Aztech HW550-3G

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

Install OpenWrt (generic explanation)

FIXME Please add the installation procedure here.

flash.layout for explanations!

dev: size erasesize name
mtd0: 00030000 00010000 “u-boot”
mtd1: 00010000 00010000 “u-boot-env”
mtd2: 00010000 00010000 “factory”
mtd3: 000e0000 00010000 “kernel”
mtd4: 006d0000 00010000 “rootfs”
mtd5: 00100000 00010000 “rootfs_data”
mtd6: 007b0000 00010000 “firmware”

NOTE: Serial connection and configured TFTP server needed!

  • After compiling firmware successfully, move bin/ramips/openwrt-ramips-rt305x-hw550-3g-squashfs-sysupgrade.bin file into your TFTP server's directory.
  • Then rename firmware to something shorter, for example rt3052f.bin (the file name must be shorter than 32 symbols).
  • Connect serial port to device (speed is 57600 8N1).
  • When you power on device, and see U-Boot log, immediately push “2” once.

You will see this message:

2: System Load Linux Kernel then write to Flash via TFTP. 
 Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
  • Push “y”, and enter: device IP, then TFTP server's IP, and then openwrt's firmware file name:
 Please Input new ones /or Ctrl-C to discard
        Input device IP (10.10.10.123) ==:10.10.10.123
        Input server IP (10.10.10.3) ==:10.10.10.3
        Input Linux Kernel filename () ==:rt3052f.bin

If TFTP server installed correctly, the firmware would be downloaded at ~30 seconds. Then it will be flashed into device (It will take about 2 minutes).

Architecture MIPS
Vendor Ralink
bootloader U-Boot
System-On-Chip Ralink RT3052F Rev 2 (MIPS24KEc V4.12)
CPU/Speed MIPS24KEc V4.12 384 MHz
Flash-Chip Spansion S29GL064N90TF104
Flash size 8192 KiB
RAM 32 MiB Zentel A3V28S40FTP -G6
Wireless Ralink RT3052 (integrated) 2.4GHz 802.11bgn
Ethernet Ralink RT3052 (integrated) 5 x 100/10 Ethernet
USB Yes 1 x 2.0
Serial Yes
JTAG Yes

Pinout
TP3 (JTAG_TD1) TP8 (GND) TP10 (3.3VDC) TP4 (JTAG_RST#)
TP7 (JTAG_TRST_N) TP5 (JTAG_TD0) TP9 (JTAG_TMS) TP6 (JTAG_TCLK)
Pinout


Now connect a serial hack adapter (DKU-5, CA-42 or similar containing the PL-2303 chip) and away you go!
The right settings for accessing the serial console are as follows:

Bits per second: 57600
Data bits: 8
Stop bits: 1
Parity: None
Flow control: None

U-Boot 1.1.3 (Nov 1 2010 - 09:32:19) Board: Ralink APSoC DRAM: 32 MB relocate_code Pointer at: 81fb0000 Set info->start[0]=BF000000 flash_protect ON: from 0xBF000000 to 0xBF01D3C3 flash_protect ON: from 0xBF030000 to 0xBF030FFF ============================================ Ralink UBoot Version: 3.3 -------------------------------------------- ASIC 3052_MP2 (Port5<->None) DRAM component: 128 Mbits SDR DRAM bus: 32 bit Total memory: 32 MBytes Flash component: NOR Flash Date:Nov 1 2010 Time:09:32:19 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 384 MHZ #### SDRAM bus set to 32 bit SDRAM size =32 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 9: Load Boot Loader code then write to Flash via TFTP. 3: System Boot system code via Flash. ## Booting image at bf050000 ... Image Name: MIPS OpenWrt Linux-3.2.9 Created: 2012-03-06 2:33:53 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 820938 Bytes = 801.7 kB Load Address: 80000000 Entry Point: 80000000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80000000) ... ## Giving linux memsize in MB, 32 Starting kernel ... [ 0.000000] Linux version 3.2.9 (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Tue Mar 6 10:33:38 SGT 2012 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 0001964c (MIPS 24Kc) [ 0.000000] Ralink RT3052 id:1 rev:3 running at 384.00 MHz [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 02000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000000 -> 0x00002000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] early_node_map[1] active PFN ranges [ 0.000000] 0: 0x00000000 -> 0x00002000 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 [ 0.000000] Kernel command line: board=HW550-3G console=ttyS1,57600 mtdparts=physmap-flash.0:192k(uboot)ro,64k(ubootenv)ro,64k(factory)ro,896k(kernel),6976k(rootfs),7872k@0x50000(firmware)console=ttyS1,57600 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes) [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes [ 0.000000] Writing ErrCtl register=00044007 [ 0.000000] Readback ErrCtl register=00044007 [ 0.000000] Memory: 29992k/32768k available (1885k kernel code, 2776k reserved, 310k data, 160k init, 0k highmem) [ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:48 [ 0.000000] console [ttyS1] enabled, bootconsole disabled [ 0.000000] console [ttyS1] enabled, bootconsole disabled [ 0.010000] Calibrating delay loop... 255.59 BogoMIPS (lpj=1277952) [ 0.090000] pid_max: default: 32768 minimum: 301 [ 0.100000] Mount-cache hash table entries: 512 [ 0.110000] NET: Registered protocol family 16 [ 0.120000] MIPS: machine is Aztech HW550-3G [ 0.140000] bio: create slab <bio-0> at 0 [ 0.150000] Switching to clocksource MIPS [ 0.160000] NET: Registered protocol family 2 [ 0.170000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.180000] TCP established hash table entries: 1024 (order: 1, 8192 bytes) [ 0.200000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.210000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.220000] TCP reno registered [ 0.230000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.240000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.260000] NET: Registered protocol family 1 [ 0.300000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.310000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.330000] msgmni has been set to 58 [ 0.340000] io scheduler noop registered [ 0.350000] io scheduler deadline registered (default) [ 0.360000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 0.370000] serial8250: ttyS0 at MMIO 0x10000500 (irq = 13) is a 16550A [ 0.380000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A [ 0.400000] physmap platform flash device: 00800000 at bf000000 [ 0.410000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x001000 [ 0.430000] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.440000] Amd/Fujitsu Extended Query version 1.3. [ 0.450000] number of CFI chips: 1 [ 0.460000] 6 cmdlinepart partitions found on MTD device physmap-flash.0 [ 0.470000] Creating 6 MTD partitions on "physmap-flash.0": [ 0.490000] 0x000000000000-0x000000030000 : "u-boot" [ 0.500000] 0x000000030000-0x000000040000 : "u-boot-env" [ 0.510000] 0x000000040000-0x000000050000 : "factory" [ 0.520000] 0x000000050000-0x000000130000 : "kernel" [ 0.540000] 0x000000130000-0x000000800000 : "rootfs" [ 0.550000] mtd: partition "rootfs" set to be root filesystem [ 0.560000] mtd: partition "rootfs_data" created automatically, ofs=6E0000, len=120000 [ 0.580000] 0x0000006e0000-0x000000800000 : "rootfs_data" [ 0.590000] 0x000000050000-0x000000800000 : "firmware" [ 0.610000] TCP westwood registered [ 0.620000] NET: Registered protocol family 17 [ 0.630000] 8021q: 802.1Q VLAN Support v1.8 [ 0.640000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4. [ 0.660000] Freeing unused kernel memory: 160k freed [ 2.800000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled/input/input0 [ 2.950000] Button Hotplug driver version 0.4.1 - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - [ 6.490000] JFFS2 notice: (353) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 15 of xref (0 dead, 2 orphan) found. [ 7.300000] SCSI subsystem initialized [ 7.540000] usbcore: registered new interface driver usbfs [ 7.550000] usbcore: registered new interface driver hub [ 7.560000] usbcore: registered new device driver usb [ 8.220000] dwc_otg: version 2.72a 24-JUN-2008 [ 8.230000] dwc_otg: Core Release: 2.66a [ 8.440000] dwc_otg: Periodic Transfer Interrupt Enhancement - disabled [ 8.460000] dwc_otg: Multiprocessor Interrupt Enhancement - disabled [ 8.470000] dwc_otg: Using DMA mode [ 8.470000] dwc_otg: Device using Buffer DMA mode [ 8.480000] dwc_otg dwc_otg.0: DWC OTG Controller [ 8.490000] dwc_otg dwc_otg.0: new USB bus registered, assigned bus number 1 [ 8.510000] dwc_otg dwc_otg.0: irq 26, io mem 0x101c0000 [ 8.520000] dwc_otg: Init: Port Power? op_state=1 [ 8.530000] dwc_otg: Init: Power Port (0) [ 8.540000] hub 1-0:1.0: USB hub found [ 8.550000] hub 1-0:1.0: 1 port detected [ 8.650000] Initializing USB Mass Storage driver... [ 8.660000] usbcore: registered new interface driver usb-storage [ 8.670000] USB Mass Storage support registered. switching to jffs2 - init - Please press Enter to activate this console. [ 20.750000] Compat-wireless backport release: compat-wireless-2012-02-23-9-g3e5b1f0 [ 20.770000] Backport based on wireless-testing.git master-2012-02-27 [ 20.820000] cfg80211: Calling CRDA to update world regulatory domain [ 21.410000] cfg80211: World regulatory domain updated: [ 21.420000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 21.440000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 21.450000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 21.470000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 21.480000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 21.500000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 21.560000] NET: Registered protocol family 10 [ 22.810000] PPP generic driver version 2.4.2 [ 22.940000] tun: Universal TUN/TAP device driver, 1.6 [ 22.950000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> [ 23.010000] IPv6 over IPv4 tunneling driver [ 23.170000] GRE over IPv4 demultiplexor driver [ 23.290000] GRE over IPv4 tunneling driver [ 23.570000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 23.890000] NET: Registered protocol family 24 [ 24.070000] nf_conntrack version 0.5.0 (471 buckets, 1884 max) [ 25.630000] xt_time: kernel timezone is -0000 [ 26.840000] ip_set version 4 loaded [ 27.250000] nf_conntrack_rtsp v0.6.21 loading [ 27.280000] nf_nat_rtsp v0.6.21 loading [ 27.420000] xt_RAWNAT: Unknown symbol ipv6_find_hdr (err 0) [ 27.550000] Netfilter messages via NETLINK v0.30. [ 27.750000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 28.370000] NF_TPROXY: Transparent proxy support initialized, version 4.1.0 [ 28.380000] NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd. [ 28.740000] usbcore: registered new interface driver usblp [ 28.780000] usbcore: registered new interface driver usbserial [ 28.800000] USB Serial support registered for generic [ 28.810000] usbcore: registered new interface driver usbserial_generic [ 28.820000] usbserial: USB Serial Driver core [ 28.960000] usbcore: registered new interface driver ums-alauda [ 29.000000] usbcore: registered new interface driver ums-cypress [ 29.040000] usbcore: registered new interface driver ums-datafab [ 29.070000] usbcore: registered new interface driver ums-freecom [ 29.110000] usbcore: registered new interface driver ums-isd200 [ 29.150000] usbcore: registered new interface driver ums-jumpshot [ 29.190000] usbcore: registered new interface driver ums-karma [ 29.220000] usbcore: registered new interface driver ums-sddr09 [ 29.260000] usbcore: registered new interface driver ums-sddr55 [ 29.300000] usbcore: registered new interface driver ums-usbat [ 29.480000] USB Serial support registered for GSM modem (1-port) [ 29.500000] usbcore: registered new interface driver option [ 29.510000] option: v0.7.2:USB Driver for GSM modems [ 39.460000] ramips-wdt: timeout value 60 must be 0 < timeout < 33 [ 43.300000] device eth0.1 entered promiscuous mode [ 43.310000] device eth0 entered promiscuous mode [ 43.390000] br-lan: port 1(eth0.1) entering forwarding state [ 43.400000] br-lan: port 1(eth0.1) entering forwarding state


To upgrade to 64MB SDRAM you need to flash a Ralink Bootloader that initialises 64MB of RAM and flash OpenWrt to the system. The original bootloader only initialises 32MB of SDRAM and the original Aztech Firmware only utilises 32MB of SDRAM as well. You can either compile the Bootloader by downloading Aztech's GPL SDK or flash a bootloader that initialises 64MB of SDRAM shared online. http://www.mediafire.com/?q25zlw2mckn8l01

Type ID Code Vendor
SDRAM 16Mx16 143MHZ TSOP54 Pb Free A43L4616AV-7F AMIC

NOTE: Serial connection and configured TFTP server needed! If you flash wrongly you risk bricking the entire device!

  • Download or compile the Ralink Bootloader
  • Then rename Bootloader to something shorter, for example “RT3052F_64MB.bin” (the file name must be shorter than 32 symbols).
  • Connect serial port to device (speed is 57600 8N1).
  • When you power on device, and see U-Boot log, immediately push “9” once.

You will see this message:

9: Load Boot Loader code then write to Flash via TFTP. 
Warning!! Erase Boot Loader in Flash then burn new one. Are you sure?(Y/N)
  • Push “y”, and enter: device IP, then TFTP server's IP, and then bootloader file name:
 Please Input new ones /or Ctrl-C to discard
        Input device IP (10.10.10.123) ==:10.10.10.123
        Input server IP (10.10.10.3) ==:10.10.10.3
        Input Uboot filename () ==:RT3052F_64MB.bin

If TFTP server installed correctly, the firmware would be downloaded at ~5 seconds. Then it will be flashed into device (It will take about 30 seconds).

U-Boot 1.1.3 (Mar 19 2010 - 10:55:07)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb0000

 Set info->start[0]=BF000000
flash_protect ON: from 0xBF000000 to 0xBF01D3C3
flash_protect ON: from 0xBF030000 to 0xBF030FFF
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 3.3
--------------------------------------------
ASIC 3052_MP2 (Port5<->None)
DRAM component: 256 Mbits SDR
DRAM bus: 32 bit
Total memory: 64 MBytes
Flash component: NOR Flash
Date:Mar 19 2010  Time:10:55:07
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384

 ##### The CPU freq = 384 MHZ ####

 SDRAM bus set to 32 bit
 SDRAM size =64 Mbytes

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.                     

To remove the “*** Warning - bad CRC, using default environment” message
Boot into the bootloader command line interface by pressing “4”.
Then type saveenv in the prompt to overwrite the boot environment variables from the original bootloader.
This will correct the error in the checksum.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by 127.0.0.1