth0: link up (1000Mbps/Full duplex) [ 42.699585] br-lan: port 1(eth0.1) entered blocking state [ 42.705096] br-lan: port 1(eth0.1) entered disabled state [ 42.710990] device eth0.1 entered promiscuous mode [ 42.715912] device eth0 entered promiscuous mode [ 42.725097] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 42.755582] br-lan: port 1(eth0.1) entered blocking state [ 42.761146] br-lan: port 1(eth0.1) entered forwarding state


In theory it's possible to boot from a SPI flash chip. We need to solder a new SPI flash chip and modify the bootstrap to force booting from it

Of course we also need a valid bootloader and firmware into the new flash chip.

Mod not tested.

Many Netgear routers have telnet support built-in, but gaining access to it requires an extra step of sending a specially formatted payload to the telnet daemon before it will allow users to log in. Netgear provides the executable called telnetenable.exe for doing just this. It is only available for the “other OS”. However, people not employed by Netgear wrote two alternative Programs that do run under Unix. One is written in C and is under the GPLv2 and the other written in Python and is under the MIT License.

As default the regdomain in the wifi EEPROM comes with the 0x00 value which defaults to US country. Therefore the number of channel will be limited as default. The EEPROMs are extracted from the caldata partition and copied on the first boot to the /lib/firmware path.

The regdomain is at offset 0x1C in both 2.4GHz and 5GHz EEPROMs:

You can hex edit theese files directly to change the regdomain to match your country. Example using the command line:

  • Change the regdomain value to 0xD4:
    echo -ne \\xD4 | dd of="/lib/firmware/ath9k-eeprom-ahb-18100000.wmac.bin" bs=1 seek=$((0x1C)) conv=notrunc
  • Check if the change was correct:
    hexdump "/lib/firmware/ath9k-eeprom-ahb-18100000.wmac.bin"

Always keep an original backup from your “caldata” partition, it is specific for your device and shouldn't be interchangeable.

If we wanted to make the change forever, then “caldata” partition should also be edited at offsets 0x101C (for the 2.4GHz radio) and 0x501C (for the 5GHz radio). Example using the command line:
(Tested under OpenWrt 22.03.2)

  • Check where the caldata partition is:
    root@WNDR4300:~# cat /proc/mtd 
    dev:    size   erasesize  name
    mtd0: 00040000 00020000 "u-boot"
    mtd1: 00040000 00020000 "u-boot-env"
    mtd2: 00040000 00020000 "caldata"
    mtd3: 00080000 00020000 "pot"
    mtd4: 00200000 00020000 "language"
    mtd5: 00080000 00020000 "config"
    mtd6: 00300000 00020000 "traffic_meter"
    mtd7: 00400000 00020000 "kernel"
    mtd8: 01500000 00020000 "ubiconcat0"
    mtd9: 01900000 00020000 "firmware"
    mtd10: 00040000 00020000 "caldata_backup"
    mtd11: 06000000 00020000 "ubiconcat1"
    mtd12: 07500000 00020000 "ubi"
  • Dump the partition somewhere (without OOB):
    dd if=/dev/mtd2 of=/tmp/caldata.bin
  • Change the 2.4 GHz regdomain
    echo -ne \\xD4 | dd of=/tmp/caldata.bin bs=1 seek=$((0x101C)) conv=notrunc
  • Check if the change was correct with hexdump:
    hexdump -s 0x1000 -n 1088 -C /tmp/caldata.bin
  • Install kmod-mtd-rw
    opkg update
    opkg install kmod-mtd-rw
  • Make the caldata partition writeable:
    insmod mtd-rw i_want_a_brick=1
  • Write back to the “caldata” partition:
    mtd write /tmp/caldata.bin caldata
  • Check if the “caldata” partition was succesfully written with hexdump:
    hexdump -C /dev/mtd2

Sometimes the 5G wifi interface (a separate AR9580 chip attached on PCIe) will completely disappear, because the PCIE_RC strap bit gets stuck at '0'. This can be checked by running “devmem 0x180600b0” and looking at bit 6:

  • GOOD: 0x002F055A
  • BAD: 0x002F051A

On OpenWrt this causes the kernel to completely ignore the PCIe interface and everything attached to it, so only the onchip 2.4GHz radio will work. On the original firmware it may cause the unit to get stuck in a reboot loop.

If this happens, just power the unit off for about 30 seconds. In fact it might be a good idea to power cycle the unit before OpenWrt's initial boot. See this thread for more information.

You may need to manually add the 5G radio to /etc/config/wireless if it was not autodetected. Here is a known-good configuration:

config wifi-device  wlan1
	option type     mac80211
	option channel  153
	option hwmode	11na
	list ht_capab	SHORT-GI-40
	list ht_capab	DSSS_CCK-40
	option htmode	HT40-
	option country  US
	option path	'pci0000:00/0000:00:00.0'

Or try this:

cd /etc/config
mv wireless wireless.tmp
wifi detect

After flashing to OpenWrt, the WAN LEDs are now green for both 1000M and 10/100M. it does not appear developers have the will to address an overlooked WAN LED color feature. see https://dev.openwrt.org/ticket/18809 and https://dev.openwrt.org/ticket/18967

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/06/27 06:33
  • by oldherl