Linksys WRT300N

Identification by S/N: Useful for identifying shrinkwrapped units. The S/N can be found on the box, below the UPC barcode.

Note for future cleanup: v1.1 works with Chaos Calmer r46589

The switch table below is accurate for OpenWRT Chaos Calmer on a v1.1 as of Aug 14 2015:

The WRT300N v1.0 is based on the Broadcom 4704 cpu. I guess it has about 300MHz. It has 4 MB flash and 32 MB SDRAM. The wireless NIC is a Broadcom Cardbus card with BCM4329 Chipset. The switch is an Broadcom BCM5325 FKQMG. Forum Entries claim this version is supported but creator of this page has no documented hardware experience.

Start to blink diag led ... CFE version 1.0.37 for BCM947XX (32bit,SP,LE) Build Date: Tue Feb 27 19:35:53 CST 2007 (root@localhost.localdomain) Copyright (C) 2000,2001,2002,2003 Broadcom Corporation. Initializing Arena Initializing PCI. [normal] PCI bus 0 slot 0/0: vendor 0x14e4 product 0x0800 (flash memory, rev 0x02) PCI bus 0 slot 1/0: vendor 0x14e4 product 0x471f (ethernet network, rev 0x02) PCI bus 0 slot 2/0: vendor 0x14e4 product 0x471a (USB serial bus, interface 0x10, rev 0x02) PCI bus 0 slot 2/1: vendor 0x14e4 product 0x471a (USB serial bus, interface 0x20, rev 0x02) PCI bus 0 slot 3/0: vendor 0x14e4 product 0x471b (USB serial bus, rev 0x02) PCI bus 0 slot 4/0: vendor 0x14e4 product 0x0804 (PCI bridge, rev 0x02) PCI bus 0 slot 5/0: vendor 0x14e4 product 0x0816 (MIPS processor, rev 0x02) PCI bus 0 slot 6/0: vendor 0x14e4 product 0x471d (IDE mass storage, rev 0x02) PCI bus 0 slot 7/0: vendor 0x14e4 product 0x4718 (network/computing crypto, rev 0x02) PCI bus 0 slot 8/0: vendor 0x14e4 product 0x080f (RAM memory, rev 0x02) PCI bus 0 slot 9/0: vendor 0x14e4 product 0x471e (class 0xfe, subclass 0x00, rev 0x02) Initializing Devices. No DPN This is a Parallel Flash Partition information: boot #00 00000000 → 0003FFFF (262144) trx #01 00040000 → 0004001B (28) os #02 0004001C → 007F7FFF (8093668) nvram #03 007F8000 → 007FFFFF (32768) Partition information: boot #00 00000000 → 0003FFFF (262144) trx #01 00040000 → 007F7FFF (8093696) nvram #02 007F8000 → 007FFFFF (32768) Reset switch via GPIO 8 ... PCI bus 0 slot 1/0: pci_map_mem: attempt to map 64-bit region tag=0x800 @ addr=18010004 PCI bus 0 slot 1/0: pci_map_mem: addr=0x18010004 pa=0x18010000 ge0: BCM5750 Ethernet at 0x18010000 CPU type 0x2901A: 300MHz Total memory: 32768 KBytes Total memory used by CFE: 0x80600000 - 0x806A1900 (661760) Initialized Data: 0x80636C40 - 0x80639BE0 (12192) BSS Area: 0x80639BE0 - 0x8063B900 (7456) Local Heap: 0x8063B900 - 0x8069F900 (409600) Stack Area: 0x8069F900 - 0x806A1900 (8192) Text (code) segment: 0x80600000 - 0x80636C40 (224320) Boot area (physical): 0x006A2000 - 0x006E2000 Relocation Factor: I:00000000 - D:00000000 Boot version: v4.4 The boot is CFE mac_init(): Find mac [00:1d:7e:1c:38:9a] in location 0 Nothing... CMD: [ifconfig eth0 -addr=192.168.1.1 -mask=255.255.255.0] eth0: Link speed: 100BaseT FDX Device eth0: hwaddr 00-1D-7E-1C-38-9A, ipaddr 192.168.1.1, mask 255.255.255.0 gateway not set, nameserver not set CMD: [go;] Check CRC of image1 Len: 0xDB000 (897024) (0xBC040000) Offset0: 0x1C (28) (0xBC04001C) Offset1: 0x974 (2420) (0xBC040974) Offset2: 0xDB000 (897024) (0xBC11B000) Header CRC: 0x292ED801 Calculate CRC: 0x292ED801 Image 1 is OK Try to load image 1. Waiting for 3 seconds to upgrade ... CMD: [load -raw -addr=0x806a1900 -max=0xf70000 :] Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null) Loading: _tftpd_open(): retries=0/3 _tftpd_open(): retries=1/3 _tftpd_open(): retries=2/3 Failed. Could not load :: Timeout occured CMD: [boot -raw -z -addr=0x80001000 -max=0xf70000 flash0.os:] Loader:raw Filesys:raw Dev:flash0.os File: Options:(null) Loading: .. 4092 bytes read Entry at 0x80001000 Closing network. eth0: cannot clear 1400/00000002

https://forum.openwrt.org/viewtopic.php?id=33937

The WRT300N v2.0 is based on the Intel IXP420 cpu which is part of the IXP425 family. The cpu runs at 266Mhz. It has 4Mb of flash and 16Mb of RAM. It has a Marvell 88E6060 switch chip. The wireless is provided by a mini-pci card containing an ar5416 or ar5418 MAC. It is running linux out of the box.

Table summary

How to get info:

• board info:

  nvram show | grep board | sort

• cpu model:

  grep cpu /proc/cpuinfo

How to install OpenWRT

• Page in spanish with some useful precompiled files, hacks and and instructions: http://heli.xbot.es/wp/?p=35

• Precompiled RedBoot available at (http://davidkra.net/downloads2.html not working) http://www.arrakis.es/~helitp/redboot_mio.rar, skip to step 10 if you use it.

Step 1: Get Linksys WRT300N v2.00.20 sources

Step 2: Untar sources and go to sources directory.

Step 3: Get this toolchain: ftp://ftp.ges.redhat.com/private/gnupro-xscale-030422/i686-pc-linux-gnulibc2.2-x-xscale-elf.tar.Z


Step 4: mkdir gnutools && mv *xscale-elf.tar.Z gnutools && cd gnutools

Step 5: Untar toolchain with this command: gunzip2 *xscale-elf.tar.Z; tar xvf *xscale-elf.tar

Step 6: export PATH=$PWD/H-i686-pc-linux-gnulibc-2.2/bin:$PATH && cd ../src/redboot

Step 7: Edit options/startup_ROMRAM.edl: replace

cdl_option CYGOPT_REDBOOT_FIS {
    user_value 0
}; 

with:

cdl_option CYGOPT_REDBOOT_FIS {
    user_value 1
}; 

and replace:

cdl_component CYGSEM_REDBOOT_FLASH_CONFIG {
    user_value 0
};

with:

cdl_component CYGSEM_REDBOOT_FLASH_CONFIG {
    user_value 1
};

Step 8: 'make'

Step 9: Setup a TFTPd or HTTPd, copy build/wrt300n/install/bin/redboot.bin to your filedir for your server

Step 10: Get into RedBoot ( Read this http://www.nslu2-linux.org/wiki/HowTo/ReflashUsingRedbootAndTFTP , serial console preferred), type:

(only if via serial console) ether
ip -h {yourIP}
load -r -b 0x70000 -m (choose tftp or http, i'll use http) http /redboot.bin
fis write -f 0x50060000 -b 0x70000 -l 0x4d254 //possible typos: length and flash address. if it doesn't work, first try -l 0x4fd00 and if it still doesn't work, try -f 0x50000000
reset

Step 11: Get http://downloads.openwrt.org/kamikaze/7.09/ixp4xx-2.6/openwrt-ixp4xx-2.6-squashfs.img and http://downloads.openwrt.org/kamikaze/7.09/ixp4xx-2.6/openwrt-wrt300nv2-2.6-zImage , rename the first to wrt.img, second to wrt,zI. put them into your filedir for your server

Step 12: Get into RedBoot, again: type:

fis init
(only if via serial console) ether
ip -h {yourip}
load -r -b 0x70000 -m {http,tftp} http /wrt.zI
fis create kernel
load -r -b 0x70000 -m {http,tftp} http /wrt.img
fis create rootfs

Step 13: Almost done :-3 , final command in RedBoot:

 fis load kernel 

Step 14. DONE

If you want to have your box auto-bootable, run 'fconfig boot_script', substitute false with true and enter:

ether
fis load kernel
exec

• Set Timeout to something bigger than 1.OpenWRT boot log

Uncompressing Linux................................................................. done, booting the kernel.
Linux version 2.6.21.6 (nbd@ds10) (gcc version 4.1.2) #2 Sun Sep 30 20:44:34 CEST 2007
CPU: XScale-IXP42x Family [690541f1] revision 1 (ARMv5TE), cr=000039ff
Machine: Linksys WRT300N v2
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT undefined 5 cache
CPU0: I cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
CPU0: D cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
Built 1 zonelists.  Total pages: 4064
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 init=/etc/preinit
PID hash table entries: 64 (order: 6, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 16MB = 16MB total
Memory: 14172KB available (1788K code, 167K data, 76K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
IXP4xx: Using 16MiB expansion bus window size
PCI: IXP4xx is host
PCI: IXP4xx Using direct access for memory space
PCI: bus0: Fast back to back transfers enabled
dmabounce: registered device 0000:00:01.0 on pci bus
Time: OSTS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
NetWinder Floating Point Emulator V0.97 (double precision)
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
IXP4xx Watchdog Timer: heartbeat 60 sec
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xc8001000 (irq = 13) is a XScale
IXP4XX Q Manager 0.2.1 initialized.
IXP4XX NPE driver Version 0.3.0 initialized
ixp_crypto: No HW crypto available
IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0x3f0000
5 RedBoot partitions found on MTD device IXP4XX-Flash.0
Creating 5 MTD partitions on "IXP4XX-Flash.0":
0x00000000-0x00080000 : "RedBoot"
0x00080000-0x00170000 : "kernel"
0x00170000-0x00290000 : "rootfs"
0x00260000-0x00290000 : "rootfs_data"
0x00290000-0x003f0000 : "unallocated"
0x003f0000-0x00400000 : "FIS directory"
i2c /dev entries driver
nf_conntrack version 0.5.0 (128 buckets, 1024 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP westwood registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear 
All bugs added by David S. Miller 
XScale DSP coprocessor detected.
ixp4xx_mac driver 0.3.1: eth0 on NPE-B with PHY[-1] initialized
ixp4xx_mac driver 0.3.1: eth1 on NPE-C with PHY[1] initialized
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
VFS: Mounted root (squashfs filesystem) readonly.
Freeing init memory: 76K
Warning: unable to open an initial console.
- preinit -
jffs2 not ready yet; using ramdisk
mini_fo: using base directory: /
mini_fo: using storage directory: /tmp/root
- init -
init started:  BusyBox v1.4.2 (2007-09-29 10:12:09 CEST) multi-call binary
Please press Enter to activate this console. eth0: NPE-B not running
eth0: NPE-B not running
PPP generic driver version 2.4.2
wlan: 0.8.4.2 (svn r2568)
ath_hal: module license 'Proprietary' taints kernel.
ath_hal: 0.9.30.13 (AR5210, AR5211, AR5212, AR5416, RF5111, RF5112, RF2413, RF5413, RF2133, REGOPS_FUNC)
ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (svn r2568)
ath_rate_minstrel: look around rate set to 10%
ath_rate_minstrel: EWMA rolloff level set to 75%
ath_rate_minstrel: max segment size in the mrr set to 6000 us
wlan: mac acl policy registered
ath_pci: 0.9.4.5 (svn r2568)
PCI: enabling device 0000:00:01.0 (0340 -> 0342)
irq 25: nobody cared (try booting with the "irqpoll" option)
handlers:
[]
Disabling IRQ #25
MadWifi: unable to attach hardware: 'Hardware didn't respond as expected' (HAL status 3)
jffs2: Too few erase blocks (3)
BusyBox v1.4.2 (2007-09-29 10:12:09 CEST) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   |   _  |  -__|     |   |  |  |    _|    _|
 |_ ^ |_____|__| ^ ^ |  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (7.09) -----------------------------------
   * 10 oz Vodka       Shake well with ice and strain
   * 10 oz Triple sec  mixture into 10 shot glasses.
   * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/# 

Hardware hacking

Memory update to 32Mb using two K4S281632d or HY57V281620h: http://heli.xbot.es/wp/?p=35 Tested with Bleeding edge r26387, partial log:

RedBoot(tm) bootstrap and debug environment, compiLed by helitp@arrakis.es [ROMRAM]
Red Hat certified release, version 2.02 - built 21:54:28, Apr 4 2011

Platform: Intel Generic Residential Gateway (IXP42X 266MHz) BE
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

RAM: 0x00000000-0x02000000, [0x0006ac98-0x01fe1000] available
FLASH: 0x50000000 - 0x50400000, 64 blocks of 0x00010000 bytes each.
== Executing boot script in 2.000 seconds - enter ^C to abort
RedBoot> ether

Trying NPE-B...success. Using NPE-B with PHY 16.
Ethernet eth0: MAC address 00:18:39:2f:fa:74
IP: 192.168.0.10/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.0.125
RedBoot> fis load kernel
RedBoot> exec
Using base address 0x0006b000 and length 0x000d5724
Uncompressing Linux... done, booting the kernel.
Linux version 2.6.37.6 (heli@asus) (gcc version 4.5.2 (Linaro GCC 4.5-2011.02-0) ) #7 Fri Apr 8 06:50:08 CEST 2011
CPU: XScale-IXP42x Family [690541f1] revision 1 (ARMv5TE), cr=000039ff
CPU: VIVT data cache, VIVT instruction cache
Machine: Linksys WRT300N v2
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 32MB = 32MB total
Memory: 30016k/30016k available, 2752k reserved, 0K highmem

Opening the case

Pull off the blue Cover Plates on top and bottom of the Device, pull off the black Front cover and remove the 4 Screws in Bottom.

Debug Mode

To enable Debug Mode, log on to your router and type: http://you.rro.ute.rip/setup.cgi?todo=debug . Actually I don't know what happens to the router after enabling, but now i'm auditing the code.

Using ping to run commands

Like with other Linksys routers, it's possible to run system commands using “ping”; for instance, entering “; reboot” (without quotation marks) in the “ping” tool will reboot the router. Doesn't work with 2.00.20

Recovering from a bad flash

To recover from a bad flash, issue these commands in RedBoot (flashing to linksys fw, assuming you already downloaded it.):

load -r -b 0x70000 -m (choose between 'http' or 'tftp', assuming http, default tftp) http -h 192.168.0.9 (change this to your ip) /wrt300n.bin
fis write -f 0x50000000 -b 0x70000 -l 0x3fffff

WRT300N v2 Serial Console

There aren't many connector slots on the board. The serial console (JP1) is just above the flash chip on the same side as the power connector. Console speed is 115200,8n1

• () Vcc () RX () TX () GND

The console connector for the WRT300N v2 uses TTL voltage. Thus it cannot be directly connected to a PC RS232 port (you may fry your WRT300N v2 if you do so). It requires level shifting (by the use of MAX3232 component for example). Details about such a modified cable are widely available. Among other places you can find them at the WRT54G (linux) pages.