OpenWrt Forum Archive

Topic: Linksys Cisco E3000 v1 / WRT-610N v2 / Asus RT-N16 hardware on trunk

The content of this topic has been archived between 30 Apr 2013 and 7 May 2018. Unfortunately there are posts – most likely complete pages – missing.

I'm finally playing around with newer Broadcom hardware. I have a couple Cisco E3000 and even managed a workable serial port tap off the WAN pads without soldering!

UPDATE: Reports are now also that the Belkin PlayMax F7D4301 is the same Broadcom chipsets too. So we have four routers all with similar firmware compatibility.

UPDATE: January 3, 2012 there is recent activity on the patches!! I See: http://www.znau.edu.ua/temp/asus-rt-n16 … README.txt

Anyone running newer trunk? Are these patches making it into the OpenWrt development tree?

(Last edited by RoundSparrow on 4 Jan 2012, 03:56)

the problem is the GMAC driver not covered by GPL.
I believe it's too much work for someone to write the whole ethernet driver.
I don't think it will be supported officially by openwrt.

maurer wrote:

the problem is the GMAC driver not covered by GPL.
I believe it's too much work for someone to write the whole ethernet driver.
I don't think it will be supported officially by openwrt.

Thank you for this pointer. I now find this: https://lkml.org/lkml/2011/4/12/499
"UNPUBLISHED PROPRIETARY for GMAC core driver sources (etcgmac.c)"

And copyright discussion, and how the source is out there, but the header implies proprietary:
http://www.spinics.net/lists/linux-wire … 69217.html

Open ticket, which mentions the license issue, on OpenWrt
https://dev.openwrt.org/ticket/6580#comment

Can we flash a OpenWrt driver combination that is missing the LAN support?  Just the wireless, flash, USB... one could drop in a USB ethernet driver as a short-term solution to use it as an Access Point....

(Last edited by RoundSparrow on 20 Dec 2011, 19:57)

In the USA, right now reputable Newegg has the Asus RT-N16 for $47! http://www.newegg.com/Product/Product.a … 6833320081  - see if you can snag a free "ShopRunner' subscription for 2-day free delivery.

The Asus has double the RAM of the Cisco and 4x the flash! However, it has only one radio, the Cisco has a second chip for 5Ghz.

Unit RAM = 128 MB (2x 64MB - Samsung K4N511163QZ-HC25 or 2x 64MB - Samsung K4T51163QG-HCE6)
Unit Flash = 32 MB (MACRONIX MX29GL256EHTI2I-90Q)

(Last edited by RoundSparrow on 20 Dec 2011, 16:28)

can you buy one for me and ship it to romania tongue  - all expenses covered by me tongue ?

maurer wrote:

can you buy one for me and ship it to romania tongue  - all expenses covered by me tongue ?

Sure. email me your address information to stephen @ hilltx.co.m - I'll reply back. I'll power it up and make sure it works before I ship to you.

(Last edited by RoundSparrow on 20 Dec 2011, 19:37)

Out Of Stock.

Ok, I've been compiling trunk against the latest patches I could locate on http://www.znau.edu.ua/temp/asus-rt-n16/ and build starts to break in USB patches on r29264 "linux: update 3.0 to 3.0.9"

It looks like Broadcom SSB EHCI support was added to OpenWrt trunk on r29264 http://dev.openwrt.org/browser/trunk/ta … ?rev=29264 - and that the patches conflict.

This is all 5 weeks ago that r29264 conflicts were introduced.  I see recent activity, from 1 week ago, here: http://patchwork.openwrt.org/patch/1676/  these seem to be focused on some Netgear routers ( WNR3500Lv2 & WNDR4500 ?)

Anyone want to help me out on getting a current trunk patch set? I'm slow at learning all this wink Still playing around with this code...

(Last edited by RoundSparrow on 21 Dec 2011, 18:16)

support for rt-n16 dev ticket evolved into a forum thread of its own
https://dev.openwrt.org/ticket/6580

Fixes required for RT-N16 against OpenWrt trunk 29288

package/mac80211/Makefile: Fix dependency from failed patch hunk

/trunk/target/linux/generic/patches-3.0/102-ehci_hcd_ignore_oc.patch: Remove line below

unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */

Apply fix from this thread:  http://permalink.gmane.org/gmane.linux. … ral/73918*

(Last edited by maurer on 21 Dec 2011, 21:15)

maurer wrote:

support for rt-n16 dev ticket evolved into a forum thread of its own
https://dev.openwrt.org/ticket/6580

Fixes required for RT-N16 against OpenWrt trunk 29288

package/mac80211/Makefile: Fix dependency from failed patch hunk

/trunk/target/linux/generic/patches-3.0/102-ehci_hcd_ignore_oc.patch: Remove line below

unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */

Ok, I got past those two problems.  Now I'm finding:

./build_dir/linux-brcm4716/linux-3.0.4/patches/platform/0001-bcma-move-parsing-of-EEPROM-into-own-function.patch

Fails on current trunk. Trying to figure out why.

post this on the ticket and email george kashperko

maurer wrote:

post this on the ticket and email george kashperko

Hey, I have your Asus router here wink  Send me your address and I'll try to get it out Tuesday.

i'm sorry for misunderstanding, i thought the're out of stock and i bought a seagate dockstar instead - to "play" with.
and already have a rt-n16 since 2 years ago - but it's productive (tomatousb).
i wanted another one to try out openwrt and debwrt - but it'll have to wait - my Christmas presents fund is gone.
Thnaks and Merry Christmas  !

Round sparrow have you made any progress getting the newest openwrt trunk to build? I've been following this thread.

@RoundSparrow If you still have the router, I'm interested in it! Thanx!

kenjiru wrote:

@RoundSparrow If you still have the router, I'm interested in it! Thanx!

yha, I'm here. Send me email at:  stephen AT hilltx dot com

I should respond right away.

azdps wrote:

George Kashperko has posted new patches as of 01/01/2012. They work against the current trunk version.

http://www.znau.edu.ua/temp/asus-rt-n16 … -01T23-55/

Cool, I'll try them out shortly.  I do now have both the Asus and Cisco E3000...

Both the Asus and Linksys stock firmware are vulnerable to the WPS PIN attack... more reason to shift to OpenWrt smile

There is work going on now to reverse engineer the gmac core: http://bcm-v4.sipsolutions.net/mac-gbit
It allows for a clean-room implementation of a new ethernet driver.

jow wrote:

There is work going on now to reverse engineer the gmac core: http://bcm-v4.sipsolutions.net/mac-gbit
It allows for a clean-room implementation of a new ethernet driver.

Cool wink

here are my notes so far on the latest patches (files dated 2012-01-03).  I checkout into a directory called openwrt - so i do some sed changes to normalize the paths in the patch files.

# fix paths
sed 's/+++ openwrt.r29617/+++ openwrt/g' 000-openwrt4716-TARGET_brcm4716-clone-brcm47xx.patch > 000-openwrt4716-TARGET_brcm4716-clone-brcm47xx_path1.patch
sed 's/+++ openwrt.r29617/+++ openwrt/g' 001-openwrt4716-TARGET_brcm4716.patch > 001-openwrt4716-TARGET_brcm4716_path1.patch 
sed 's/+++ openwrt.r29617/+++ openwrt/g' 002-openwrt4716-TARGET_brcm4716-deps.patch  > 002-openwrt4716-TARGET_brcm4716-deps_path1.patch 
sed 's/+++ openwrt.r29637/+++ openwrt/g' 001-openwrt4716-TARGET_brcm4716-F7D4301-fix.patch > 001-openwrt4716-TARGET_brcm4716-F7D4301-fix_path1.patch

# patch -p0 < 000-openwrt4716-TARGET_brcm4716-prereq.patch 
patch -p0 < 000-openwrt4716-TARGET_brcm4716-clone-brcm47xx_path1.patch
patch -p0 < 001-openwrt4716-TARGET_brcm4716_path1.patch
patch -p0 < 001-openwrt4716-TARGET_brcm4716-F7D4301-fix_path1.patch
patch -p0 < 002-openwrt4716-TARGET_brcm4716-deps_path1.patch

I'm compiling latest trunk right now, r29644. Not sure if I'll have time to install and test on router before bed, I will report back if I do wink

(Last edited by RoundSparrow on 4 Jan 2012, 03:55)

Ok, compiled latest trunk (r29644) and did a upgrade from stock Linksys firmware admin pages on E3000.... here is a boot log off console!

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Tue Jul 27 16:07:16 CST 2010 (ljh@team2-complier)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.

No DPN
This is a Parallel Flash
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.51
CPU type 0x19740: 480MHz
Tot mem: 65536 KBytes

CFE mem:    0x80700000 - 0x8079DAC0 (645824)
Data:       0x80732A20 - 0x80737080 (18016)
BSS:        0x80737080 - 0x80737AC0 (2624)
Heap:       0x80737AC0 - 0x8079BAC0 (409600)
Stack:      0x8079BAC0 - 0x8079DAC0 (8192)
Text:       0x80700000 - 0x80732A1C (207388)

Boot version: v4.2
The boot is CFE

mac_init(): Find mac [98:FC:11:91:6B:F4] in location 0
Nothing...
country_init(): Find country code in location 0
The country is same
Device eth0:  hwaddr 98-FC-11-91-6B-F4, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Check CRC of image1
  Header CRC:    0xDE8C3C86
  Calculate CRC: 0xDE8C3C86
Image 1 is OK
Try to load image 1.
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3788 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
[    0.000000] Linux version 3.0.12 (adminsag@ipcx201ubuntu1) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #
2 Tue Jan 3 21:46:05 CST 2012
[    0.000000] CPU revision is: 00019740 (MIPS 74Kc)
[    0.000000] bcm47xx: using ssb bus
[    0.000000] ssb: Found END of erom after 9 cores
[    0.000000] ssb: chipcommon status is 0x800
[    0.000000] ssb: ssb_pmu_resources_init: Resource count 7
[    0.000000] ssb: Initializing MIPS core...
[    0.000000] ssb: set_irq: core 0x0812, irq 3 => 3
[    0.000000] ssb: set_irq: core 0x082d, irq 4 => 4
[    0.000000] ssb: set_irq: core 0x0819, irq 5 => 5
[    0.000000] ssb: after irq reconfiguration
[    0.000000] ssb: core 0x0800, irq : 2(S)* 3  4  5  6  D  I
[    0.000000] ssb: core 0x0812, irq : 2(S)  3* 4  5  6  D  I
[    0.000000] ssb: core 0x082d, irq : 2(S)  3  4* 5  6  D  I
[    0.000000] ssb: core 0x082c, irq : 2(S)  3  4  5  6  D  I*
[    0.000000] ssb: core 0x0819, irq : 2(S)  3  4  5* 6  D  I
[    0.000000] ssb: core 0x0820, irq : 2(S)  3  4  5  6* D  I
[    0.000000] ssb: core 0x082e, irq : 2(S)* 3  4  5  6  D  I
[    0.000000] ssb: core 0x080e, irq : 2(S)  3  4  5  6  D  I*
[    0.000000] ssb: core 0x0834, irq : 2(S)* 3  4  5  6  D  I
[    0.000000] found parallel flash.
[    0.000000] ssb: Sonics Silicon Backplane (AI type) found at address 0x18000000
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00004000
[    0.000000] Movable zone start PFN for each node
[    0.000000] early_node_map[1] active PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00004000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 62192k/65536k available (2095k kernel code, 3344k reserved, 332k data, 156k init, 0k highmem)
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS0] enabled
[    0.004000] Calibrating delay loop... 239.10 BogoMIPS (lpj=478208)
[    0.040000] pid_max: default: 32768 minimum: 301
[    0.044000] Mount-cache hash table entries: 512
[    0.048000] NET: Registered protocol family 16
[    0.060000] bio: create slab <bio-0> at 0
[    0.068000] Switching to clocksource MIPS
[    0.076000] Switched to NOHz mode on CPU #0
[    0.084000] NET: Registered protocol family 2
[    0.088000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.096000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    0.104000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.112000] TCP: Hash tables configured (established 2048 bind 2048)
[    0.116000] TCP reno registered
[    0.120000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.124000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.132000] NET: Registered protocol family 1
[    0.144000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.152000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.160000] msgmni has been set to 121
[    0.164000] io scheduler noop registered
[    0.168000] io scheduler deadline registered (default)
[    0.176000] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
\FD    0.20000 serial8250: ttyS0 at MMIO 0xb8000300 (irq = 2) is a U6_16550A
[    0.232000] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2) is a U6_16550A
[    0.240000] bcm47xx_pflash: flash init: 0x1c000000 0x02000000
[    0.248000] Physically mapped flash: Found 1 x16 devices at 0x0 in 8-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0000cb
[    0.256000] Amd/Fujitsu Extended Query Table at 0x0040
[    0.264000]   Amd/Fujitsu Extended Query version 1.1.
[    0.268000] number of CFI chips: 1
[    0.272000] bcm47xx_pflash: Flash device: 0x2000000 at 0x1fc00000
[    0.280000] bcm47xx_part: bootloader size: 262144
[    0.284000] bcm47xx_part: Looking for dual image
[    0.288000] bcm47xx_part: TRX offset : 0
[    0.292000] 4 bcm47xx partitions found on MTD device Physically mapped flash
[    0.300000] Creating 4 MTD partitions on "Physically mapped flash":
[    0.308000] 0x000000000000-0x000000040000 : "cfe"
[    0.312000] 0x000000040000-0x0000007f0000 : "linux"
[    0.320000] 0x000000117000-0x0000007f0000 : "rootfs"
[    0.328000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcin
g read-only
[    0.340000] mtd: partition "rootfs" set to be root filesystem
[    0.348000] mtd: partition "rootfs_data" created automatically, ofs=320000, len=4D0000
[    0.356000] 0x000000320000-0x0000007f0000 : "rootfs_data"
[    0.364000] 0x0000007f0000-0x000000800000 : "nvram"
[    0.372000] bcm47xx_sflash: error registering platform driver: -19
[    0.380000] BCM47xx Watchdog Timer enabled (30 seconds, nowayout)
[    0.388000] TCP westwood registered
[    0.392000] NET: Registered protocol family 17
[    0.396000] 802.1Q VLAN Support v1.8
[    0.408000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    0.416000] Freeing unused kernel memory: 156k freed
[    1.972000] diag: Router model not detected.
[    3.168000] roboswitch: Probing device eth0: No such device
[    3.176000] roboswitch: Probing device eth1: No such device
[    3.180000] roboswitch: Probing device eth2: No such device
[    3.184000] roboswitch: Probing device eth3: No such device
[    6.296000] diag: Router model not detected.
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
[    9.600000] JFFS2 notice: (264) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orph
an) and 4 of xref (0 dead, 2 orphan) found.
switching to jffs2
- init -

Please press Enter to activate this console. [   11.676000] bgmac ssb0:1: eth0: Broadcom SSB GMAC ethernet driver (ext. Robo Switch
) 00:01:36:1f:e4:59
[   11.792000] USB20H mdio control register: 0x8000000C
[   11.996000] SCSI subsystem initialized
[   12.032000] roboswitch: Probing device eth0: found a 53115! It's a 5350.
[   12.208000] usbcore: registered new interface driver usbfs
[   12.212000] usbcore: registered new interface driver hub
[   12.224000] usbcore: registered new device driver usb
[   13.144000] wl: module license 'unspecified' taints kernel.
[   13.148000] Disabling lock debugging due to kernel taint
[   13.228000] wl0: Broadcom BCM4329 802.11 Wireless Controller 5.10.56.27
[   13.236000] SSB/BCMA glue driver successfully attached
[   13.752000] PPP generic driver version 2.4.2
[   14.076000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   14.284000] NET: Registered protocol family 24
[   14.432000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[   14.436000] ehci-platform ehci-platform.0: Generic Platform EHCI Controller
[   14.444000] ehci-platform ehci-platform.0: new USB bus registered, assigned bus number 1
[   14.476000] ehci-platform ehci-platform.0: irq 5, io mem 0x18004000
[   14.492000] ehci-platform ehci-platform.0: USB 0.0 started, EHCI 1.00
[   14.496000] hub 1-0:1.0: USB hub found
[   14.500000] hub 1-0:1.0: 2 ports detected
[   14.532000] nf_conntrack version 0.5.0 (974 buckets, 3896 max)
[   15.164000] uhci_hcd: USB Universal Host Controller Interface driver
[   15.192000] Initializing USB Mass Storage driver...
[   15.200000] usbcore: registered new interface driver usb-storage
[   15.204000] USB Mass Storage support registered.
[   16.920000] device eth0.0 entered promiscuous mode
[   16.924000] device eth0 entered promiscuous mode
[   17.268000] br-lan: port 1(eth0.0) entering forwarding state
[   17.272000] br-lan: port 1(eth0.0) entering forwarding state



BusyBox v1.19.3 (2012-01-03 21:25:37 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 ATTITUDE ADJUSTMENT (bleeding edge, r29643) ----------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------
root@OpenWrt:/#

It is working pretty good so far. I was able to make the router an Access Point using WPA2 encryption using LuCI.  If anyone else wants a copy, here is the Cisco Linksys E3000 binary for R29644 (the bootlog shown in this post), LuCI included: https://sites.google.com/site/stephengu … uashfs.bin

We tested the router as an Access Point at our Austin Linux meeting tonight. Seems to max out wireless throughput around 1.5Mbps... pretty crappy. This was from various client 802.11n systems, 4 active ones. CPU was not maxed out, so not sure what is going on with the wireless driver.

(Last edited by RoundSparrow on 5 Jan 2012, 04:59)

I get an error with the patches. Can anyone help ?
I noticed sed 's/+++ openwrt.r29637/+++ openwrt/g' 001-openwrt4716-TARGET_brcm4716-F7D4301-fix.patch. In George's patches there is no reference to r29637.

patch -p1 < 002-openwrt4716-TARGET_brcm4716-deps_path1.patch
patching file package/broadcom-diag/Makefile
Hunk #1 FAILED at 15.
1 out of 1 hunk FAILED -- saving rejects to file package/broadcom-diag/Makefile.rej
patching file package/broadcom-wl/Makefile
Hunk #1 FAILED at 26.
1 out of 1 hunk FAILED -- saving rejects to file package/broadcom-wl/Makefile.rej
can't find file to patch at input line 50
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|--- openwrt.r29617.orig/package/broadcom-wl/src/glue/wl_glue.c 2012-01-01 23:49:52.817459651 +0200
|+++ openwrt/package/broadcom-wl/src/glue/wl_glue.c     2011-12-31 15:44:44.865129233 +0200
--------------------------
File to patch:
Skip this patch? [y] y
Skipping patch.
1 out of 1 hunk ignored
patching file package/kernel/modules/netdevices.mk
Hunk #1 FAILED at 761.
1 out of 1 hunk FAILED -- saving rejects to file package/kernel/modules/netdevices.mk.rej
patching file package/kernel/modules/other.mk
Hunk #1 FAILED at 527.
1 out of 1 hunk FAILED -- saving rejects to file package/kernel/modules/other.mk.rej
patching file package/kernel/modules/usb.mk
Hunk #1 succeeded at 857 with fuzz 2 (offset -145 lines).
patching file package/mac80211/Makefile
Hunk #1 FAILED at 49.
1 out of 1 hunk FAILED -- saving rejects to file package/mac80211/Makefile.rej
patching file package/nvram/Makefile
Hunk #1 FAILED at 19.
1 out of 1 hunk FAILED -- saving rejects to file package/nvram/Makefile.rej
patching file package/switch/Makefile
Hunk #1 FAILED at 15.
1 out of 1 hunk FAILED -- saving rejects to file package/switch/Makefile.rej

(Last edited by VeNoM on 19 Jan 2012, 10:15)

development for brcm47xx is advancing faster than george can patch things up - last change 4 days ago.
but i believe that he'll come back with a new set of patches soon.
if you want to compile it - try pulling older sources  - latest update on george's repo was on 9.01.2012 - so sources < 29700 should be able to compile without errors.
that's only my guess - if you want it - try it - i t might do it in the weekend and report back