NETGEAR WNR3500 v1

Currently there is no support for OpenWrt on this router; initial porting efforts are in progress.

This router is similar to the Netgear WNR854T, but is stripped down to some degree.

• SoC: Marvell 88F5 181 B1 = Marvell Orion SoC
• CPU: ARM926 @ 500MHz
• Flash: 8MB
• RAM: 16 MB → too little for any current OpenWrt version, see 4/32 warning

Unlike the WNR854T everything is on one board; there is no separate mini-PCI wireless card and no USB port.

The base address for the flash is 0xff800000.

Netgear doesn't compress their kernel using built-in methods; instead it uses lzma compression and then u-boot decompresses the kernel to 0x400000 before booting it.

By default, the bootloader does this as a part of the proprietary command “chkFlashImage”; however you can run this custom equivalent command to perform the decompression while bypassing the checksum verification:

lzmadecode ff800000 00400000 1048576

You can make this permanent by running from u-boot over the serial console:

setenv bootcmd 'lzmadecode ff800000 00400000 1048576; setenv bootargs console=ttyS0,115200 root=/dev/mtdblock2 mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro; bootm 0x400000;'; saveenv

Original string is:

bootcmd=chkFlashImage; setenv bootargs 'console=ttyS0,115200 root=/dev/mtdblock2 mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro'; bootm 0x400000; 

If you don't apply this, you will find that you can boot into OpenWrt once, but after that it will fail the checksum verification and you'll have to do a TFTP restore to either the stock firmware or OpenWrt.

To build images that can be flashed into the stock web interface, obtain Netgear's SDK, cd to the source directory and do:

./tools/lzma e /path/to/uImage uImage-lzma
./tools/packet -k uImage-lzma -f /path/to/root.squashfs -b compatible.txt -ok kernel_image -oall kernel_rootfs_image -or rootfs_image -i ./project/acos/include/ambitCfg.h

The flashable image will be written to kernel_rootfs_image.chk.

As for the kernel stuff, I'm still figuring out how to “properly” add a new machine type and tell the kernel what board we're using so that it loads the correct partition map. It seems to ignore mtdparts on the command line. Right now, I'm patching wnr854t-setup.c which is a terrible kludge.

Boot code version : 1.0.3

 ** MARVELL BOARD: RD-88F5181L-VOIP-GE LE 

U-Boot 1.1.1 (Jan 25 2008 - 09:11:36) Marvell version: 1.10.16

DRAM CS[0] base 0x00000000   size  16MB 
DRAM Total size  16MB 
[8192kB@ff800000] Flash:  8 MB
Addresses 12M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (12M - 8M): Done
*** Warning - bad CRC, using default environment


Soc: 88F5181 B1
CPU: ARM926 (Rev 0) running @ 500Mhz 
Orion 1 streaming disabled 
SysClock = 166Mhz , TClock = 166Mhz 


USB 0: host mode
PCI 0: PCI Express End Point Interface
PCI 1: Conventional PCI, speed = 33000000
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0 
Marvell>>

The header JP2 on the mainboard is a serial console, 115200 8N1. Like most Netgear boards, you need a TTL shifter despite this being the focal point of Netgear's “My Open Router” campaign. Pinout:

Pin 1: Vcc Pin 2: Rx Pin 3: ununsed Pin 4: unused Pin 5: Tx Pin 6: Ground

The serial console gives you full access to the bootloader and a root shell once the factory firmware is booted.

The Netgear WNR3500 is a Wireless-N Gigabit Router. It uses a Marvell TopDog based design.

• 88F5180 processor
• 88E6131 8 port gigabit Ethernet switch
• 88W8363 Baseband/MAC
• 88E1112 gigabit Ethernet PHY
• 88W8060 2T3R Transceiver.

All these parts are the same as in the WNR854T, except the Baseband/MAC, which is an 88W8161 in the WNR854T. It's just a cut down version of the WNR854T:

• Wireless on pcb instead of mini pci card
• No Heatsink On The CPU (854T Does)
• 16 Meg Ram instead of 32 Meg
• 4 Meg flash instead of 8 Meg
• 500 Mhz Arm9 CPU = same

In the default firmware (which is based on Linux), there is a hidden wifi configuration page that can be accessed by visiting http://www.routerlogin.net/WiFi_HiddenPage.htm

For more details see netgear forum thread.

The Telnet Console trick can be used to gain access to a Linux terminal prompt in the default firmware.

Here's some info from the telnet hack, posted originally in a netgear forum thread.

BusyBox v1.01 (2008.05.15-09:19+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# version
Release version : Netgear Wireless Router WNR3500
U12H09200/V1.0.22/6.0.22
Time : Jun 25 2008 09:41:43

# cat /proc/version
Linux version 2.4.27-vrs1 (weal@hotteam.cs) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-1)) #1 Wed Jun 25 09:39:13 CST 2008

# cat /proc/cpuinfo
Processor : ARM926EJ-Sid(wb) rev 0 (v5EJl)
BogoMIPS : 332.59
Features : swp half thumb fastmult

Hardware : MV-88fxx81
Revision : 0000
Serial : 0000000000000000

# cat /proc/meminfo
total: used: free: shared: buffers: cached:
Mem: 14909440 14405632 503808 0 880640 2088960
Swap: 0 0 0
MemTotal: 14560 kB
MemFree: 492 kB
MemShared: 0 kB
Buffers: 860 kB
Cached: 2040 kB
SwapCached: 0 kB
Active: 3880 kB
Inactive: 2240 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 14560 kB
LowFree: 492 kB
SwapTotal: 0 kB
SwapFree: 0 kB

# ps x
PID Uid VmSize Stat Command
1 0 416 S init
2 0 SW [keventd]
3 0 SWN [ksoftirqd_CPU0]
4 0 SW [kswapd]
5 0 SW [bdflush]
6 0 SW [kupdated]
7 0 SW [mtdblockd]
142 0 484 S swresetd
144 0 380 S dnsRedirectReplyd
146 0 1212 S httpd
150 0 592 S dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -u r
151 0 504 S udhcpd /tmp/udhcpd.conf
153 0 484 S ddnsd &
159 0 476 S heartbeat
163 0 604 S pot run
165 0 940 S upnpd
173 0 660 S /usr/sbin/email
184 0 580 S lld2d br0
222 0 532 S wpsd
226 0 648 S wsccmd /tmp/wsc
231 0 460 S /bin/sh
234 0 648 S wsccmd /tmp/wsc
235 0 648 S wsccmd /tmp/wsc
239 0 572 S /usr/sbin/timesync /sbin/ntpclient
240 0 440 S udhcpc -i eth0 -p /var/run/udhcpc0.pid -s /tmp/udhcpc
243 0 648 R wsccmd /tmp/wsc
248 0 648 R wsccmd /tmp/wsc
249 0 648 S wsccmd /tmp/wsc
250 0 648 S wsccmd /tmp/wsc
251 0 648 S wsccmd /tmp/wsc
252 0 648 S wsccmd /tmp/wsc
253 0 648 S wsccmd /tmp/wsc
254 0 696 S hostapd -W /tmp/wsc/hostapd.conf
5795 0 536 S telnetd
10292 0 500 S /bin/sh
10493 0 552 R ps x
#

And here is some additional data. This WNR3500 is running v1.0.29 (binary upgrade file is WNR3500-V1.0.29_8.0.29NA.chk):

BusyBox v1.01 (2008.10.17-05:51+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# version
Release version : Netgear Wireless Router WNR3500
                  U12H09200/V1.0.29/8.0.29NA
           Time : Oct 24 2008 14:31:44
Bootcode version: NOT supported
# cat /proc/version
Linux version 2.4.27-vrs1 (weal@hotteam.cs) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-1)) #1 Fri Oct 24 14:29:18 CST 2008
# cat /proc/cpuinfo
Processor       : ARM926EJ-Sid(wb) rev 0 (v5EJl)
BogoMIPS        : 332.59
Features        : swp half thumb fastmult

Hardware        : MV-88fxx81
Revision        : 0000
Serial          : 0000000000000000
# routerinfo
Release version : Netgear Wireless Router WNR3500
                  U12H09200/V1.0.29/8.0.29NA
           Time : Oct 24 2008 14:31:44
Bootcode version: NOT supported
WSC PIN - 56474947
LAN mac address - 00:1E:2A:72:78:D9
WAN mac address - 00:1E:2A:72:78:DA
WLAN mac address - 00:1e:2a:72:78:d8
Board ID - U12H092T01_NETGEAR
serial number -
# cat /proc/meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  14909440 14385152   524288        0  1196032  2306048
Swap:        0        0        0
MemTotal:        14560 kB
MemFree:           512 kB
MemShared:           0 kB
Buffers:          1168 kB
Cached:           2252 kB
SwapCached:          0 kB
Active:           4008 kB
Inactive:         2232 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        14560 kB
LowFree:           512 kB
SwapTotal:           0 kB
SwapFree:            0 kB
# ps x
  PID  Uid     VmSize Stat Command
    1 0           496 S   init
    2 0               SW  [keventd]
    3 0               RWN [ksoftirqd_CPU0]
    4 0               SW  [kswapd]
    5 0               SW  [bdflush]
    6 0               SW  [kupdated]
    7 0               SW  [mtdblockd]
   17 0           492 S   /sbin/syslogd
  138 0           408 S   /sbin/iwevent
  144 0           456 S   swresetd
  146 0           380 S   dnsRedirectReplyd
  148 0          1024 S   httpd
  152 0           496 S   udhcpd /tmp/udhcpd.conf
  153 0           492 S   dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -u r
  155 0           476 S   ddnsd &
  160 0           428 S   heartbeat
  170 0           840 S   upnpd
  179 0           660 S   /usr/sbin/email
  184 0           580 S   lld2d br0
  218 0           596 S   wpsd
  224 0          1036 S   wsccmd /tmp/wsc
  227 0           420 S   udhcpc -i eth0 -p /var/run/udhcpc0.pid -s /tmp/udhcpc
  229 0           484 S   /bin/sh
  232 0          1036 S   wsccmd /tmp/wsc
  233 0          1036 S   wsccmd /tmp/wsc
  234 0          1036 S   wsccmd /tmp/wsc
  235 0          1036 R   wsccmd /tmp/wsc
  236 0          1036 S   wsccmd /tmp/wsc
  237 0          1036 S   wsccmd /tmp/wsc
  238 0          1036 S   wsccmd /tmp/wsc
  239 0          1036 S   wsccmd /tmp/wsc
  240 0          1036 S   wsccmd /tmp/wsc
  241 0          1036 S   wsccmd /tmp/wsc
  242 0           676 S   hostapd -W /tmp/wsc/hostapd.conf
 1427 0           388 S   telnetd
 1972 0           504 S   /bin/sh
 2225 0           560 R   ps x

How to add tags