Nexx WT3020

The Nexx WT3020 is a series of miniature routers based on the MediaTek MT7620n with two Ethernet ports and a 802.11n 2T/2R 2.4 GHz 300Mbps wireless interface. There are several models with different hardware and software features.

Nexx WT3020A (top view). Click to enlarge Nexx WT3020A (bottom view). Click to enlarge Nexx WT3020A (top board view). Click to enlarge

Nexx WT3020H (detailed top board view). Click to enlarge Nexx WT3020H (detailed bottom board view). Click to enlarge

Nexx WT3020F board detail top Nexx WT3020F board detail bottom Nexx WT3020F box bottom

There are four known versions (according to the manufacturer) with different functionalities:

Model USB port Flash memory Description
WT3020A No 4 MB Wireless router
WT3020H Yes 8 MB Wireless router with USB port¹
WT3020F Yes 8 MB Wireless router with USB port and 3G dongle support¹
WT3020F³ Yes 8 MB Wireless router with USB port and 3G dongle support¹
WT3020AD Yes 8 MB Wireless router with USB port, 3G dongle support and extra features¹²

¹: differences between WT3020H, WT3020F and WT3020AD are only found in the original firmware
²: extra features are unknown
³: different hardware model, see below

Architecture MIPS 24KEc V5.0 (ramips)
Vendor MediaTek
Bootloader U-boot 1.1.3
System-On-Chip MediaTek MT7620n
CPU Speed 580MHz
RAM memory 64 MB DDR
RAM chip EtronTech EM6AB160TSE-5G
Flash memory 4 or 8 MB ¹
Flash chip Winbond W25Q32BV (4MB), W25Q64BV or cFeon Q64-104HIP or 25Q64FVSIG (8MB) ¹
Wired network 2 x Ethernet 100 Mbps (switched)
Ethernet chip MediaTek MT7530 (SoC)
Ethernet switch MediaTek MT7530 (integrated)
Wireless network 2.4 GHz 802.11n MiMo 2×2:2
Wireless chip MediaTek RT5390 (SoC)
Wireless antennas 2 x printed on-board
USB No / 1 x USB 2.0 host (A-type) ¹
Serial port Yes (TTL pins)

¹: depending on model

The serial port of the WT3020 can be accessed using the TTL pins shown in the image below. A voltage level converter (such as a CP2102 TTL-USB dongle) is required.

Nexx WT3020A (serial port)

The communication settings are: 57600 bps 8N1.

On the WT3020H model (8 MB flash), the Ethernet MAC starts with 20:28:18:...

GPIOs 0, 2, 18, and 19 are exposed on the board, as was tested with this method. They are connected to pull-down resistors. Click to enlarge the photos to see where the GPIOs are.

Nexx WT3020H (GPIO 2 and 18). Click to enlarge Nexx WT3020H (GPIO 0 and 19). Click to enlarge

As of 2016-09-03 the following is confirmed to be working:

Uboot http://breed.hackpascal.net/

Filename breed-mt7620-reset1.bin Size 80KB (82015B) MD5 0294140fdaa4c736f5a05fbcd7b7d130

Filename breed-mt7620-reset1.bin Timestamp 2018-10-14 20:50 Size 89K (91224B) MD5 04df1cf3aec4cf6e2b676e49f20830ad

(tested successfully with stock firmware, OpenWRT 18.06.1 and snapshot from 2018-10-21 on WT3020F, but flashed before moving to OpenWRT)

A guide for getting from stock to OpenWrt and to install OnionWrt can be found here: http://www.securityskeptic.com/2016/01/how-to-turn-a-nexx-wt3020-router-into-a-tor-router.html. The referenced OnionWrt Tor router install script can be found on the Internet Archive.

Uboot can be flashed like this (only if mtd0 is writable, on stock it's possible, on OpenWrt mtd0 is usually read-only in dts):

# mtd_write unlock mtd0 GetFileSize: No such file or directory Unlocking mtd0 ... # mtd_write erase mtd0 GetFileSize: No such file or directory Unlocking mtd0 ... Erasing mtd0 ... Erase char is 255 # mtd_write -r write breed-mt7620-reset1.bin mtd0 Unlocking mtd0 ... Writing from breed-mt7620-reset1.bin to mtd0 ... [w]

(at this time router output may stop and router will reboot)

Use the factory.bin image for initial install via stock firmware web-UI.

  1. Download firmware (see above)
  2. Connect to the WLAN “NEXX_...”, no password is needed or connect via LAN cable (preferred)
  3. Go to http://192.168.8.1 → Username: admin, Password: admin, System Setting → Upgrade Firmware
  4. Select the downloaded firmware file and press “Upgrade”
  5. After a while, you will get “Rebooting... System reboot takes a few moment, you might need to reconnect to the Router after rebooting.”
  6. After the system comes up, you should be able to log-in via LuCI at http://192.168.1.1/
root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "factory"
mtd3: 007b0000 00010000 "firmware"
mtd4: 001369e9 00010000 "kernel"
mtd5: 00679617 00010000 "rootfs"
mtd6: 004f0000 00010000 "rootfs_data"
offset 0x00000 0x30000 0x40000 0x50000 0x17cde2* 0x30000*
mtd 0 1 2 3
name u-boot u-boot-env factory firmware
mtd 4 5
name kernel rootfs
mtd 6
name rootfs-data

* These values depend on the kernel image size.

The flash chip usually holds the operating system, mac address and calibration data. To get the binary blob from the flash chip, use a SPI programmer (CH341A in this case, or use a RasPi). Attach a clamp on the flash chip and connecting it to the SPI programmer:

flashrom -c W25Q64.V -p ch341a_spi -r /tmp/data

The u-boot-env mtd partition contains 4096 bytes of data used by U-Boot and some remaining garbage from the original firmware.

Configuration for uboot-envtools:

root@OpenWrt:/# cat /etc/fw_env.config
# MTD device    Offset     Env size     Flash sector size
/dev/mtd1       0x0000     0x1000

The /dev/mtd2 partition contains configuration and calibration data. The MAC address is stored with offset 4.

root@OpenWrt:/# hexdump -C /dev/mtd2
00000000  20 76 05 01 20 28 18 aa  bb cc ff ff ff ff ff ff  | v.. (... ......|
[...]

The MAC address (macaddr / hwaddr) is copied to /etc/config/network on the first boot after flashing a new OpenWrt image.

The MAC address of eth0.1 in this example is 20:28:18:aa:bb:cc. eth0.2 will get the same MAC address increased by one, e.g. 20:28:18:aa:bb:cd.

The meaning of the remaining data is still unknown. It may contain some calibration data for WiFi.

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

Failsafe mode appears to be broken as of r43977 (fixme). Please see https://dev.openwrt.org/ticket/18768

Update 03 jan 2018:
Failsafe mode appears again to be broken, with the new hardware model. More details will follow.

Since there is no visible (blinking LED) indication that would tell when the kernel has finished loading, you need to find out the right timing. Looking at the output of the serial console, a reliable way of entering failsafe mode is to power on the device, wait for 10 seconds, then start pressing the reset button repeatedly until you reach 20 seconds. Now you should be in failsafe mode (as can be verified by looking at the serial console).

However, as of r43977, it seems to be impossible to log in over Ethernet. Is this a bug?

In failsafe mode as of r43977, the network is configured like this as we can see from the serial console:

root@(none):/# ifconfig

eth0      Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:xx  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:1043 (1.0 KiB)
          Interrupt:5 

Looking at /rom/lib/preinit/07_set_preinit_iface_ramips, it appears that failsafe mode is known broken on this device as of r43977.

root@WT3020H:~# cat /rom/lib/preinit/07_set_preinit_iface_ramips
#!/bin/sh
#
# Copyright (C) 2013 OpenWrt.org
#

. /lib/ramips.sh

ramips_set_preinit_iface() {
	RT3X5X=`cat /proc/cpuinfo | egrep "(RT3.5|RT5350|MT7628)"`
	if [ -n "${RT3X5X}" ]; then
		swconfig dev rt305x set reset 1
	fi

	if echo $RT3X5X | egrep -q "(RT5350|MT7628)"; then
		# This is a dirty hack to get by while the switch
		# problem is investigated. When VLAN is disabled, ICMP
		# pings work as expected, but TCP connections time
		# out, so telnetting in failsafe is impossible. The
		# likely reason is TCP checksumming hardware getting
		# disabled:
		# https://www.mail-archive.com/openwrt-devel@lists.openwrt.org/msg19870.html
		swconfig dev rt305x set enable_vlan 1
		swconfig dev rt305x vlan 1 set ports "0 6"
		swconfig dev rt305x port 6 set untag 0
		swconfig dev rt305x set apply 1
		vconfig add eth0 1
		ifconfig eth0 up
		ifname=eth0.1
	else
		ifname=eth0
	fi
}

As you can see, the code is looking for MT7628 but the Nexx WT3020 has MT7620N.

root@WT3020H:~# cat /proc/cpuinfo
system type		: Ralink MT7620N ver:2 eco:6
machine			: Nexx WT3020
processor		: 0
cpu model		: MIPS 24KEc V5.0
BogoMIPS		: 766.77

In failsafe mode, using the serial console, we see:

root@(none):/# swconfig list
Found: switch0 - mt7620

So possibly some code along the lines of https://lists.openwrt.org/pipermail/openwrt-devel/2014-August/027316.html needs to be added in order for OpenWrt Failsafe to work on this device, since as of r43977 it does not work yet.

As of r43977, after booting OpenWrt, the nework configuration looks like this by default. Note that the WAN port (towards the edge of the PCB) is eth0.2.

root@OpenWrt:/# cat /etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd98:xxx:0888::/48'

config interface 'lan'
	option ifname 'eth0.1'
	option force_link '1'
	option macaddr '20:28:18:xx:xx:7e'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option ifname 'eth0.2'
	option force_link '1'
	option macaddr '20:28:18:xx:xx:7f'
	option proto 'dhcp'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0 6t'
root@OpenWrt:/# ifconfig

br-lan    Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fd98:xxxx:888::1/60 Scope:Global
          inet6 addr: fe80::xxxx:xxxx:xxxx:xxxx/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:41 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:5430 (5.3 KiB)

eth0      Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          inet6 addr: fe80::xxxx:xxxx:xxxx:xxxx/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:275 errors:0 dropped:0 overruns:0 frame:0
          TX packets:143 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:43656 (42.6 KiB)  TX bytes:16916 (16.5 KiB)
          Interrupt:5 

eth0.1    Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:30 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:4324 (4.2 KiB)

eth0.2    Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          inet addr:192.168.0.16  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::2228:xxxx:xxxx:xxxx/64 Scope:Link
          inet6 addr: 2a02:908:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:267 errors:0 dropped:0 overruns:0 frame:0
          TX packets:105 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:37258 (36.3 KiB)  TX bytes:9905 (9.6 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:16 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1648 (1.6 KiB)  TX bytes:1648 (1.6 KiB)

Without Ethernet cable attached:

root@WT3020H:/# swconfig dev switch0  show
Global attributes:
	enable_vlan: 1
Port 0:
	pvid: 2
	link: port:0 link:down
Port 1:
	pvid: 1
	link: port:1 link:down
Port 2:
	pvid: 1
	link: port:2 link:down
Port 3:
	pvid: 1
	link: port:3 link:down
Port 4:
	pvid: 1
	link: port:4 link:down
Port 5:
	pvid: 0
	link: port:5 link:down
Port 6:
	pvid: 0
	link: port:6 link:up speed:1000baseT full-duplex 
Port 7:
	pvid: 0
	link: port:7 link:down
VLAN 1:
	vid: 1
	ports: 1 2 3 4 6t 
VLAN 2:
	vid: 2
	ports: 0 6t 

With Ethernet cable attached to the WAN port (edge of the PCB):

root@WT3020H:/# swconfig dev switch0  show
Global attributes:
	enable_vlan: 1
Port 0:
	pvid: 2
	link: port:0 link:up speed:100baseT full-duplex 
Port 1:
	pvid: 1
	link: port:1 link:down
Port 2:
	pvid: 1
	link: port:2 link:down
Port 3:
	pvid: 1
	link: port:3 link:down
Port 4:
	pvid: 1
	link: port:4 link:down
Port 5:
	pvid: 0
	link: port:5 link:down
Port 6:
	pvid: 0
	link: port:6 link:up speed:1000baseT full-duplex 
Port 7:
	pvid: 0
	link: port:7 link:down
VLAN 1:
	vid: 1
	ports: 1 2 3 4 6t 
VLAN 2:
	vid: 2
	ports: 0 6t 

Out of the box, you can connect the device to your Ethernet network using the WAN ethernet port (the one next to the edge of the board). It will grab an IP address from the network using DHCP. You then can log in to the device using telnet like this:

$ telnet <IP address assigned by DHCP>

Escape character is '^]'.

(none) login: nexxadmin
Password: y1n2inc.com0755

This is a log using OpenWrt CHAOS CALMER (Bleeding Edge, r43977)

U-Boot 1.1.3 (Jan 3 2014 - 09:12:42) MAX Board: Ralink APSoC DRAM: 64 MB relocate_code Pointer at: 83fb4000 enable ephy clock...done. rf reg 29 = 5 SSC disabled. ****************************** Software System Reset Occurred ****************************** spi_wait_nsec: 29 spi device id: 1c 30 17 1c 30 (30171c30) find flash: EN25Q64 raspi_read: from:30000 len:1000 raspi_read: from:30000 len:1000 ============================================ Ralink UBoot Version: 4.1.1.0 -------------------------------------------- ASIC 7620_MP (Port5<->None) DRAM component: 512 Mbits DDR, width 16 DRAM bus: 16 bit Total memory: 64 MBytes Flash component: SPI Flash Date:Jan 3 2014 Time:09:12:42 ============================================ icache: sets:512, ways:4, linesz:32 ,total:65536 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 580 MHZ #### estimate memory size =64 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP.  4  3  2  1  0 3: System Boot system code via Flash. ## Booting image at bc050000 ... raspi_read: from:50000 len:40 Image Name: MIPS OpenWrt Linux-3.14.28 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1164568 Bytes = 1.1 MB Load Address: 80000000 Entry Point: 80000000 raspi_read: from:50040 len:11c518 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80000000) ... ## Giving linux memsize in MB, 64 Starting kernel ... [ 0.000000] Linux version 3.14.28 (openwrt@gb-10) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r43977) ) #1 Fri Jan 16 16:33:53 UTC 2015 [ 0.000000] Board has DDR1 [ 0.000000] Analog PMU set to hw control [ 0.000000] Digital PMU set to hw control [ 0.000000] SoC Type: Ralink MT7620N ver:2 eco:6 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019650 (MIPS 24KEc) [ 0.000000] MIPS: machine is Nexx WT3020 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x00000000-0x03ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x03ffffff] [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Writing ErrCtl register=00017df8 [ 0.000000] Readback ErrCtl register=00017df8 [ 0.000000] Memory: 61316K/65536K available (2549K kernel code, 134K rwdata, 508K rodata, 192K init, 188K bss, 4220K reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:256 [ 0.000000] CPU Clock: 580MHz [ 0.000000] systick: running - mult: 214748, shift: 32 [ 0.000000] genirq: Flags mismatch irq 7. 00014600 (timer) vs. 00014600 (systick) [ 0.010000] Calibrating delay loop... 766.77 BogoMIPS (lpj=3833856) [ 0.050000] pid_max: default: 32768 minimum: 301 [ 0.050000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.060000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.060000] pinctrl core: initialized pinctrl subsystem [ 0.070000] NET: Registered protocol family 16 [ 0.080000] bio: create slab <bio-0> at 0 [ 0.080000] rt2880_gpio 10000600.gpio: registering 24 gpios [ 0.090000] rt2880_gpio 10000600.gpio: registering 24 irq handlers [ 0.090000] rt2880_gpio 10000660.gpio: registering 32 gpios [ 0.100000] rt2880_gpio 10000660.gpio: registering 32 irq handlers [ 0.100000] rt2880_gpio 10000688.gpio: registering 1 gpios [ 0.110000] rt2880_gpio 10000688.gpio: registering 1 irq handlers [ 0.110000] Switched to clocksource systick [ 0.120000] NET: Registered protocol family 2 [ 0.120000] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.140000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.150000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.170000] TCP: reno registered [ 0.170000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.170000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.200000] NET: Registered protocol family 1 [ 0.200000] rt-timer 10000100.timer: maximum frequency is 2441Hz [ 0.220000] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.240000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.260000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.280000] msgmni has been set to 119 [ 0.280000] io scheduler noop registered [ 0.300000] io scheduler deadline registered (default) [ 0.300000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.320000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a 16550A [ 0.350000] console [ttyS0] enabled [ 0.350000] console [ttyS0] enabled [ 0.350000] bootconsole [early0] disabled [ 0.350000] bootconsole [early0] disabled [ 0.380000] m25p80 spi32766.0: found en25q64, expected w25q64 [ 0.380000] m25p80 spi32766.0: en25q64 (8192 Kbytes) [ 0.400000] 4 ofpart partitions found on MTD device spi32766.0 [ 0.410000] Creating 4 MTD partitions on "spi32766.0": [ 0.420000] 0x000000000000-0x000000030000 : "u-boot" [ 0.440000] 0x000000030000-0x000000040000 : "u-boot-env" [ 0.440000] 0x000000040000-0x000000050000 : "factory" [ 0.460000] 0x000000050000-0x000000800000 : "firmware" [ 0.490000] 2 uimage-fw partitions found on MTD device firmware [ 0.510000] 0x000000050000-0x00000016c558 : "kernel" [ 0.510000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.540000] 0x00000016c558-0x000000800000 : "rootfs" [ 0.550000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.580000] mtd: device 5 (rootfs) set to be root filesystem [ 0.590000] 1 squashfs-split partitions found on MTD device rootfs [ 0.600000] 0x000000340000-0x000000800000 : "rootfs_data" [ 0.620000] ralink_soc_eth 10100000.ethernet (unregistered net_device): port 0 link up (100Mbps/Full duplex) [ 0.640000] ralink_soc_eth 10100000.ethernet: loaded mt7620 driver [ 0.650000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5 [ 0.670000] rt3xxx-usbphy usbphy.3: loaded [ 0.670000] rt2880_wdt 10000120.watchdog: Initialized [ 0.690000] TCP: cubic registered [ 0.690000] NET: Registered protocol family 17 [ 0.700000] Bridge firewalling registered [ 0.710000] 8021q: 802.1Q VLAN Support v1.8 [ 0.730000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5. [ 0.750000] Freeing unused kernel memory: 192K (80320000 - 80350000) procd: Console is alive procd: - watchdog - [ 5.370000] usbcore: registered new interface driver usbfs [ 5.390000] usbcore: registered new interface driver hub [ 5.390000] usbcore: registered new device driver usb [ 5.410000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 5.430000] ehci-platform: EHCI generic platform driver [ 5.830000] rt3xxx-usbphy usbphy.3: remote usb device wakeup disabled [ 5.850000] rt3xxx-usbphy usbphy.3: UTMI 16bit 30MHz [ 5.850000] ehci-platform 101c0000.ehci: EHCI Host Controller [ 5.870000] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1 [ 5.890000] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000 [ 5.910000] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00 [ 5.910000] hub 1-0:1.0: USB hub found [ 5.930000] hub 1-0:1.0: 1 port detected [ 5.930000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 5.950000] ohci-platform: OHCI generic platform driver [ 5.960000] ohci-platform 101c1000.ohci: Generic Platform OHCI controller [ 5.980000] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2 [ 5.980000] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000 [ 6.070000] hub 2-0:1.0: USB hub found [ 6.070000] hub 2-0:1.0: 1 port detected procd: - preinit - [ 6.950000] 8021q: adding VLAN 0 to HW filter on device eth0 [ 6.990000] random: mktemp urandom read with 65 bits of entropy available Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level jffs2 is ready No jffs2 marker was found [ 10.640000] jffs2: notice: (310) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found. switching to overlay procd: - early - procd: - watchdog - procd: - ubus - procd: - init - Please press Enter to activate this console. [ 13.590000] NET: Registered protocol family 10 [ 13.610000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 13.630000] Loading modules backported from Linux version master-2014-11-04-0-gf3660a2 [ 13.650000] Backport generated by backports.git backports-20141023-2-g4ff890b [ 13.670000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 13.690000] nf_conntrack version 0.5.0 (961 buckets, 3844 max) [ 13.730000] xt_time: kernel timezone is -0000 [ 13.770000] cfg80211: Calling CRDA to update world regulatory domain [ 13.780000] cfg80211: World regulatory domain updated: [ 13.800000] cfg80211: DFS Master region: unset [ 13.800000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time) [ 13.820000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 13.840000] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 13.860000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A) [ 13.860000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 13.890000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s) [ 13.910000] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s) [ 13.910000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 13.940000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A) [ 13.940000] PPP generic driver version 2.4.2 [ 13.940000] NET: Registered protocol family 24 [ 13.940000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 5390, rev 0500 detected [ 13.940000] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 7620 detected procd: - init complete - [ 19.730000] 8021q: adding VLAN 0 to HW filter on device eth0 [ 19.760000] device eth0.1 entered promiscuous mode [ 19.770000] device eth0 entered promiscuous mode [ 19.780000] br-lan: port 1(eth0.1) entered forwarding state [ 19.800000] br-lan: port 1(eth0.1) entered forwarding state [ 21.800000] br-lan: port 1(eth0.1) entered forwarding state [ 21.800000] ralink_soc_eth 10100000.ethernet eth0: port 0 link down [ 22.120000] br-lan: port 1(eth0.1) entered disabled state [ 28.150000] random: nonblocking pool is initialized


U-boot bootlog

U-Boot 1.1.3 (Jan 7 2013 - 11:32:07) Board: Ralink APSoC DRAM: 64 MB relocate_code Pointer at: 83fb4000 enable ephy clock...done. rf reg 29 = 5 SSC disabled. ****************************** Software System Reset Occurred ****************************** spi_wait_nsec: 29 spi device id: ef 40 16 0 0 (40160000) find flash: W25Q32BV raspi_read: from:30000 len:1000 *** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 4.1.0.0 -------------------------------------------- ASIC 7620_MP (Port5<->None) DRAM component: 512 Mbits DDR, width 16 DRAM bus: 16 bit Total memory: 64 MBytes Flash component: SPI Flash Date:Jan 7 2013 Time:11:32:07 ============================================ icache: sets:512, ways:4, linesz:32 ,total:65536 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 580 MHZ #### estimate memory size =64 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP.


Firmware bootlog

3: System Boot system code via Flash. ## Booting image at bc050000 ... raspi_read: from:50000 len:40 Image Name: Linux Kernel Image Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 3153749 Bytes = 3 MB Load Address: 80000000 Entry Point: 8000c310 raspi_read: from:50040 len:301f55 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.36 (root@localhost.localdomain) (gcc version 3.4.2) #609 Wed Jan 8 04:44:20 CST 2014 The CPU feqenuce set to 580 MHz MIPS CPU sleep mode enabled. PCIE: bypass PCIe DLL. PCIE: Elastic buffer control: Addr:0x68 -> 0xB4 disable all power about PCIe PCIE: PLL power down for MT7620N CPU revision is: 00019650 (MIPS 24Kc) Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 console=ttyS0 PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes Writing ErrCtl register=00036478 Readback ErrCtl register=00036478 Memory: 57820k/65536k available (4453k kernel code, 7716k reserved, 846k data, 1568k init, 0k highmem) NR_IRQS:128 MTK/Ralink System Tick Counter init... cd:8050ff18, m:214748, s:32 Console: colour dummy device 80x25 console [ttyS1] enabled Calibrating delay loop... 386.04 BogoMIPS (lpj=772096) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 NET: Registered protocol family 16 bio: create slab <bio-0> at 0 usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb Switching to clocksource Ralink external timer NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 RT3xxx EHCI/OHCI init. squashfs: version 4.0 (2009/01/31) Phillip Lougher NTFS driver 2.1.29 [Flags: R/W]. fuse init (API version 7.15) Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) io scheduler noop registered (default) HDLC line discipline maxframe=4096 N_HDLC line discipline registered. Ralink gpio driver initialized Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A brd: module loaded deice id : ef 40 16 0 0 (40160000) W25Q32BV(ef 40160000) (4096 Kbytes) mtd .name = raspi, .size = 0x00400000 (0M) .erasesize = 0x00000004 (0K) .numeraseregions = 65536 Creating 4 MTD partitions on "raspi": 0x000000000000-0x000000030000 : "Bootloader" 0x000000030000-0x000000040000 : "Config" 0x000000040000-0x000000050000 : "Factory" 0x000000050000-0x000000800000 : "Kernel" mtd: partition "Kernel" extends beyond the end of device "raspi" -- size truncated to 0x3b0000 rdm_major = 253 SMACCR1 -- : 0x00008c88 SMACCR0 -- : 0x2b001802 Ralink APSoC Ethernet Driver Initilization. v3.0 256 rx/tx descriptors allocated, mtu = 1500! SMACCR1 -- : 0x00008c88 SMACCR0 -- : 0x2b001802 PROC INIT OK! PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 === pAd = c0105000, size = 651752 === <-- RTMPAllocTxRxRingMemory, Status=0 <-- RTMPAllocAdapterBlock, Status=0 AP Driver version-2.7.1.5 ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1 rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000 rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2 rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000 hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected usbcore: registered new interface driver cdc_acm cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters i8042.c: i8042 controller self test timeout. Trying to free nonexistent resource <0000000000000060-000000000000006f> mice: PS/2 mouse device common for all mice usbcore: registered new interface driver usbhid usbhid: USB HID core driver nf_conntrack version 0.5.0 (903 buckets, 3612 max) nf_conntrack_rtsp v0.6.21 loading matchsize=264 xt_time: kernel timezone is -0000 nf_nat_rtsp v0.6.21 loading ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux TCP cubic registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> _nvram_read checksum = 6771 save checksum = 6771 Freeing unused kernel memory: 1568k freed Hit enter to continue...Restoring defaults...hwaddr = C0:FF:EE:C0:FF:EE ssid === NEXX_c0ffee done 7620. switch reg write offset=2004, value=ff0003 switch reg write offset=2104, value=ff0003 switch reg write offset=2204, value=ff0003 switch reg write offset=2304, value=ff0003 switch reg write offset=2404, value=ff0003 switch reg write offset=2504, value=ff0003 switch reg write offset=2010, value=81000c0 switch reg write offset=2110, value=81000c0 switch reg write offset=2210, value=81000c0 switch reg write offset=2310, value=81000c0 switch reg write offset=2410, value=81000c0 switch reg write offset=2510, value=81000c0 switch reg write offset=2610, value=8100000 switch reg write offset=2710, value=8100000 switch reg write offset=2604, value=20ff0003 switch reg write offset=2704, value=Raeth v3.0 (20Taskletff,SkbRecycle0) 003 phy_tx_ring = 0x03231000, tx_ring = 0xa3231000 phy_rx_ring0 = 0x03232000, rx_ring0 = 0xa3232000 SMACCR1 -- : 0x00008c88 SMACCR0 -- : 0x2b001802 swESW: Link Status Changed - Port4 Link UP itCDMA_CSG_CFG = 81000000 chGDMA1_FWD_CFG = 20710000 reg write offset=2610, value=81000000 switch reg write offset=2014, value=10001 switch reg write offset=2114, value=10001 switch reg write offset=2214, value=10001 Algorithmics/MIPS FPU Emulator v1.5 switch reg write offset=2314, value=10001 switch reg write offset=2414, value=10002 switch reg write offset=2514, value=10001 insmod: scsi_mod.ko: module not found insmod: cdrom.ko: module not found insmod: sr_mod.ko: module not found insmod: scsi_wait_scan.ko: module not found insmod: usb-storage.ko: module not found insmod: sd_mod.ko: module not found sh: can't create /proc/sys/net/netfilter/nf_conntrack_buckets: Permission denied ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device RX DESC a30f0000 size = 2048 RTMP_TimerListAdd: add timer obj c0174a80! RTMP_TimerListAdd: add timer obj c0142260! RTMP_TimerListAdd: add timer obj c0142234! RTMP_TimerListAdd: add timer obj c0142208! RTMP_TimerListAdd: add timer obj c014b5ec! RTMP_TimerListAdd: add timer obj c014b708! RTMP_TimerListAdd: add timer obj c014b618! RTMP_TimerListAdd: add timer obj c014298c! RTMP_TimerListAdd: add timer obj c010a550! RTMP_TimerListAdd: add timer obj c010b3cc! RTMP_TimerListAdd: add timer obj c010c248! RTMP_TimerListAdd: add timer obj c010d0c4! RTMP_TimerListAdd: add timer obj c010df40! RTMP_TimerListAdd: add timer obj c010edbc! RTMP_TimerListAdd: add timer obj c010fc38! RTMP_TimerListAdd: add timer obj c0110ab4! RTMP_TimerListAdd: add timer obj c014269c! APSDCapable[0]=0 APSDCapable[1]=0 APSDCapable[2]=0 APSDCapable[3]=0 APSDCapable[4]=0 APSDCapable[5]=0 APSDCapable[6]=0 APSDCapable[7]=0 APSDCapable[8]=0 APSDCapable[9]=0 APSDCapable[10]=0 APSDCapable[11]=0 APSDCapable[12]=0 APSDCapable[13]=0 APSDCapable[14]=0 APSDCapable[15]=0 default ApCliAPSDCapable[0]=0 Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) 1. Phy Mode = 9 2. Phy Mode = 9 E2PROM: D0 target power=0xff20 E2PROM: 40 MW Power Delta= 0 3. Phy Mode = 9 RTMP_TimerListAdd: add timer obj c010a148! AntCfgInit: primary/secondary ant 0/1 Initialize RF Central Registers for E2 !!! Initialize RF Central Registers for E3 !!! Initialize RF Channel Registers for E2 !!! Initialize RF Channel Registers for E3 !!! Initialize RF DCCal Registers for E2 !!! Initialize RF DCCal Registers for E3 !!! D1 = 0, D2 = 8, CalCode = 19 !!! RT6352_Temperature_Init : BBPR49 = 0x0 RT6352_Temperature_Init : TemperatureRef25C = 0xfffffff6 Current Temperature from BBP_R49=0xfffffffd TX BW Filter Calibration !!! RX BW Filter Calibration !!! LOFT Calibration Done! IQCalibration Start! IQCalibration Done! CH = 0, (gain= 0, phase=3e) IQCalibration Start! IQCalibration Done! CH = 1, (gain= 1, phase= 2) TX IQ Calibration Done! internal ALC is not enabled in NVM ! MCS Set = ff ff 00 00 01 RTMP_TimerListAdd: add timer obj c0142ef8! Main bssid = C0:FF:EE:C0:FF:EE <==== rt28xx_init, Status=0 0x1300 = 00064380 killall: rt2860apd: no process killed rt2860apd: No such file or directory device eth2 entered promiscuous mode device ra0 entered promiscuous mode device eth2.2 entered promiscuous mode br0: port 2(eth2.2) entering forwarding state br0: port 2(eth2.2) entering forwarding state br0: port 1(ra0) entering forwarding state br0: port 1(ra0) entering forwarding state Changing password for admin Password for admin changed by admin proftpd: No such file or directory config_samba.sh: No such file or directory info, udhcp server (v0.9.8) started time.windows.com: Unknown host open error Open /proc/max/macfilter Failed Interface doesn't accept private ioctl... set (8BE2): Invalid argument Open /proc/max/trackerurl Failed IDLE Hit enter to continue...Hit enter to continue...Hit enter to continue...info, udhcp client (v0.9.8) started info, Sending discover... (4)


The device is small and convenient for plug and forget usage in many ways. Therefore it is shame it does not have a PoE capability. As it has only Fast ethernet 100 Mbps (WAN and LAN ports), we can manually take unusued ethernet conductors and use them for do-it-yourself PoE.

  • Some thin wires
  • DC-DC converter
  • Power switch or relay (to prevent reverse current flow to ethernet in case of using microUSB power delivery)
  • Multimeter and patience
  • DO NOT FORGET, THAT ALL PARTS OF THE CIRCUIT MUST HANDLE MAXIMUM CURRENT DELIVERY. NEXX ITSELF HAS 1.2 ADC, for me the weakest part is DC-DC converter that can handle 1.7 A, but it is still higher than the limit.

PoE uses unused ethernet pins 5-6 (blue; +DC) and 7-8 (brown; GND) to power delivery in case you have only fast ethernet 10/100 Mbit. So you can unsolder them from the board and use them for PoE. For that task, I used small scissors and ripped them off the board :P
You can use pins from WAN or LAN ports or both if you wish. I used pins from WAN port (in the picture 1a with GND connected to ethernet shield and 1b).
You can power PoE by many voltage sources, so there is step down DC-DC converter (2.) which can handle 5-17 VDC input and is set up to 5 VDC output. Therefore you can PoE it from 5 to 17 volts power sources.
From there, the left side output GND is again connected to (not visible) ethernet shield (not necessary, 1a GND is also connected so this is “just in case”) and the +5 VDC output goes to power switch. The power switch is important if you do not have reverse current protection! There you choose between PoE and microUSB power delivery. You can also use some relay to do this automaticaly.
I connected the +5 VDC output to female USB-A +5 VDC pin as it was the largest part that you can use for this ;)
You also need to “adjust” the above router cover if you use the power switch - I fixed the switch on the USB-A port. And remember to isolate all moving parts to prevent unwanted short-circuit. I used glue gun for that (see the bottom of DC-DC converter).

Use multimeter resistance measurement to see, which parts are connected to which. The 5 VDC are short-circuited on both microUSB and USB-A ports, same with the GND.
Do not use diode for reverse current protection as there will be voltage drop and unnecessary power losses.
And the last thing - this is only my idea how to do PoE on Nexx WT3020. Do it as you wish if you like to.
The result pic, I can not upload it here

The device is small and convenient for plug and forget usage in many ways. But since v21 arrived even 8MB devices are sometime short in flash depending of the set of packages you need.

Skills in HW soldering as in case you degrade the PCB YOUR DEVICE IS DEAD
Iron with a pin end as wide as the four leads of a SO8 (easier to heat one side of the chip at once when removing)
Iron with a fine pin end (easier to avoid short circuits when soldering)
Some flux to improve the thermal contact when removing the chip
isopropyl alcohol for cleanning flux residues (using an old toothbrush)
Some solder sucking wick to clean the pads once the chip has been removed
A new flash en25Q64 or W25Q64 for 8MB, MX25L128 for 16MB or MX25L256 for 32MB (those chips are recognized by the u-boot and have the same pin out and form factor of the origninal S08 device)
A flash programmer HW and SW (I used a CH341 full 3.3V HW, be carefull to this because many chinese devices have 3.3V flash supply with 5V data signals, and the AsProgammer SW)
A modified unit with console access.

You MUST backup the u-boot, u-boot-env and factory partitions. This is easily done if you a are running v19 from the System/Backup Flash Firmware/Save mtd block content.
It can be done from the console as well:
dd if=/dev/mtdX of=/tmp/FILENAME
for each partition, then you have to get the files on a backup disk.
This step is particularly critical for the factory data which are dedicated to the particular unit you are modifying (HW settings).
As the three partitions are at the beginning of the flash it is easy to setup the new flash. I means also that previous FW version (original size) will still work.
You MUST also verify that you can compile a FW version for this unit using the config.buildinfo of the version you want to generate (no need if you just move from 4MB to 8MB FW already exist). The new FW will later address a new flash capacity and will need access to the kernel modules repo (vermagic MUST be identical).
Create a flash of the new size having the three original partitions at the beginning and verify that the content is identical to the source data.

Select the branch of the release you want to generate. You have to look for the files to modify (the ones where the device is specifically identified). Be carefull, the files are not always identical from one branch to the next.
grep -rl “WT3020”
grep -rl “wt3020”

In v21.02.0-rc4 the files to be modified are:
target/linux/ramips/base-files/etc/board.d/02_network
target/linux/ramips/image/mt7620.mk
tools/firmware-utils/src/mkporayfw.c
You also need to create the appropriate dts in folder target/linux/ramips/dts
I personaly expand the flash to 16MB and this is the example I will show below.

In: target/linux/ramips/base-files/etc/board.d/02_network
look for the section related to WT3020 and add the new device

	wt3020-4m|\
	wt3020-8m|\
	wt3020-16m)
		ucidef_add_switch "switch0" \
			"4:lan" "0:wan" "6@eth0"
		;;

create the dts file taking one of the existing as a reference.
You can see that only the compatible, model and firmware partition are to be modified

target/linux/ramips/dts/mt7620n_nexx_wt3020-16m.dts

#include "mt7620n_nexx_wt3020.dtsi"

/ {
	compatible = "nexx,wt3020-16m", "nexx,wt3020", "ralink,mt7620n-soc";
	model = "Nexx WT3020 (16M)";
};

&ehci {
	status = "okay";
};

&ohci {
	status = "okay";
};

&spi0 {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <10000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "u-boot";
				reg = <0x0 0x30000>;
				read-only;
			};

			partition@30000 {
				label = "u-boot-env";
				reg = <0x30000 0x10000>;
				read-only;
			};

			factory: partition@40000 {
				label = "factory";
				reg = <0x40000 0x10000>;
				read-only;
			};

			partition@50000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x50000 0xfb0000>;
			};
		};
	};
};

In: target/linux/ramips/image/mt7620.mk
look for the section related to WT3020 and add the new device.
The image size is easily calculated from the firmware partition size listed in the new dts file.
The firmware partition size is: 0xfb0000 = 16449536, 16449536/1024 = 16064k

define Device/nexx_wt3020-16m
  SOC := mt7620n
  IMAGE_SIZE := 16064k
  IMAGES += factory.bin
  IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
	poray-header -B WT3020 -F 16M
  DEVICE_VENDOR := Nexx
  DEVICE_MODEL := WT3020
  DEVICE_VARIANT := 16M
  DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
  SUPPORTED_DEVICES += wt3020 wt3020-16M
endef
TARGET_DEVICES += nexx_wt3020-16m

in: tools/firmware-utils/src/mkporayfw.c
Just have to modify the struct flash_layout and struct board_info to add the new flash size and board name

static struct flash_layout layouts[] = {
	{
		.id		= "4M",
		.fw_max_len	= 0x3c0000,
	}, {
		.id		= "8M",
		.fw_max_len	= 0x7c0000,
	}, {
		.id		= "16M",
		.fw_max_len	= 0xfc0000,
	}, {
		/* terminating entry */
	}
};

static struct board_info boards[] = {
	{
		.id             = "A5-V11",
		.hw_id          = HWID_A5_V11,
		.layout_id      = "4M",
		.key            = KEY_A5_V11,
        }, {
		.id		= "MPR-A1",
		.hw_id		= HWID_HAME_MPR_A1_L8,
		.layout_id	= "4M",
		.key		= KEY_HAME,
	}, {
		.id		= "MPR-L8",
		.hw_id		= HWID_HAME_MPR_A1_L8,
		.layout_id	= "4M",
		.key		= KEY_HAME,
	}, {
		.id		= "R50B",
		.hw_id		= HWID_PORAY_R50B,
		.layout_id	= "4M",
		.key		= KEY_PORAY_2,
	}, {
		.id		= "R50D",
		.hw_id		= HWID_PORAY_R50D,
		.layout_id	= "4M",
		.key		= KEY_PORAY_3,
	}, {
		.id		= "R50E",
		.hw_id		= HWID_PORAY_R50E,
		.layout_id	= "4M",
		.key		= KEY_PORAY_4,
	}, {
		.id		= "M3",
		.hw_id		= HWID_PORAY_M3,
		.layout_id	= "4M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "M4",
		.hw_id		= HWID_PORAY_M4,
		.layout_id	= "4M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "Q3",
		.hw_id		= HWID_PORAY_Q3,
		.layout_id	= "4M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "X5 or X6",
		.hw_id		= HWID_PORAY_X5_X6,
		.layout_id	= "8M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "X5",
		.hw_id		= HWID_PORAY_X5_X6,
		.layout_id	= "8M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "X6",
		.hw_id		= HWID_PORAY_X5_X6,
		.layout_id	= "8M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "X8",
		.hw_id		= HWID_PORAY_X8,
		.layout_id	= "8M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "X1",
		.hw_id		= HWID_PORAY_X1,
		.layout_id	= "8M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "WT1520",
		.hw_id		= HWID_NEXX_WT1520,
		.layout_id	= "4M",
		.key		= KEY_NEXX_1,
	}, {
		.id		= "WT1520",
		.hw_id		= HWID_NEXX_WT1520,
		.layout_id	= "8M",
		.key		= KEY_NEXX_1,
        }, {
                .id             = "WT3020",
                .hw_id          = HWID_NEXX_WT3020,
                .layout_id      = "4M",
                .key            = KEY_NEXX_2,
        }, {
                .id             = "WT3020",
                .hw_id          = HWID_NEXX_WT3020,
                .layout_id      = "8M",
                .key            = KEY_NEXX_2,
        }, {
                .id             = "WT3020",
                .hw_id          = HWID_NEXX_WT3020,
                .layout_id      = "16M",
                .key            = KEY_NEXX_2,
        }, {




		/* terminating entry */
	}
};

Generate the new FW and verify that the vermagic is identical to the one of the current branch.

NOTE since 22.03
dtsi/dts: the partitioning of the content between the two files is different. Setup the mt7620n_nexx_wt3020-16m.dts file according the new format, data are similar.

mkporayfw.c: the file is part of the firmware-utils package which moved in a separate repository. You will have to clone the repo, modify the mkporayfw.c file as previously and generate a patch.

cd /your/working/directory/               # not the openwrt one
git clone https://git.openwrt.org/project/firmware-utils.git
cd firmware-utils/src
(edit mkporayfw.c as previously)
git diff HEAD > 900-mkporayfw-16m.patch   # or any filename
cd /your/openwrt/directory/
mkdir tools/firmware-utils/patches
cp your patch into the above directory

You will have to build from a clean version so that the patch is applied.

Remember that you MUST avoid to overheat the PCB neither to pull the flash when removing it (taking the risk to pill the PCB pads and KILL you device).
Put some flux on the flash pads
Unsolder the flash
Once it's done clean the pads using the solder sucking wick (no overheat! add flux if necessary)
Take the new flash you have programmed/verified and solder it in place (take care to the orientation and short circuits)
Clean flux residues (isopropyl alcohol)

Check with the console access that your unit is starting, obviously it will fail at the end because no FW is loaded but the uboot process start shall complete.
You can now load the new FW using TFTP (option 2 in the u-boot start menu)
The default TFTP server address is at 192.168.0.233
The default FW image name is root_uImage
Once it's done your unit is ready to use. Future FW release can be updated as usual.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by 127.0.0.1