802.11 b/g/n MIMO access point (2T3R), 10/100/1000M eth., 802.3af PoE. Manufacturer link.

On the other side of the PCB there are 4 test points:

• TP1 GND
• TP2 ? (probably Vcc)
• TP3,4 serial console

The serial interface is 3.3V TTL levels (need USB cable and/or level converter to connect to a PC). Settings are 57k6 8N1 no flow control.

For TFTP from u-Boot the AP has to bo connected to a 10/100M switch (does not work neither on a 10/100/1000M switch nor on a 10M hub).

For FW recovery use option 2 (Load system code then write to Flash via TFTP.) to download the original FW image (currently U300ARAEN_2.4.15.bin, unzip first ).

 U-Boot 1.1.3 (Feb 22 2008 - 16:48:17)
 
 Board: RT2880 DRAM:  16 MB
 
  twe0 set to <NULL>
 
  toe0 set to <NULL>
 flash_protect ON: from 0xBF000000 to 0xBF02479B
 protect on 0
 protect on 1
 protect on 2
 flash_protect ON: from 0xBF030000 to 0xBF03FFFF
 protect on 3
 ============================================ 
 ASIC -VerB/C (MAC to 100PHY Mode)
 DRAM COMPONENT=64Mbits 
 DRAM BUS=32BIT 
 Total memory = 16Mbytes
 Date:Feb 22 2008  Time:16:48:17
 ============================================ 
 
  D-CACHE set to 4 way 
  I-CACHE set to 4 way 
 
  ##### The CPU freq = 266 MHZ #### 
 
  SDRAM bus set to 32 bit 
  SDRAM size =16 Mbytes
 
 Please choose the operation: 
    1: Load system code to SDRAM via TFTP. 
    2: Load system code then write to Flash via TFTP. 
    3: Boot system code via Flash (default).
    4: Entr boot command line interface.
    5: Load ucos code to SDRAM via TFTP. 
 
 
 3: System Boot system code via Flash.
 ## Booting image at bf050000 ...
    Image Name:   Linux Kernel Image
    Created:      2008-10-29  18:46:32 UTC
 System Control Status = 0x02910084 
    Image Type:   MIPS Linux Kernel Image (lzma compressed)
    Data Size:    2447621 Bytes =  2.3 MB
    Load Address: 88000000
    Entry Point:  88190040
    Verifying Checksum ... OK
    Uncompressing Kernel Image ... OK
 No initrd
 ## Transferring control to Linux (at address 88190040) ...
 ## Giving linux memsize in MB, 16
 
 
 Starting kernel ...
 
 
 
 THIS IS ASIC
 ramsize = 16 MBytes
 rambase not set, set to default (0x08000000)
 MEMORY DESCRIPTOR dump:
 [0,883d0b80]: base<08000000> size<01000000> type<Free RAM memory>
 
  The CPU feqenuce set to 266 MHz
 CPU revision is: 0001906c
 icache: sets:256, ways:4, linesz:16 ,total:16384, waybit:12, flags:0x0
 dcache: sets:256, ways:4, linesz:16 ,total:16384, waybit:12, flags:0x0
 i waysize = 4096, d waysize = 4096, i sets= 256, d sets=256
 Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
 Primary data cache 16kB, 4-way, linesize 16 bytes.
 [setup_scache]:1032
 Linux version 2.4.30 (root@linux-r3ht) (gcc version 3.3.6) #1 Thu Oct 30 02:42:35 CST 2008
 Determined physical RAM map:
  memory: 01000000 @ 08000000 (usable)
 Initial ramdisk at: 0x881c2000 (1855488 bytes)
 On node 0 totalpages: 36864
 zone(0): 36864 pages.
 zone(1): 0 pages.
 zone(2): 0 pages.
 Kernel command line: console=ttyS1,57600n8 root=/dev/ram0
 cause = e080804c, status = 1000ff00
 calculating r4koff... 0028b0aa(2666666)
 CPU frequency 266.67 MHz
 Using 133.333 MHz high precision timer.
 Calibrating delay loop... 266.24 BogoMIPS
 Memory: 10872k/16384k available (1585k kernel code, 5512k reserved, 1912k data, 92k init, 0k highmem)
 Dentry cache hash table entries: 32768 (order: 6, 262144 bytes)
 Inode cache hash table entries: 16384 (order: 5, 131072 bytes)
 Mount cache hash table entries: 512 (order: 0, 4096 bytes)
 Buffer cache hash table entries: 8192 (order: 3, 32768 bytes)
 Page-cache hash table entries: 65536 (order: 6, 262144 bytes)
 Checking for 'wait' instruction...  unavailable.
 POSIX conformance testing by UNIFIX
 pci.c pcibios_init():840
 BAR0 at slot 0 = 8
 pci.c pcibios_fixup_resources():640
 bus = 0, dev = 0, fun = 0
 dev= 0x88564c00
 Linux NET4.0 for Linux 2.4
 Based upon Swansea University Computer Society NET3.039
 Initializing RT netlink socket
 Starting kswapd
 devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
 devfs: boot_options: 0x1
 squashfs: version 3.1 (2006/08/19) Phillip Lougher
 pty: 256 Unix98 ptys configured
 Ralink RT2880 gpio driver start init
 SetGPIOType: id [12] type[0]
 SetGPIOType: id [11] type[0]
 SetGPIOType: id [13] type[1]
 SetGPIOType: id [0] type[1]
 Ralink RT2880 gpio driver initialized
 spidrv_major = 217
 Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
 ttyS00 at 0x300500 (irq = 9) is a 16550A
 ttyS01 at 0x300c00 (irq = 8) is a 16550A
 HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
 N_HDLC line discipline registered.
 RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
 GDMA1_MAC_ADRH -- : 0x00000000
 GDMA1_MAC_ADRL -- : 0x00000000
 Ralink APSoC Ethernet Driver Initilization. v1.60  256 rx/tx descriptors allocated, mtu = 1600!
 GDMA1_MAC_ADRH -- : 0x0000b848
 GDMA1_MAC_ADRL -- : 0x000c4328
 PROC INIT OK!
 rdm_major = 254
 FLASH_API: MAN_ID=C2 DEV_ID=22A8 SIZE=4MB
 physmap flash device: 400000 at bfc00000
  Amd/Fujitsu Extended Query Table v1.1 at 0x0040
 number of CFI chips: 1
 Region0: SectorSize=0x2000 SectorNum=8
 Region1: SectorSize=0x10000 SectorNum=63
 cfi_cmdset_0002: Using word write method.
 cfi_cmdset_0002: Disabling fast programming due to code brokenness.
 Using physmap partition definition
 Creating 4 MTD partitions on "RT2880 SOC Physically mapped flash":
 0x00000000-0x00030000 : "Bootloader"
 mtd: Giving out device 0 to Bootloader
 0x00030000-0x00040000 : "Config "
 mtd: Giving out device 1 to Config 
 0x00040000-0x00050000 : "Factory"
 mtd: Giving out device 2 to Factory
 0x00050000-0x00400000 : "Kernel"
 mtd: Giving out device 3 to Kernel
 NET4: Linux TCP/IP 1.0 for NET4.0
 IP Protocols: ICMP, UDP, TCP, IGMP
 IP: routing cache hash table of 1024 buckets, 8Kbytes
 TCP: Hash tables configured (established 16384 bind 32768)
 GRE over IPv4 tunneling driver
 Linux IP multicast router 0.06 plus PIM-SM
 NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
 NET4: Ethernet Bridge 008 for NET4.0
 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
 All bugs added by David S. Miller <davem@redhat.com>
 RAMDISK: Compressed image found at block 0
 Freeing initrd memory: 1812k freed
 VFS: Mounted root (squashfs filesystem) readonly.
 Mounted devfs on /dev
 Freeing prom memory: 0kb freed
 Freeing unused kernel memory: 92k freed
 console started
 trying to start /sbin/init
 Algorithmics/MIPS FPU Emulator v1.5
 
 init started: BusyBox v1.8.2 (2008-10-30 02:36:26 CST)
 
 starting pid 10, tty '': '/etc_ro/rcS'''
 mount: mounting devpts: called with bogus options
 none on /sys failed: No such device
 mount: mounting none on /proc/bus/usb failed: No such file or directory
 
 starting pid 16, tty '/dev/console': '/bin/sh'
 
 
 BusyBox v1.8.2 (2008-10-30 02:36:26 CST) built-in shell (ash)
 Enter 'help' for a list of built-in commands.
 
 # 
 
 Yes:
 
       ****** WeLoveLinux ****** 
 
  Welcome to ...
 kernel reg pid 14 success .
 
 httpd Reg gpio hook success .
 insmod rt2860v2_ap
 2860 version : 1.9.0.0 (Oct 30 2008)
 
 
 
 === pAd = c0507000, size = 484224 ===
 
 
 <-- RTMPAllocAdapterBlock, Status=0
 ralink_init make_wireless_config rt2860
 ifconfig ra0 0.0.0.0
 RX DESC a8c4d000  size = 2048
 <-- RTMPAllocTxRxRingMemory, Status=0
 1. Phy Mode = 9
 2. Phy Mode = 9
 3. Phy Mode = 9
 ...

 # cat /proc/version
 Linux version 2.4.30 (root@linux-r3ht) (gcc version 3.3.6) #1 Thu Oct 30 02:42:35 CST 2008

 # cat /proc/cpuinfo
 system type             : Palmchip Surfboard
 processor               : 0
 cpu model               : unknown V6.12
 BogoMIPS                : 266.24
 wait instruction        : no
 microsecond timers      : yes
 tlb_entries             : 16
 extra interrupt vector  : yes
 hardware watchpoint     : no
 VCED exceptions         : not available
 VCEI exceptions         : not available

# cat /proc/devices
Character devices:
  1 mem
  2 pty/m%d
  3 pty/s%d
  4 tts/%d
  5 cua/%d
 10 misc
 36 netlink
 90 mtd
128 ptm
136 pts/%d
162 raw
200 flash0
217 spiS0
252 gpio
254 rdm0

Block devices:
  1 ramdisk
 31 mtdblock

 # cat /proc/meminfo
         total:    used:    free:  shared: buffers:  cached:
 Mem:  13082624 10506240  2576384        0   897024  3710976
 Swap:        0        0        0
 MemTotal:        12776 kB
 MemFree:          2516 kB
 MemShared:           0 kB
 Buffers:           876 kB
 Cached:           3624 kB
 SwapCached:          0 kB
 Active:           2464 kB
 Inactive:         2044 kB
 HighTotal:           0 kB
 HighFree:            0 kB
 LowTotal:        12776 kB
 LowFree:          2516 kB
 SwapTotal:           0 kB
 SwapFree:            0 kB

 # cat /proc/mtd
 dev:    size   erasesize  name
 mtd0: 00030000 00010000 "Bootloader"
 mtd1: 00010000 00010000 "Config "
 mtd2: 00010000 00010000 "Factory"
 mtd3: 003b0000 00010000 "Kernel"

 # cat /proc/interrupts
            CPU0
   3:       1269       Surfboard  eth2
   4:      12078       Surfboard  ra0
   6:      53928       Surfboard  timer
   8:        313       Surfboard  serial
 
 ERR:          0

# ps
   PID  Uid        VSZ Stat Command
     1 0          1608 S   init
     2 0               SW  [keventd]
     3 0               SWN [ksoftirqd_CPU0]
     4 0               SW  [kswapd]
     5 0               SW  [bdflush]
     6 0               SW  [kupdated]
     7 0               SW  [mtdblockd]
    14 0          1992 S   httpd
    16 0          1616 S   /bin/sh
    19 0               SW  [rtmpWscHandle]
   116 0          1608 S   udhcpc -i br0 -h W300A -s /etc_ro/udhcpc.script -p /v
   125 0          1992 S   httpd
   126 0          1992 S   httpd
   127 0           748 S   wins W300A 192.168.2.90
   134 0          1608 R   ps

 # cat /proc/pci
 PCI devices found:
   Bus  0, device   0, function  0:
     Class 0080: PCI device 1814:0802 (rev 1).
       Master Capable.  Latency=255.
       Prefetchable 32 bit memory at 0x0 [0xfffffff].
 # cat /proc/bus/pci/devices
 0000    18140802        0       00000008        00000000        00000000         00000000        00000000        00000000        00000000        1000000000000000        00000000        00000000        00000000        00000000        00000000

Available patch for trunk - see the mailing list and also discussion

The AP uses PHY Vitesse VSC8601 - need libphy with Vitesse (plus the patch). PHY is controlled via MDIO (do not enable GPIO MDI on RT2880), PHY address 6. The dual color (orange/green) Link/activity LED is connected directly to the PHY.

Green WPS led is on GPIO 11, active low.

Green SYS led is on GPIO 12, active low.

WLAN LED is on wifi chip RT2820 (registered as rt2800pci-phy0::radio). Note that the LED polarity is by default reversed. This is taken from the firmware copied from flash. Could be fixed by patching the /lib/firmware/RT288x.eeprom when copying from flash - do something like:

rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ, &word);
word |= 0x1000; /* swap polarity */
rt2x00_eeprom_write(rt2x00dev, EEPROM_FREQ, word);

Power LED seems to be connected directly to power.

Reset button is on GPIO 0, active low.

The radio firmware is (as in most similar routers/APs) at the beginning of the factory partition (used standard rt2x00_eeprom_extract "factory" 0 272).

 dev:    size   erasesize  name
 mtd0: 00030000 00010000 "Bootloader"
 mtd1: 00010000 00010000 "Config "
 mtd2: 00010000 00010000 "Factory"
 mtd3: 003b0000 00010000 "Kernel"

 0x00000000-0x00030000 : "Bootloader"
 0x00030000-0x00040000 : "Config "
 0x00040000-0x00050000 : "Factory"
 0x00050000-0x00400000 : "Kernel"

mtdlayout_4M=192k(u-boot)ro,64k(u-boot-env)ro,64k(factory)ro,896k(kernel),2880k(rootfs),3776k@0x50000(firmware)

static struct mtd_partition w300a_partitions[] = {
    {
        .name   = "u-boot",
        .offset = 0,
        .size   = 0x030000,              // 192KB = 196608 = 0x030000
        .mask_flags = MTD_WRITEABLE,
    }, {
        .name   = "u-boot-env",
        .offset = 0x030000,
        .size   = 0x010000,             // 64KB = 65536 = 0x010000
        .mask_flags = MTD_WRITEABLE,
    }, {
        .name   = "factory",
        .offset = 0x040000,
        .size   = 0x010000,            // 64KB = 65536 = 0x010000
        .mask_flags = MTD_WRITEABLE,
    }, {
        .name   = "kernel",
        .offset = 0x050000,
        .size   = 0x0E0000,           // 896KB = 917504 = 0x0E0000
    } , {
        .name   = "rootfs",
        .offset = 0x130000,          // 0x050000 + 0x0E0000 = 0x130000
        .size   = 0x2d0000,          // 2880KB = 2949120 = 2D0000, end=0x400000=4MB
    }, {
        .name   = "firmware",
        .offset = 0x050000,
        .size   = 0x3b0000,          //3776KB = 3866624 = 0x3B0000
    }
}; 

Getting FW - TBD/see discussion.

So far only tested with the serial console. I.e. from the u-boot menu use 1 (boot from tftp) or 2 (flash from tftp). Both running initramfs from tftp and flashing squashfs and then running from internal flash works fine. You can also flash back the original firmware (see above).

Have not checked the image format or hwo to prepare a "factory" version which could be flashed via the original web gui.

Tested basic AP use (wifi and eth in a bridge), managed to get 300M link on wifi (using the noscan option) and do data transfer through it.

Be careful when adding features. With 16MB of RAM you can easily run out of memory.

How to add tags