Tenda 3G611R+

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

3G611R+

3G 11N Wireless Router

Not officially supported

Apparently works with Tenda W306R or Edimax 3g-6200n OpenWrt firmware.

CPU Ram Flash Network WLAN USB Serial JTag
Ralink RT3050F @ 320 MHz 32 MiB 4 MiB 4x 10/100 bgn Yes Yes ?

hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

The Tenda 3G611R+ has the following buttons:

BUTTON Event
Reset reset
Secure Easy Setup WPS

Architecture MIPS
Vendor Ralink
Bootloader U-Boot
System-On-Chip RT3050F
CPU/Speed 320MHz
Flash-Chip mx29lv320ebti-70g
Flash size 4 MB
RAM 32 MB (EM63A165TS-6G)
Wireless
Ethernet 4x Port 10/100 Mbit/s + 1 WAN
USB Yes
Serial Yes
JTAG Not populated

Remove 4x rubber feet, unscrew 4 screws, gently unclick the cover by going along the groove with nails and a little force and patience.

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Serial connection parameters
for Tenda 3G611R+
57600, 8 N 1; 3.3V TTL

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

U-Boot 1.1.3 (Dec 8 2009 - 13:38:58) Board: Ralink APSoC DRAM: 32 MB relocate_code Pointer at: 81fb0000 flash_protect ON: from 0xBF000000 to 0xBF01D663 flash_protect ON: from 0xBF030000 to 0xBF030FFF *** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 3.3 -------------------------------------------- ASIC 3052_MP2 (Port5<->None) DRAM component: 256 Mbits SDR DRAM bus: 16 bit Total memory: 32 MBytes Flash component: NOR Flash Date:Dec 8 2009 Time:13:38:58 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 320 MHZ #### SDRAM bus set to 16 bit SDRAM size =32 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 9: Load Boot Loader code then write to Flash via TFTP. You choosed 4 0 4: System Enter Boot Command Line Interface. U-Boot 1.1.3 (Dec 8 2009 - 13:38:58) RT3052 # printenv bootcmd=tftp bootdelay=1 baudrate=57600 ethaddr="00:AA:BB:CC:DD:10" ipaddr=10.10.10.123 serverip=10.10.10.3 ramargs=setenv bootargs root=/dev/ram rw addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1 flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr) kernel_addr=BFC40000 u-boot=u-boot.bin load=tftp 8A100000 $(u-boot) u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize) loadfs=tftp 8A100000 root.cramfs u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize) test_tftp=tftp 8A100000 root.cramfs;run test_tftp stdin=serial stdout=serial stderr=serial ethact=Eth0 (10/100-M) Environment size: 765/4092 bytes RT3052 #


COPY HERE THE BOOTLOG WITH THE ORIGINAL FIRMWARE


Not the real firmware

U-Boot 1.1.3 (Dec 8 2009 - 13:38:58) Board: Ralink APSoC DRAM: 32 MB relocate_code Pointer at: 81fb0000 flash_protect ON: from 0xBF000000 to 0xBF01D663 flash_protect ON: from 0xBF030000 to 0xBF030FFF *** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 3.3 -------------------------------------------- ASIC 3052_MP2 (Port5<->None) DRAM component: 256 Mbits SDR DRAM bus: 16 bit Total memory: 32 MBytes Flash component: NOR Flash Date:Dec 8 2009 Time:13:38:58 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 320 MHZ #### SDRAM bus set to 16 bit SDRAM size =32 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 9: Load Boot Loader code then write to Flash via TFTP. 0 3: System Boot system code via Flash. ## Booting image at bf050000 ... Image Name: MIPS OpenWrt Linux-3.18.20 Created: 2015-09-11 17:21:27 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1050789 Bytes = 1 MB Load Address: 80000000 Entry Point: 80000000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80000000) ... ## Giving linux memsize in MB, 32 Starting kernel ... [ 0.000000] Linux version 3.18.20 (buildbot@builder1) (gcc version 4.8.3 (Ope nWrt/Linaro GCC 4.8-2014.04 r46450) ) #1 Fri Sep 4 19:34:21 CEST 2015 [ 0.000000] SoC Type: Ralink RT3350 id:1 rev:2 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001964c (MIPS 24KEc) [ 0.000000] MIPS: machine is Edimax 3g-6200n [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 02000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x00000000-0x01ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x01ffffff] [ 0.000000] Initmem setup node 0 [mem 0x00000000-0x01ffffff] [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 byt es [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pag es: 8128 [ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs 2 [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes) [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Writing ErrCtl register=0002b45e [ 0.000000] Readback ErrCtl register=0002b45e [ 0.000000] Memory: 29080K/32768K available (2543K kernel code, 120K rwdata, 312K rodata, 152K init, 186K bss, 3688K reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:256 [ 0.000000] CPU Clock: 320MHz [ 0.000000] clocksource_of_init: no matching clocksources found [ 0.000000] Calibrating delay loop... 212.58 BogoMIPS (lpj=1062912) [ 0.080000] pid_max: default: 32768 minimum: 301 [ 0.080000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.090000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.100000] pinctrl core: initialized pinctrl subsystem [ 0.110000] NET: Registered protocol family 16 [ 0.130000] rt2880_gpio 10000600.gpio: registering 24 gpios [ 0.140000] rt2880_gpio 10000600.gpio: registering 24 irq handlers [ 0.150000] Switched to clocksource MIPS [ 0.160000] NET: Registered protocol family 2 [ 0.170000] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.180000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.190000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.210000] TCP: reno registered [ 0.210000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.220000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.240000] NET: Registered protocol family 1 [ 0.250000] rt-timer 10000100.timer: maximum frequency is 6510Hz [ 0.260000] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.300000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.310000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT Y) (c) 2001-2006 Red Hat, Inc. [ 0.330000] msgmni has been set to 56 [ 0.360000] io scheduler noop registered [ 0.360000] io scheduler deadline registered (default) [ 0.380000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.400000] console [ttyS0] disabled [ 0.400000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 6666666) is a 16550A [ 0.420000] console [ttyS0] enabled [ 0.420000] console [ttyS0] enabled [ 0.430000] bootconsole [early0] disabled [ 0.430000] bootconsole [early0] disabled [ 0.450000] 1f000000.cfi: Found 1 x16 devices at 0x0 in 16-bit bank. Manufact urer ID 0x0000c2 Chip ID 0x0022a8 [ 0.470000] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.480000] Amd/Fujitsu Extended Query version 1.1. [ 0.490000] number of CFI chips: 1 [ 0.560000] 5 ofpart partitions found on MTD device 1f000000.cfi [ 0.570000] Creating 5 MTD partitions on "1f000000.cfi": [ 0.580000] 0x000000000000-0x000000030000 : "u-boot" [ 0.590000] 0x000000030000-0x000000040000 : "u-boot-env" [ 0.600000] 0x000000040000-0x000000050000 : "factory" [ 0.620000] 0x0000003e0000-0x000000400000 : "cimage" [ 0.630000] 0x000000050000-0x0000003e0000 : "firmware" [ 0.650000] 2 uimage-fw partitions found on MTD device firmware [ 0.660000] 0x000000050000-0x0000001508e5 : "kernel" [ 0.680000] 0x0000001508e5-0x0000003e0000 : "rootfs" [ 0.690000] mtd: device 6 (rootfs) set to be root filesystem [ 0.700000] 1 squashfs-split partitions found on MTD device rootfs [ 0.710000] 0x000000370000-0x0000003e0000 : "rootfs_data" [ 0.730000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5 [ 0.750000] rt2880_wdt 10000120.watchdog: Initialized [ 0.760000] TCP: cubic registered [ 0.770000] NET: Registered protocol family 17 [ 0.780000] bridge: automatic filtering via arp/ip/ip6tables has been depreca ted. Update your scripts to load br_netfilter if you need this. [ 0.800000] Bridge firewalling registered [ 0.810000] 8021q: 802.1Q VLAN Support v1.8 [ 0.840000] VFS: Mounted root (squashfs filesystem) readonly on device 31:6. [ 0.860000] Freeing unused kernel memory: 152K (802ea000 - 80310000) [ 2.270000] init: Console is alive [ 2.280000] init: - watchdog - [ 3.920000] usbcore: registered new interface driver usbfs [ 3.940000] usbcore: registered new interface driver hub [ 3.950000] usbcore: registered new device driver usb [ 4.830000] dwc2 101c0000.otg: DWC OTG Controller [ 4.840000] dwc2 101c0000.otg: new USB bus registered, assigned bus number 1 [ 4.850000] dwc2 101c0000.otg: irq 26, io mem 0x00000000 [ 4.860000] hub 1-0:1.0: USB hub found [ 4.870000] hub 1-0:1.0: 1 port detected [ 5.310000] init: - preinit - [ 6.460000] 8021q: adding VLAN 0 to HW filter on device eth0 [ 6.700000] random: mktemp urandom read with 10 bits of entropy available Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 10.150000] jffs2: notice: (300) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 10.190000] mount_root: switching to jffs2 overlay [ 10.250000] procd: - early - [ 10.250000] procd: - watchdog - [ 11.270000] procd: - ubus - [ 12.280000] procd: - init - Please press Enter to activate this console. [ 13.740000] NET: Registered protocol family 10 [ 13.760000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 13.800000] Loading modules backported from Linux version master-2015-03-09-0-g141f155 [ 13.820000] Backport generated by backports.git backports-20150129-0-gdd4a670 [ 13.840000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 13.870000] nf_conntrack version 0.5.0 (456 buckets, 1824 max) [ 13.960000] xt_time: kernel timezone is -0000 [ 14.010000] cfg80211: Calling CRDA to update world regulatory domain [ 14.090000] cfg80211: World regulatory domain updated: [ 14.100000] cfg80211: DFS Master region: unset [ 14.100000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time) [ 14.120000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 14.140000] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 14.160000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A) [ 14.170000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 14.190000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s) [ 14.210000] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s) [ 14.220000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 14.240000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A) [ 14.330000] PPP generic driver version 2.4.2 [ 14.350000] NET: Registered protocol family 24 [ 14.410000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 2872, rev 0200 detected [ 14.430000] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 0005 detected [ 26.570000] 8021q: adding VLAN 0 to HW filter on device eth0 [ 26.620000] device eth0 entered promiscuous mode [ 79.330000] random: nonblocking pool is initialized


Failsafe does not work, as buttons are not mapped in firmware, must use UART

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2021/01/30 11:09
  • by danitool