Nexx WT3020

The Nexx WT3020 is a series of miniature routers based on the MediaTek MT7620n with two Ethernet ports and a 802.11n 2T/2R 2.4 GHz 300Mbps wireless interface. There are several models with different hardware and software features.

There are four known versions (according to the manufacturer) with different functionalities:

¹: differences between WT3020H, WT3020F and WT3020AD are only found in the original firmware
²: extra features are unknown
³: different hardware model, see below

¹: depending on model

The serial port of the WT3020 can be accessed using the TTL pins shown in the image below. A voltage level converter (such as a CP2102 TTL-USB dongle) is required.

The communication settings are: 57600 bps 8N1.

On the WT3020H model (8 MB flash), the Ethernet MAC starts with 20:28:18:...

GPIOs 0, 2, 18, and 19 are exposed on the board, as was tested with this method. They are connected to pull-down resistors. Click to enlarge the photos to see where the GPIOs are.

• certain versions of uboot are reported as problematic​- POSSIBLE BRICK
• factory firmware to do the initial upgrade is reported non-working, fails with “Bad Magic Number”,​ sysupgrade via mtd works
• failsafe mode is reported non-working The same issue again exists with the WT3020F “new” hardware model on CC.15.05rc3

As of 2024-06-02 the following is confirmed to be working

# md5sum breed-mt7620-reset1.bin
f341bb3295566695996656bf249b34b1  breed-mt7620-reset1.bin

To upgrade, put a ethernet cable into the LAN (next to the micro usb). Press and hold the reset-button and insert the micro-usb for power. After 3 seconds let go of the the reset-button. Shortly after the former breed-web-interface will show up on 192.168.1.1 From there you can also flash the most recent openwrt-23.05.3-ramips-mt7620-nexx_wt3020-8m-squashfs-sysupgrade.bin If you struggle with the chinese web interface, use google translate on your phone with a camera. The upgrade menu is the second one from the top. You can also reach it with this url http://192.168.1.1/upgrade.html Then there are three options. bootloader, the second one is the ROM (it's in chinese) where you flash the -sysupgrade.bin and the third one is eeprom (don't use that).

As of 2016-09-03 the following is confirmed to be working:

Uboot http://breed.hackpascal.net/

Filename	breed-mt7620-reset1.bin
Size	80KB (82015B)
MD5	0294140fdaa4c736f5a05fbcd7b7d130

Filename	breed-mt7620-reset1.bin
Timestamp	2018-10-14 20:50
Size	89K (91224B)
MD5	04df1cf3aec4cf6e2b676e49f20830ad

(tested successfully with stock firmware, OpenWRT 18.06.1 and snapshot from 2018-10-21 on WT3020F, but flashed before moving to OpenWRT)

A guide for getting from stock to OpenWrt and to install OnionWrt can be found here: http://www.securityskeptic.com/2016/01/how-to-turn-a-nexx-wt3020-router-into-a-tor-router.html. The referenced OnionWrt Tor router install script can be found on the Internet Archive.

Uboot can be flashed like this (only if mtd0 is writable, on stock it's possible, on OpenWrt mtd0 is usually read-only in dts):

# mtd_write unlock mtd0 
GetFileSize: No such file or directory 
Unlocking mtd0 ... 
# mtd_write erase mtd0 
GetFileSize: No such file or directory 
Unlocking mtd0 ... 
Erasing mtd0 ... 
Erase char is 255 
# mtd_write -r write breed-mt7620-reset1.bin mtd0 
Unlocking mtd0 ... 
Writing from breed-mt7620-reset1.bin to mtd0 ... [w]

(at this time router output may stop and router will reboot)

Use the factory.bin image for initial install via stock firmware web-UI.

1. Download firmware (see above)
2. Connect to the WLAN “NEXX_...”, no password is needed or connect via LAN cable (preferred)
3. Go to http://192.168.8.1 → Username: admin, Password: admin, System Setting → Upgrade Firmware
4. Select the downloaded firmware file and press “Upgrade”
5. After a while, you will get “Rebooting... System reboot takes a few moment, you might need to reconnect to the Router after rebooting.”
6. After the system comes up, you should be able to log-in via LuCI at http://192.168.1.1/

root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "factory"
mtd3: 007b0000 00010000 "firmware"
mtd4: 001369e9 00010000 "kernel"
mtd5: 00679617 00010000 "rootfs"
mtd6: 004f0000 00010000 "rootfs_data"

* These values depend on the kernel image size.

The flash chip usually holds the operating system, mac address and calibration data. To get the binary blob from the flash chip, use a SPI programmer (CH341A in this case, or use a RasPi). Attach a clamp on the flash chip and connecting it to the SPI programmer:

flashrom -c W25Q64.V -p ch341a_spi -r /tmp/data

The u-boot-env mtd partition contains 4096 bytes of data used by U-Boot and some remaining garbage from the original firmware.

Configuration for uboot-envtools:

root@OpenWrt:/# cat /etc/fw_env.config
# MTD device    Offset     Env size     Flash sector size
/dev/mtd1       0x0000     0x1000

The /dev/mtd2 partition contains configuration and calibration data. The MAC address is stored with offset 4.

root@OpenWrt:/# hexdump -C /dev/mtd2
00000000  20 76 05 01 20 28 18 aa  bb cc ff ff ff ff ff ff  | v.. (... ......|
[...]

The MAC address (macaddr / hwaddr) is copied to /etc/config/network on the first boot after flashing a new OpenWrt image.

The MAC address of eth0.1 in this example is 20:28:18:aa:bb:cc. eth0.2 will get the same MAC address increased by one, e.g. 20:28:18:aa:bb:cd.

The meaning of the remaining data is still unknown. It may contain some calibration data for WiFi.

Failsafe mode appears to be broken as of r43977 (fixme). Please see https://dev.openwrt.org/ticket/18768

Update 03 jan 2018:
Failsafe mode appears again to be broken, with the new hardware model. More details will follow.

Since there is no visible (blinking LED) indication that would tell when the kernel has finished loading, you need to find out the right timing. Looking at the output of the serial console, a reliable way of entering failsafe mode is to power on the device, wait for 10 seconds, then start pressing the reset button repeatedly until you reach 20 seconds. Now you should be in failsafe mode (as can be verified by looking at the serial console).

However, as of r43977, it seems to be impossible to log in over Ethernet. Is this a bug?

In failsafe mode as of r43977, the network is configured like this as we can see from the serial console:

root@(none):/# ifconfig

eth0      Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:xx  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:1043 (1.0 KiB)
          Interrupt:5 

Looking at /rom/lib/preinit/07_set_preinit_iface_ramips, it appears that failsafe mode is known broken on this device as of r43977.

root@WT3020H:~# cat /rom/lib/preinit/07_set_preinit_iface_ramips
#!/bin/sh
#
# Copyright (C) 2013 OpenWrt.org
#

. /lib/ramips.sh

ramips_set_preinit_iface() {
	RT3X5X=`cat /proc/cpuinfo | egrep "(RT3.5|RT5350|MT7628)"`
	if [ -n "${RT3X5X}" ]; then
		swconfig dev rt305x set reset 1
	fi

	if echo $RT3X5X | egrep -q "(RT5350|MT7628)"; then
		# This is a dirty hack to get by while the switch
		# problem is investigated. When VLAN is disabled, ICMP
		# pings work as expected, but TCP connections time
		# out, so telnetting in failsafe is impossible. The
		# likely reason is TCP checksumming hardware getting
		# disabled:
		# https://www.mail-archive.com/openwrt-devel@lists.openwrt.org/msg19870.html
		swconfig dev rt305x set enable_vlan 1
		swconfig dev rt305x vlan 1 set ports "0 6"
		swconfig dev rt305x port 6 set untag 0
		swconfig dev rt305x set apply 1
		vconfig add eth0 1
		ifconfig eth0 up
		ifname=eth0.1
	else
		ifname=eth0
	fi
}

As you can see, the code is looking for MT7628 but the Nexx WT3020 has MT7620N.

root@WT3020H:~# cat /proc/cpuinfo
system type		: Ralink MT7620N ver:2 eco:6
machine			: Nexx WT3020
processor		: 0
cpu model		: MIPS 24KEc V5.0
BogoMIPS		: 766.77

In failsafe mode, using the serial console, we see:

root@(none):/# swconfig list
Found: switch0 - mt7620

So possibly some code along the lines of https://lists.openwrt.org/pipermail/openwrt-devel/2014-August/027316.html needs to be added in order for OpenWrt Failsafe to work on this device, since as of r43977 it does not work yet.

As of r43977, after booting OpenWrt, the nework configuration looks like this by default. Note that the WAN port (towards the edge of the PCB) is eth0.2.

root@OpenWrt:/# cat /etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd98:xxx:0888::/48'

config interface 'lan'
	option ifname 'eth0.1'
	option force_link '1'
	option macaddr '20:28:18:xx:xx:7e'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option ifname 'eth0.2'
	option force_link '1'
	option macaddr '20:28:18:xx:xx:7f'
	option proto 'dhcp'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0 6t'

root@OpenWrt:/# ifconfig

br-lan    Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fd98:xxxx:888::1/60 Scope:Global
          inet6 addr: fe80::xxxx:xxxx:xxxx:xxxx/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:41 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:5430 (5.3 KiB)

eth0      Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          inet6 addr: fe80::xxxx:xxxx:xxxx:xxxx/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:275 errors:0 dropped:0 overruns:0 frame:0
          TX packets:143 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:43656 (42.6 KiB)  TX bytes:16916 (16.5 KiB)
          Interrupt:5 

eth0.1    Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:30 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:4324 (4.2 KiB)

eth0.2    Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          inet addr:192.168.0.16  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::2228:xxxx:xxxx:xxxx/64 Scope:Link
          inet6 addr: 2a02:908:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:267 errors:0 dropped:0 overruns:0 frame:0
          TX packets:105 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:37258 (36.3 KiB)  TX bytes:9905 (9.6 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:16 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1648 (1.6 KiB)  TX bytes:1648 (1.6 KiB)

Without Ethernet cable attached:

root@WT3020H:/# swconfig dev switch0  show
Global attributes:
	enable_vlan: 1
Port 0:
	pvid: 2
	link: port:0 link:down
Port 1:
	pvid: 1
	link: port:1 link:down
Port 2:
	pvid: 1
	link: port:2 link:down
Port 3:
	pvid: 1
	link: port:3 link:down
Port 4:
	pvid: 1
	link: port:4 link:down
Port 5:
	pvid: 0
	link: port:5 link:down
Port 6:
	pvid: 0
	link: port:6 link:up speed:1000baseT full-duplex 
Port 7:
	pvid: 0
	link: port:7 link:down
VLAN 1:
	vid: 1
	ports: 1 2 3 4 6t 
VLAN 2:
	vid: 2
	ports: 0 6t 

With Ethernet cable attached to the WAN port (edge of the PCB):

root@WT3020H:/# swconfig dev switch0  show
Global attributes:
	enable_vlan: 1
Port 0:
	pvid: 2
	link: port:0 link:up speed:100baseT full-duplex 
Port 1:
	pvid: 1
	link: port:1 link:down
Port 2:
	pvid: 1
	link: port:2 link:down
Port 3:
	pvid: 1
	link: port:3 link:down
Port 4:
	pvid: 1
	link: port:4 link:down
Port 5:
	pvid: 0
	link: port:5 link:down
Port 6:
	pvid: 0
	link: port:6 link:up speed:1000baseT full-duplex 
Port 7:
	pvid: 0
	link: port:7 link:down
VLAN 1:
	vid: 1
	ports: 1 2 3 4 6t 
VLAN 2:
	vid: 2
	ports: 0 6t 

Out of the box, you can connect the device to your Ethernet network using the WAN ethernet port (the one next to the edge of the board). It will grab an IP address from the network using DHCP. You then can log in to the device using telnet like this:

$ telnet <IP address assigned by DHCP>

Escape character is '^]'.

(none) login: nexxadmin
Password: y1n2inc.com0755

This is a log using OpenWrt CHAOS CALMER (Bleeding Edge, r43977)

The device is small and convenient for plug and forget usage in many ways. Therefore it is shame it does not have a PoE capability. As it has only Fast ethernet 100 Mbps (WAN and LAN ports), we can manually take unusued ethernet conductors and use them for do-it-yourself PoE.

• Some thin wires
• DC-DC converter
• Power switch or relay (to prevent reverse current flow to ethernet in case of using microUSB power delivery)
• Multimeter and patience
• DO NOT FORGET, THAT ALL PARTS OF THE CIRCUIT MUST HANDLE MAXIMUM CURRENT DELIVERY. NEXX ITSELF HAS 1.2 ADC, for me the weakest part is DC-DC converter that can handle 1.7 A, but it is still higher than the limit.

PoE uses unused ethernet pins 5-6 (blue; +DC) and 7-8 (brown; GND) to power delivery in case you have only fast ethernet 10/100 Mbit. So you can unsolder them from the board and use them for PoE. For that task, I used small scissors and ripped them off the board :P
You can use pins from WAN or LAN ports or both if you wish. I used pins from WAN port (in the picture 1a with GND connected to ethernet shield and 1b).
You can power PoE by many voltage sources, so there is step down DC-DC converter (2.) which can handle 5-17 VDC input and is set up to 5 VDC output. Therefore you can PoE it from 5 to 17 volts power sources.
From there, the left side output GND is again connected to (not visible) ethernet shield (not necessary, 1a GND is also connected so this is “just in case”) and the +5 VDC output goes to power switch. The power switch is important if you do not have reverse current protection! There you choose between PoE and microUSB power delivery. You can also use some relay to do this automaticaly.
I connected the +5 VDC output to female USB-A +5 VDC pin as it was the largest part that you can use for this ;)
You also need to “adjust” the above router cover if you use the power switch - I fixed the switch on the USB-A port. And remember to isolate all moving parts to prevent unwanted short-circuit. I used glue gun for that (see the bottom of DC-DC converter).

Use multimeter resistance measurement to see, which parts are connected to which. The 5 VDC are short-circuited on both microUSB and USB-A ports, same with the GND.
Do not use diode for reverse current protection as there will be voltage drop and unnecessary power losses.
And the last thing - this is only my idea how to do PoE on Nexx WT3020. Do it as you wish if you like to.

The result pic:

The device is small and convenient for plug and forget usage in many ways. But since v21 arrived even 8MB devices are sometime short in flash depending of the set of packages you need.

Skills in HW soldering as in case you degrade the PCB YOUR DEVICE IS DEAD
Iron with a pin end as wide as the four leads of a SO8 (easier to heat one side of the chip at once when removing)
Iron with a fine pin end (easier to avoid short circuits when soldering)
Some flux to improve the thermal contact when removing the chip
isopropyl alcohol for cleanning flux residues (using an old toothbrush)
Some solder sucking wick to clean the pads once the chip has been removed
A new flash en25Q64 or W25Q64 for 8MB, MX25L128 for 16MB or MX25L256 for 32MB (those chips are recognized by the u-boot and have the same pin out and form factor of the origninal S08 device)
A flash programmer HW and SW (I used a CH341 full 3.3V HW, be carefull to this because many chinese devices have 3.3V flash supply with 5V data signals, and the AsProgammer SW)
A modified unit with console access.

You MUST backup the u-boot, u-boot-env and factory partitions. This is easily done if you a are running v19 from the System/Backup Flash Firmware/Save mtd block content.
It can be done from the console as well:
dd if=/dev/mtdX of=/tmp/FILENAME
for each partition, then you have to get the files on a backup disk.
This step is particularly critical for the factory data which are dedicated to the particular unit you are modifying (HW settings).
As the three partitions are at the beginning of the flash it is easy to setup the new flash. I means also that previous FW version (original size) will still work.
You MUST also verify that you can compile a FW version for this unit using the config.buildinfo of the version you want to generate (no need if you just move from 4MB to 8MB FW already exist). The new FW will later address a new flash capacity and will need access to the kernel modules repo (vermagic MUST be identical).
Create a flash of the new size having the three original partitions at the beginning and verify that the content is identical to the source data.

Select the branch of the release you want to generate. You have to look for the files to modify (the ones where the device is specifically identified). Be carefull, the files are not always identical from one branch to the next.
grep -rl “WT3020”
grep -rl “wt3020”

In v21.02.0-rc4 the files to be modified are:
target/linux/ramips/base-files/etc/board.d/02_network
target/linux/ramips/image/mt7620.mk
tools/firmware-utils/src/mkporayfw.c
You also need to create the appropriate dts in folder target/linux/ramips/dts
I personaly expand the flash to 16MB and this is the example I will show below.

In: target/linux/ramips/base-files/etc/board.d/02_network
look for the section related to WT3020 and add the new device

	wt3020-4m|\
	wt3020-8m|\
	wt3020-16m)
		ucidef_add_switch "switch0" \
			"4:lan" "0:wan" "6@eth0"
		;;

create the dts file taking one of the existing as a reference.
You can see that only the compatible, model and firmware partition are to be modified

target/linux/ramips/dts/mt7620n_nexx_wt3020-16m.dts

#include "mt7620n_nexx_wt3020.dtsi"

/ {
	compatible = "nexx,wt3020-16m", "nexx,wt3020", "ralink,mt7620n-soc";
	model = "Nexx WT3020 (16M)";
};

&ehci {
	status = "okay";
};

&ohci {
	status = "okay";
};

&spi0 {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <10000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "u-boot";
				reg = <0x0 0x30000>;
				read-only;
			};

			partition@30000 {
				label = "u-boot-env";
				reg = <0x30000 0x10000>;
				read-only;
			};

			factory: partition@40000 {
				label = "factory";
				reg = <0x40000 0x10000>;
				read-only;
			};

			partition@50000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x50000 0xfb0000>;
			};
		};
	};
};

In: target/linux/ramips/image/mt7620.mk
look for the section related to WT3020 and add the new device.
The image size is easily calculated from the firmware partition size listed in the new dts file.
The firmware partition size is: 0xfb0000 = 16449536, 16449536/1024 = 16064k

define Device/nexx_wt3020-16m
  SOC := mt7620n
  IMAGE_SIZE := 16064k
  IMAGES += factory.bin
  IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
	poray-header -B WT3020 -F 16M
  DEVICE_VENDOR := Nexx
  DEVICE_MODEL := WT3020
  DEVICE_VARIANT := 16M
  DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
  SUPPORTED_DEVICES += wt3020 wt3020-16M
endef
TARGET_DEVICES += nexx_wt3020-16m

in: tools/firmware-utils/src/mkporayfw.c
Just have to modify the struct flash_layout and struct board_info to add the new flash size and board name

static struct flash_layout layouts[] = {
	{
		.id		= "4M",
		.fw_max_len	= 0x3c0000,
	}, {
		.id		= "8M",
		.fw_max_len	= 0x7c0000,
	}, {
		.id		= "16M",
		.fw_max_len	= 0xfc0000,
	}, {
		/* terminating entry */
	}
};

static struct board_info boards[] = {
	{
		.id             = "A5-V11",
		.hw_id          = HWID_A5_V11,
		.layout_id      = "4M",
		.key            = KEY_A5_V11,
        }, {
		.id		= "MPR-A1",
		.hw_id		= HWID_HAME_MPR_A1_L8,
		.layout_id	= "4M",
		.key		= KEY_HAME,
	}, {
		.id		= "MPR-L8",
		.hw_id		= HWID_HAME_MPR_A1_L8,
		.layout_id	= "4M",
		.key		= KEY_HAME,
	}, {
		.id		= "R50B",
		.hw_id		= HWID_PORAY_R50B,
		.layout_id	= "4M",
		.key		= KEY_PORAY_2,
	}, {
		.id		= "R50D",
		.hw_id		= HWID_PORAY_R50D,
		.layout_id	= "4M",
		.key		= KEY_PORAY_3,
	}, {
		.id		= "R50E",
		.hw_id		= HWID_PORAY_R50E,
		.layout_id	= "4M",
		.key		= KEY_PORAY_4,
	}, {
		.id		= "M3",
		.hw_id		= HWID_PORAY_M3,
		.layout_id	= "4M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "M4",
		.hw_id		= HWID_PORAY_M4,
		.layout_id	= "4M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "Q3",
		.hw_id		= HWID_PORAY_Q3,
		.layout_id	= "4M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "X5 or X6",
		.hw_id		= HWID_PORAY_X5_X6,
		.layout_id	= "8M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "X5",
		.hw_id		= HWID_PORAY_X5_X6,
		.layout_id	= "8M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "X6",
		.hw_id		= HWID_PORAY_X5_X6,
		.layout_id	= "8M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "X8",
		.hw_id		= HWID_PORAY_X8,
		.layout_id	= "8M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "X1",
		.hw_id		= HWID_PORAY_X1,
		.layout_id	= "8M",
		.key		= KEY_PORAY_1,
	}, {
		.id		= "WT1520",
		.hw_id		= HWID_NEXX_WT1520,
		.layout_id	= "4M",
		.key		= KEY_NEXX_1,
	}, {
		.id		= "WT1520",
		.hw_id		= HWID_NEXX_WT1520,
		.layout_id	= "8M",
		.key		= KEY_NEXX_1,
        }, {
                .id             = "WT3020",
                .hw_id          = HWID_NEXX_WT3020,
                .layout_id      = "4M",
                .key            = KEY_NEXX_2,
        }, {
                .id             = "WT3020",
                .hw_id          = HWID_NEXX_WT3020,
                .layout_id      = "8M",
                .key            = KEY_NEXX_2,
        }, {
                .id             = "WT3020",
                .hw_id          = HWID_NEXX_WT3020,
                .layout_id      = "16M",
                .key            = KEY_NEXX_2,
        }, {




		/* terminating entry */
	}
};

Generate the new FW and verify that the vermagic is identical to the one of the current branch.

NOTE since 22.03
dtsi/dts: the partitioning of the content between the two files is different. Setup the mt7620n_nexx_wt3020-16m.dts file according the new format, data are similar.

mkporayfw.c: the file is part of the firmware-utils package which moved in a separate repository. You will have to clone the repo, modify the mkporayfw.c file as previously and generate a patch.

cd /your/working/directory/               # not the openwrt one
git clone https://git.openwrt.org/project/firmware-utils.git
cd firmware-utils/src
(edit mkporayfw.c as previously)
git diff HEAD > 900-mkporayfw-16m.patch   # or any filename
cd /your/openwrt/directory/
mkdir tools/firmware-utils/patches
cp your patch into the above directory

You will have to build from a clean version so that the patch is applied.

Remember that you MUST avoid to overheat the PCB neither to pull the flash when removing it (taking the risk to pill the PCB pads and KILL you device).
Put some flux on the flash pads
Unsolder the flash
Once it's done clean the pads using the solder sucking wick (no overheat! add flux if necessary)
Take the new flash you have programmed/verified and solder it in place (take care to the orientation and short circuits)
Clean flux residues (isopropyl alcohol)

Check with the console access that your unit is starting, obviously it will fail at the end because no FW is loaded but the uboot process start shall complete.
You can now load the new FW using TFTP (option 2 in the u-boot start menu)
The default TFTP server address is at 192.168.0.233
The default FW image name is root_uImage
Once it's done your unit is ready to use. Future FW release can be updated as usual.

How to add tags