Differences

This shows you the differences between two versions of the page.

toh:linksys:wag160n [2012/11/08 11:52]
virus
toh:linksys:wag160n [2013/07/16 01:48] (current)
excogitation wrong credit
Line 1: Line 1:
====== Linksys WAG160N ====== ====== Linksys WAG160N ======
 +**<color red>The WAG160N is currently not supported!.</color>**
- The Linksys [[http://www.linksysbycisco.com/US/en/products/WRT160N|WAG160N]] is an ADSL gateway with wireless acccess point integrated.+ The Linksys [[http://support.linksys.com/en-eu/support/gateways/WAG160N|WAG160N]] is an ADSL gateway with wireless acccess point integrated.
- The source code tarball is available from the [[http://www.linksysbycisco.com/gpl|Linksys GPL Code Center]]:+ The source code tarball is available from the [[http://support.linksys.com/en-eu/gplcodecenter?gplsku=#WAG160N|Linksys GPL Code Center]]:\\ 
 + [[http://downloads.linksysbycisco.com/downloads/wag160n_v1.00.15_eu_annexA.tar,0.gz|WAG160N 1.00.15 Annex A]]\\ 
 + [[http://downloads.linksysbycisco.com/downloads/wag160n_v1.00.15_eu_annexB.tar,0.gz|WAG160N 1.00.15 Annex B]]
- [[http://downloads.linksysbycisco.com/downloads/wag160n_v1.00.15_eu_annexA.tar,0.gz|WAG160N 1.00.15 Annex A]]+===== Supported Versions ===== 
 +^ Version/Model ^ wifi ^ Supported ^ 
 +| [[#v1.hardware|WAG160Nv1]] | AR5416 | [[https://forum.openwrt.org/viewtopic.php?id=19601|WIP]] | 
 +| [[#v2.hardware|WAG160Nv2]] | AR9223 | [[https://forum.openwrt.org/viewtopic.php?id=27801|WIP]] |
- [[http://downloads.linksysbycisco.com/downloads/wag160n_v1.00.15_eu_annexB.tar,0.gz|WAG160N 1.00.15 Annex B]]+===== Hardware ===== 
 +==== Info v1 ====
-====== Supported Versions ====== +| **[[wp>Instruction set|Architecture]]:**    | [[wp>MIPS architecture|MIPS]] || 
-^ Version/Model ^ S/N ^ OpenWrt Version Supported ^ Model Specific Notes ^ +| **Vendor:**          | [[wp>Broadcom]] || 
-| [[#v1.hardware|WAG160Nv1]] | N/A | 10.03 |  | +| **[[doc:techref:Bootloader]]:**    | [[doc:techref:bootloader:CFE|CFE]] || 
-| [[#v2.hardware|WAG160Nv2]] | | | |+| **Board Id:** | 96358GW | 
 +| **[[doc:hardware:soc|System-On-Chip]]:**  | Broadcom BCM6358SKFBG | 
 +| **[[doc:hardware:cpu|CPU]]/Speed**        | BMIPS4350 V1.0 / 300 Mhz  [[doc:hardware:soc:soc.broadcom.bcm63xx:smp|BMIPS Dual Core]] || 
 +| **Flash-Chip:** | MX29LV320AB |  
 +| **Flash size:** | 4MB |  
 +| **RAM-Chip:** | EtronTech EM6AA160TS-5G / DDR-400 | 
 +| **RAM size:** | 32MB | 
 +| **Wireless:** | Atheros AR5416 |  
 +| **Ethernet:**        | Broadcom [[http://wiki.openwrt.org/_media/toh/bcm5325_pinout.png|BCM5325]] w/ vlan support [[doc:uci:network#swconfig]] |
 +| **USB:** | No |  
 +| **Serial:** | [[#Serial|Yes]] |  
 +| **JTAG:** | ? |
-===== v1 Hardware ===== +==== v2 Hardware ==== 
-==== Info ====+The PCB is a bit redesigned. Most noticeable points are the presence of an actual power button (top left in photos), and that J10 is labeled (anyway, I've not been able to get anything from there neither with 115200 8N1 nor with other speeds). There is also a plastic sheet covering the bottom of the PCB, maybe to help heat dissipation.
-| **Architecture:** MIPS |  +Not so noticeable is the fact that the LED corresponding to port1 is doubled, being similar to the power led. Also the wireless seems different, as chip is labelled as AR9223-AC1A. 
-| **Vendor:** Broadcom|  + 
-| **Bootloader:** CFE |  +Tftp upload of firmware seems not straightforward. According to information found on the linksys forums, requires the "password enabled" tftp utility from linksys. 
-| **System-On-Chip:** Broadcom BCM6358SKFBG | + 
-| **CPU Speed:** 300Mhz |  +See [[.:wag160nv2|this page]] for details and pictures of the WAG160Nv2.
-| **Flash-Chip:** MX29LV320AB |  +
-| **Flash size:** 4MB |  +
-| **RAM:**  EtronTech EM6AA160TS-5G 32MB SDRAM | +
-| **Wireless:** Atheros AR5416 |  +
-| **Ethernet:** Broadcom BCM5325EKQMG (4 port switch)| +
-| **USB:** No |  +
-| **Serial:** [[#Serial|Yes]] |  +
-| **JTAG:** ? |+
==== LEDs & Buttons ==== ==== LEDs & Buttons ====
Line 43: Line 53:
^ Button ^ GPIO ^ ^ Button ^ GPIO ^
| WPS | 34 | | WPS | 34 |
 +==== Opening the case ====
-==== Photos ====+Remove the four screws on the base of the case. The case is then secured by one small and one large gray clip (from rear to front) on each side of the case. At the front of the case, there are two large black clips.
-=== Top of PCB ===+Prise the top of the router from the bottom using a small screwdriver - I found this easier by starting at the front.  It's not a nice process!
-{{ :toh:linksys:WAG160N_top.jpg?640 }}+Even if all of the gray clips are broken or removed, the case is perfectly adequately sealed using only the front black clips and the four screws. This also makes the case far easier to open. I found this easiest to do by working around the case from the back with a medium-sized screwdriver, being careful not to be upsetting the antennas and wires which are located around the edges of the case. Once the top has been removed, using pliers, the broken or remaining gray clips can be tidied up by twisting off what remains of them.
-=== Bottom of PCB (JTAG encircled) ===+==== Photos ====
-{{ :toh:linksys:WAG160N_bottom.jpg?640 }}+^ Top of PCB ^ Bottom of PCB (JTAG encircled) ^ 
 +| {{ :toh:linksys:WAG160N_top.jpg?400x350 }} | {{ :toh:linksys:WAG160N_bottom.jpg?400x350 }} |
-=== Serial Port (J10) ===+==== Serial ====
-{{ :toh:linksys:WAG160N_J10.jpg }}+Serial console can be attached to J10 which is located at the bottom right of the board (when looking at the unit from the front).  On my unit; the J10 label was obscured by a sticky pad. 
 +^ Serial Port (J10) ^ 
 +| {{ :toh:linksys:WAG160N_J10.jpg?400x350 }}
 +There is no connector soldered to the board. If you want to add one, it needs to be of pitch 2.5mm.
-=== JTAG (J1) ===+<code> 
 +Legend (in arrow direction)
 +1  GND 
 +2  Tx 
 +3  VCC (3,3V) 
 +4  RX 
 +</code> 
 +The settings for the serial console are "115200 bauds, 8 bits, no parity, 1 stop bit (115200 8N1)", with hardware and software flow control both disabled.
-{{ :toh:linksys:WAG160N_J1.jpg }} 
-===== v2 Hardware ===== +**NOTE:** You cannot plug directly those pins to your pc serial port. You need a RS232-TTL level adapter (or just set the jumper on your USB->Serial-converter to 3.3V if it provides that option). See [[oldwiki:openwrtdocs:customizing:hardware:serial_console]]
-The PCB is a bit redesigned. Most noticeable points are the presence of an actual power button (top left in photos), and that J10 is labeled (anyway, I've not been able to get anything from there neither with 115200 8N1 nor with other speeds). There is also a plastic sheet covering the bottom of the PCB, maybe to help heat dissipation.+
-Not so noticeable is the fact that the LED corresponding to port1 is doubled, being similar to the power led. Also the wireless seems different, as chip is labelled as AR9223-AC1A.+==== Flashing - only v1! ==== 
 +Read on if you're sure you have the **<color red>wag160n v1</color>** _and_ serial ports already soldered.
-Tftp upload of firmware seems not straightforward. According to information found on the linksys forums, requires the &quot;password enabled&quot; tftp utility from linksys.+Setup a tftpd server e.g. 
 +&lt;code&gt;sudo apt-get install tftpd-hpa tftp</code> 
 +make sure it works by putting some file in /var/lib/tftpboot e.g. 
 +<code>sudo sh -c 'echo "hello" > /var/lib/tftpboot/test'</code>
-See [[.:wag160nv2|this page]] for details and pictures of the WAG160Nv2.+<code>tftp localhost 
 +get test</code> 
 +if you get sth. like 
 +<code>Received 7 bytes in 0.0 seconds</code> 
 +*thumbsup*
 +Copy your downloaded/built openwrt image to to /var/lib/tftpboot.
 +You can [[http://www64.zippyshare.com/d/76956273/850385/OpenWrt%20attitude%20adjustment.7z|get it here - Attitude Adjustment, r34073]] by Virus
 +or try the [[https://forum.openwrt.org/viewtopic.php?id=19601| related wag160n_v1 forum thread]].
-===== Opening the case =====+<code>sudo cp openwrt-WAG160Nv1-squashfs-cfe-attitude-adjustment-beta-2.bin /var/lib/tftpboot/bcm963xx_fs_kernel</code> 
 +File name needs to be bcm963xx_fs_kernel because that's what the wag160n CFE expects.
-Remove the four screws on the base of the case. The case is then secured by one small and one large gray clip (from rear to front) on each side of the case. At the front of the case, there are two large black clips.+Connect to your router with an ethernet cable. 
 +Assign 192.168.1.100 to your box - because that's what the wag160n will try pull the boot image from 
 +(192.168.1.100 as gateway).
-Prise the top of the router from the bottom using a small screwdriver - I found this easier by starting at the front. It's not a nice process!+Next up you need to connect to the wag160n through telnet.
-Even if all of the gray clips are broken or removed, the case is perfectly adequately sealed using only the front black clips and the four screws. This also makes the case far easier to open. I found this easiest to do by working around the case from the back with a medium-sized screwdriver, being careful not to be upsetting the antennas and wires which are located around the edges of the case. Once the top has been removed, using pliers, the broken or remaining gray clips can be tidied up by twisting off what remains of them.+e.g. setup minicom 
 +<code>sudo minicom -s  
 +</code> 
 +-> serial port setup 
 +A -> /dev/ttyUSB0  (or dev/ttyACM0 or whatever) 
 +E -> E (115200) -> Q (8N1) 
 +-> safe setup as dfl (or as <configuration_name>)
-===== Serial =====+and connect with 
 +<code>sudo minicom</code> 
 +or if you saved a named config 
 +<code>sudo minicom <configuration_name></code>
-Serial console can be attached to J10 which is located at the bottom right of the board (when looking at the unit from the front).  On my unit; the J10 label was obscured by a sticky pad.+you should now see your router booting 
 +<code>*** Press any key to stop auto run (1 seconds) *** </code>; 
 +press a key.
-There is no connector soldered to the board. If you want to add one, it needs to be of pitch 2.5mm.+<code>CFE> </code> 
 +*nice* 
 + 
 +**<color red>make sure your router is a wag160n v1</color>** 
 + 
 +press f
<code> <code>
-Legend (in arrow direction)+Loading 192.168.1.100:bcm963xx_fs_kernel ...                                     
-1  GND +Finished loading 2752516 bytes 
-2  Tx + 
-3  VCC (3,3V) +Flashing root file system and kernel at 0xbfc10000: ............................ 
-4  RX+                                                                                 
 +.                                                                               
 +*** Image flash done *** !                                                       
 +Resetting board... 
</code> </code>
-**NOTE:** You cannot plug directly those pins to your pc serial port. You need a RS232-TTL level adapter. See [[oldwiki:openwrtdocs:customizing:hardware:serial_console]]+*done*
-==== Configuration ==== +==== JTAG ==== 
-The settings for the serial console are "115200 bauds, 8 bits, no parity, 1 stop bit (115200 8N1)", with hardware and software flow control both disabled.+^ JTAG Port (J1)
 +| {{ :toh:linksys:WAG160N_J1.jpg?400x350 }} |
-===== Interfaces =====+===== Bootlogs ===== 
 +==== OEM bootlog ==== 
 +<HTML> 
 +<p style="padding: 10px;border:1px solid grey;height:600px;font:10px/14px Georgia, Garamond, Serif;overflow:Auto;background-color:#FFFFFF"> 
 +<code>CFE version 1.0.37-5.4 for BCM96358 (32bit,SP,BE) 
 +Build Date: å››  1月 10 19:25:21 CST 2008 (root@9DavidZhang2) 
 +Copyright (C) 2000-2005 Broadcom Corporation.
-The default network configuration is: +Boot Address 0xbfc00000
-^ Interface Name ^ Description ^ Default configuration ^ +
-| br-lan | LAN & WiFi | 192.168.1.1/24 |  +
-| eth0 | ADSL | None | +
-| eth1 | LAN ports (1 to 4) | None |  +
-| radio0 | Wireless | Disabled |+
-===== Boot messages =====+Initializing Arena. 
 +Initializing Devices. 
 +Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB 
 +CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz 
 +Total memory: 33554432 bytes (32MB)
-<code> +Total memory used by CFE:  0x80401000 - 0x80528800 (1210368) 
-Linux version 2.6.32.9 (virus@Virion) (gcc version 4.3.3 (GCC) ) #18 Mon Mar 15 16:16:55 CET 2010+Initialized Data:          0x8041E550 - 0x8041FF60 (6672) 
 +BSS Area:                  0x8041FF60 - 0x80426800 (26784) 
 +Local Heap:                0x80426800 - 0x80526800 (1048576) 
 +Stack Area:                0x80526800 - 0x80528800 (8192) 
 +Text (code) segment:      0x80401000 - 0x8041E544 (120132) 
 +Boot area (physical):      0x00529000 - 0x00569000 
 +Relocation Factor:        I:00000000 - D:00000000 
 + 
 +Board IP address                  : 192.168.1.1   
 +Host IP address                  : 192.168.1.100   
 +Gateway IP address                :   
 +Run from flash/host (f/h)        : f   
 +Default host run file name        : vmlinux   
 +Default host flash file name      : bcm963xx_fs_kernel   
 +Boot delay (0-9 seconds)          : 1   
 +Board Id Name                    : 96358GW   
 +Psi size in KB                    : 24 
 +Number of MAC Addresses (1-32)    : 10   
 +Base MAC Address                  : 00:1d:7e:b3:9b:52   
 +Ethernet PHY Type                : Internal 
 +Memory size in MB                : 32 
 +CMT Thread Number                : 0 
 + 
 +*** Press any key to stop auto run (1 seconds) *** 
 +</code> 
 +</p> 
 +</HTML> 
 + 
 +==== OpenWrt bootlog ==== 
 +<HTML> 
 +<p style="padding: 10px;border:1px solid grey;height:600px;font:10px/14px Georgia, Garamond, Serif;overflow:Auto;background-color:#FFFFFF"> 
 +<code>Linux version 2.6.32.9 (virus@Virion) (gcc version 4.3.3 (GCC) ) #18 Mon Mar 15 16:16:55 CET 2010
Detected Broadcom 0x6358 CPU revision a1 Detected Broadcom 0x6358 CPU revision a1
CPU frequency is 300 MHz CPU frequency is 300 MHz
Line 264: Line 355:
br-lan: port 2(wlan0) entering forwarding state br-lan: port 2(wlan0) entering forwarding state
</code> </code>
 +</p>
 +</HTML>
 +
===== Hints ===== ===== Hints =====
Line 273: Line 367:
Normally the ''dd'' command would be used for copying such data; however the Linksys provided OS does not include this command.  Using the ''cp'' command would result in just the inode information being copied, so instead use the ''cat'' command - placing the result within the /tmp directory which is a writable part of the filesystem, Normally the ''dd'' command would be used for copying such data; however the Linksys provided OS does not include this command.  Using the ''cp'' command would result in just the inode information being copied, so instead use the ''cat'' command - placing the result within the /tmp directory which is a writable part of the filesystem,
-''cat /dev/mtdblock4 > /tmp/ath_data''+<code>cat /dev/mtdblock4 > /tmp/ath_data</code>
You then need to get this image off the router.  As there is no ftp client installed; use the in-built web server.  As you can't write to the directory currently used by the http server, let's just hijack the daemon for a short while, You then need to get this image off the router.  As there is no ftp client installed; use the in-built web server.  As you can't write to the directory currently used by the http server, let's just hijack the daemon for a short while,
-''/usr/sbin/rc httpd stop +<code>/usr/sbin/rc httpd stop 
-/usr/sbin/mini_httpd -d /tmp''+/usr/sbin/mini_httpd -d /tmp</code>
You should now be able to download mtdblock4 from another system, using something smilar to, You should now be able to download mtdblock4 from another system, using something smilar to,
-''wget --user=admin --password=adminpass -O ath_data http://192.168.1.1/ath_data''+<code>wget --user=admin --password=adminpass -O ath_data http://192.168.1.1/ath_data</code>
Once you've downloaded mtdb4 kill the mini-httpd and restart the web server using its normal configuration, Once you've downloaded mtdb4 kill the mini-httpd and restart the web server using its normal configuration,
-''killall mini_httpd +<code>killall mini_httpd 
-/usr/sbin/rc httpd start''+/usr/sbin/rc httpd start</code>
===== Tags ===== ===== Tags =====
{{tag>bcm63xx bcm6358}} {{tag>bcm63xx bcm6358}}

Back to top

toh/linksys/wag160n.1352371941.txt.bz2 · Last modified: 2012/11/08 11:52 by virus