Netgear WNR3500v1




 * On the OpenWrt Wiki

Per a dissected US unit..
 * "U12H092", "Rev. 2", and "GP" is silkscreened on the board.
 * All radial capacitors used are CapXon branded.


 * The device has 8MB Flash and 32MB RAM.
 * The specific P/Ns used are in the infobox.
 * The netgear.com.cn device table also specifies
 * the device as having 8MB Flash and 32MB RAM.


 * The 802.11n radio is using two RFMD RF5125
 * 2.4-2.5GHz Power Amplifier ICs

Pinout
(3.3) (RxD) (...) (...) (TxD) (GND) 1              JP2

Info derived from
{{SCollapse|Serial info

version
Release version : Netgear Wireless Router WNR3500 U12H09200/V1.0.36/8.0.36NA Time : Jun 11 2009 11:21:42 Boot code version : 1.0.3
 * 1) version

cat /proc/version
Linux version 2.4.27-vrs1 (weal@svn) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-1)) #1 Thu Jun 4 15:04:37 CST 2009
 * 1) cat /proc/version

cat /proc/cpuinfo
Processor      : ARM926EJ-Sid(wb) rev 0 (v5EJl) BogoMIPS       : 332.59 Features       : swp half thumb fastmult
 * 1) cat /proc/cpuinfo

Hardware       : MV-88fxx81 Revision       : 0000 Serial         : 0000000000000000

cat /proc/cmdline
console=ttyS0,115200 root=/dev/mtdblock2 mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro
 * 1) cat /proc/cmdline

cat /proc/meminfo
total:   used:    free:  shared: buffers:  cached: Mem: 14909440 14462976   446464        0  1241088  2596864 Swap:       0        0        0 MemTotal:       14560 kB MemFree:           436 kB MemShared:           0 kB Buffers:          1212 kB Cached:           2536 kB SwapCached:          0 kB Active:           3608 kB Inactive:         2912 kB HighTotal:           0 kB HighFree:            0 kB LowTotal:        14560 kB LowFree:           436 kB SwapTotal:           0 kB SwapFree:            0 kB
 * 1) cat /proc/meminfo

cat /proc/mtd
dev:   size   erasesize  name mtd0: 00800000 00010000 "Physically mapped flash" mtd1: 00100000 00010000 "kernel" mtd2: 00630000 00010000 "rootfs" mtd3: 00010000 00010000 "traffic_meter1" mtd4: 00010000 00010000 "traffic_meter2" mtd5: 00010000 00010000 "POT" mtd6: 00010000 00010000 "board_data" mtd7: 00010000 00010000 "nvram" mtd8: 00080000 00010000 "u-boot" mtd9: 00800000 00010000 "all" }}
 * 1) cat /proc/mtd

{{SCollapse|boot log Boot code version : 1.0.3

** MARVELL BOARD: RD-88F5181L-VOIP-GE LE U-Boot 1.1.1 (Jan 25 2008 - 09:11:36) Marvell version: 1.10.16

DRAM CS[0] base 0x00000000  size  16MB DRAM Total size 16MB [8192kB@ff800000] Flash: 8 MB Addresses 12M - 0M are saved for the U-Boot usage. Mem malloc Initialization (12M - 8M): Done
 * Warning - bad CRC, using default environment

Soc: 88F5181 B1 CPU: ARM926 (Rev 0) running @ 500Mhz Orion 1 streaming disabled SysClock = 166Mhz, TClock = 166Mhz

USB 0: host mode PCI 0: PCI Express End Point Interface PCI 1: Conventional PCI, speed = 33000000 Net:  egiga0 [PRIME] Hit any key to stop autoboot: 0 Decompressing kernel... Image Name:  Linux-2.4.27-vrs1 Created:     2009-06-11   3:22:18 UTC Image Type:  ARM Linux Kernel Image (uncompressed) Data Size:   1428280 Bytes =  1.4 MB   Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK OK Starting kernel ...
 * 1) Booting image at 00400000 ...

ZLinux version 2.4.27-vrs1 (weal@svn) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-1)) #1 Thu Jun 4 15:04:37 CST 2009 CPU: ARM926EJ-Sid(wb) revision 0 Machine: MV-88fxx81 Using UBoot passing parameters structure Sys Clk = 166666667, Tclk = 166666667 On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro Calibrating delay loop... 332.59 BogoMIPS Memory: 16MB 0MB 0MB 0MB = 16MB total Memory: 14492KB available (1231K code, 374K data, 68K init) Dentry cache hash table entries: 2048 (order: 2, 16384 bytes) Inode cache hash table entries: 1024 (order: 1, 8192 bytes) Mount cache hash table entries: 512 (order: 0, 4096 bytes) Buffer cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) CPU: Testing write buffer: pass POSIX conformance testing by UNIFIX init hw started.

CPU Interface - SDRAM_CS0 ....base 00000000, size 16MB SDRAM_CS1 ....disable SDRAM_CS2 ....disable SDRAM_CS3 ....disable PEX0_MEM ....base e0000000, size 128MB PEX0_IO ....base f2000000, size  1MB PCI0_MEM ....base e8000000, size 128MB PCI0_IO ....base f2100000, size  1MB INTER_REGS ....base f1000000, size  1MB DEVICE_CS0 ....no such DEVICE_CS1 ....no such DEVICE_CS2 ....no such DEV_BOOCS ....base f4000000, size 16MB Flash bankwidth 2, base f4000000, size 1000000 PCI: bus0: Fast back to back transfers enabled HW already initialized. PCI: bus1: Fast back to back transfers enabled Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket WatchDog enabled.

Marvell Development Board (LSP Version 1.1.3) -- RD-88F5181L-VOIP-GE Soc: 88F5181 B1 Detected Tclk 166666667 and SysClk 166666667 TWSI: twsiAddr7BitSet ERROR - Addr (7 Bit) int TimeOut. TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut. TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut. TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut. TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut. TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut. TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut. TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut. TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut. TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut. TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut. TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut. TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut. TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut. Starting kswapd devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 Squashfs 2.2-r2 (released 2005/09/08) (C) 2002-2005 Phillip Lougher Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled ttyS00 at 0xf1012000 (irq = 3) is a 16550A Marvell Gateway Driver: Detected RD_88F5181L_VOIP_GE Wireless atthena LED button turned off Using VLAN-tag Mode L3/L4 Checksum offload enabled Multi queue support ( rxq0=128 rxq1=64 rxq2=64 rxq3=64 txq0=2000 ) Using boot network interface configuration eth0: mac_addr 00:1f:33:4b:91:07, VID 0x100, port list: port-0 eth1: mac_addr 00:1f:33:4b:91:06, VID 0x200, port list: port-1 port-2 port-3 port-4 init switch layer... done init MAC layer... done loading network interfaces: eth0 eth1 PPP generic driver version 2.4.2 physmap flash device: 1000000 at f4000000 Amd/Fujitsu Extended Query Table v1.1 at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling fast programming due to code brokenness. Using physmap partition definition

Creating 9 MTD partitions on "Physically mapped flash": 0x00000000-0x00100000 : "kernel" 0x00100000-0x00730000 : "rootfs" 0x00730000-0x00740000 : "traffic_meter1" 0x00740000-0x00750000 : "traffic_meter2" 0x00750000-0x00760000 : "POT" 0x00760000-0x00770000 : "board_data" 0x00770000-0x00780000 : "nvram" 0x00780000-0x00800000 : "u-boot" 0x00000000-0x00800000 : "all" Initializing Cryptographic API NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 1024 bind 2048) NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 Fast Floating Point Emulator V0.94M by Peter Teichmann. mount_block_root: mtdblock/2 VFS: Mounted root (squashfs filesystem) readonly. Mounted devfs on /dev Freeing init memory: 68K init started: BusyBox v1.01 (2009.03.03-08:18+0000) multi-call binary mv_gateway: starting eth0 mv_gateway: starting eth1 /sbin/syslogd: not found /proc/sys/net/ipv4/neigh/br0/base_reachable_time: cannot create Reading board data... WSC UUID: 0x93130468f8a39c3e3950eacf3d452c23 Using /lib/modules/2.4.27/net/acos_nat.o Warning: loading acos_nat will taint the kernel: no license See http://www.tux.org/lkml/#export-tainted for information about tainted modules Using /lib/modules/2.4.27/ap8x/ap8x.o Warning: loading ap8x will taint the kernel: non-GPL license - Proprietary See http://www.tux.org/lkml/#export-tainted for information about tainted modules ap0: Marvell AP-8x 802.11n adapter: mem=0xe8000000, irq=36 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 Waiting for Wireless Events from interfaces... device eth1 entered promiscuous mode device ap0 entered promiscuous mode br0: port 2(ap0) entering learning state br0: port 1(eth1) entering learning state ARPING to 255.255.255.255 from 192.168.1.1 via br0 br0: port 2(ap0) entering forwarding state br0: topology change detected, propagating br0: port 1(eth1) entering forwarding state br0: topology change detected, propagating Sent 3 probes (3 broadcast(s)) Received 0 reply info, udhcp server (v0.9.8) started error, unable to parse 'option wins ' error, unable to parse 'option domain ' Info: No FWPT default policies. wlanconfigd: No such file or directory POT integrity check OK. POT time is up. Starting WPS module ... mv_gateway: stopping eth0 mv_gateway: eth0 change mac address to 00:1f:33:4b:91:07 mv_gateway: starting eth0 Start DHCP client daemon

BusyBox v1.01 (2009.03.03-08:18+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands.

Wireless atthena LED button turned on WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 ap0: STA ff:ff:ff:ff:ff:ff IEEE 802.11: deassociated
 * 1) WPS Version: 14.1, December 11 2008

cat /proc/bus/pci/devices
0138   11ab2a0a        24      e8000000        e8010000        00000000        00000000        00000000        00000000        00000000        00010000  00010000 00000000        00000000        00000000        00000000        00000000        ap%d
 * 1) cat devices

lsmod
Module                 Size  Used by    Tainted: P ap8x                  798272   1 acos_nat             290340   0 (unused)
 * 1) lsmod

ps aux
PID Uid     VmSize Stat Command 1 0          428 S   init 2 0              SW  [keventd] 3 0              SWN [ksoftirqd_CPU0] 4 0              SW  [kswapd] 5 0              SW  [bdflush] 6 0              SW  [kupdated] 7 0              SW  [mtdblockd] 141 0          428 S   /sbin/iwevent 147 0          456 S   swresetd 149 0          840 S   upnpd 151 0          384 S   dnsRedirectReplyd 153 0          808 S   httpd 157 0          476 S   udhcpd /tmp/udhcpd.conf 160 0          508 S   dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -u r  161 0           480 S   ddnsd & 164 0          352 S   telnetenabled 166 0          556 S   heartbeat 174 0          728 S   /usr/sbin/email 181 0          584 S   lld2d br0 213 0          588 S   wpsd 217 0         1228 S   wsccmd /tmp/wsc 220 0          424 S   udhcpc -i eth0 -p /var/run/udhcpc0.pid -s /tmp/udhcpc 222 0          496 R   /bin/sh 225 0         1228 S   wsccmd /tmp/wsc 226 0         1228 S   wsccmd /tmp/wsc 227 0         1228 S   wsccmd /tmp/wsc 228 0         1228 S   wsccmd /tmp/wsc 229 0         1228 S   wsccmd /tmp/wsc 230 0         1228 S   wsccmd /tmp/wsc 231 0         1228 S   wsccmd /tmp/wsc 232 0         1228 S   wsccmd /tmp/wsc 233 0          732 S   hostapd -W /tmp/wsc/hostapd.conf 599 0          552 R   ps aux }}
 * 1) ps aux