User Tools

Site Tools


Planex MZK-W04N-XX

CPU: Ralink RT2880F
Flash: 8MB
Wi-Fi: Ralink RT2860 (maybe RT2820 - hard to see) 802.11N, 3 antennas look to be non-removable
Switch: IC+ IP175C 4LAN+1WAN 10/100

Serial console

Serial console is available at 57600 8n1 on J1 (I had to desolder / solder a 0.1“ pin header), pinout:

1: VCC (closest to edge of board) (?)
2: RXD (data from PC to router)
3: GND
4: TXD (Data from router to PC)


OEM bootlog

U-Boot 1.1.3 (Nov 15 2007 - 14:37:24) Board: RT2880 DRAM: 32 MB twe0 set to <NULL> toe0 set to <NULL> flash_protect ON: from 0xBC400000 to 0xBC42B097 protect on 0 protect on 1------------------------------------------------------------------- protect on 2 <ESC> Exit <Enter> Enter flash_protect ON: from 0xBC430000 to 0xBC43FFFF protect on 3 *** Warning - bad CRC, using default environment ============================================ ASIC -VerB/C (MAC to Phy Mode) DRAM COMPONENT=128Mbits DRAM BUS=32BIT Total memory = 32Mbytes Date:Nov 15 2007 Time:14:37:24 ============================================ D-CACHE set to 4 way I-CACHE set to 4 way ##### The CPU freq = 266 MHZ #### SDRAM bus set to 32 bit SDRAM size =32 Mbytes Please choose the operation: 0: Load ucos code to SDRAM via TFTP Client. 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 5: Load ucos code to SDRAM via TFTP. 0 3: System Boot system code via Flash. ## Booting image at bc450014 ... Image Name: Linux Kernel Image Created: 2008-01-30 8:40:50 UTC System Control Status = 0x02110084 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 2531244 Bytes = 2.4 MB Load Address: 8a000000 Entry Point: 881b0040 Verifying Checksum ... OK Uncompressing Kernel Image ... No initrd ## Transferring control to Linux (at address 881b0040) ... ## Giving linux memsize in MB, 32 Starting kernel ... THIS IS ASIC ramsize = 32 MBytes rambase not set, set to default (0x08000000) MEMORY DESCRIPTOR dump: [0,88239940]: base<08000000> size<02000000> type<Free RAM memory> The CPU feqenuce set to 266 MHz CPU revision is: 0001906c icache: sets:256, ways:4, linesz:16 ,total:16384, waybit:12, flags:0x0 dcache: sets:256, ways:4, linesz:16 ,total:16384, waybit:12, flags:0x0 i waysize = 4096, d waysize = 4096, i sets= 256, d sets=256 Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes. Primary data cache 16kB, 4-way, linesize 16 bytes. [setup_scache]:1032 Linux version 2.4.30 (root@localhost.localdomain) (gcc version 3.3.6) #636 ä¸ 1æ 30 16:40:47 CST 2008 Determined physical RAM map: memory: 02000000 @ 08000000 (usable) On node 0 totalpages: 40960 zone(0): 40960 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4 cause = c0c08268, status = 1000e700 calculating r4koff... 00144b50(1330000) CPU frequency 133.00 MHz Using 133.000 MHz high precision timer. Calibrating delay loop... 265.42 BogoMIPS Memory: 28712k/32768k available (1713k kernel code, 4056k reserved, 112k data, 96k init, 0k highmem) Dentry cache hash table entries: 32768 (order: 6, 262144 bytes) Inode cache hash table entries: 16384 (order: 5, 131072 bytes) Mount cache hash table entries: 512 (order: 0, 4096 bytes) Buffer cache hash table entries: 8192 (order: 3, 32768 bytes) Page-cache hash table entries: 65536 (order: 6, 262144 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX pci.c pcibios_init():840 BAR0 at slot 0 = 8 pci.c pcibios_fixup_resources():640 bus = 0, dev = 0, fun = 0 dev= 0x883fcc00 Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd devfs: v1.12c (20020818) Richard Gooch ( devfs: boot_options: 0x1 squashfs: version 3.0 (2006/03/15) Phillip Lougher pty: 256 Unix98 ptys configured LED & GPIO & LAN Status Driver LED_VERSION spidrv_major = 217 Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled ttyS00 at 0x300500 (irq = 9) is a 16550A ttyS01 at 0x300c00 (irq = 8) is a 16550A HDLC line discipline: version $Revision: $, maxframe=4096 N_HDLC line discipline registered. RA2880 Ethernet Driver Initilization. v1.01 256 rx/tx descriptors allocated! Netlink init ok! PROC INIT OK! ICPLUS 175C config LAN_WAN finished (evaluation board) PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered MPPE/MPPC encryption/compression module registered FLASH_API: MAN_ID=C2 DEV_ID=22A8 SIZE=4MB physmap flash device: 800000 at 1c400000 Amd/Fujitsu Extended Query Table v1.1 at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling fast programming due to code brokenness. Using physmap partition definition Creating 7 MTD partitions on "RT2880 SOC Physically mapped flash": 0x00000000-0x00030000 : "Bootloader" mtd: Giving out device 0 to Bootloader 0x00030000-0x00040000 : "Config " mtd: Giving out device 1 to Config 0x00040000-0x00050000 : "Factory" mtd: Giving out device 2 to Factory 0x00050000-0x00110000 : "Kernel" mtd: Giving out device 3 to Kernel 0x00110000-0x003e0000 : "RootFS" mtd: Giving out device 4 to RootFS 0x003e0000-0x00400000 : "Cimage" mtd: Giving out device 5 to Cimage 0x00050000-0x003e0000 : "Uimage" mtd: Giving out device 6 to Uimage NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 1024 buckets, 8Kbytes TCP: Hash tables configured (established 16384 bind 32768) Linux IP multicast router 0.06 plus PIM-SM ip_conntrack version 2.1 (1280 buckets, 10240 max) - 316 bytes per conntrack ip_tables: (C) 2000-2002 Netfilter core team, Type=Restricted Cone ipt_random match loaded netfilter PSD loaded - (c) astaro AG ipt_recent v0.3.1: Stephen Frost <>. ipt_IPV4OPTSSTRIP loaded arp_tables: (C) 2002 David S. Miller NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 802.1Q VLAN Support v1.8 Ben Greear <> All bugs added by David S. Miller <> Load RT2880 Timer Module(Wdg/Soft) VFS: Mounted root (squashfs filesystem) readonly. Mounted devfs on /dev Freeing prom memory: 0kb freed Freeing unused kernel memory: 96k freed console started trying to start /sbin/init Algorithmics/MIPS FPU Emulator v1.5 insmod: /lib/modules/2.4.30: No such file or Please press Enter to activate this console. Sat Jan 1 00:00:00 UTC 2000 mount: Mounting /proc on /proc failed: Device or resource busy IC-Plus PHY Init...ok GDMA1_FWD_CFG = 10000 DSP_EN OFF version driver phy_tx_ring = 09afe000, tx_ring = a9afe000, size: 16 bytes phy_rx_ring = 09afd000, rx_ring = a9afd000, size: 16 bytes ra2880stop()...Done Free TX/RX Ring Memory! IC-Plus PHY Init...ok GDMA1_FWD_CFG = 10000 DSP_EN OFF version driver phy_tx_ring = 09afc000, tx_ring = a9afc000, size: 16 bytes phy_rx_ring = 09afb000, rx_ring = a9afb000, size: 16 bytes eth2.1: Setting MAC address to 00 90 cc f7 6d 04. VLAN (eth2.1): Underlying device (eth2) has same MAC, not checking promiscious mode. eth2.2: Setting MAC address to 00 90 cc f7 6d 05. device eth2 entered promiscuous mode VLAN (eth2.2): Setting underlying device (eth2) to promiscious mode. killall: no process killed killall: no process killed Initialize WLAN interface Using /bin/rt2860ap.o 2860 version : v1.6.0.0 (2007/10/12) === pAd = c00ff000, size = 465104 === <-- RTMPAllocAdapterBlock, Status=0 RX DESC a9876000 size = 2048 <-- RTMPAllocDMAMemory, Status=0 1. Phy Mode = 9 2. Phy Mode = 9 3. Phy Mode = 9 MCS Set = ff ff 00 00 00 Main bssid = 00:90:cc:f7:6d:04 The UUID Hex string is:2880288028801880a8800090ccf76d04 The UUID ASCII string is:28802880-2880-1880-a880-0090ccf76d04! <==== RTMPInitialize, Status=0 0x1300 = 00064300 Setup BRIDGE interface SIOCGIFFLAGS: No such device SIOCGIFFLAGS: No such device SIOCGIFFLAGS: No such device SIOCGIFFLAGS: No such device SIOCGIFFLAGS: No such device bridge br0 doesn't exist; can't delete it Setup bridge... device eth2.1 entered promiscuous mode eth2.1: dev_set_promiscuity(master, 1) SIOCDELRT: No such process device ra0 entered promiscuous mode ra0: attempt to add interface with same source address. SIOCDELRT: No such process br0: port 2(ra0) entering learning state br0: port 1(eth2.1) entering learning state br0: port 2(ra0) entering forwarding state br0: topology change detected, propagating br0: port 1(eth2.1) entering forwarding state br0: topology change detected, propagating SIOCDELRT: No such process SIOCDELRT: No such process ------> 802.1x--------->Enter ------> 802.1x------>Exit Static DHCP Leases disable! SIOCDELRT: No such process udhcpd (v0.9.9-pre) started Setup WAN interface device eth2 is not a slave of br0 device eth2.1 is already a member of a bridge; can't enslave it to bridge br0. Set: phy[29].reg[23] = 07c2 Set: phy[29].reg[22] = 8420 Set: phy[29].reg[24] = 0001 Set: phy[29].reg[25] = 0001 Set: phy[29].reg[26] = 0001 Set: phy[29].reg[27] = 0001 Set: phy[29].reg[28] = 0002 Set: phy[30].reg[9] = 1089 Set: phy[30].reg[1] = 2f00 Set: phy[30].reg[2] = 0030 don't create ********** run Diagd ********** ********** run GaTest ********** =================Enable WSC_UPNP=================== =================Enable WSC_UPNP=================== udhcp client (v0.9.9-pre) started don't create =================Enable LLTD=================== into eth2.2.deconfig killall: lld2d: no process killed killall: snmpd: no process killed =================END LLTD=================== =================Enable GPIO Interrupt================ gPassiveMsgQ Init success! gPassiveMsgID=0x386d4390! gActiveMsgQ Init success! ralink_gpio:ioctl GPIO REG ralink_gpio:ioctl GPIO REG =================END GPIO Interrupt=================== rm: cannot remove `/tmp/agentenabledflag': No such file or directory /bin/ 484: /bin/agent: not found sock=5!(0x0x7fff7d00) Create netlink socket thread success! Create ioctl socket(6) success! Pthread(wscDevNLHandle)Now waiting for the netlink socket incoming message! ip_table: set wan_name=eth2.2 Using /lib/modules/2.4.18-MIPS/RT2880/sw_nat.o insmod: unresolved symbol ra_sw_nat_hook_tx insmod: unresolved symbol ra_sw_nat_hook_rx @@@@@@ SSDP_PORT = 1900 UPnP Initialized IP-Addr: Port: 49152 HW-Addr: 00:90:cc:f7:6d:04! Specifying the webserver root directory -- /etc/xml UUID Str=uuid:28802880-2880-1880-a880-0090ccf76d04! alloc memory size=1050! <?xml version="1.0" encoding="utf-8"?> <root xmlns="urn:schemas-upnp-org:device-1-0"> <specVersion> <major>1</major> <minor>0</minor> </specVersion> <device> <deviceType>urn:schemas-wifialliance-org:device:WFADevice:1</deviceType> <friendlyName>11N_Router</friendlyName> <manufacturer>.</manufacturer> <manufacturerURL>.</manufacturerURL> <modelDescription>AP WSC device</modelDescription> <modelName>Wireless Router</modelName> <modelNumber>BR6524N</modelNumber> <modelURL>.</modelURL> <serialNumber>12345678</serialNumber> <UDN>uuid:28802880-2880-1880-a880-0090ccf76d04</UDN> <serviceList> <service> <serviceType>urn:schemas-wifialliance-org:service:WFAWLANConfig:1</serviceType> <serviceId>urn:wifialliance-org:serviceId:WFAWLANConfig1</serviceId> <SCPDURL>WFAWLANConfigSCPD.xml</SCPDURL> <controlURL>control</controlURL> <eventSubURL>event</eventSubURL> </service> </serviceList> </device> </root> Registering the RootDevice with descDocUrl: RootDevice Registered WscLocalDevice: Device: FriendlyName=11N_Router! DescDocURL=! UDN=uuid:28802880-2880-1880-a880-0090ccf76d04! PresURL=! Service: servIdStr=urn:wifialliance-org:serviceId:WFAWLANConfig1! servTypeStr=urn:schemas-wifialliance-org:service:WFAWLANConfig:1! scpdURL=! eventURL=! controlURL=! WscLocalDeviceInit Initialized killall: radiusd: no process killed RADIUS server disable !!

And then boots to some lame GUI-ish login program…


So I ordered a MZK-W04N instead of the USB equipped MZK-W04NU … The MZK-W04N is a totally different beast. Oops.

I haven't been able to find GPL source for this thing, but it def is running U-Boot and Linux. Seems similar to the Asus RT-N15, Belkin F5D8235-4, Linksys WRT-160N, etc.

===== UPDATE 10/jun/2010 ======

Planex (PCi) W04n-XX is IDENTICAL to Edimax 6524N router. The only difference is ROM & RAM sizes.

How to flash without serial cable: Configure your PC with static IP address between and (ex. Connect your pc to mzk-w04n-xx port 1. Remove the power cable from the router. Press and hold reset button, while inserting the power cable, hold pressing the reset for 10 seconds. Now w04n-xx is accepting tftp flashing on fixed IP

Enjoy. By RyLoS (you can reach me on Press and keep pressed th


For some Help with the Tags, please have a look here: tags

inbox/toh/mzk-w04n.txt · Last modified: 2015/12/14 18:59 by tmomas