OpenWrt Forum Archive

Topic: Netgear WNR2000 OpenWRT (Atheros AP81, AR9103 chip, u-boot)

The content of this topic has been archived between 3 Apr 2018 and 3 May 2018. Unfortunately there are posts – most likely complete pages – missing.

edude03 wrote:

fuhry, you are amazing. This works amazingly well.

However, I do have one slight issue, after flashing DHCP doesn't work. Did I miss something?
EDIT: I also noticed that settings don't persist through a reboot, I'm going to take a look into that tonight though.

I'll try testing DHCP later today. It looks like dnsmasq and all the relevant LuCI modules are included in the current builds. However, I don't use that many features of my wifi router... DHCP is run from a separate box.

mazade wrote:

^_^ and I'm on the opposite end of the spectrum from fuhry... somewhere past being a total tard.
<whining>
All that is functioning on my wnr2000 is the base u-boot environment.
How might I be able to flash, towards the direction of stock FW, or continuing on towards full OpenWRT that you gentlemen have so kindly provided.
I do have all of the images/files to move in either direction, but I don't have there wherewithal to figure out the commands and memory addresses to make it all happen.
</whining>

Flash the default firmware, go through the telnetenable procedure, and try the copypasta in my previous post, and let me know if it works. All of it should be automated now.

(Last edited by fuhry on 24 Jan 2011, 23:01)

Hi fuhry,

I have used your procedure above to get open-wrt installed. However, I couldn't seem to get a working wireless-client-bridge mode.  So, I have a few questions:

(a) Is WNR2000 v1 essentially Trendnet TEW-632BRP as both use u-boot?  If so, can I flash DD-WRT AR9130 firmware, tew632brp-firmware.bin?
(b) If so,  what's the proper steps to not brick it?
(c) If not,  I would like to ask if it's possible and how to repackage your u-boot with image parts extracted from "tew632brp-firmware.bin."


Could you provide some advices and steps?  thanks!

(Last edited by ypiwafe on 2 Feb 2011, 18:50)

ypiwafe wrote:

Hi fuhry,

I have used your procedure above to get open-wrt installed. However, I couldn't seem to get a working wireless-client-bridge mode.  So, I have a few questions:

(a) Is WNR2000 v1 essentially Trendnet TEW-632BRP as both use u-boot?  If so, can I flash DD-WRT AR9130 firmware, tew632brp-firmware.bin?
(b) If so,  what's the proper steps to not brick it?
(c) If not,  I would like to ask if it's possible and how to repackage your u-boot with image parts extracted from "tew632brp-firmware.bin."


Could you provide some advices and steps?  thanks!

I have no idea. Just because two devices use u-boot doesn't mean they're compatible. U-Boot works on about 8 different architectures and hundreds of boards. A more reliable way to check compatibility is to find out if that Trendnet router uses the same reference board (Atheros AP81).

Safest option is to grab the u-boot sources from the manufacturer's source code distribution (which they are legally obligated to provide, btw) and build using their recommended configuration. Then modify the sources to suit your needs.

can someone possibly explain this in a more noob friendly way, i'd like to help/try to install OpenWRT on my router

well i successfully followed fuhry's steps and loaded openwrt on my WNR2000.
however couple of issues

WiFi is not working
and DHCP is not working

comparing to my Linksys Backfire running router i see that device is named differently (radio0 vs wl0 on linksys [for WiF] )
and while linksys has /proc/net/wl0 file wnr doesnt have /proc/net/radio0

(like something is not initializing fully)

or maybe im just looking at wrong stuff sad

has anyone else same issues or has solve them ?

EDIT:

actualy i managed to activate wifi smile some manual reconfigration seems to have activated wifi (now only DHCP is left )

(Last edited by PhanLord on 24 Feb 2011, 02:15)

Somehow i can't seem to unlock telnet on my WNR2000 v1 with firmware     V1.2.3.7NA.

When i try telnet 192.168.1.1, the following messages displayed.

Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
Connection closed by foreign host.

It would be great if someone can help me out. Thanks

The WNR2000v3 runs Kamikaze(7.09).
I get this when i connect via telnet.

nilsa@ubuntu:~$ telnet 10.0.0.20 23
Trying 10.0.0.20...
Connected to 10.0.0.20.
Escape character is '^]'.
 === IMPORTANT ============================
  Use 'passwd' to set your login password
  this will disable telnet and enable SSH
 ------------------------------------------


BusyBox v1.4.2 (2010-09-29 12:14:24 CST) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (7.09) -----------------------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@WNR2000v3:/#

As you can see the box tells me to use passwd to set a password. Which will disable telnet and enable ssh, but if I try I get the following:

root@WNR2000v3:/# passwd
passwd: no record of root in /etc/shadow, using /etc/passwd
Changing password for root
New password:
Retype password:
passwd: cannot update password file /etc/passwd
root@WNR2000v3:/

As a test i tried to run chmod on the passwd file:

root@WNR2000v3:/# chmod 700 /etc/passwd
chmod: /etc/passwd: Read-only file system
root@WNR2000v3:/#

Which tells that the file system is read-only, so then my question is what can I do to write to the file system(I can of course write to the /tmp folder)?

Edit:
I also ran dmesg to get some info on what's in the box w/o needing to open the box.

Linux version 2.6.15 (alime@alime-laptop) (gcc version 3.4.4 (OpenWrt-2.0)) #1 Wed Sep 29 12:23:21 CST 2010
flash_size passed from bootloader = 4
CPU revision is: 00019374
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
On node 0 totalpages: 8192
  DMA zone: 8192 pages, LIFO batch:1
  DMA32 zone: 0 pages, LIFO batch:0
  Normal zone: 0 pages, LIFO batch:0
  HighMem zone: 0 pages, LIFO batch:0
Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=31:08 rootfstype=squashfs init=/etc/preinit mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),3392k(rootfs),64k(config),128k(language_table),64k(pot),64k(traffic_meter),64k(ART),3473344@327744(mount_fs)
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 256 (order: 8, 4096 bytes)
Using 180.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 30176k/32768k available (1686k kernel code, 2576k reserved, 337k data, 108k init, 0k highmem)
Calibrating delay loop... 238.59 BogoMIPS (lpj=119296)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
PCI init:ar7240_pcibios_init
ar7240_pcibios_init(295): PCI CMD write: 0x356
Returning IRQ 48
AR7240 GPIOC major 0
Initializing usb led semaphore
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Initializing Cryptographic API
io scheduler noop registered
io scheduler deadline registered
Serial: 8250/16550 driver $Revision: #2 $ 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
9 cmdlinepart partitions found on MTD device ar7240-nor0
Creating 9 MTD partitions on "ar7240-nor0":
0x00000000-0x00040000 : "u-boot"
0x00040000-0x00050000 : "u-boot-env"
0x00050000-0x003a0000 : "rootfs"
0x003a0000-0x003b0000 : "config"
0x003b0000-0x003d0000 : "language_table"
0x003d0000-0x003e0000 : "pot"
0x003e0000-0x003f0000 : "traffic_meter"
0x003f0000-0x00400000 : "ART"
0x00050040-0x003a0000 : "mount_fs"
mtd: partition "mount_fs" doesn't start on an erase block boundary -- force read-only
u32 classifier
    Perfomance counters on
NET: Registered protocol family 2
IP route cache hash table entries: 512 (order: -1, 2048 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
ip_conntrack version 2.4 (256 buckets, 2048 max) - 240 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
IPP2P v0.8.2 loading
DNIFILTER loading
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
ip6_tables: (C) 2000-2002 Netfilter core team
registering ipv6 mark target
NET: Registered protocol family 17
Ebtables v2.0 registered
arch/mips/ar7240/gpio.c (ar7240_simple_config_init) JUMPSTART_GPIO: 12
ar7240wdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 108k freed
Warning: unable to open an initial console.
Algorithmics/MIPS FPU Emulator v1.5
ipt_CONENAT: module license 'unspecified' taints kernel.
ip_conntrack_rtsp v0.6.21 loading
/home/alime/git_home/wnr2000v3.git/build_mips/linux-2.6-wnr2000v3/kmod-dnirtsp/ip_conntrack_dnirtsp.c: init: port #0: 554
ip_nat_rtsp v0.6.21 loading
ip_conntrack_proto_esp loaded
ip_nat_proto_esp loaded
ip_conntrack_pptp version 3.1 loaded
ip_nat_pptp version 3.0 loaded
dni-qos module init at dev:eth0, real_dev:eth0
AG7240: Length per segment 1536
AG7240: Max segments per packet 1
AG7240: Max tx descriptor count    40
AG7240: Max rx descriptor count    252
AG7240: fifo cfg 3 01f00140
AG7240CHH: Mac address for unit 0
AG7240CHH: e0:91:f5:c9:d0:f9 
AG7240: init the QOS
AG7240CHH: Mac address for unit 1
AG7240CHH: e0:91:f5:c9:d0:f8 
ag7240_ring_alloc Allocated 640 at 0x81c6a800
ag7240_ring_alloc Allocated 4032 at 0x81371000
Virian MDC CFG Value ==> 4
Setting PHY...
ADDRCONF(NETDEV_UP): eth0: link is not ready
device eth1 entered promiscuous mode
ag7240_ring_alloc Allocated 640 at 0x81cf7c00
ag7240_ring_alloc Allocated 4032 at 0x81ce0000
Virian MDC CFG Value ==> 4
ATHRS26: resetting s26
ATHRS26: s26 reset done
enabling the header of S26
Setting PHY...
ADDRCONF(NETDEV_UP): eth1: link is not ready
AG7240: enet unit:1 phy:0 is up...Mii 100Mbps full duplex
AG7240: done cfg2 0x7205 ifctl 0x0 miictrl  
ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
br0: port 1(eth1) entering learning state
br0: topology change detected, propagating
br0: port 1(eth1) entering forwarding state
ag7240_ring_free Freeing at 0x81c6a800
ag7240_ring_free Freeing at 0x81371000
ag7240_ring_alloc Allocated 640 at 0x81c6a800
ag7240_ring_alloc Allocated 4032 at 0x81371000
Virian MDC CFG Value ==> 4
Setting PHY...
ADDRCONF(NETDEV_UP): eth0: link is not ready
ag7240_ring_free Freeing at 0x81c6a800
ag7240_ring_free Freeing at 0x81371000
ag7240_ring_alloc Allocated 640 at 0x81c6a800
ag7240_ring_alloc Allocated 4032 at 0x81371000
Virian MDC CFG Value ==> 4
Setting PHY...
eth1: no IPv6 routers present
ADDRCONF(NETDEV_UP): eth0: link is not ready
ath_hal: 0.9.17.1 (AR5416, REGOPS_FUNC, WRITE_EEPROM, 11D)
wlan: 0.8.4.2 (Atheros/multi-bss)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_pci: 0.9.4.5 (Atheros/multi-bss)
PCI: Setting latency timer of device 0000:00:00.0 to 64
wifi0: Atheros 9287: mem=0x10000000, irq=48 hw_base=0xb0000000
wlan: mac acl policy registered
wlan_me: Version 0.1
Copyright (c) 2008 Atheros Communications, Inc. All Rights Reserved
Country ie is DE 
device ath0 entered promiscuous mode
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
br0: port 2(ath0) entering disabled state
Country ie is DE 
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
SHAN=== Chaning for PS state change for type 0 subtype 160 (got many of those)

(Last edited by Mysterio on 13 Mar 2011, 11:31)

Dang, I thought I discovered something but Mysterio beat me to it...  Looks like netgear went the way of the buffalo. As far as the passwd, i tried:

mount -o remount,rw /
cp -r /etc/* /tmp/etc/
mount -o bind /tmp/etc /etc
passwd
root@WNR2000v3:~# passwd
passwd: no record of root in /etc/shadow, using /etc/passwd
Changing password for root
New password:
Retype password:
Password for root changed by root

Success! then I fux0red around and got kicked off, no ssh, no telnet, no more telnetenabled...

gonna reboot now.

Hello,


After getting a WNR2000 for $20 (I am not sure of the version, PCB has a rev 5, no revision markings on the back label to my understanding), and installing the modified version of u-boot, kernel and user space as described by fuhry, I now have a working u-boot dist, but any new edits are discarded at reboot.

All filesystems are mounted as r/w:

root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 2.0M      2.0M         0 100% /rom
tmpfs                    14.4M     20.0K     14.4M   0% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev
root                     14.4M     40.0K     14.4M   0% /tmp/root
mini_fo:/tmp/root         2.0M      2.0M         0 100%

password *seems* to be working with r/w filesystem:

root@OpenWrt:/# passwd
Changing password for root
New password:
Retype password:
Password for root changed by root

mounts:

root@OpenWrt:/# mount
rootfs on / type rootfs (rw)
/dev/root on /rom type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,relatime)
tmpfs on /dev type tmpfs (rw,relatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
root on /tmp/root type tmpfs (rw,relatime,mode=755)
mini_fo:/tmp/root on / type mini_fo (rw,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)

dmesg:

root@OpenWrt:/# dmesg 
Linux version 2.6.32.27 (dan@charlie.roc.xx0r.info) (gcc version 4.3.3 (GCC) ) #13 Sat Feb 26 10:33:02 EST 2011
prom: fw_arg0=00000009, fw_arg1=a1f6ffb0, fw_arg2=a1f704b0, fw_arg3=00000004
MyLoader: sysp=aaaa5554, boardp=aaaa5554, parts=aaaa5554
bootconsole [early0] enabled
CPU revision is: 00019374 (MIPS 24Kc)
Atheros AR9130 rev 2, CPU:400.000 MHz, AHB:200.000 MHz, DDR:400.000 MHz
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
On node 0 totalpages: 8192
free_area_init_node: node 0, pgdat 802c3b70, node_mem_map 81000000
  Normal zone: 64 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 8128 pages, LIFO batch:0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: rootfstype=squashfs console=ttyS0,115200 board=WNR2000 panic=10 init=/etc/preinit rootdelay=2  board=WNR2000 console=ttyS0,115200 init=/etc/preinit mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),2304k(rootfs),64k(user-config),1152k(uImage),128k(language_table),64k(rootfs_checksum),64k(ART) rootfstype=squashfs rootdelay=2 panic=10 mem=32M
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 29384k/32768k available (2038k kernel code, 3384k reserved, 411k data, 152k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:56
Calibrating delay loop... 266.24 BogoMIPS (lpj=1331200)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
MIPS: machine is NETGEAR WNR2000
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
yaffs Jan 14 2011 06:09:14 Installing. 
msgmni has been set to 57
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
console [ttyS0] enabled, bootconsole disabled
Atheros AR71xx SPI Controller driver version 0.2.4
m25p80 spi0.0: mx25l3205d (4096 Kbytes)
spi0.0: searching for MyLoader partition table at offset 0x10000
spi0.0: searching for MyLoader partition table at offset 0x20000
spi0.0: searching for MyLoader partition table at offset 0x30000
spi0.0: searching for MyLoader partition table at offset 0x40000
spi0.0: no MyLoader partition table found
spi0.0: no WRT160NL signature found
Creating 8 MTD partitions on "spi0.0":
0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000050000 : "u-boot-env"
0x000000050000-0x000000290000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=250000, len=40000 
0x000000250000-0x000000290000 : "rootfs_data"
0x000000290000-0x0000002a0000 : "user-config"
0x0000002a0000-0x0000003c0000 : "uImage"
0x0000003c0000-0x0000003e0000 : "language_table"
0x0000003e0000-0x0000003f0000 : "rootfs_checksum"
0x0000003f0000-0x000000400000 : "art"
ag71xx_mdio: probed
eth0: Atheros AG71xx at 0xb9000000, irq 4
eth0: using fixed link parameters
eth1: Atheros AG71xx at 0xba000000, irq 5
eth1: connected to PHY at ag71xx-mdio:04 [uid=004dd042, driver=Generic PHY]
Atheros AR71xx hardware watchdog driver version 0.1.0
ar71xx-wdt: timeout=15 secs (max=21)
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Waiting 2sec before mounting root device...
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 152k freed
Please be patient, while OpenWrt loads ...
input: gpio-buttons as /devices/platform/gpio-buttons/input/input0
Button Hotplug driver version 0.3.1
ar71xx: pll_reg 0xb8050014: 0x13000a44
eth0: link up (100Mbps/Full duplex)
Registered led device: wnr2000:green:power
Registered led device: wnr2000:amber:power
Registered led device: wnr2000:green:wps
Registered led device: wnr2000:blue:wlan
mini_fo: using base directory: /
mini_fo: using storage directory: /tmp/root
eth0: link down
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
ar71xx: pll_reg 0xb8050014: 0x13000a44
eth0: link up (100Mbps/Full duplex)
device eth0 entered promiscuous mode
br-lan: port 1(eth0) entering forwarding state
ADDRCONF(NETDEV_UP): eth1: link is not ready
Compat-wireless backport release: compat-wireless-2011-01-06
Backport based on wireless-testing.git master-2011-01-05
cfg80211: Calling CRDA to update world regulatory domain
cfg80211: World regulatory domain updated:
cfg80211:     (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211:     (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
ath: EEPROM regdomain: 0x0
ath: EEPROM indicates default country code should be used
ath: doing EEPROM country->regdmn map search
ath: country maps to regdmn code: 0x3a
ath: Country alpha2 being used: US
ath: Regpair used: 0x3a
ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
ieee80211 phy0: Atheros AR9100 MAC/BB Rev:0 AR2122 RF Rev:a2 mem=0xb80c0000, irq=2
cfg80211: Calling CRDA for country: US
cfg80211: Regulatory domain changed to country: US
cfg80211:     (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211:     (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2700 mBm)
cfg80211:     (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 1700 mBm)
cfg80211:     (5250000 KHz - 5330000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5490000 KHz - 5600000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5650000 KHz - 5710000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 3000 mBm)
ip_tables: (C) 2000-2006 Netfilter Core Team
nf_conntrack version 0.5.0 (461 buckets, 1844 max)
br-lan: no IPv6 routers present
jffs2: Too few erase blocks (4)
ar71xx-wdt: enabling watchdog timer

I am a bit scared encountering the "jffs2: Too few erase blocks (4)", but I do not believe the filesystem is jffs.

I am on my way to grab the openwrt sources to start building with, but I want to know how to remap the odd file system boundaries on the WNR2000 to that which builds.  I should also return from work with a 3.3V-level shifter so I can grab the serial output.

Essentially your rootfs is too big so there is not enough space left for the jffs2 overlay.  Whats mounted r/w in your case is just a temporary ramdisk.

Well Darn!

What is the (4) indicate in the "jffs2: Too few erase blocks (4)" dmesg ouput?  I am 4 blocks oversized?


I still am wondering what version of router I own.  V1? V2? V3? V4?

fuhry,

What is the maximum size for the rootfs?  Still 2304k for an unmodified mtd mapping?

(Last edited by rumbit on 2 May 2011, 16:45)

It means you have only 4 free blocks but needs at least five or so.

How large is a block?  I believe this is implementation dependent, but how could I calculate how large it should be?

Usually 64k or 128k, depending on your flash chip.
Check the "erase size" column in /proc/mtd. 0x10000 is 64k, 0x20000 is 128k.

Thanks jow,

I got it working, I:
- recompiled the basic necessary options I needed, eg luci, some wifi stuffs, nano (i hate vi)
- copied the recompiled <backfire>/bin/ar71xx/openwrt-ar71xx-ap81-rootfs-squashfs.bin to /tmp
- reran mtd -e mtd2 write openwrt-ar71xx-ap81-rootfs-squashfs.bin mtd2


Now to hack it to get the wireless to bridge.  That will probably be harder.

Have done some more research on the v3's u-boot.
In the main.c I found this.

#ifdef FIRMWARE_INTEGRITY_CHECK
    //char *bootm_ecos = "bootm $ecos";
    int len;
    ulong data, checksum;
    image_header_t *hdr = (image_header_t *)(CFG_FLASH_BASE + CONFIG_JFFS2_PART_OFFSET - 0x40 );
#endif

And..

#ifdef FIRMWARE_INTEGRITY_CHECK
        if (ntohl(hdr->ih_magic) != IH_MAGIC) {
            puts ("   Bad Magic Number\n");
            goto bad_img;
        }
        else {
            image_header_t theader;
            memmove(&theader,hdr,sizeof(image_header_t));
            data = (ulong)&theader;
            len  = sizeof(image_header_t);

            checksum = ntohl(theader.ih_hcrc);
            theader.ih_hcrc = 0;

            if (crc32 (0, (char *)data, len) != checksum) {
                puts ("Bad Header Checksum\n");
                goto bad_img;
            }
            else {
                data = (ulong)hdr + sizeof(image_header_t);
                len  = ntohl(hdr->ih_size);
                puts ("   Verifying Checksum ... ");
                if (crc32 (0, (char *)data, len) != ntohl(hdr->ih_dcrc)) {
                    printf ("Bad Data CRC\n");
                    goto bad_img;
                }
                else {
                    puts ("OK\n");
                    goto good_img;
                }
            }
        }
bad_img:
        StartTftpServerToRecoveFirmware();
good_img:
# endif

FIRMWARE_INTEGRITY_CHECK is defined in the include/configs/wnr2000v3.h file.

#define FIRMWARE_INTEGRITY_CHECK 1
#define FIRMWARE_RECOVER_FROM_TFTP_SERVER 1

#ifdef FIRMWARE_RECOVER_FROM_TFTP_SERVER
#define CFG_IMAGE_LEN 0x350000
#define CFG_IMAGE_BASE_ADDR (CFG_ENV_ADDR + CFG_ENV_SIZE)
#define CFG_IMAGE_ADDR_BEGIN (CFG_IMAGE_BASE_ADDR)
#define CFG_IMAGE_ADDR_END   (CFG_IMAGE_BASE_ADDR + CFG_IMAGE_LEN)
#define CFG_FLASH_CONFIG_BASE               (CFG_IMAGE_ADDR_END)
#define CFG_FLASH_CONFIG_PARTITION_SIZE     0x10000
#define CFG_STRING_TABLE_LEN 0x19000 /* Each string table takes 100K to save */
#define CFG_STRING_TABLE_NUMBER 1
#define CFG_STRING_TABLE_TOTAL_LEN 0x20000 /* Totally allocate 128K to save only one string table */
#define CFG_STRING_TABLE_BASE_ADDR 0x9f3b0000
#define CFG_STRING_TABLE_ADDR_BEGIN (CFG_STRING_TABLE_BASE_ADDR)
#define CFG_STRING_TABLE_ADDR_END   (CFG_STRING_TABLE_ADDR_BEGIN + CFG_STRING_TABLE_TOTAL_LEN)
#endif

Is it just the data crc checksum we need to get rid of(and the data header?), or is it more?

[EDIT]
Also it's an other way than to trick the webserver to copy the files to the computer.
I used tftpd32 by Ph. Jounin and used the routers built-in tftp client to send the files over.
You can also transfer files to the router this way.

(Last edited by Mysterio on 7 Jun 2011, 15:50)

Also the JTAG header on the v3 is easy found.
It's placed over the WPS button.
https://lh6.googleusercontent.com/-828OSw8fTO8/Te3gXjjO4eI/AAAAAAAAACc/S9VR2kq-i4c/s640/IMG_2350.JPG

Have also uploaded other pictures here.

(Last edited by Mysterio on 7 Jun 2011, 15:54)

I've got a WNR2000v3 as well. Is there anything I can do to help?

@path0s: I'm sending you a pm with some things you can do.

I have everything installed, and WiFi, DNS, and DHCP working, but System=>Software shows 0 bytes of free space. I want to install a QoS package, but alas, I cannot. How would I fix this?

Hello,

I tried to install OpenWrt on a WNR2000 V1 with the install procedure by fuhry, the one without repartitioning.
Unfortunately I got an amber flashing power led after reboot.

Now I can reboot with a hard reset to get into TFTP mode (green flashing power led).
If I upload a stock firmware, the upload is successful but then the WNR2000 seems to keep rebooting...

What can I do ?
Would I solve this problem accessing the serial console ?
If needed, can someone provide me a backup u-boot environment?

Thanks in advance smile

This is something you should be able to recover from with a serial console. If you upload the stock firmware without deleting mtd1 (uboot-env) I have found it will not boot successfully.

You can delete that easily with uboot. I don't remember exactly... once you boot uboot do "help mtdparts". I think you want to to "mtdparts default" and then "mtdparts erase nor0,1" and "mtdparts erase nor0,4".

I'm *not* positive about that at all! But basically you want to erase mtd1 and mtd4 and then when you reboot and do an tftp flash it should work.

If it doesn't post again. I have thought my wnr2000v1 was beyond repair a couple times. But as long as you don't destroy uboot you should be OK.

EDIT: That should be:

mtdparts default
erase nor0,4
erase nor0,1

(Last edited by radengr on 24 Aug 2011, 01:46)

If anyone is still having problems with their WNR2000v1 router, I was able to build a new image using the svn sources for backfire 10.3.1-rc5 that works great. DHCP & Wifi going out of the box, and 240.00 KB of free space. I had a hard time finding a config that worked AND had some free space so I thought I would share.

Basically you need to do this:

1. Set up your build environment by following the OpenWRT guide.

2. Check out the RC5 sources:
svn checkout svn://svn.openwrt.org/openwrt/branches/backfire/@27608
cd backfire/
./scripts/feeds update -a
./scripts/feeds install -a

3. Configure with "make menuconfig"
set "Target System"  to "Atheros AR71xx/AR7240/AR913x"
set "Target Profile" to "Atheros AP81 reference board"
set "LuCI" -> "Collections" -> "luci" to <*> (built-in)
save your config

4. "make"

5. cd "/bin/ar71xx". The files you want are:

openwrt-ar71xx-ap81-rootfs-squashfs.bin (replaces Fuhry's root.sqfs)
openwrt-ar71xx-uImage-lzma.bin (replaces Fuhry's uImage)

Good luck!

@radengr: thanks a lot for your fast answer smile I succeeded flashing the original firmware with a serial console. But at this time I cannot say whether it works or not hmm
Also booting a ramdisk OpenWrt kernel via TFTP, I succeeded flashing fuhry's firmware, but I encountered the same problem as rumbit: "jffs2: Too few erase blocks (4)", and the consequences are the same - unfortunately I have at this time no Linux available to recompile OpenWrt...

Just for the sack of completeness: has someone a backup of the original partitions from a WNR2000v1 (mainly mtd1 u-boot & mtd2 u-boot-env) ? if available, can they be shared on the Web? Can the original u-boot-env be built with fuhry's ubootenv.pl?

@radengr: can you share your two files?

Thanks again / in advance smile

(Last edited by jpleboeuf on 27 Aug 2011, 22:55)