User Tools

Site Tools



Note: The ASUS RT-N10P is a different hardware design, and this firmware does not run on it.

Supported Versions

Hardware Highlights



To build:

  • Read and follow the build documentation
  • Choose Ralink RT288x/RT305x as target and RT305x based boards as subtarget.
  • The generated firmware you want to use for this device is openwrt-ramips-rt305x-rt-n10-plus-squashfs-sysupgrade.bin

TFTP Firmware Install


  • Set your computer to a static IP Note the IP of .15 is critical - the bootloader accepts tftp from this IP.
  • Plug your computer into any LAN port
  • Turn the device off and wait a few seconds. Hold the Reset button in with a pen and insert power.
  • Wait until the WPS light blinks slowly and then let go of the Reset button. Your router is now in recovery mode and has the IP Note it will not respond to pings.
  • Send a firmware image using command-line tftp
    • eg. from Linux:
      $ tftp
      tftp> binary
      tftp> connect
      tftp> put openwrt-ramips-rt305x-rt-n10-plus-squashfs-sysupgrade.bin
      Sent 2490464 bytes in 1.2 seconds
      tftp> quit
    • or using curl
      $ curl -T openwrt-ramips-rt305x-rt-n10-plus-squashfs-sysupgrade.bin tftp://
    • or using the Microsoft Windows tftp client
      C:\Temp>tftp -i put openwrt-15.05.1-ramips-rt305x-rt-n10-plus-squashfs-sysupgrade.bin
      Transfer successful: 3407876 bytes in 2 second(s), 1703938 bytes/s
  • Wait a minute or two as the device loads the new firmware. You can ping the device at to know when OpenWrt comes online. The WPS light will flash rapidly when OpenWrt begins to initialize, and stay solid when it has finished booting. Also, if you have access to the console (via a serial cable, for example), then you will see that the router first receives the file, then writes the the device, and finally outputs an ok message.

Now follow First Login to learn more about how to set up your device.

Back to original firmware

The TFTP procedure can be used to flash both, OpenWrt images or the ASUS factory firmware on the website.



RAM: M12L2561616A-6TG, 166MHz. 1 set of Empty RAM TSOP-II solder pads. SOC datasheet indicates these pins are NC (not connected) on the 3050 (which the RT-N10+ uses), but are usable on the 3052.


Using the JTAG as gpio pins should be possible by editing target/linux/ramips/dts/RT-N10-PLUS.dts to remove “jtag” from ralink,pinmux (untested).


Serial Port

Serial port already has headers soldered. It is the 4-pin header in the middle of the board. 3.3V, 57600 8N1. Pin 1 is labeled on the board.

Pin 1 Pin 2 Pin 3 Pin 4

Flash Layout

Asus RT-N10+ Flash Layout
Layer 0 4096k flash
Layer 1 u-boot mtd0 192k devdata mtd1 64k devconf mtd2 64k firmware mtd6 3776k
Layer 2 kernel mtd3 832k rootfs mtd4 2944k
Layer 3 rootfs_data mtd5 1536k

Notes from the stock firmware

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "Bootloader"
mtd1: 00010000 00010000 "Config"
mtd2: 00010000 00010000 "Factory"
mtd3: 003b0000 00010000 "Kernel"
# cat /proc/cpuinfo
system type             : Ralink SoC
processor               : 0
cpu model               : MIPS 24K V4.12
BogoMIPS                : 212.99
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes
ASEs implemented        : mips16 dsp
VCED exceptions         : not available
VCEI exceptions         : not available
# cat meminfo
MemTotal:        29072 kB
MemFree:          8944 kB
Buffers:             0 kB
Cached:          11740 kB
SwapCached:          0 kB
Active:           5392 kB
Inactive:         8092 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               0 kB
Writeback:           0 kB
AnonPages:        1780 kB
Mapped:           1372 kB
Slab:             4132 kB
SReclaimable:      844 kB
SUnreclaim:       3288 kB
PageTables:        360 kB
NFS_Unstable:        0 kB
Bounce:              0 kB
CommitLimit:     14536 kB
Committed_AS:     4532 kB
VmallocTotal:  1048404 kB
VmallocUsed:      1792 kB
VmallocChunk:  1045952 kB
# cat partitions
major minor  #blocks  name

  31     0        192 mtdblock0
  31     1         64 mtdblock1
  31     2         64 mtdblock2
  31     3       3776 mtdblock3
# cat version
Linux version 2.6.21 (asus@localhost) (gcc version 3.4.2) #1006 Fri Sep 30 10:40:40 CST 2011

OEM bootlog

U-Boot 1.1.3 (Jul 26 2010 - 14:43:11) Board: Ralink APSoC DRAM: 32 MB relocate_code Pointer at: 81b7c000 Set info->start[0]=BF000000 flash_protect ON: from 0xBF000000 to 0xBF022FBB protect on 0 protect on 1 protect on 2 flash_protect ON: from 0xBF030000 to 0xBF03FFFF protect on 3 *** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 3.2 -------------------------------------------- ASIC 3052_MP2 (Port5<->Phy) DRAM COMPONENT: 256Mbits DRAM BUS: 16BIT Total memory: 32 MBytes Date:Jul 26 2010 Time:14:43:11 ============================================ icache: sets:128, ways:4, linesz:32 ,total:16384 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 320 MHZ #### SDRAM bus set to 16 bit SDRAM size =32 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 9: Load Boot Loader code then write to Flash via TFTP. 0 3: System Boot system code via Flash. eth_register Eth0 (10/100-M) enetvar=ethaddr,Eth addr:00:0C:43:09:26:BB eth_current->name = Eth0 (10/100-M) verify is 1 ## load addr bf050000 ... print img header Magic: [00000000] CRC: [00000000] Image Name: Created: 1970-01-01 0:00:00 UTC System Control Status = 0x00400000 Image Type: Invalid CPU Invalid OS Invalid Image (uncompressed) Data Size: 0 Bytes = 0 kB Load Address: 00000000 Entry Point: 00000000 Bad Magic Number , 00000000 ## Booting image at bf050000 ... sizeof image_header_t is 64 print img header Magic: [27051956] CRC: [e84297a4] Image Name: Created: 2011-09-30 2:41:00 UTC System Control Status = 0x00400000 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 3770814 Bytes = 3.6 MB Load Address: 80000000 Entry Point: 80324000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80324000) ... ## Giving linux memsize in MB, 32 Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.21 (asus@localhost) (gcc version 3.4.2) #1006 Fri Sep 30 10:40:40 CST 2011 The CPU feqenuce set to 320 MHz CPU revision is: 0001964c Determined physical RAM map: memory: 02000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Built 1 zonelists. Total pages: 8128 Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 Primary instruction cache 16kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 16kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). Cache parity protection disabled cause = 80800050, status = 1100ff00 PID hash table entries: 128 (order: 7, 512 bytes) calculating r4koff... 00138800(1280000) CPU frequency 320.00 MHz Using 160.000 MHz high precision timer. Console: colour dummy device 80x25 Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 26340k/32768k available (2712k kernel code, 6428k reserved, 499k data, 2732k init, 0k highmem) Mount-cache hash table entries: 512 NET: Registered protocol family 16 Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered detected lzma initramfs detected lzma initramfs initramfs: LZMA lc=3,lp=0,pb=2,dictSize=1048576,origSize=10037760 LZMA initramfs by Ming-Ching Tiew <>...............................................................r squashfs: LZMA suppport for by jro fuse init (API version 7.8) io scheduler noop registered (default) FLASH_API: MAN_ID=1 DEV_ID=7E1A00 SIZE=4MB Ralink gpio driver initialized HDLC line discipline: version $Revision: $, maxframe=4096 N_HDLC line discipline registered. Serial: 8250/16550 driver $Revision: $ 2 ports, IRQ sharing disabled serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize loop: loaded (max 8 devices) PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 PPPoL2TP kernel driver, V0.18.3 PPTP driver version 0.8.5 ralink flash device: 0x1000000 at 0x1f000000 Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. Creating 4 MTD partitions on "Ralink SoC physically mapped flash": 0x00000000-0x00030000 : "Bootloader" 0x00030000-0x00040000 : "Config" 0x00040000-0x00050000 : "Factory" 0x00050000-0x01000000 : "Kernel" mtd: partition "Kernel" extends beyond the end of device "Ralink SoC physically mapped flash" -- size truncated to 0 block2mtd: version $Revision: $ nf_conntrack version 0.5.0 (16384 buckets, 8192 max) ipt_time loading ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone arp_tables: (C) 2002 David S. Miller TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 10 NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <> All bugs added by David S. Miller <> GDMA1_MAC_ADRH -- : 0x00000000 GDMA1_MAC_ADRL -- : 0x00000000 Ralink APSoC Ethernet Driver Initilization. v2.00 256 rx/tx descriptors allocated, mtu = 1500! NAPI enable, weight = 0, Tx Ring = 256, Rx Ring = 256 GDMA1_MAC_ADRH -- : 0x0000001e GDMA1_MAC_ADRL -- : 0xe3ef9d30 PROC INIT OK! Freeing unused kernel memory: 2732k freed devpts: called with bogus options mount: mounting none on /proc/bus/usb failed: No such file or diAlgorithmics/MIPS FPU Emulator v1.5 rectory nvram_linux: no version for "struct_module" found: kernel tainted. [chk rc] sw_mode val is 1 [chk rc] sw_mode val is 1 [rc Chk] [1][] [chk sw_mode]: 1 rmmod: nf_nat_rtsp: No such file or directory rmmod: nf_conntrack_rtsp: No such file or directory waitpid: No child processes BSSID number: 1 gen ralink config rt2860v2_ap: module license 'unspecified' taints kernel. insmod: dwc_otg.ko: module not found insmod: usblp.ko: module not found chk ver:0710[rc] START 14DAE9858C90 14DAE9858C90 GDMA1_MAC_ADRH -- : 0x000014da GDMA1_MAC_ADRL -- : 0xe9858c90 waitpid: No child proce phy_tx_ring = 0x00361000, tx_ring = 0xa0361000 phy_rx_ring = 0x00000000, rx_ring = 0x00000000 sses RT305x_ESW: Link Status Changed CDMA_CSG_CFG = 81000007 GDMA1_FWD_CFG = 710000 0x1300 = 00064380 eth2.2: Setting MAC address to 14 da e9 85 8c 90. VLAN (eth2.2): Underlying device (eth2) has same MAC, not checking promiscious mode. waitpid: No child processes waitpid: No child processes STBport is 0 case WLLLL eth2.1: dev_set_promiscuity(master, 1) device eth2 entered promiscuous mode device eth2.1 entered promiscuous mode waitpid: No child processes device ra0 entered promiscuous mode waitpid: No child proceRT305x_ESW: Link Status Changed sses sw_mode ex is 1 [rc] not repeater mode [][] ## [rc] set lan_br0: port 2(ra0) entering listening state if as 192.168.1.br0: port 1(eth2.1) entering listening state 1/ set default filter settings waitpid: No child processes [rc] start services [rc] start dhcpd starting... info, udhcp server (v0.9.8-asus) started [1234] start dnsbr0: port 2(ra0) entering learning state br0: port 1(eth2.1) entering learning state sh: lpd: not found br0: topology change detected, propagating br0: port 2(ra0) entering forwarding state br0: topology change detected, propagating br0: port 1(eth2.1) entering forwarding state RT305x_ESW: Link Status Changed u2ec: No such file or directory ***** g_wl_interface = ra0 ****** libupnp: using UDP SSDP_PORT = 1900 upnpd[280]: UPnP SDK Successfully Initialized. upnpd[280]: Succesfully set the Web Server Root Directory. --- START: Wait to start wanduck --- upnpd[280]: IGD root device successfully registered. resume stp forwarding delay and hello time waitpid: No child processes start wan: wan_ifname=eth2.2, wan_proto=dhcp bcmp cur_hwaddr, ifr.sa_data not match wlconf: No such file or directory waitpid: No child processes pass start pppoe relay info, udhcp client (v0.9.8-asus) started eth2.2: No such process killall: telnetd: no process killed [1234] restart dns Unknown host upnp will be delayed 10 secs Password for 'admin' changed waitpid: No child processes start wsc waitpid: No child processes WPS: PIN waitpid: No child processes start detectWan [rc] start 802.1x BusyBox v1.12.1 (2011-09-30 10:33:37 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. # libupnp: using UDP SSDP_PORT = 1900 ## wsc upnp dev start ## ## USE XML TEMPLATE ## ## create device desc xml:/etc_ro/xml//WFADeviceDesc.xml ## dump all description files: Starting full scan! upnpd[280]: Advertisements Sent. Listening for requests ... # Enable direct rule socket: Operation now in progress [wd] chk usb plugin [k] track_flag=0, clean_flag=0, mm_flag=0, ipaddr=0 ## rc recv HOTPLUG track ok:0 SIGTTIN: do nothing info, Performing a DHCP renew, under state: 0 info, Performing a DHCP renew, under state: 0



toh/asus/rt-n10plus.txt · Last modified: 2018/05/06 22:52 by tmomas