From DD-WRT Wiki

[edit] DD-WRT Support

DD-WRT is not supported on this model. If you attempt to load DD-WRT, you will brick your device. The following notes are for development purposes only, and refer to the stock Linksys firmware.

[edit] Hardware

[edit] Specs

CPU

Ralink RT2780F chipset, GX29970D0, 0803ST

CPU is functionally identical to RT2880, used in e.g. WRT160N

WRT100 and WRT110 share same Linksys GPL source code

RAM

16 MiB ESMT M12L128168A AZG2P730E 6T 0805

Flash

4 MiB EON EN29LV320AB-70TCP 172D19A 0802CDA

Network Switch

IC+ IP175E LF 0805S13 FPT5363.1

Radio

2.4 GHz RT2720L as transceiver: 1 transmit, 2 receive (1T2R)

S/N Prefix

MSU0

FCC ID

Q87-WRT110

[edit] Serial console

• Serial settings are 57600 8N1.
• 4.4kΩ resistor may or may not be necessary. YMMV.
• JTAG port is present; pinout currently unknown.
• As with all other routers, you will need a MAX232 level converter to convert the router's TTL 3.3v inverted serial signal to 5v RS232 levels.
  • However, I was able to get away with a simple 7414 NOT gate to invert the Rx/Tx signals, plus a forgiving USB-Serial adapter that would accept the 3.3v levels.
• As with all other routers, on the DB9 end you will want to short the RTS/CTS pins and the DTR/DSR pins to fake out a hardware handshake.

[edit] Software

[edit] U-Boot

Boot transcript log available here.

U-boot options:

  1: Load system code to SDRAM via TFTP. 
  2: Load system code then write to Flash via TFTP. 
  3: Boot system code via Flash (default).
  4: Entr boot command line interface.
  5: Load ucos code to SDRAM via TFTP. 

Some boot options are not listed in the menu (per /WRT110_Shipping_Uboot_SDK_2_2_0_0/lib_mips/board.c). Use at your own risk.

7 (disabled): Load Linux filesystem then write to Flash via TFTP. 
8: Load Boot Loader code to SDRAM via TFTP.
9: Load Boot Loader code then write to Flash via TFTP.

U-boot command line:

RT2880 # help
?       - alias for 'help'
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp	- boot image via network using BootP/TFTP protocol
cp      - memory copy
echo    - echo args to console
erase   - erase FLASH memory
help    - print online help
loopback   - Ralink eth loopback test !!
md      - memory display
mdio   - Ralink PHY register R/W command !!
mm      - memory modify (auto-incrementing)
mw      - memory write (fill)
nm      - memory modify (constant address)
printenv- print environment variables
protect - enable or disable FLASH write protection
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
spicmd	- read/write data from/to eeprom or vtss
tftpboot- boot image via network using TFTP protocol
version - print monitor version

U-boot NVRAM includes some macros:

RT2880 # printenv
bootcmd=tftp
bootdelay=1
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
preboot=echo;echo
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
kernel_addr=BFC40000
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
ethact=Eth0 (10/100-M)
n"=code.bin
filesize=2d0020
fileaddr=8A800000
ipaddr=192.168.1.1
serverip=192.168.1.2
autostart=no
bootfile=code.bin
stdin=serial
stdout=serial
stderr=serial

[edit] Extract Kernel

Stock firmware is in ??? format. This consists of a custom linksys header, uboot header, gzipped kernel, cramfs userland, ???.

1. Download stock firmware 1.0.07
2. Download U-Boot source code and compile the mkimage utility with make tools
3. Extract kernel + uboot header:
   # tail -c+33 FW_WRT110_WRT100_1.0.07.002_EN_20091123.bin | head -c 776680 > code.uboot
4. Extract just kernel:
   # tail -c+97 FW_WRT110_WRT100_1.0.07.002_EN_20091123.bin | head -c 776616 | gunzip > vmlinux
5. Modify kernel as desired
6. Repackage it up:
   # gzip --best vmlinux; ./mkimage -A mips -O linux -T kernel -C gzip -a 8a000000 -e 8818a040 -d vmlinux.gz kernel.uboot

[edit] Uploading a new kernel

Kernel ignores bootargs passed in via u-boot. Kernel will only obey bootargs that are hard-coded into the kernel, near the end of its binary.

1. Install TFTP server on PC
2. Connect serial console
3. Connect PC to WAN (not switch) port, with static IP
4. Push '1' repeatedly just after poweron to interrupt u-boot
5. Give IPs and filename

[edit] Logical (Mtdblock) flash map

0x00000000-0x00050000 : "uBoot"
0x00050000-0x00130000 : "Linux Kernel"
0x00130000-0x003e0000 : "RootFS"
0x003e0000-0x003f0000 : "NVRAM"
0x003f0000-0x00400000 : "NVRAM_FACTORY"

[edit] Physical (UBoot) flash map

0xbc400000 - uboot
0xbc540000 - filesystem

[edit] Debricking Guide

Many people [1] have described a flashing/blinking Power LED syndrome. Seems to come from v1.0.02 firmware, where userspace ra0 wireless driver utility segfaults and software watchdog reboots router. This is, in turn, caused by userspace NVRAM corruption (e.g., power loss while changing configuration settings.)

Symptoms

• Router stuck in ~20s reboot cycle, Wifi and SES LEDs remain lit for 5s
• Works great as a dumb Ethernet switch
• 30-30-30 Rear reset button does nothing
• Does not respond to pings
• Does not respond to TFTP attempts
• Does not respond to TFTP WRQ (write request) UDP packet
• Router sends IGMP announcements every 20s
• Router broadcasts ARP queries if you try to connect to it
• Traffic sent through router results in ICMP dest host unreachable (port unreachable) packets
• Telnet port 80 gives TCP reset packets, sometimes

Solution

1. Install serial console as detailed above
2. Near end of Linux boot process, hit <Enter> repeatedly to interrupt initscripts
3. At :/> prompt, type nvram restore

[edit] Links

• Forums: RT2880 support thread