Re: Wrt160nl?

vincentfox wrote:

I get apparent WRT160NL recognition now, but no root prompt.
It just stops at the end think it doesn't like GPIO code.

This error was caused by the hotplug2 update, fixed with 16154 already.

Starting kernel ...

Linux version (vf5@baird) (gcc version 4.1.2) #1 Thu May 28 11:46:40 P
DT 2009
console [early0] enabled
m25p80 spi0.0: unrecognized JEDEC id 1c2017

Oops, another unsupported flash. Should be fixed with 16167.

The awesomo firmware just panics:

Starting kernel ...
VFS: Cannot open root device "<NULL>" or unknown-block(0,0)
Please append a correct "root=" boot option; here are the available partitions:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

Unfortunately very limited on debugging time now, maybe I can pursue some over the weekend.

Seems like that this is not an initramfs image.

Re: Wrt160nl?

Ah yes, better now.  Have root prompt again:

Starting kernel ...

Linux version (vf5@baird) (gcc version 4.1.2) #1 Fri May 29 22:33:53 P
DT 2009
console [early0] enabled
CPU revision is: 00019374 (MIPS 24Kc)
Atheros AR9130 rev 2 (id:0xb8), CPU:400.000 MHz, AHB:200.000 MHz, DDR:400.000 MH
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: rootfstype=squashfs,yaffs,jffs2 noinitrd console=ttyS0,1152
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 27664k/32768k available (1807k kernel code, 5104k reserved, 327k data, 2
192k init, 0k highmem)
SLUB: Genslabs=6, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Calibrating delay loop... 266.24 BogoMIPS (lpj=1331200)
Mount-cache hash table entries: 512
net_namespace: 480 bytes
NET: Registered protocol family 16
MIPS: machine is Linksys WRT160NL
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
yaffs May 29 2009 22:28:27 Installing.
msgmni has been set to 54
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
console handover: boot [early0] -> real [ttyS0]
Atheros AR71xx SPI Controller driver version 0.2.2
m25p80 spi0.0: en25p64 (8192 Kbytes)
Searching for RedBoot partition table in spi0.0 at offset 0x7e0000
Searching for RedBoot partition table in spi0.0 at offset 0x7f0000
No RedBoot partition table detected in spi0.0
Creating 6 MTD partitions on "spi0.0":
0x00000000-0x00040000 : "u-boot"
0x00040000-0x00120000 : "kernel"
0x00120000-0x007e0000 : "filesytem"
0x007e0000-0x007f0000 : "nvram"
0x007f0000-0x00800000 : "ART"
0x00040000-0x007e0000 : "firmware"
Atheros AR71xx hardware watchdog driver version 0.1.0
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <>
All bugs added by David S. Miller <>
Freeing unused kernel memory: 2192k freed
Algorithmics/MIPS FPU Emulator v1.5
- preinit -
Press CTRL-C for failsafe

Please press Enter to activate this console. cfg80211: Using static regulatory d
omain info
cfg80211: Regulatory domain: US
        (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
        (2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
        (5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
        (5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
        (5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
        (5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
        (5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)
cfg80211: Calling CRDA for country: US
phy0: Atheros AR9100 MAC/BB Rev:0, AR2122 RF Rev:a2, mem=0xb80c0000, irq=2
cfg80211: Calling CRDA for country: US
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
nf_conntrack version 0.5.0 (512 buckets, 2048 max)
wlan: trunk
ath_hal: module license 'Proprietary' taints kernel.
ath_hal: 2009-05-08 (AR5210, AR5211, AR5212, AR5416, RF5111, RF5112, RF2413, RF5
413, RF2133, RF2425, REGOPS_FUNC, XR)
ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (trunk)
ath_rate_minstrel: look around rate set to 10%
ath_rate_minstrel: EWMA rolloff level set to 75%
ath_rate_minstrel: max segment size in the mrr set to 6000 us
wlan: mac acl policy registered
ath_pci: trunk
gpio-buttons driver version 0.1.1

BusyBox v1.13.4 (2009-05-28 11:22:18 PDT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r16200) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!

Re: Wrt160nl?

No GPIO access as yet:

root@OpenWrt:/# ls -la /dev/gpio*
ls: /dev/gpio*: No such file or directory

54 (edited by vincentfox 2009-05-30 07:44:09)

Re: Wrt160nl?

juhosg wrote:

The RTL8306SD switch is not supported yet. Additionally, i don't know how it is connected to the two ethernet MACs.

I am not sure what you mean here?

Any way I can find out this information?

The ifconfig output tells me design has discrete LAN & WAN ports not shared VLAN trick.

/ # ifconfig -a
ath0      Link encap:Ethernet  HWaddr 00:23:69:98:2E:DD
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:52 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br0       Link encap:Ethernet  HWaddr 00:23:69:98:2E:DB
          inet addr:  Bcast:  Mask:
          RX packets:43 errors:0 dropped:0 overruns:0 frame:0
          TX packets:39 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:5269 (5.1 KiB)  TX bytes:11462 (11.1 KiB)

eth0      Link encap:Ethernet  HWaddr 00:23:69:98:2E:DB
          RX packets:47 errors:0 dropped:0 overruns:0 frame:0
          TX packets:39 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:6111 (5.9 KiB)  TX bytes:11462 (11.1 KiB)

eth1      Link encap:Ethernet  HWaddr 00:23:69:98:2E:DC
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:  Mask:
          UP LOOPBACK RUNNING MULTICAST  MTU:16436  Metric:1
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:236 (236.0 B)  TX bytes:236 (236.0 B)

wifi0     Link encap:Ethernet  HWaddr 00:23:69:98:2E:DD
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:2 Memory:b80c0000-b80c4000

/ #

Skimming through the RealTek datasheet here: … 6SD-GR.pdf

It's a chip with 6 MAC and 5 ports.  It says it "...supports a dual MII/RMII interface for external devices
to connect to the 6th MAC, 5th tranceiver, and 5th PHY."

Full markings on switch chip:
G602B Taiwan

Trivial info: In the G602B marking, the G indicates "green" (RoHS compliant I think) and the B indicates 2nd revision.

Re: Wrt160nl?

juhosg wrote:

There are no suitable firmware images yet, I would need a full flash dump for analisys.

The only way I know how to get a flash dump is via JTAG. Is there another way? Some sort of software I could add into the original linksys image on compile? If not, I'll try to find a pin-out and find some way to get wires on those little points.

juhosg wrote:

Seems like that this is not an initramfs image.

Could have sworn I set it to make me an image in menuconfig. When I get my console cable, i'll try again.

Re: Wrt160nl?

Hmmm.... JTAG.  It's already got the location for a JTAG header.  I have soldered the larger variety and didn't find it too difficult.  However I am not even sure what "size" you call the size used these days?  It's a micro-size not the standard pin header size.  If there's a designation for it maybe I can find it at Fry's and solder a header on and start down that path slowly.

57 (edited by vincentfox 2009-06-02 06:23:21)

Re: Wrt160nl?

I am not understanding what blocks my ability to work with GPIO.

I have included obvious modules in the build:

root@OpenWrt:/dev# opkg list_installed|grep gpio
gpioctl - 1.0-1 -
kmod-gpio-dev - -
kmod-input-gpio-buttons - -
kmod-leds-gpio - -
root@OpenWrt:/dev# lsmod|grep gpio
gpio_buttons            2048  0
leds_gpio               1344  0
gpio_dev                1872  0
input_polldev           1552  1 gpio_buttons
input_core             18384  2 gpio_buttons,input_polldev

And yet I get:

root@OpenWrt:/dev# gpioctl set 0
Error whilst opening /dev/gpio

Creating manually with mknod /dev/gpio c 254 0 doesn't help.

58 (edited by vincentfox 2009-06-02 07:05:14)

Re: Wrt160nl?

It looks like there is already source for the RTL8306 switch chip.
It is linked as eth8186.c attachment off a ticket at DD-WRT project.

59 (edited by vincentfox 2009-06-06 01:33:19)

Re: Wrt160nl?

Ah, found something else interesting.

Hiding inside WAN port and LAN#4 are what look like serial pins.

First time I recall seeing this mentioned was some thread on WRT610N.
Same setup as WRT610N but now present in 2 connectors.

They are clearly labelled 3.3V, TX, RX, GND must be a more factory
approved way to access the serial ports for debugging.  These are long
copper contacts on the PCB opposite the RJ-45 pins so they would require
some kind of special RJ-45 plug.

60 (edited by vincentfox 2009-06-06 06:08:49)

Re: Wrt160nl?

BOTH of the connections in WAN & LAN#4 appear to go to ttyS0.

I found some pico-size jumpers I could clamp onto the contacts
and no matter which set I used I had the console even from UBOOT
level so I believe these and J3 are wired together.

I can see how an RJ-45 with some springy contacts on the other
side could be used for quick console access.  I assume these were
put in for enterprise-level usage or perhaps developers not
Joe EndUser.  I would not even know how such a connector
would be designated in order to go searching for it.

Re: Wrt160nl?

Some additional data I thought to gather off UBOOT:

ar7100> bdinfo
boot_params = 0x81F67FB0
memstart    = 0x80000000
memsize     = 0x02000000
flashstart  = 0xBF000000
flashsize   = 0x00800000
flashoffset = 0x0003B50C
ethaddr     = 00:AA:BB:CC:DD:EE
ip_addr     =
baudrate    = 115200 bps
ar7100> iminfo

## Checking Image at bf04003c ...
   Image Name:   Linux Kernel Image
   Created:      2009-04-06   5:54:03 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    896978 Bytes = 876 kB
   Load Address: 80002000
   Entry Point:  801db000
   Verifying Checksum ... OK

Re: Wrt160nl?

Any luck integrating eth8186.c? I got console working on mine, so I can help out. Just let me know where to focus.

Re: Wrt160nl?


Sick child here now so not able to find long stretches of time for switch coding.  Have at it.

Re: Wrt160nl?

Vincent, I hope your kid gets well soon! I'll hack some things together and let you know how it works out.

Re: Wrt160nl?

Has there been any more progress?

Re: Wrt160nl?

At this point, I'm putting a 3rd party firmware for wrt160nv2 on my Christmas wish list.  smile

67 (edited by RoundSparrow 2009-06-25 00:19:52)

Re: Wrt160nl?

Cool to see Cisco introduce an Atheros in USA based on AP81!  Here's hoping the switch gets working soon.

Re: Wrt160nl?

I was trying a little while back to find a jtag pin out, both by research and trial and error. No Luck. Then I got busy and lost interest. The developer needs a full flash dump of the device and a driver for the switch's chipset to move forward. If someone knows where I can get a jtag pin out, so I can send a flash dump in, let me know. I am back on board until work picks up again.

Re: Wrt160nl?

Mine arrived 30 minutes ago, but it doesn't seem to power up.
What's the power adapter brand that came with yours?
This ones case seems to have been opened before..
Any help is appreciated!! Can't wait to fiddle with it!!

Re: Wrt160nl?

Bestec 12volt 1.5amp

Re: Wrt160nl?

So fast!! Thanks!
Mine is Leader Electronics mu18-d120150-c5
12v 1.5a too..
Used to get linksys rebranded ones with my other routers; strange.
I'll give it another go at night again, if it doesn't power up i'll have to rma it.. sad
Thanks again for the info:)

Re: Wrt160nl?

Heh, I just woke up and checked my e-mail. :-) Didn't even notice the timing. Let me know how it goes.

Re: Wrt160nl?

Hi all!

I got my Wrt160NL last weekend and I'm thinking about hacking it as well. Unfortunately i never tried to hack an embedded device before.

From the comments in this thread I would need a proper JTAG cable (e.g. a shortened Nokia CA-42, quite cheap @ Ebay) and connect it to the router's PCB right? In addition to this i would need some proper terminal software to get a console?

In theory it would be enough to just build OpenWrt with the correct settings and deploy it via the web console - the JTAG cable is more for recovering situations right?

I'm not sure about how easy one can destroy certain things on this router, coding shouldn't be a problem but my electronic skills got a bit rusty - do you have any advice whether it's a good idea for a newbie to try it? Or should I keep my hands off this?

thanks in advance and best regards,

74 (edited by vincentfox 2009-07-01 20:44:40)

Re: Wrt160nl?

Hooking up a serial cable is usually easy and very handy.  With serial console you have the window into what happens when it boots and nearly always gives you a root prompt with no password from which you can explore the factory firmware before you do anything else.  I find it so useful to have a serial console that I fit one to nearly every router that passed through my hands.

JTAG is a different thing.

So far Kamikaze runs but without switch driver so this is a real speed-bump.

Re: Wrt160nl?

I totally overlooked that there is a serial port on the board - so you're using a plain old serial connection as well right? I think in this case I'll have a try with starting Kamikaze on it smile

My workstation still has a RS-232 port so i think it shouldn't be a problem using this?