The Linksys E3000 is based on the same hardware as the Linksys WRT610N v2.0 with changes to the CFE and a larger NVRAM block. The E3000 is based on the Broadcom 4718 cpu running at 480MHz. It has 8 MB flash (MX29LV640EBTI) and 64 MB SDRAM (H5PS5162FFR).
The switch is a BCM53115 chip.
| Version/Model || S/N || OpenWrt Version Supported || Model Specific Notes
| E3000 v1.0 || CVQ01 || 14.07 with limited wireless performance || Proprietary broadcom-wl driver can be tested for better performance
| CPU || Ram || Flash || Network || Wireless || USB || Serial || JTag
| BCM4718@480MHz || 64MiB || 8MiB || 1+4 x 1000 M || 2.4 GHz (SoC) + 5 GHz (BCM4322) || Yes (2.0) || Yes || No/Yes*
Install using the stock web interface
Tot mem: 65536 KBytes
CFE mem: 0x80700000 - 0x8079DAC0 (645824)
Data: 0x80732A20 - 0x80737080 (18016)
BSS: 0x80737080 - 0x80737AC0 (2624)
Heap: 0x80737AC0 - 0x8079BAC0 (409600)
Stack: 0x8079BAC0 - 0x8079DAC0 (8192)
Text: 0x80700000 - 0x80732A1C (207388)
OEM installation using the TFTP method
If interested in using the proprietary broadcom-wl driver, read up on the Broadcom BCM47xx page in the OpenWRT wiki here: Broadcom BCM47xx
Switch Ports (for VLANs)
Switch ports 1-4 are for the LAN, and 0 is for the Internet (WAN) port. Note that the switch ports are the opposite of what is labeled on the device; thus switch port 1 is labeled LAN4, etc. Switch port 8 is the internal connection to the CPU. Not sure what happened to 5-7 but it's assumed they're just not wired out to anything.
| Port || Switch port
| CPU (Internal) || 8
| Internet (WAN) || 0
| LAN 1 || 4
| LAN 2 || 3
| LAN 3 || 2
| LAN 4 || 1
| Architecture: MIPS
| Vendor: Broadcom
| Bootloader: CFE
| System-On-Chip: Broadcom BCM4718
| CPU Speed: 480 Mhz
| Flash-Chip: MACRONIX MX29LV640EBTI-70G - 64 Megabit (8M x 8-bit / 4M x 16-bit)
| Flash size: 8 MiB
| RAM: 64 MiB
| Wireless: 1x Broadcom BCM4718 SoC 802.11b/g/n, 1x Broadcom BCM4322 802.11a/n (integrated)
| Ethernet: Broadcom BCM53115 Gigabit Switch
| USB: 1x USB 2.0 Host
| Serial: Yes
| JTAG: Yes, but SMD pull up resistors are missing
Opening the case
Note: This will void your warranty!
The case is held together with 4 T-10 security star-drive screws (security torx). The top is also attached with plastic claws and it is easiest to start working these from one of the front corners and working the front apart, then work toward the back.
There are 5 solder pads near the rim on the backside of the PCB, see image from WRT610n:
There is also a serial connection on the PCB inside of the WAN port.
Serial port settings are 115000@8N1.
The CFE installed on the E3000 locates itself at 0x80700000. This can cause conflicts with the standard VMLINUX_LOAD_ADDRESS for BCM47XX devices, 0x80001000 when the image size is > 7335936 bytes. It is not known at this time how much this will hamper development efforts. It is possible to modify the VMLINUX_LOAD_ADDRESS in arch/mips/bcm47xx/Platform to allow larger ramdisk enabled images to be tested. A setting of 0x81001000 has been successful with tftp loading of large ramdisk based firmware image.
Both wireless adapters work on trunk, however you will need to use broadcom-wl to achieve full speed, and make use of both adapters, as on the open source driver only one adapter works at 24mbit.