I picked up a Netgear WNR1000v2 VC router at a garage sale recently ($5!) and I've been hacking at it.
The WNR1000v2 contains, according to https://wikidevi.com/wiki/Netgear_WNR1000v2
* Atheros AR7240 CPU (300MHz)
* 4MB Flash
* 32MB RAM (Woooh! I thought it'd only had 16MB at first)
* U-Boot accessible by serial console
* Atheros AR9285 B/G/N wifi chip with one connector
* AR7240 Ethernet Switch
* Runs a heavily modified OpenWRT 7.09 Kamikaze stock.
So far, I've managed to compile OpenWRT Backfire and Attitude Adjustment ar71xx ramdisk images and, with a serial cable, have successfully booted into them. I did have to modify the magic number of the image to allow the modified u-Boot bootloader to boot it. I used the utility here http://aorlinsk2.free.fr/openwrt/wndr3700/ but modified to use the magic number 0x31303030 (ASCII 1000 in hex) instead of ASCII 3700.
However, once the router boots, I have no network interfaces in either Backfire or Attitude Adjustment. For giggles, I tried appending board=WNR2000 to the bootargs, but that resulted in a freeze in Backfire and a kernel panic in Attitude Adjustment. There appears to be some board-specific initialization that needs to happen to enable the network devices, and I'm not sure where to go from here.
mach-wnr2000.c (in arch/mips/ath79) looks interesting. What would I have to do to use this file as a base for the WNR1000v2?
Some other information:
In OpenWRT, I probed for GPIOs and came up with the following information:
There are 18 GPIOs registered.
The following GPIOs control LEDS:
0 WAN amber active low 1 power amber active low 11 power green active low 12 LAN4 amber active low
The rest of the GPIOs are unknown:
2 (value always 1) 3 (value always 0) 4 (value always 0) 5 (value always 0) 6 (value always 0) 7 (value always 0) 8 (value always 0) 9 (value always 1) 10 (value always 1) 13 (value always 0) 14 (value always 0) 15 (value always 0) 16 (value always 0) 17 (value always 0)
Given that there are three GPIOs with values stuck at 1 and three buttons, I'm assuming that three of these are, in fact, tied to the buttons. However, I couldn't get them to react when pressing the buttons while echoing the value in a shell loop. I also don't know what the GPIOs are for the wireless LED and the WPS LED, or for WAN green and the rest of the LAN LEDs.
I have not touched flash memory at all, although the flash layout is somewhat peculiar:
dev: size erasesize name mtd0: 00040000 00010000 "u-boot" mtd1: 00010000 00010000 "u-boot-env" mtd2: 00350000 00010000 "rootfs" mtd3: 00010000 00010000 "config" mtd4: 00020000 00010000 "language_table" mtd5: 00010000 00010000 "pot" mtd6: 00010000 00010000 "traffic_meter" mtd7: 00010000 00010000 "ART" mtd8: 0034ffc0 00010000 "mount_fs"
The kernel and rootfs are lumped together in the same partition. It is booted by loading the file from the partition via the fsload command (which means that Netgear's U-Boot knows how to grok the filesystem?) and booting from that location in memory.
So, I'd appreciate a nudge in the right direction:
1) What do I need to do to start working on board-specific code for this device based off of the WNR2000's board file? Will creating another .c file and adding it to the Makefile be sufficient?
2) How can I track down the correct GPIOs for the missing buttons and LEDs?
For debug information, here's the boot log from the serial console:
http://jacksontech.net/wnr1000v2/serial_log_aa.txt (Attitude Adjustment)
http://jacksontech.net/wnr1000v2/serial_log_stock.txt (Stock firmware)
Note that the AA boot log is much shorter; it doesn't even try to init the network devices.
Edit: Fixed router name. WNR, not WRN. Gah!
(Last edited by supertanker on 8 Jul 2014, 04:11)