Tenda 3G611R+

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

3G611R+

3G 11N Wireless Router

OpenWrt support

Not officially supported

Apparently works with Tenda W306R or Edimax 3g-6200n OpenWrt firmware.

Supporting activities

Hardware highlights

CPU Ram Flash Network WLAN USB Serial JTag
Ralink RT3050F @ 320 MHz 32 MiB 4 MiB 4x 10/100 bgn Yes Yes ?

Buttons

hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

The Tenda 3G611R+ has the following buttons:

BUTTON Event
Reset reset
Secure Easy Setup WPS

Leds

Hardware

Info

Architecture MIPS
Vendor Ralink
Bootloader U-Boot
System-On-Chip RT3050F
CPU/Speed 320MHz
Flash-Chip mx29lv320ebti-70g
Flash size 4 MB
RAM 32 MB (EM63A165TS-6G)
Wireless
Ethernet 4x Port 10/100 Mbit/s + 1 WAN
USB Yes
Serial Yes
JTAG Not populated

Photos

Opening the case

Remove 4x rubber feet, unscrew 4 screws, gently unclick the cover by going along the groove with nails and a little force and patience.

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Serial connection parameters
for Tenda 3G611R+
57600, 8 N 1; 3.3V TTL

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

Bootlogs

U-Boot 1.1.3 (Dec 8 2009 - 13:38:58) Board: Ralink APSoC DRAM: 32 MB relocate_code Pointer at: 81fb0000 flash_protect ON: from 0xBF000000 to 0xBF01D663 flash_protect ON: from 0xBF030000 to 0xBF030FFF *** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 3.3 -------------------------------------------- ASIC 3052_MP2 (Port5<->None) DRAM component: 256 Mbits SDR DRAM bus: 16 bit Total memory: 32 MBytes Flash component: NOR Flash Date:Dec 8 2009 Time:13:38:58 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 320 MHZ #### SDRAM bus set to 16 bit SDRAM size =32 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 9: Load Boot Loader code then write to Flash via TFTP. You choosed 4 0 4: System Enter Boot Command Line Interface. U-Boot 1.1.3 (Dec 8 2009 - 13:38:58) RT3052 # printenv bootcmd=tftp bootdelay=1 baudrate=57600 ethaddr="00:AA:BB:CC:DD:10" ipaddr=10.10.10.123 serverip=10.10.10.3 ramargs=setenv bootargs root=/dev/ram rw addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1 flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr) kernel_addr=BFC40000 u-boot=u-boot.bin load=tftp 8A100000 $(u-boot) u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize) loadfs=tftp 8A100000 root.cramfs u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize) test_tftp=tftp 8A100000 root.cramfs;run test_tftp stdin=serial stdout=serial stderr=serial ethact=Eth0 (10/100-M) Environment size: 765/4092 bytes RT3052 #


OEM bootlog

COPY HERE THE BOOTLOG WITH THE ORIGINAL FIRMWARE


OpenWrt bootlog

Not the real firmware

U-Boot 1.1.3 (Dec 8 2009 - 13:38:58) Board: Ralink APSoC DRAM: 32 MB relocate_code Pointer at: 81fb0000 flash_protect ON: from 0xBF000000 to 0xBF01D663 flash_protect ON: from 0xBF030000 to 0xBF030FFF *** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 3.3 -------------------------------------------- ASIC 3052_MP2 (Port5<->None) DRAM component: 256 Mbits SDR DRAM bus: 16 bit Total memory: 32 MBytes Flash component: NOR Flash Date:Dec 8 2009 Time:13:38:58 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 320 MHZ #### SDRAM bus set to 16 bit SDRAM size =32 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 9: Load Boot Loader code then write to Flash via TFTP. 0 3: System Boot system code via Flash. ## Booting image at bf050000 ... Image Name: MIPS OpenWrt Linux-3.18.20 Created: 2015-09-11 17:21:27 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1050789 Bytes = 1 MB Load Address: 80000000 Entry Point: 80000000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80000000) ... ## Giving linux memsize in MB, 32 Starting kernel ... [ 0.000000] Linux version 3.18.20 (buildbot@builder1) (gcc version 4.8.3 (Ope nWrt/Linaro GCC 4.8-2014.04 r46450) ) #1 Fri Sep 4 19:34:21 CEST 2015 [ 0.000000] SoC Type: Ralink RT3350 id:1 rev:2 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001964c (MIPS 24KEc) [ 0.000000] MIPS: machine is Edimax 3g-6200n [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 02000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x00000000-0x01ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x01ffffff] [ 0.000000] Initmem setup node 0 [mem 0x00000000-0x01ffffff] [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 byt es [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pag es: 8128 [ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs 2 [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes) [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Writing ErrCtl register=0002b45e [ 0.000000] Readback ErrCtl register=0002b45e [ 0.000000] Memory: 29080K/32768K available (2543K kernel code, 120K rwdata, 312K rodata, 152K init, 186K bss, 3688K reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:256 [ 0.000000] CPU Clock: 320MHz [ 0.000000] clocksource_of_init: no matching clocksources found [ 0.000000] Calibrating delay loop... 212.58 BogoMIPS (lpj=1062912) [ 0.080000] pid_max: default: 32768 minimum: 301 [ 0.080000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.090000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.100000] pinctrl core: initialized pinctrl subsystem [ 0.110000] NET: Registered protocol family 16 [ 0.130000] rt2880_gpio 10000600.gpio: registering 24 gpios [ 0.140000] rt2880_gpio 10000600.gpio: registering 24 irq handlers [ 0.150000] Switched to clocksource MIPS [ 0.160000] NET: Registered protocol family 2 [ 0.170000] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.180000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.190000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.210000] TCP: reno registered [ 0.210000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.220000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.240000] NET: Registered protocol family 1 [ 0.250000] rt-timer 10000100.timer: maximum frequency is 6510Hz [ 0.260000] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.300000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.310000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT Y) (c) 2001-2006 Red Hat, Inc. [ 0.330000] msgmni has been set to 56 [ 0.360000] io scheduler noop registered [ 0.360000] io scheduler deadline registered (default) [ 0.380000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.400000] console [ttyS0] disabled [ 0.400000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 6666666) is a 16550A [ 0.420000] console [ttyS0] enabled [ 0.420000] console [ttyS0] enabled [ 0.430000] bootconsole [early0] disabled [ 0.430000] bootconsole [early0] disabled [ 0.450000] 1f000000.cfi: Found 1 x16 devices at 0x0 in 16-bit bank. Manufact urer ID 0x0000c2 Chip ID 0x0022a8 [ 0.470000] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.480000] Amd/Fujitsu Extended Query version 1.1. [ 0.490000] number of CFI chips: 1 [ 0.560000] 5 ofpart partitions found on MTD device 1f000000.cfi [ 0.570000] Creating 5 MTD partitions on "1f000000.cfi": [ 0.580000] 0x000000000000-0x000000030000 : "u-boot" [ 0.590000] 0x000000030000-0x000000040000 : "u-boot-env" [ 0.600000] 0x000000040000-0x000000050000 : "factory" [ 0.620000] 0x0000003e0000-0x000000400000 : "cimage" [ 0.630000] 0x000000050000-0x0000003e0000 : "firmware" [ 0.650000] 2 uimage-fw partitions found on MTD device firmware [ 0.660000] 0x000000050000-0x0000001508e5 : "kernel" [ 0.680000] 0x0000001508e5-0x0000003e0000 : "rootfs" [ 0.690000] mtd: device 6 (rootfs) set to be root filesystem [ 0.700000] 1 squashfs-split partitions found on MTD device rootfs [ 0.710000] 0x000000370000-0x0000003e0000 : "rootfs_data" [ 0.730000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5 [ 0.750000] rt2880_wdt 10000120.watchdog: Initialized [ 0.760000] TCP: cubic registered [ 0.770000] NET: Registered protocol family 17 [ 0.780000] bridge: automatic filtering via arp/ip/ip6tables has been depreca ted. Update your scripts to load br_netfilter if you need this. [ 0.800000] Bridge firewalling registered [ 0.810000] 8021q: 802.1Q VLAN Support v1.8 [ 0.840000] VFS: Mounted root (squashfs filesystem) readonly on device 31:6. [ 0.860000] Freeing unused kernel memory: 152K (802ea000 - 80310000) [ 2.270000] init: Console is alive [ 2.280000] init: - watchdog - [ 3.920000] usbcore: registered new interface driver usbfs [ 3.940000] usbcore: registered new interface driver hub [ 3.950000] usbcore: registered new device driver usb [ 4.830000] dwc2 101c0000.otg: DWC OTG Controller [ 4.840000] dwc2 101c0000.otg: new USB bus registered, assigned bus number 1 [ 4.850000] dwc2 101c0000.otg: irq 26, io mem 0x00000000 [ 4.860000] hub 1-0:1.0: USB hub found [ 4.870000] hub 1-0:1.0: 1 port detected [ 5.310000] init: - preinit - [ 6.460000] 8021q: adding VLAN 0 to HW filter on device eth0 [ 6.700000] random: mktemp urandom read with 10 bits of entropy available Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 10.150000] jffs2: notice: (300) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 10.190000] mount_root: switching to jffs2 overlay [ 10.250000] procd: - early - [ 10.250000] procd: - watchdog - [ 11.270000] procd: - ubus - [ 12.280000] procd: - init - Please press Enter to activate this console. [ 13.740000] NET: Registered protocol family 10 [ 13.760000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 13.800000] Loading modules backported from Linux version master-2015-03-09-0-g141f155 [ 13.820000] Backport generated by backports.git backports-20150129-0-gdd4a670 [ 13.840000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 13.870000] nf_conntrack version 0.5.0 (456 buckets, 1824 max) [ 13.960000] xt_time: kernel timezone is -0000 [ 14.010000] cfg80211: Calling CRDA to update world regulatory domain [ 14.090000] cfg80211: World regulatory domain updated: [ 14.100000] cfg80211: DFS Master region: unset [ 14.100000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time) [ 14.120000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 14.140000] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 14.160000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A) [ 14.170000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 14.190000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s) [ 14.210000] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s) [ 14.220000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 14.240000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A) [ 14.330000] PPP generic driver version 2.4.2 [ 14.350000] NET: Registered protocol family 24 [ 14.410000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 2872, rev 0200 detected [ 14.430000] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 0005 detected [ 26.570000] 8021q: adding VLAN 0 to HW filter on device eth0 [ 26.620000] device eth0 entered promiscuous mode [ 79.330000] random: nonblocking pool is initialized


Notes

Failsafe does not work, as buttons are not mapped in firmware, must use UART

Tags

How to add tags